3
votes
3answers
242 views

How can I prevent the compromise of a Domain Controller on ESX stored in a unsecured location?

A client of ours has a DC that will be located in an insecure location. RODCs and separate domains/forests are not permitted by management. All the servers will be located on a VMWare ESX server. ...
5
votes
1answer
150 views

“Anonymous Logon” vs “NTLM V1” What to disable?

Working on getting rid of NTLM V1 logins all together in the AD environment; found lot of events, almost all of them from the user "Anonymous Logon"(4624 events) other 1(4624 events) percent coming ...
0
votes
0answers
30 views

Where does the biometrics domain settings change when the windows client interface is used?

To enable biometrics one would change the group policy for an OU to allow for domain login. This can be accomplished by changing settings in Group Policy on the server: Adminitrative Templates ...
13
votes
3answers
2k views

Force authenticated user immediate logoff (emergency case)

In Active Directory if you want to prevent a user from logging in you can either disable their account or simply reset their password. However, if you have a user who is already logged in to a ...
1
vote
1answer
55 views

Domain admin accounts can do less than domain administrator account

On a Windows 2008R2 server, a domain admin account has lesser rights than the domain administrator account. For example, the domain admin account can't install a service or create a file on the root ...
24
votes
7answers
2k views

Is it best practices to have separate login for a domain for domain admins?

I typically like to set up separate logins for myself, one with regular user permissions, and a separate one for administrative tasks. For example, if the domain was XXXX, I'd set up a XXXX\bpeikes ...
0
votes
0answers
63 views

Why AD DS user is able to write to ADLDS(ADAM) container(user is neither imported nor added as foreignsecurityprincipal)?PS/dsacls cmd to fix it-DENY

I have installed 'AD LDS' instance on one of my windows server 2012 which is part of a domain. I brought few users (windows security principals to 'AD LDS') as 'ForeignSecurityPrincipals' from AD DS ...
1
vote
1answer
29 views

How do I audit where security groups are applied in my domain? [closed]

I've been asked to find out how and where specific security groups are being used in my organizations AD domain. I know what the groups are and where to find them in the directory, but I don't know ...
1
vote
1answer
314 views

Can a windows service running with network service or local system account, updated active directory container?

I have two windows services (one running as network service and the other as local system) - because of some architecture reasons these cannot run under domain user account. And there will be a store ...
5
votes
1answer
72 views

Preventing a Domain Computer from Logging off Causes loss of Authentication

I have a set a domain computer to not require a password on wakeup. This is a strange situation I know but we want the user to never have to login to the computer unless he specifically logs out or ...
4
votes
3answers
181 views

How secure is traffic between domain members?

I was just thinking about security in AD domain environment. I have a question: how secure is communication between domains by default (without implementing IPSec etc.) For example if I download a ...
0
votes
1answer
39 views

Conditional authentication in IIS?

Is it possible to specify conditional authentication methods in IIS (6 or 7) based on http headers? So for example mobile browsers would use a guest account while desktop browsers would need ...
0
votes
0answers
25 views

Cant Add Columns to a AD Task pad except for the top level of the domain

We are working on Active Directory taskpads application for user management in our organization and facing stange issue. When we create a taskpad, and when we are at top level of the domain, i can ...
0
votes
1answer
61 views

allowing only access to TFS to external

Recently I've found the need for allowing access to external people to my TFS server, but I have to be sure that they can't access others servers. This is what I've tried so far: Created a security ...
3
votes
1answer
43 views

What SPNs are needed for an intranet web service that reads remote registries

Imagine a website that shows the value of a remote registry key, live, such as the version of the anti-virus definitions on a remote PC. To be clear, there are 3 computers involved, the web server ...
0
votes
1answer
73 views

Exchange 2003 smtp collector delivery restriction

In a Exchange 2003 the SMTP collector has the 'Delivery Restriction' configurated to deny for all except for who is in a security group mail-enabled (called 'InternetMail'). There are user ...
1
vote
1answer
59 views

Restricting particular OUs from accessing Active Directory folder

I know how to restrict individual users from accessing/reading OUs or folders in Active Directory. This page provides a good guide on how to do this. But how can one bar the users of an entire OU, ...
4
votes
1answer
31 views

Domain security vs. Forest security

Is it true that the administrators of a domain "A" can reset a user's password in another domain "B" within the same Forest "out-of-the-box" ? I believe that it is not possible for a Domain ...
-2
votes
2answers
68 views

Personal Data on Work Computer [closed]

I have a question. When using a computer at work one saves personal data as well. For example gmail accounts in the browser. Other credentials again in the browser or elsewhere. Also files from places ...
5
votes
1answer
279 views

How can I proactively detect compromised Exchange 2010 accounts?

We have had issues with compromised Exchange accounts sending out malicious e-mails via SMTP and OWA. It seems that many of these accounts were compromised via incoming phishing attempts. We are ...
4
votes
2answers
54 views

Segmented network password reset in event of intrusion

Taking network segmentation into consideration how do I define the scope of which passwords to reset in the event of a breach? Change all your passwords for all accounts on all computers that are ...
3
votes
2answers
2k views

What is the rationale for a minimum password age?

I just had a user unable to change his password on a Windows 2008 domain. It was giving him a cryptic message about complexity requirements even though he was certain his chosen password was meeting ...
2
votes
2answers
514 views

What effect will disabling WinRM authentication methods have?

In WinRM Service section of Group Policy, I have the option of disabling the following authentication mechanisms: Basic CredSSP Kerberos Negotiate With concerns of security in mind, I would like ...
1
vote
1answer
1k views

Why do I need Pre-Windows 2000 Compatible Access to enumerate group membership?

I am trying to lock down security including removing the leaked password hashes that the UNIX addon creates. I removed Authenticated Users from the Pre-Windows 2000 Compatible Access group. However ...
1
vote
0answers
27 views

How to give Admins Access to move users to a Single OU [duplicate]

We are delegating few acceses to some admins via taskpads; So we created a OU called "Delete" and we want the admins to move all the users to be deleted to that OU; How can we do that , how can we ...
0
votes
2answers
1k views

How do I apply special group Exchange calendar permissions?

I've got an Active Directory Security Group with a number of people in it. I'd like anyone in that group to be able to update each other's calendars. How do I go about telling Exchange (2010) to do ...
0
votes
1answer
237 views

What is the reasoning behind how Active Directory group nesting works? [closed]

For a long time, I've had trouble understanding how group nesting is supposed to work in a multi-forest AD environment. It seems like there are arbitrary limitations placed on group types, with ...
20
votes
3answers
4k views

How are cached Windows credentials stored on the local machine?

How are cached Active Directory domain credentials stored on a Windows client? Are they stored in the local SAM database, thus making them susceptible to the same rainbow table attacks that local user ...
3
votes
4answers
132 views

What are the dominant purposes of having random user names vs fixed-format email addresses with AD/LDAP?

Example, a user name might be "ekg7d9a", but the user's real name is "Charlie Hanes", and the email is "chanes@example.com". What are the dominant reasons to use non-related user names with logins ...
4
votes
1answer
250 views

Active Directory reversible encryption for single sign-on?

Problem: Creating and maintaining hundreds of student accounts The school where I work runs Active Directory on Server 2008. Every year, our students have to sign up for accounts with a third-party ...
0
votes
1answer
185 views

Applocker custom extension (Java, CPL, MSC etc.)

We have a Terminal server and want to prevent users from running inappropriate software. Previously we used Software Restriction Policies for this purpose. Now, Microsoft seems to recommend Applocker ...
1
vote
2answers
3k views

How to make security group in one forest show up in another forest?

I have two Win2k8 forests which I do maintenance on. The two forests have full 2 way external, non transitive trust with each other. I have a folder in forest X, domain countryX.mycompany.com ...
-1
votes
1answer
222 views

Can't login to Windows Small Business Server 2003

I removed AD by cmd using dcpromo and now when trying to access and login after a reboot with the Administrator account I can't. Do I need to reset the password from a boot disk?
1
vote
1answer
163 views

Setting up limited AD account for external support person

I'm trying to setup a limited account for an outside company in active directory. They need to connect to one server to setup their software. I created a new group called "Limited Access", made that ...
1
vote
2answers
1k views

c$ accessible for all domain users

We use a system to name every PC, we use this way: each workstation starts with WS followed by a number. So PC 14's name = WS14 and PC number 1 is WS01. What I discovered now is that when I try (from ...
3
votes
3answers
299 views

Allow members of a group to be unlocked by a specific account on AD

Background I'm creating a service to allow support staff to enable their firecall accounts out of hours (i.e. if there's an issue in the night and we can't get hold of someone with admin rights, ...
3
votes
0answers
89 views

Error connecting ESX 5.0.0 to domain

I am trying to connect an ESX 5.0.0 to our Domain Controler, in order to give a Domain group specific roles security. But I do not see any groups after the host connects to the domain. Under ...
0
votes
2answers
122 views

Remote hosts accessing AD's registry

I have a situation here. I have an intrusion detection system and it constantly alerts me that a remote host is accessing our AD's registry remotely. Our remote hosts are mainly Windows XP and our ...
0
votes
3answers
1k views

connecting ipads to a windows domain [duplicate]

Possible Duplicate: iPad Management Do iPads (version 1, 2, and/or 3) have the ability to connect to a windows server 2008 or 2008 R2 domain? If not, is there a way to enforce security ...
-1
votes
3answers
374 views

Can a windows domain admin access non shared files on a PC connected, but not joined to the domain? [closed]

My company allows users to bring their own devices into the office and use the internal network due to our fast internet connection. These devices/PC's are not joined to the company Windows Domain. ...
1
vote
0answers
574 views

Only allow domain logins using TeamViewer

TLDR How do I setup TeamViewer to only allow logins that authenticate through Windows (domain controller), while disallowing any other login method? I recently started a system administrator job ...
1
vote
2answers
1k views

How to safely use corporate Active Directory (LDAP) authentication for an internet facing web site? [closed]

Let's say you have a public web service (Jira in my case) that is used by both intranet users and external users. The server is already configured to use HTTPS (secure). Because the server is ...
1
vote
1answer
294 views

How can I control “Access this computer from the network” / SeNetworkLogonRight from the domain controller?

I need to set the "Access this computer from the network" / SeNetworkLogonRight right for all computers in a given domain. What I would like to achieve is that only users added to the "Users" (or a ...
4
votes
3answers
1k views

How do I configure active directory when Sql Server 2012 is using a Virtual Account?

I'm getting the following event log entry from Sql Server 2012: SQL Server Scheduled Job 'Replication agents checkup' - Status: Failed - Invoked on: 2012-08-04 10:00:00 - Message: The job failed. ...
2
votes
2answers
510 views

Is it possible to disable “Admin Approval Mode” for a single account on a server?

A console-app runs on a single server in a domain and is tasked with deleting some home areas of users, who are no longer active. These homeareas are located on 50+ different servers spread around the ...
2
votes
3answers
737 views

Local account lockout via Group Policy

Is it possible to set an Account Lockout Threshold via Group Policy but have it only apply to local accounts on member workstations and not to domain logins?
5
votes
5answers
1k views

Protect files on NTFS volume from Domain Administrators

We're a small company with a 2008R2 domain on which we have a file server with several shared volumes. We have a number of IT staff in the domain administrators role, because effectively we're all on ...
1
vote
2answers
2k views

Is it safer to remove the Domain Users group from the server local users group

We have a new Windows 2008 R2 server and we have noticed that the Domain Users group is added to the Local Users group of the server. This server will be used for hosting our webapps. It seems to be a ...
2
votes
3answers
97 views

Primary domain controller for web hosting + SQL cluster

I was hoping to get some advice here on a web hosting query. We are building an eCommerce website that will basically reside on 2 x web servers (fronted by a load balancer) and interacting with a ...
1
vote
3answers
546 views

UAC in an Active Directory environment

At work, we've recently received a recommendation to have two separate accounts for domain administrators. One account would be a standard user account with no admin privileges and one would be a ...