The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
1answer
3k views

How to do delegation on BIND server

continuing the last question about Windows AD + Linux BIND. I decided to create a subdamain for AD to run on. It's ad.wxxx.xxxxx. My configuration is okay, but I don't think it does the delegation ...
1
vote
0answers
158 views

Kerberos: connection from win app running from IIS to SQL failed

I have an IIS web-application with Windows authentication and impersonation. This application connects to SQL server. In this case Kerberos works fine. But there is a problem. Web-application runs ...
2
votes
1answer
134 views

Delegation Permissions to admins in Active Directory/Taskpads

I am trying to provide taskpads to few admins to operate on few tasks delegated to them at OU level.I ran into the following problem; lets say i delegated access to the admin on OU X and which is ...
7
votes
2answers
1k views

Risks of Kerberos Delegation

I've been spending hours upon hours trying to learn and understand Windows Authentication, Kerberos, SPNs, and Constrained Delegation in IIS 7.5. One thing I just don't get is why it is "risky" to ...
0
votes
1answer
785 views

Exchange 2010 and Delegate Oddity

I've tested and reproduced a problem that goes like this: Jo is a delegate for Steve. When Steve gets an invite, Jo receives a copy and accepts (or declines). Jo cannot accept or decline on her Mac ...
3
votes
1answer
135 views

How do I avoid Lame DNS or other issues when switching between 3rd party DNS servers?

I have 800 DNS zones at many different providers, and am trying to centralize them to either UltraDNS or Dynect. Is is possible for me to configure each NS to nameserverX.MyCompany.com and avoid ...
0
votes
3answers
262 views

create dns delegation where new nameserver are to be in the delegation on windows 2008 os

We have a domain "muzzard.com" which has nameservers ns0 and ns1 I'd like to add a delegation aws.muzzard.com and have the nameservers for that delegation in there e.g. ns0.aws.muzzard.com etc. ...
3
votes
0answers
958 views

Grant Kerberos Constrained Delegation to SQL Server 2012 running as Managed Service Account

I can't see how to grant Kerberos Constrained Delegation for a service identified by a Managed Service Account. I have a Windows 2008 R2 functional level single domain single forest, two 2008 R2 SP1 ...
2
votes
2answers
111 views

Delegating Administrator Control in AD

My IT environment is growing, and I want to delegate Domain Admin control to specific OU's. This way at each site, the admin in that location can only make changes in his site-specific OU. In my ...
0
votes
1answer
2k views

Delegation issue

I have a small vps in the Netherlands and a domain registered with bluehost. I added this domain account (WHM) to my vps by changing the nameserver of the correspondent domain on bluehost to ns1.xx....
0
votes
3answers
1k views

How can I add a custom Powershell CMDLET to Exchange 2010?

I remember reading about how it's possible to add scripts or commandlets to Exchange 2010... in a way that as soon as Powershell imports the remote commands, your custom command is available as well. ...
1
vote
3answers
141 views

What strategies do admins use to devolve/delegate control of Bind configurations on a single DNS server?

I have a relatively simple Bind/DNS configuration, and would like to allow some of my users to be able to add their own configurations (eg A records and CNAMEs). Even though I trust my users, I want ...
4
votes
2answers
194 views

Active Directory, control to users

I'm responsible by Active Directory (AD) where I'm working, and I'm trying to figure out, how can I allow, that sector managers of the company, may add and delete users from its departments respective,...
5
votes
2answers
12k views

Is it possible to grant Read-Only Access to all Event Logs on Domain Controllers

I would like to grant Read-Access to event logs on all my domain controllers, ideally at a domain level using GPO. I would like members of a group to be able to view the Application Log, the System ...
1
vote
0answers
799 views

How to fix “SignTool Error: IStore2::Load returned error: 0x80090345”

I have a Jenkins job running the signtool utility on a remote node, the console log looks like so: Started by user anonymous Building remotely on vm-builder [VE] $ cmd /c call "C:\Documents and ...
4
votes
2answers
470 views

DNS delegation on same server with DDNS and second slave server

I have two servers running BIND, the first is setup as the master of two zones and the second as a slave for those zones. The zones are example.com and ddns.example.com. I have DDNS running and ...
0
votes
2answers
2k views

What are best practices for giving users administrative access in Windows AD domain?

The title may be slightly misleading but I'm interested in best practices for delegating administrative access for two different scenarios: giving developers local administrative access to certain ...
0
votes
1answer
144 views

Sorting out delegation

I'm trying to sort out Windows Auth delegation for an IIS box talking to a SQL box, which should be passing through the users credentials. I've detailed the configuration of this double-hop scenario ...
5
votes
1answer
95 views

Services Accounts

We have a service account that is a member of the domain admins group. This is something that makes me exceptionally uncomfortable. I am looking to change this as soon as possible but am fairly new ...
2
votes
1answer
2k views

In Win/AD, does kerberos authentication require the services accounts to be the same?

I am trying to isolate the cause of a KRB5KDC_ERR_BADOPTION (13) that I am seeing come back in a WireShark trace. I have set an SPN to associate xxx/server.fqdn:port with the domain account that ...
3
votes
3answers
4k views

Kerberos Delegation for SQL Bulk insert (access denied)

I have a problem when trying to bulk insert to SQL under the following situation: Running management studio on Workstation A SQL Running on Server B File to bulk upload from located on Server C ...
0
votes
2answers
98 views

DNS delegation without changing WHOIS

I am hosting several domains on my own nameservers. Some I'd like to use with a third party webhosting provider that asked me to move the domain over to them as they don't support external nameservers....
0
votes
1answer
860 views

Constrained Delegation works if App Pool is Local System but not if Network Service in IIS 7

I have an issue with Constrained Delegation and IIS 7 on Windows Server 2008. We have a web application which uses impersonation to access a SQL Report Server. This has worked fine with IIS 6 with ...
0
votes
2answers
2k views

Create a linked SQL server across a domain

I am trying to create linked server on a SQL 2008 server to sql server on another domain. I tried following the advice given in this article: http://msdn.microsoft.com/en-us/library/ee191523%28v=sql....
1
vote
1answer
1k views

Granting Editor rights in Outlook 2007 via Exchange Management Console?

Am I missing something? Do my individual users have to allow delegate access through the tools>options>delegates tab, or can I give individuals the rights to do so in EMC? This is a new position for ...
1
vote
2answers
778 views

Kerberos constrained delegation not working

I have a typical double hop scenario, User ->IIS->SQL. I am using IIS 7.5, which is using Kernal Model Authentication, so I am setting up the IIS server account for delegation. If I set this to "...
0
votes
1answer
253 views

How do I get a list of users in AD who have the ability to reset another user's password?

I need to provide a list of all the users who can reset other users' passwords. e.g. Service Desk Staff, Domain Admins etc. This might have been delegated at a specific OU or at domain level. Is ...
0
votes
2answers
462 views

Automate setup of constrained kerberos delegation in AD

I have a web app that uses some backend servers (UNC, HTTP and SQL). To get this working I need to configure ServicePrincipalNames for the account running the IIS AppPool and then allow kerberos ...
1
vote
1answer
484 views

Asp.NET Delegation and Calling a SharePoint Webservice

I'm trying to make a call to the SharePoint Search Webservice from an Asp.NET 4.0 application that does not reside on the SharePoint server. Everything seems to work, accept it is using the AppPool's ...
0
votes
1answer
362 views

Cross Forest Delegation

Is it possible to do delegation in a cross forest scenario with only a one way trust? I have 2 domains which are in different forests, and there is a one way trust from the resourcedomain to the ...
1
vote
2answers
2k views

Creating CNAME to delegated domain

We are trying to configure F5 to do load balancing on 4 sub domains similar to this article. For Example prod.wip.example.com. NS F5NS1.example.com. prod.wip.example.com. NS F5NS2.example....
1
vote
1answer
629 views

openID delegation - no endpoint found

I posted this query on staackoverflow main but it was suggested I should ask here. Sorry for the non-openID login, but as you can see, I'm having some issues. In short: A couple weeks ago I noticed ...
2
votes
4answers
28k views

BIND: how to delegate subzone to other DNS server?

I'm in the process of migrating from a workgroup served by a BIND9 DNS server, to a AD Domain based on Windows Server 2008 R2, and I'd like to keep using the BIND server until the AD infrastructure is ...
0
votes
2answers
118 views

Permissions, rights, roles, user groups, delegations [closed]

I am looking for a good book, Internet resource that can clearly explain these terms. Really, I would not like to read any Microsoft books or any book about windows or other operation systems. I ...
0
votes
1answer
77 views

Question about delegating zone

A little question about DNS. Given a domain, say: example.com I want to setup a subdomain like this: sub.example.com I want to delegate this zone to third party Name Servers(secondaries), say: ...
3
votes
1answer
941 views

DNS, subdomain, and IPv6 — possible to add subdomain.example.com NS record to an IPv6 host?

example.com is listed with a registrar -- specifically, answerable.com. I want to host a subdomain in-house, specifically home.example.com. I am using an ipv6 gateway, specifically gogo6, to have a ...
5
votes
5answers
2k views

IIS Strategies for Accessing Secured Network Resources

Problem: A user connects to a service on a machine, such as an IIS web site or a SQL Server database. The site or the database need to gain access to network resources such as file shares (the most ...
1
vote
1answer
1k views

Delegate “Read” Ability to GPO's

Is there a way to allow a non-administrator to "read" (as in browse and look at the settings) of domain gpo's? I see in GPMC there is an option to allow delegation of "Read Group Policy Results ...
3
votes
4answers
222 views

Active Directory Delegation Help

I am trying to get a junior team mate setup with rights on AD to create accounts, change passwords and create emails on exchange. What would be the best way to do this? I tried half assing a ...
2
votes
5answers
1k views

Managing per-user rc.d init scripts

I want to delegate SysV init scripts to each user. Like the SysV init, each item in ${HOME}/rc.d starting with S will be launched on server start-up with the start argument. The same for the server ...
1
vote
1answer
413 views

IIS delegate credentials

On my machine (a win server 2003) I have an ASP.Net web application which call an ASP.Net web service on a different server (also a win 2003 server). The web application is set to impersonate and use ...
5
votes
3answers
2k views

Delegating account unlock rights in AD

I'm trying to delegate the rights to unlock user accounts in our Active Directory domain. This should be easy, and I've done it before... but every time the user tries to unlock an account (using the ...
1
vote
1answer
2k views

Can I create DNS records for some hosts, delegate other queries in the same domain to another DNS server?

I have an internal DNS server. I've added a custom record for a domain name that is public. I want to add local records but keep the public domain name resolved. For instance : foo.bar.com = wan ip ->...
5
votes
4answers
2k views

What to do with user mailboxes in Exchange 2003 after they leave organization?

Over the ages we've accumulated mailboxes of users who have since left the company. Due to concerns at the time (they have important stuff in the mailboxes, we need to get to it) the SOP was to leave ...
3
votes
3answers
199 views

End-User AD Management solution [closed]

We've just migrated to a pure Microsoft environment and are looking for an end-user AD management solution. Ideally we'd like users to be able to manage their personal info in AD. We have ~500 users ...
7
votes
2answers
2k views

Is there a way to get Kerberos credentials to delegate twice? Why not?

All my nerdly life, I've dealt with this limitation of Windows Domains Login - console Integrated auth to something (usually web app) My credentials can't move to another server (e.g. database or ...
0
votes
1answer
163 views

Outlook 2007 Mutliple Accounts

We have someone here set up with multiple accounts in Outlook 2007. We don't have an exchange server. When this person sends a meeting request from the non default account, it says it's from [non ...
2
votes
3answers
1k views

How long is the update delay when changing nameserver delegation, and how can I test the change?

I just changed our delegated name sever though our registrar (MelbourneIT, if it's important). The updated nameserver value shows in the whois report - does this mean that the update has completed? ...
1
vote
3answers
6k views

Set up delegation trust for domain user

I have a domain user account (in mydomain.com, let's say) that is set to be the logon account for numerous instances of SQL Server 2005 on multiple machines. I want to have this domain account (not ...