The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
0answers
25 views

Kerberos constrained delegation

There is a small problem with the setting Kerberos constrained delegation in Active Directory. The scheme works as follows: 1. Client workstation. 2. Web server with Windows 2008 Ent installed IIS ...
0
votes
2answers
45 views

Active Directory Users Delegated Permissions

This is probably a dumb question, but how does the delegated user access ad to make these changes? I have set this up but a user cannot launch the active directory users and groups tool. Only admins ...
4
votes
2answers
50 views

Can windows enable delegation across domains?

I have two domains foo.local test.local I can run powershell hyper-v cmdlets against the test.local hyper-v server if I am using a VM that is in the test.local domain. Get-VM -ComputerName ...
0
votes
0answers
49 views

Quest PowerShell: Export AD permissions and apply them at a later stage

I'm trying to standardise our AD permissions for our 4 support groups. I've already applied permissions for 2 standard groups (Global support) and I'm now facing a painful clean-up for site based ...
0
votes
1answer
47 views

Zone delegation

I'm running a bind 9.8-server and want to delegate a sub-domain to a different dns-server (also administered by me), but I can't seem to get bind to accept my config and I can't figure out why. Below ...
0
votes
1answer
73 views

Nameserver delegation to private subnet

I'm currently having some problems delegating a subdomain, e.g. lan.example.com, to a nameserver in a private network. My private network is split in to subnets 192.168.0.1/24 <--- 192.168.0.1 ...
0
votes
0answers
29 views

Reporting Services 2008 and kerberos delegation/impersonation

I've spent quite some time configuring the use of Kerberos and Windows 2008 SQL Reporting Services - I've registered all the SPNs, configured the various authentication options in the XML files and ...
1
vote
1answer
60 views

is it possible to delegate file srv and print srv managing to other users in windows 2008 R2 without giving them full admin rights?

we have some field service guys that work locally for some of our customers, we want to transfer the tasks of managing file servers and print servers to them. first we Thought about giving them local ...
6
votes
1answer
420 views

In Active Directory, how do I delegate write permissions on specific attributes of protected user accounts?

We have a tool being developed that will keep specific attributes of Active Directory user objects up to date with an authoritative source of employee information truth elsewhere, so that when ...
5
votes
2answers
490 views

Active Directory Permissions: Delete vs Move

I want our help desk to be able to move user accounts but NOT delete them. Here is the summary of our current permissions set on the affected OU's (this DOES allow them to delete user accounts): ...
2
votes
1answer
16 views

Delegate Access and Subfolders

Sometimes when a user leaves a company the manager will request access to the former employees mailbox on our Exchange 2013. I can use mailbox delegation to give them full access, but if there are any ...
0
votes
0answers
51 views

How can I utilise resource based delegation

Windows 2012 comes with an extension to the existing Kerberos Constrained Delegation, called resource based delegation (RBCD). There are a number of great articles that explain how it works for ...
1
vote
0answers
240 views

Account Operators built in group and “User Cannot Change Password” property

I have a question about configuring of "User Cannot Change Password" property. Does default "Account Operators" domain group has ability to change this property? If not can it be delegated via AD ...
0
votes
0answers
19 views

Enabling constrained delegation on DC computer account

Is it necessary to have constrained delegation enabled on Microsoft AD domain controller computer account? If yes then why and what are consequences of disabling it? I'm mainly interested in current ...
2
votes
1answer
68 views

Azure - Is it possible for global administrators to enforce per-subscription resource limits?

My company is moving all its internal production and development servers to Azure, and needs a way to delegate administration while at the same time keeping track of resource usage; thus, we are going ...
1
vote
1answer
1k views

How can I delegate “Attributes 1-15” in Exchange / AD?

The following attributes are present on an Exchange user, and this is what my colleague sees: (notice the locks) How can I properly delegate Read access (or Read write if it must be) to these ...
0
votes
0answers
90 views

Triple hop authentication

Trying to setup impersonation for web application running in IIS that connects to a web service that connects to SQL server, where all the layers are on different machines. Here is the setup Web ...
0
votes
0answers
124 views

Any other option than HTTPS + Basic auth for reverse proxied IIS site that uses double hop authentication to SQL server

We've been struggling for a while to get, what I had assumed would be a relatively common scenario to work and would appreciate any pointers. We have 2 x Windows 2012 Servers running IIS Server SQL ...
5
votes
1answer
438 views

Different ACLs on two OU's with same “protect object from deletion” setting

Background After I configured our Active Directory so that the ability to move computers was delegated to helpdesk staff, I started hearing reports that computers would get "stuck" in specific OU's. ...
4
votes
1answer
660 views

DNS referral / delegation: which DNS is responsible; How to delegate the right way?

Introduction I bought the domain earechnung.at with Hetzner and am using my webspace at All-Inkl. I want to use the nameservers of my webhost (All-Inkl). Zonefiles and Nameservers As I registered ...
1
vote
1answer
52 views

Unable to delegate Replicating Directory Changes to a user in AD - option missing from wizard

Disclaimer: I originally asked this over at SharePoint SE, but I figured I'd ask it here too as it's more of an AD problem than a SP specific one. I'm trying to delegate the Replicating Directory ...
1
vote
0answers
86 views

IIS 7.5 connect to a web site using IIS Manager using the current user credentials

I am trying to use IIS Manager to connect to a site or an application but would like to pass through or use the current authenticated user's credentials. There is only a username and password option ...
0
votes
1answer
210 views

Set Country / Region field Access via Active Directory Delegation

After creating a security group for special permissions (edit User Objects fields like Street, ZIP etc.) I have a problem of not being able to delegate permission for the field "Country/Region" on a ...
1
vote
1answer
78 views

Active Directory, delegating control for specific class

There are objects in my AD that have objectClass set to device, and I would like to delegate control to non-admin users so they will be able to add new and delete existing objects with objectClass set ...
3
votes
1answer
1k views

How to proper delegate domain in BIND for Active Directory servers

I have to delegate domain for AD serwers. Let say example.com and I'm using Bind(dns.bind.com) on CentOS. I added proprer configuration to named.conf and using A,NS records delegate domain to AD ...
1
vote
1answer
196 views

Delete entry from Exchange calendar when delegate denies meeting request

I created a Room-Mailbox in Exchange. This Mailbox will be used to manage vacation Days. I delegated control to a user to deny and accept vacation requests. The requestee is informed correctly about ...
0
votes
1answer
541 views

Cant find “Read Lockout Time” and “Write Lockout Time” for delegation on OU

Trying to delegate permissions to a group on a OU; but cant find 2 properties in special permissions for "User Objects" they are "Read Lockout Time" and "Write Lockout Time" any reason i couldnt see ...
1
vote
1answer
549 views

Difference between “Descendant User Objects” and just “User Objects”

i am trying to delegate permissions on a cetain OU to a certain group. All i find is "Descendatn User Objects" and not just "User Objects" ; we have those available in other domain; please do let me ...
4
votes
1answer
115 views

Active Directory write permissions let edit users information but not administrator-users information

In our Active Directory (2008 R2), I used delegation to give permission to edit user information attributes such as phone numbers, title, postal address, ... to a group of non-admin users. Members of ...
1
vote
0answers
64 views

bind9, Resolve example.com but forward *.example.com to a forwarder possible?

is it possible in bind to resolve example.com with a zone but resolve all subdomains of example.com with a forwarder? If somebody knows how this can work or has some simple sample configurations i ...
0
votes
1answer
81 views

Why would delegated nameservers ever be different to authoritative nameservers?

If you go on intodns.com and type in stackoverflow.com, the parent server tells me that nameservers for the domain are here: ns1.serverfault.com. ['198.252.206.80'] [TTL=172800] ...
0
votes
1answer
63 views

rDNS entry on a separate name server from forward dns - is this okay?

Our reverse DNS lookup is delegated to our name server (ns.example1.com) by AT&T, who leases us our IP address (1.2.3.4) and our forward DNS lookups were on the same name server (ns.example1.com). ...
1
vote
2answers
633 views

delegating /24 and /64 reverse zones

I'm sure I'm overlooking something so simple, but I'm just not seeing it... I'm trying to delegate the /24 and /64 reverse zones for our Test network to hosts within the Test network. I'm seeing the ...
1
vote
1answer
289 views

Internal DNS delegate to external host

We have been facing an issue with internal DNS delegation. Here is a description of our architecture and the issue: Architecture Domain1 DHCPDNS1 and DHCPDNS2 (Windows Server 2012) Domain2 ...
3
votes
1answer
166 views

SPNs and Kerberos Delegation

I would like to check my understanding. This is a fully hypothetical scenario below as I am currently studying for a certification. I have an IIS App Pool with a basic website, which accesses data ...
2
votes
0answers
281 views

Delegate rights to AD security group to Add UNIX Attributes

We have several Linux servers that are AD integrated, all our DC's are Server 2008R2 running at 2003 DFL and FFL with MSSFU installed. I wish to delegate the population of the UNIX Attributes tab to ...
-1
votes
1answer
996 views

Delegate software install/uninstall power to users/groups [closed]

I would like to have support personnel install and uninstall software across the domain, with no less and no more admininstrative capabilities. How do I do so?
1
vote
1answer
202 views

AD: delegating computer log access

I would like to setup the following audit scenario: A large Active Directory domain is scattered among various phisical sites, each contained in its own organizational unit. The members of a ...
3
votes
2answers
1k views

Limiting view of Active Directory Users and Computers

I am delegating a group of users to a specific person to be able to keep up with thier account management, and I have delegated them the authority to do this to just this group. Is there a way that I ...
0
votes
1answer
1k views

Multihop Kerberos delegation on IIS7 / Windows 2008

So here I am again dealing with probably the number one support question on IIS, SPNs. I am not a novice when it comes to this, having lived the pains of getting SSRS front ends to delegate for SQL ...
0
votes
1answer
86 views

DNS config to handle email for third party subdomain

Our customers host their own email (e.g. company.com), but need our service to handle email addressed to a specific subdomain (e.g. sub.company.com) We'd like to control DNS for their subdomain, ...
0
votes
1answer
2k views

How to do delegation on BIND server

continuing the last question about Windows AD + Linux BIND. I decided to create a subdamain for AD to run on. It's ad.wxxx.xxxxx. My configuration is okay, but I don't think it does the delegation ...
1
vote
0answers
139 views

Kerberos: connection from win app running from IIS to SQL failed

I have an IIS web-application with Windows authentication and impersonation. This application connects to SQL server. In this case Kerberos works fine. But there is a problem. Web-application runs ...
2
votes
1answer
124 views

Delegation Permissions to admins in Active Directory/Taskpads

I am trying to provide taskpads to few admins to operate on few tasks delegated to them at OU level.I ran into the following problem; lets say i delegated access to the admin on OU X and which is ...
6
votes
2answers
620 views

Risks of Kerberos Delegation

I've been spending hours upon hours trying to learn and understand Windows Authentication, Kerberos, SPNs, and Constrained Delegation in IIS 7.5. One thing I just don't get is why it is "risky" to ...
0
votes
1answer
625 views

Exchange 2010 and Delegate Oddity

I've tested and reproduced a problem that goes like this: Jo is a delegate for Steve. When Steve gets an invite, Jo receives a copy and accepts (or declines). Jo cannot accept or decline on her Mac ...
3
votes
1answer
115 views

How do I avoid Lame DNS or other issues when switching between 3rd party DNS servers?

I have 800 DNS zones at many different providers, and am trying to centralize them to either UltraDNS or Dynect. Is is possible for me to configure each NS to nameserverX.MyCompany.com and avoid ...
0
votes
3answers
189 views

create dns delegation where new nameserver are to be in the delegation on windows 2008 os

We have a domain "muzzard.com" which has nameservers ns0 and ns1 I'd like to add a delegation aws.muzzard.com and have the nameservers for that delegation in there e.g. ns0.aws.muzzard.com etc. ...
2
votes
0answers
710 views

Grant Kerberos Constrained Delegation to SQL Server 2012 running as Managed Service Account

I can't see how to grant Kerberos Constrained Delegation for a service identified by a Managed Service Account. I have a Windows 2008 R2 functional level single domain single forest, two 2008 R2 SP1 ...
2
votes
2answers
106 views

Delegating Administrator Control in AD

My IT environment is growing, and I want to delegate Domain Admin control to specific OU's. This way at each site, the admin in that location can only make changes in his site-specific OU. In my ...