0
votes
0answers
19 views

Where does the biometrics domain settings change when the windows client interface is used?

To enable biometrics one would change the group policy for an OU to allow for domain login. This can be accomplished by changing settings in Group Policy on the server: Adminitrative Templates ...
13
votes
3answers
626 views

Force authenticated user immediate logoff (emergency case)

In Active Directory if you want to prevent a user from logging in you can either disable their account or simply reset their password. However, if you have a user who is already logged in to a ...
1
vote
1answer
45 views

Domain admin accounts can do less than domain administrator account

On a Windows 2008R2 server, a domain admin account has lesser rights than the domain administrator account. For example, the domain admin account can't install a service or create a file on the root ...
24
votes
7answers
2k views

Is it best practices to have separate login for a domain for domain admins?

I typically like to set up separate logins for myself, one with regular user permissions, and a separate one for administrative tasks. For example, if the domain was XXXX, I'd set up a XXXX\bpeikes ...
0
votes
0answers
33 views

Why AD DS user is able to write to ADLDS(ADAM) container(user is neither imported nor added as foreignsecurityprincipal)?PS/dsacls cmd to fix it-DENY

I have installed 'AD LDS' instance on one of my windows server 2012 which is part of a domain. I brought few users (windows security principals to 'AD LDS') as 'ForeignSecurityPrincipals' from AD DS ...
1
vote
1answer
27 views

How do I audit where security groups are applied in my domain? [closed]

I've been asked to find out how and where specific security groups are being used in my organizations AD domain. I know what the groups are and where to find them in the directory, but I don't know ...
1
vote
1answer
165 views

Can a windows service running with network service or local system account, updated active directory container?

I have two windows services (one running as network service and the other as local system) - because of some architecture reasons these cannot run under domain user account. And there will be a store ...
5
votes
1answer
71 views

Preventing a Domain Computer from Logging off Causes loss of Authentication

I have a set a domain computer to not require a password on wakeup. This is a strange situation I know but we want the user to never have to login to the computer unless he specifically logs out or ...
4
votes
3answers
160 views

How secure is traffic between domain members?

I was just thinking about security in AD domain environment. I have a question: how secure is communication between domains by default (without implementing IPSec etc.) For example if I download a ...
0
votes
1answer
30 views

Conditional authentication in IIS?

Is it possible to specify conditional authentication methods in IIS (6 or 7) based on http headers? So for example mobile browsers would use a guest account while desktop browsers would need ...
0
votes
0answers
21 views

Cant Add Columns to a AD Task pad except for the top level of the domain

We are working on Active Directory taskpads application for user management in our organization and facing stange issue. When we create a taskpad, and when we are at top level of the domain, i can ...
0
votes
1answer
43 views

allowing only access to TFS to external

Recently I've found the need for allowing access to external people to my TFS server, but I have to be sure that they can't access others servers. This is what I've tried so far: Created a security ...
3
votes
1answer
39 views

What SPNs are needed for an intranet web service that reads remote registries

Imagine a website that shows the value of a remote registry key, live, such as the version of the anti-virus definitions on a remote PC. To be clear, there are 3 computers involved, the web server ...
0
votes
1answer
70 views

Exchange 2003 smtp collector delivery restriction

In a Exchange 2003 the SMTP collector has the 'Delivery Restriction' configurated to deny for all except for who is in a security group mail-enabled (called 'InternetMail'). There are user ...
1
vote
1answer
47 views

Restricting particular OUs from accessing Active Directory folder

I know how to restrict individual users from accessing/reading OUs or folders in Active Directory. This page provides a good guide on how to do this. But how can one bar the users of an entire OU, ...
4
votes
1answer
30 views

Domain security vs. Forest security

Is it true that the administrators of a domain "A" can reset a user's password in another domain "B" within the same Forest "out-of-the-box" ? I believe that it is not possible for a Domain ...
-2
votes
2answers
65 views

Personal Data on Work Computer [closed]

I have a question. When using a computer at work one saves personal data as well. For example gmail accounts in the browser. Other credentials again in the browser or elsewhere. Also files from places ...
5
votes
1answer
216 views

How can I proactively detect compromised Exchange 2010 accounts?

We have had issues with compromised Exchange accounts sending out malicious e-mails via SMTP and OWA. It seems that many of these accounts were compromised via incoming phishing attempts. We are ...
4
votes
2answers
54 views

Segmented network password reset in event of intrusion

Taking network segmentation into consideration how do I define the scope of which passwords to reset in the event of a breach? Change all your passwords for all accounts on all computers that are ...
3
votes
2answers
983 views

What is the rationale for a minimum password age?

I just had a user unable to change his password on a Windows 2008 domain. It was giving him a cryptic message about complexity requirements even though he was certain his chosen password was meeting ...
2
votes
2answers
441 views

What effect will disabling WinRM authentication methods have?

In WinRM Service section of Group Policy, I have the option of disabling the following authentication mechanisms: Basic CredSSP Kerberos Negotiate With concerns of security in mind, I would like ...
1
vote
1answer
907 views

Why do I need Pre-Windows 2000 Compatible Access to enumerate group membership?

I am trying to lock down security including removing the leaked password hashes that the UNIX addon creates. I removed Authenticated Users from the Pre-Windows 2000 Compatible Access group. However ...
1
vote
0answers
27 views

How to give Admins Access to move users to a Single OU [duplicate]

We are delegating few acceses to some admins via taskpads; So we created a OU called "Delete" and we want the admins to move all the users to be deleted to that OU; How can we do that , how can we ...
0
votes
2answers
1k views

How do I apply special group Exchange calendar permissions?

I've got an Active Directory Security Group with a number of people in it. I'd like anyone in that group to be able to update each other's calendars. How do I go about telling Exchange (2010) to do ...
0
votes
1answer
228 views

What is the reasoning behind how Active Directory group nesting works? [closed]

For a long time, I've had trouble understanding how group nesting is supposed to work in a multi-forest AD environment. It seems like there are arbitrary limitations placed on group types, with ...
20
votes
3answers
3k views

How are cached Windows credentials stored on the local machine?

How are cached Active Directory domain credentials stored on a Windows client? Are they stored in the local SAM database, thus making them susceptible to the same rainbow table attacks that local user ...
3
votes
4answers
132 views

What are the dominant purposes of having random user names vs fixed-format email addresses with AD/LDAP?

Example, a user name might be "ekg7d9a", but the user's real name is "Charlie Hanes", and the email is "chanes@example.com". What are the dominant reasons to use non-related user names with logins ...
4
votes
1answer
235 views

Active Directory reversible encryption for single sign-on?

Problem: Creating and maintaining hundreds of student accounts The school where I work runs Active Directory on Server 2008. Every year, our students have to sign up for accounts with a third-party ...
0
votes
1answer
151 views

Applocker custom extension (Java, CPL, MSC etc.)

We have a Terminal server and want to prevent users from running inappropriate software. Previously we used Software Restriction Policies for this purpose. Now, Microsoft seems to recommend Applocker ...
1
vote
2answers
2k views

How to make security group in one forest show up in another forest?

I have two Win2k8 forests which I do maintenance on. The two forests have full 2 way external, non transitive trust with each other. I have a folder in forest X, domain countryX.mycompany.com ...
-1
votes
1answer
194 views

Can't login to Windows Small Business Server 2003

I removed AD by cmd using dcpromo and now when trying to access and login after a reboot with the Administrator account I can't. Do I need to reset the password from a boot disk?
1
vote
1answer
146 views

Setting up limited AD account for external support person

I'm trying to setup a limited account for an outside company in active directory. They need to connect to one server to setup their software. I created a new group called "Limited Access", made that ...
1
vote
2answers
950 views

c$ accessible for all domain users

We use a system to name every PC, we use this way: each workstation starts with WS followed by a number. So PC 14's name = WS14 and PC number 1 is WS01. What I discovered now is that when I try (from ...
3
votes
3answers
266 views

Allow members of a group to be unlocked by a specific account on AD

Background I'm creating a service to allow support staff to enable their firecall accounts out of hours (i.e. if there's an issue in the night and we can't get hold of someone with admin rights, ...
3
votes
0answers
78 views

Error connecting ESX 5.0.0 to domain

I am trying to connect an ESX 5.0.0 to our Domain Controler, in order to give a Domain group specific roles security. But I do not see any groups after the host connects to the domain. Under ...
0
votes
2answers
118 views

Remote hosts accessing AD's registry

I have a situation here. I have an intrusion detection system and it constantly alerts me that a remote host is accessing our AD's registry remotely. Our remote hosts are mainly Windows XP and our ...
0
votes
3answers
952 views

connecting ipads to a windows domain [duplicate]

Possible Duplicate: iPad Management Do iPads (version 1, 2, and/or 3) have the ability to connect to a windows server 2008 or 2008 R2 domain? If not, is there a way to enforce security ...
-1
votes
3answers
361 views

Can a windows domain admin access non shared files on a PC connected, but not joined to the domain? [closed]

My company allows users to bring their own devices into the office and use the internal network due to our fast internet connection. These devices/PC's are not joined to the company Windows Domain. ...
1
vote
0answers
511 views

Only allow domain logins using TeamViewer

tl;dr How do I setup teamviewer to only allow logins that authenticate through windows (domain controller), while disallowing any other login method? I recently started a Systems Admin job where ...
1
vote
2answers
1k views

How to safely use corporate Active Directory (LDAP) authentication for an internet facing web site? [closed]

Let's say you have a public web service (Jira in my case) that is used by both intranet users and external users. The server is already configured to use HTTPS (secure). Because the server is ...
1
vote
1answer
263 views

How can I control “Access this computer from the network” / SeNetworkLogonRight from the domain controller?

I need to set the "Access this computer from the network" / SeNetworkLogonRight right for all computers in a given domain. What I would like to achieve is that only users added to the "Users" (or a ...
4
votes
3answers
1k views

How do I configure active directory when Sql Server 2012 is using a Virtual Account?

I'm getting the following event log entry from Sql Server 2012: SQL Server Scheduled Job 'Replication agents checkup' - Status: Failed - Invoked on: 2012-08-04 10:00:00 - Message: The job failed. ...
2
votes
2answers
451 views

Is it possible to disable “Admin Approval Mode” for a single account on a server?

A console-app runs on a single server in a domain and is tasked with deleting some home areas of users, who are no longer active. These homeareas are located on 50+ different servers spread around the ...
2
votes
3answers
578 views

Local account lockout via Group Policy

Is it possible to set an Account Lockout Threshold via Group Policy but have it only apply to local accounts on member workstations and not to domain logins?
5
votes
5answers
1k views

Protect files on NTFS volume from Domain Administrators

We're a small company with a 2008R2 domain on which we have a file server with several shared volumes. We have a number of IT staff in the domain administrators role, because effectively we're all on ...
1
vote
2answers
1k views

Is it safer to remove the Domain Users group from the server local users group

We have a new Windows 2008 R2 server and we have noticed that the Domain Users group is added to the Local Users group of the server. This server will be used for hosting our webapps. It seems to be a ...
2
votes
3answers
94 views

Primary domain controller for web hosting + SQL cluster

I was hoping to get some advice here on a web hosting query. We are building an eCommerce website that will basically reside on 2 x web servers (fronted by a load balancer) and interacting with a ...
1
vote
3answers
514 views

UAC in an Active Directory environment

At work, we've recently received a recommendation to have two separate accounts for domain administrators. One account would be a standard user account with no admin privileges and one would be a ...
1
vote
1answer
4k views

Network Policy Server authentication failing

I've configured our RADIUS client (pfSense) and Windows 2008 NPS for authentication via RADIUS. The set-up is a Captive portal where LAN users authenticate with Active Directory. When looking at our ...
10
votes
2answers
2k views

Can someone please explain Windows Service Principle Names (SPNs) without oversimplifying?

I have wrestled with service principle names a few times now and the Microsoft explanation is just not sufficient. I am configuring an IIS application to work on our domain and it looks like some of ...