0
votes
1answer
11 views

Reload VIAccounts list with PowerCli to select a newly created group

I'm using a script that creates groups in Active Directory, and links them to my vCenter server using New-VIPermission. The trick is that it doesn't find the groups created unless I restart the script ...
1
vote
0answers
92 views

SecErr: DSID-031A1190, 4003 (INSUFF_ACCESS_RIGHTS), data 0

I am trying to change the password of the currently logged in user via ldifde using this command: ldifde -i -f pwd.ldif -t 636 My AD server is running in SSL mode with a self signed certificate. The ...
5
votes
1answer
117 views

Different ACLs on two OU's with same “protect object from deletion” setting

Background After I configured our Active Directory so that the ability to move computers was delegated to helpdesk staff, I started hearing reports that computers would get "stuck" in specific OU's. ...
5
votes
1answer
308 views

Granting Domain Admin privileges to a cross-forest user account?

Does anyone know of a way to [effectively] have a user or group in one forest acquire the privileges of the Domain Admin group in another forest? The obvious approach of adding Domain ...
0
votes
1answer
53 views

Set Country / Region field Access via Active Directory Delegation

After creating a security group for special permissions (edit User Objects fields like Street, ZIP etc.) I have a problem of not being able to delegate permission for the field "Country/Region" on a ...
1
vote
1answer
258 views

Include AD domain admins group in Linux sudoers?

I'm working in a company whose network is configured through a Win Server Active Directory, with hundreds Windows of computers connected to the local domain. We are doing some tests to start ...
0
votes
1answer
299 views

Managing inherited mailbox permissions in Exchange 2007

Reviewing the Full Access permissions on a mailbox using Exchange Management Console (EMC) does not show you the whole picture. Example - EMC shows no permissions for the account Domain\administrator ...
1
vote
0answers
99 views

SQL Server 2012 permissions from AD group login not refreshed until server restart

We have some IIS sites which runs under Managed Service Accounts (Windows Server 2012). Theese MSAs are members of resource groups in Active Directory. We are using resource groups as logins in SQL ...
0
votes
3answers
221 views

Bizarre - Domain Admin has no rights to modify domain scripts directory

Here is a quickie that has had me scratching my head. Not a showstopper, so an answer isn’t urgent, but still. I am trying to modify the logon scripts directory to include a login script. I have gone ...
1
vote
1answer
100 views

Difference between “Descendant User Objects” and just “User Objects”

i am trying to delegate permissions on a cetain OU to a certain group. All i find is "Descendatn User Objects" and not just "User Objects" ; we have those available in other domain; please do let me ...
0
votes
0answers
25 views

Cant Add Columns to a AD Task pad except for the top level of the domain

We are working on Active Directory taskpads application for user management in our organization and facing stange issue. When we create a taskpad, and when we are at top level of the domain, i can ...
0
votes
0answers
40 views

Allow ad user to read local group

I am currently implementing a plugin for our communication server (david® by Tobit.Software) which must read some information from the active directory. The constellation is as follows: Server A (MS ...
0
votes
2answers
232 views

Set group permission on folder

I have a folder with lots of subfolders D:\Data\Subfolder1 D:\Data\Subfolder2 D:\Data\Subfolder3 D:\Data\Subfolder4 D:\Data\Subfolder5 ... I need to create three active directory groups ...
1
vote
2answers
539 views

Weird behavior using Active Directory group mapped to SQL Server user/login

I've run across a very odd behavior on SQL Server 2008R2. I have a third-party application which acts as a SQL Server client. I have a subset of my users who should have access to this application. ...
1
vote
1answer
252 views

Robocopy and NTFS Permissions

If as an administrator I remove all permissions from a folder - and set the owner to another user in Active Directory, I will not be able to copy that folder through explorer to another folder/drive ...
1
vote
0answers
89 views

Best way to bind multiple RHEL 6 Systems to AD and use NFS?

I am currently migrating systems to an AD domain using winbind. This works fine but I have discovered that NFS mounts don't have proper permissions because users and groups end up with different ...
3
votes
3answers
192 views

Active Directory delegation best practices

I am in the process of delegating some Active Directory tasks to a group of users. These users do not have domain administration rights and will only perform tasks such as creating/disabling accounts ...
0
votes
0answers
724 views

Windows Server 2008 R2 hangs when Editing folder permissions

Background: The server in question is a member of a domain. This is a brand new server, freshly installed. I can log into this server using any domain user (which tells me that on some level it is ...
2
votes
2answers
199 views

Active Directory: Accessing network share as WinXP SYSTEM user

The Problem: I cannot access a Domain Computers-accesible network share by a process running on Windows XP as a SYSTEM account. I've got a 2008R2 domain, a 2003R2 file server and a set of clients. ...
4
votes
1answer
3k views

What does it mean to grant/set permissions for NETWORK SERVICE on a network share?

I'm confused about the NETWORK SERVICE account (group?) works on network shares: On one hand, NETWORK SERVICE is generally described as an account that's local to a given machine. (See, e.g., here on ...
1
vote
0answers
90 views

Windows Server 2008 Server in VM, in domain: Can not print, access denied

I'm having an issue with printing from a particular application from our Windows Server 2008 R2 64-bit with licensed Remote Desktop Services (running in Amazon EC2). When I connect via Remote Desktop ...
1
vote
1answer
91 views

How to give a user write permissions to a file whereas the group he is in is denied to write (in Active Directory)?

For example, I have a group Department A. Among other users, I have a user named Boss. I want to create a file that can be changed only by Boss, and be readonly for the other users from that group. I ...
1
vote
0answers
27 views

How to give Admins Access to move users to a Single OU [duplicate]

We are delegating few acceses to some admins via taskpads; So we created a OU called "Delete" and we want the admins to move all the users to be deleted to that OU; How can we do that , how can we ...
2
votes
1answer
233 views

Restricting access to Share using both an AD user using a specific Computer

The Environment: One AD domain that is not managed by local admins (can’t edit, can’t add GPO, etc.) Users have accounts here. Call this AD alpha This AD Alpha has a trust to a local AD domain (Call ...
2
votes
2answers
83 views

How to make Groups as not readable to Users in AD

We are using taskpads to delegete tasks(such as reset password) to remote admins; the delegation is done at the OU level ; but unfortunately OU contains some special accounts/groups(such as ...
5
votes
1answer
213 views

Permissions are a mess- advice for cleanup?

Walking into a new organization, permissions are a mess. Over time, many many users have been given access to folders and files explicitely as needed instead of having established group policies for ...
3
votes
1answer
257 views

How to give user limited active directory perms?

We are a very small company, and for some time I've been the only guy managing our domain/Active Directory. I'm NOT a sys admin, I'm a software dev, but I've done the best I could for them. We're ...
1
vote
4answers
1k views

Filtering GPO's Based on Computer Account Security Group

So, I have a GPO, which runs a quick start up script to delete locally installed IP printers from all machines on our AD domain during computer start up. This works great...the issue appears when we ...
0
votes
0answers
178 views

NTFS Permission Structure to allow Traversal but no Modification except in Leaf Nodes?

Assume there's this folder structure: D:\ --+-- Acctg --+-- Payable | +-- Receivable | +-- Fin --+-- Inv | +-- Tax | +-- Treas | ...
2
votes
2answers
2k views

NTFS - Domain Admins don't have permissions despite being part of the Local Administrators group

As per "Best Practices" staff in our IT department have two accounts. An unprivileged account and an account that is a member of the global Domain Admins ($DOMAIN\Domain Admins) group. On our file ...
1
vote
1answer
163 views

Setting up limited AD account for external support person

I'm trying to setup a limited account for an outside company in active directory. They need to connect to one server to setup their software. I created a new group called "Limited Access", made that ...
1
vote
1answer
232 views

How to block a user from accessing SharePoint that's on a group with permissions to access

Example: I added to Readers my 'DOMAIN\domain users' on SharePoint. I want to prevent user JOHN to access my SharePoint site, is there any way of doing that in SharePoint, without going into AD? Like ...
4
votes
1answer
201 views

Running a service with a user from a different domain not working

I've been stuck on this for a while, not sure what permission I'm missing. I've got domain A and domain B, A trusts B, but B does not trust A. I'm trying to run a service in domain A with a user ...
3
votes
2answers
134 views

Found a service which logs on using the account name “.\AccountName” - What does “.\” mean? [duplicate]

Possible Duplicate: Is there a specific name for the “.\” (dot-slash) shorthand used to log onto a Windows machine? I came across a server on an older windows server 2003 box today which ...
2
votes
1answer
282 views

Simple active directory permissions issue

I've created a Domain Controller and 3 additional machines (SQL-A, SQL-B, SQL-CORE). All are on Windows Server2008R2 as VMs running on virtualbox. I have successfully joined the 3 machines to the ...
0
votes
1answer
394 views

Why can't this user connect to domain share?

Part of my reorganizing credentials in the domain, I have created several users that will be used solely for services (backup, LDAP, etc) The idea is that systems that need specific usage will use a ...
0
votes
1answer
428 views

Determine local group membership of an AD user?

I have several local groups on a Server 2008 instance. In this group are several members from our AD domain. Is there a way to determine all of the local groups a given AD domain user belongs to by ...
4
votes
3answers
1k views

How do I configure active directory when Sql Server 2012 is using a Virtual Account?

I'm getting the following event log entry from Sql Server 2012: SQL Server Scheduled Job 'Replication agents checkup' - Status: Failed - Invoked on: 2012-08-04 10:00:00 - Message: The job failed. ...
3
votes
2answers
196 views

Allow AD user to set passwords but no other attributes

I need an Active Directory user that can set passwords of other users but only passwords and not other attributes of the users. How can I configure that?
1
vote
2answers
468 views

Backup Permissions for an Active Directory Profile Directory

I have Folder Redirection turned on so the profiles are on a Windows shared folder on a File and Print Server... \folders\Profiles I want to back up the entire Profiles directory, but as Domain ...
0
votes
3answers
1k views

Effective Permissions displays incorrect information

I have a security mystery :) Effective permissions tab shows that a few sampled users (IT ops) have any and all rights (all boxes are ticked). The permissions show that Local Administrators group has ...
1
vote
0answers
234 views

really slow active directory lookup from member server when adding user permissions to folders

I have a unique issue with a current server 2008 r2 deployment that is a member server on our internal domain. When I create a folder and set the permissions from the security tab, if I choose to ...
2
votes
1answer
190 views

Domain Admin requires admin elevation with UAC turned off?

I have a Domain Admin User that logs on via RDP to a w2k8 r2 server, UAC is turned off locally at that server. Whenever I try to access certain folders, I'm getting the following prompt: "You don't ...
2
votes
1answer
3k views

Can I use group policy to set the permissions on registry keys?

I know that I can use group policy preferences to set registry key values on a Windows 7 computer. But is it possible to apply registry key permissions using group policy? Note: I've seen this post ...
4
votes
3answers
14k views

User in domain admin group cannot access directory the group has permission to access

I've run into a rather interesting issue when playing with one of my domain labs. There's a directory on a 2008 R2 fileserver that's being used for folder redirection for all users in the "Staff" OU. ...
1
vote
2answers
1k views

Set owner of new users home folder to user instead of BUILTIN\Administrators when using ADUC (on Windows Server 2008 R2)

In our AD, we create new users by copying a default user in ADUC. For the default user we specified a home folder using the %USERNAME% variable (mapped to H:): \fileserver\homes\%USERNAME% For new ...
1
vote
2answers
410 views

Add permissions for a usergroup to all domainprofiles (roaming profiles) on server 2008 R2

This is our current situation: We have an active directory with Server 2008 R2 and roaming profiles which is currently in use (old server), and we have a new Server 2008 R2. We already set up a new AD ...
3
votes
2answers
1k views

Can't Connect w/ SQL Management Studio After Domain Change

Our old Small Business Server 2003 (acting as our domain controller) was on the fritz, so we replaced it with a new Windows Server 2008 box and set the server up as our new domain controller. In ...
1
vote
5answers
3k views

how to extract all permissions that a domain user have on the network

I would like to know all the permissions a windows domain user have in my network. Is there a way, with a script file or a tool, that can extract this kind of information by checking all the servers ...
0
votes
1answer
183 views

Clients lose permission to Windows 2003 AD

My network has about 20 Windows XP clients. It often happens that a client can't access the shared folders in the Windows 2003 Server that I have; that happens right after logging in. It gives me a ...