The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
0answers
7 views

Any other option than HTTPS + Basic auth for reverse proxied IIS site that uses double hop authentication to SQL server

We've been struggling for a while to get, what I had assumed would be a relatively common scenario to work and would appreciate any pointers. We have 2 x Windows 2012 Servers running IIS Server SQL ...
5
votes
1answer
58 views

Different ACLs on two OU's with same “protect object from deletion” setting

Background After I configured our Active Directory so that the ability to move computers was delegated to helpdesk staff, I started hearing reports that computers would get "stuck" in specific OU's. ...
4
votes
1answer
51 views

DNS referral / delegation: which DNS is responsible; How to delegate the right way?

Introduction I bought the domain earechnung.at with Hetzner and am using my webspace at All-Inkl. I want to use the nameservers of my webhost (All-Inkl). Zonefiles and Nameservers As I registered ...
1
vote
1answer
19 views

Unable to delegate Replicating Directory Changes to a user in AD - option missing from wizard

Disclaimer: I originally asked this over at SharePoint SE, but I figured I'd ask it here too as it's more of an AD problem than a SP specific one. I'm trying to delegate the Replicating Directory ...
0
votes
1answer
31 views

Set Country / Region field Access via Active Directory Delegation

After creating a security group for special permissions (edit User Objects fields like Street, ZIP etc.) I have a problem of not being able to delegate permission for the field "Country/Region" on a ...
1
vote
0answers
19 views

IIS 7.5 connect to a web site using IIS Manager using the current user credentials

I am trying to use IIS Manager to connect to a site or an application but would like to pass through or use the current authenticated user's credentials. There is only a username and password option ...
5
votes
2answers
269 views

Risks of Kerberos Delegation

I've been spending hours upon hours trying to learn and understand Windows Authentication, Kerberos, SPNs, and Constrained Delegation in IIS 7.5. One thing I just don't get is why it is "risky" to ...
1
vote
1answer
40 views

Active Directory, delegating control for specific class

There are objects in my AD that have objectClass set to device, and I would like to delegate control to non-admin users so they will be able to add new and delete existing objects with objectClass set ...
3
votes
1answer
83 views

How to proper delegate domain in BIND for Active Directory servers

I have to delegate domain for AD serwers. Let say example.com and I'm using Bind(dns.bind.com) on CentOS. I added proprer configuration to named.conf and using A,NS records delegate domain to AD ...
5
votes
5answers
2k views

IIS Strategies for Accessing Secured Network Resources

Problem: A user connects to a service on a machine, such as an IIS web site or a SQL Server database. The site or the database need to gain access to network resources such as file shares (the most ...
0
votes
0answers
30 views

Delete entry from Exchange calendar when delegate denies meeting request

I created a Room-Mailbox in Exchange. This Mailbox will be used to manage vacation Days. I delegated control to a user to deny and accept vacation requests. The requestee is informed correctly about ...
1
vote
1answer
67 views

Difference between “Descendant User Objects” and just “User Objects”

i am trying to delegate permissions on a cetain OU to a certain group. All i find is "Descendatn User Objects" and not just "User Objects" ; we have those available in other domain; please do let me ...
0
votes
1answer
123 views

Cant find “Read Lockout Time” and “Write Lockout Time” for delegation on OU

Trying to delegate permissions to a group on a OU; but cant find 2 properties in special permissions for "User Objects" they are "Read Lockout Time" and "Write Lockout Time" any reason i couldnt see ...
4
votes
1answer
46 views

Active Directory write permissions let edit users information but not administrator-users information

In our Active Directory (2008 R2), I used delegation to give permission to edit user information attributes such as phone numbers, title, postal address, ... to a group of non-admin users. Members of ...
2
votes
2answers
97 views

Delegating Administrator Control in AD

My IT environment is growing, and I want to delegate Domain Admin control to specific OU's. This way at each site, the admin in that location can only make changes in his site-specific OU. In my ...
0
votes
1answer
77 views

Active Directory Administrative centre delegation with a Non-Administrator Account Server 2008 R2

I am running Server 2008 R2 in an Active Directory Domain Environment. I have created a group in Active Directory and I have delegated management authority to that group to a user. I want this user ...
1
vote
0answers
45 views

bind9, Resolve example.com but forward *.example.com to a forwarder possible?

is it possible in bind to resolve example.com with a zone but resolve all subdomains of example.com with a forwarder? If somebody knows how this can work or has some simple sample configurations i ...
1
vote
3answers
17k views

BIND: how to delegate subzone to other DNS server?

I'm in the process of migrating from a workgroup served by a BIND9 DNS server, to a AD Domain based on Windows Server 2008 R2, and I'd like to keep using the BIND server until the AD infrastructure is ...
0
votes
1answer
46 views

Why would delegated nameservers ever be different to authoritative nameservers?

If you go on intodns.com and type in stackoverflow.com, the parent server tells me that nameservers for the domain are here: ns1.serverfault.com. ['198.252.206.80'] [TTL=172800] ...
1
vote
2answers
219 views

delegating /24 and /64 reverse zones

I'm sure I'm overlooking something so simple, but I'm just not seeing it... I'm trying to delegate the /24 and /64 reverse zones for our Test network to hosts within the Test network. I'm seeing the ...
0
votes
1answer
46 views

rDNS entry on a separate name server from forward dns - is this okay?

Our reverse DNS lookup is delegated to our name server (ns.example1.com) by AT&T, who leases us our IP address (1.2.3.4) and our forward DNS lookups were on the same name server (ns.example1.com). ...
1
vote
1answer
94 views

Internal DNS delegate to external host

We have been facing an issue with internal DNS delegation. Here is a description of our architecture and the issue: Architecture Domain1 DHCPDNS1 and DHCPDNS2 (Windows Server 2012) Domain2 ...
0
votes
0answers
46 views

Kerberos credential delegation

I am currently trying to enable a spnego based SSO Application. As part of this I seek to get the delegated credentials. How to verify that the credential I get after GSSContext.acceptSecContext(gss, ...
3
votes
1answer
93 views

SPNs and Kerberos Delegation

I would like to check my understanding. This is a fully hypothetical scenario below as I am currently studying for a certification. I have an IIS App Pool with a basic website, which accesses data ...
0
votes
1answer
209 views

Multihop Kerberos delegation on IIS7 / Windows 2008

So here I am again dealing with probably the number one support question on IIS, SPNs. I am not a novice when it comes to this, having lived the pains of getting SSRS front ends to delegate for SQL ...
1
vote
0answers
136 views

Delegate rights to AD security group to Add UNIX Attributes

We have several Linux servers that are AD integrated, all our DC's are Server 2008R2 running at 2003 DFL and FFL with MSSFU installed. I wish to delegate the population of the UNIX Attributes tab to ...
-1
votes
1answer
251 views

Delegate software install/uninstall power to users/groups [closed]

I would like to have support personnel install and uninstall software across the domain, with no less and no more admininstrative capabilities. How do I do so?
0
votes
1answer
79 views

AD: delegating computer log access

I would like to setup the following audit scenario: A large Active Directory domain is scattered among various phisical sites, each contained in its own organizational unit. The members of a ...
2
votes
1answer
240 views

Limiting view of Active Directory Users and Computers

I am delegating a group of users to a specific person to be able to keep up with thier account management, and I have delegated them the authority to do this to just this group. Is there a way that I ...
0
votes
1answer
63 views

DNS config to handle email for third party subdomain

Our customers host their own email (e.g. company.com), but need our service to handle email addressed to a specific subdomain (e.g. sub.company.com) We'd like to control DNS for their subdomain, ...
0
votes
1answer
798 views

How to do delegation on BIND server

continuing the last question about Windows AD + Linux BIND. I decided to create a subdamain for AD to run on. It's ad.wxxx.xxxxx. My configuration is okay, but I don't think it does the delegation ...
0
votes
2answers
325 views

Automate setup of constrained kerberos delegation in AD

I have a web app that uses some backend servers (UNC, HTTP and SQL). To get this working I need to configure ServicePrincipalNames for the account running the IIS AppPool and then allow kerberos ...
0
votes
1answer
306 views

Exchange 2010 and Delegate Oddity

I've tested and reproduced a problem that goes like this: Jo is a delegate for Steve. When Steve gets an invite, Jo receives a copy and accepts (or declines). Jo cannot accept or decline on her Mac ...
2
votes
5answers
906 views

Managing per-user rc.d init scripts

I want to delegate SysV init scripts to each user. Like the SysV init, each item in ${HOME}/rc.d starting with S will be launched on server start-up with the start argument. The same for the server ...
1
vote
0answers
116 views

Kerberos: connection from win app running from IIS to SQL failed

I have an IIS web-application with Windows authentication and impersonation. This application connects to SQL server. In this case Kerberos works fine. But there is a problem. Web-application runs ...
2
votes
1answer
114 views

Delegation Permissions to admins in Active Directory/Taskpads

I am trying to provide taskpads to few admins to operate on few tasks delegated to them at OU level.I ran into the following problem; lets say i delegated access to the admin on OU X and which is ...
3
votes
1answer
91 views

How do I avoid Lame DNS or other issues when switching between 3rd party DNS servers?

I have 800 DNS zones at many different providers, and am trying to centralize them to either UltraDNS or Dynect. Is is possible for me to configure each NS to nameserverX.MyCompany.com and avoid ...
0
votes
3answers
116 views

create dns delegation where new nameserver are to be in the delegation on windows 2008 os

We have a domain "muzzard.com" which has nameservers ns0 and ns1 I'd like to add a delegation aws.muzzard.com and have the nameservers for that delegation in there e.g. ns0.aws.muzzard.com etc. ...
2
votes
0answers
424 views

Grant Kerberos Constrained Delegation to SQL Server 2012 running as Managed Service Account

I can't see how to grant Kerberos Constrained Delegation for a service identified by a Managed Service Account. I have a Windows 2008 R2 functional level single domain single forest, two 2008 R2 SP1 ...
-1
votes
1answer
826 views

Delegation issue

I have a small vps in the Netherlands and a domain registered with bluehost. I added this domain account (WHM) to my vps by changing the nameserver of the correspondent domain on bluehost to ...
0
votes
3answers
888 views

How can I add a custom Powershell CMDLET to Exchange 2010?

I remember reading about how it's possible to add scripts or commandlets to Exchange 2010... in a way that as soon as Powershell imports the remote commands, your custom command is available as well. ...
3
votes
2answers
254 views

DNS delegation on same server with DDNS and second slave server

I have two servers running BIND, the first is setup as the master of two zones and the second as a slave for those zones. The zones are example.com and ddns.example.com. I have DDNS running and ...
1
vote
3answers
122 views

What strategies do admins use to devolve/delegate control of Bind configurations on a single DNS server?

I have a relatively simple Bind/DNS configuration, and would like to allow some of my users to be able to add their own configurations (eg A records and CNAMEs). Even though I trust my users, I want ...
1
vote
2answers
792 views

Creating CNAME to delegated domain

We are trying to configure F5 to do load balancing on 4 sub domains similar to this article. For Example prod.wip.example.com. NS F5NS1.example.com. prod.wip.example.com. NS ...
4
votes
2answers
169 views

Active Directory, control to users

I'm responsible by Active Directory (AD) where I'm working, and I'm trying to figure out, how can I allow, that sector managers of the company, may add and delete users from its departments ...
4
votes
2answers
3k views

Is it possible to grant Read-Only Access to all Event Logs on Domain Controllers

I would like to grant Read-Access to event logs on all my domain controllers, ideally at a domain level using GPO. I would like members of a group to be able to view the Application Log, the System ...
1
vote
0answers
359 views

How to fix “SignTool Error: IStore2::Load returned error: 0x80090345”

I have a Jenkins job running the signtool utility on a remote node, the console log looks like so: Started by user anonymous Building remotely on vm-builder [VE] $ cmd /c call "C:\Documents and ...
0
votes
2answers
863 views

What are best practices for giving users administrative access in Windows AD domain?

The title may be slightly misleading but I'm interested in best practices for delegating administrative access for two different scenarios: giving developers local administrative access to certain ...
0
votes
1answer
129 views

Sorting out delegation

I'm trying to sort out Windows Auth delegation for an IIS box talking to a SQL box, which should be passing through the users credentials. I've detailed the configuration of this double-hop scenario ...
5
votes
1answer
77 views

Services Accounts

We have a service account that is a member of the domain admins group. This is something that makes me exceptionally uncomfortable. I am looking to change this as soon as possible but am fairly new ...