The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
2answers
34 views

Active Directory Users Delegated Permissions

This is probably a dumb question, but how does the delegated user access ad to make these changes? I have set this up but a user cannot launch the active directory users and groups tool. Only admins ...
4
votes
2answers
44 views

Can windows enable delegation across domains?

I have two domains foo.local test.local I can run powershell hyper-v cmdlets against the test.local hyper-v server if I am using a VM that is in the test.local domain. Get-VM -ComputerName ...
4
votes
1answer
109 views

Active Directory write permissions let edit users information but not administrator-users information

In our Active Directory (2008 R2), I used delegation to give permission to edit user information attributes such as phone numbers, title, postal address, ... to a group of non-admin users. Members of ...
0
votes
0answers
25 views

Quest PowerShell: Export AD permissions and apply them at a later stage

I'm trying to standardise our AD permissions for our 4 support groups. I've already applied permissions for 2 standard groups (Global support) and I'm now facing a painful clean-up for site based ...
1
vote
1answer
55 views

is it possible to delegate file srv and print srv managing to other users in windows 2008 R2 without giving them full admin rights?

we have some field service guys that work locally for some of our customers, we want to transfer the tasks of managing file servers and print servers to them. first we Thought about giving them local ...
3
votes
3answers
197 views

End-User AD Management solution [closed]

We've just migrated to a pure Microsoft environment and are looking for an end-user AD management solution. Ideally we'd like users to be able to manage their personal info in AD. We have ~500 users ...
0
votes
1answer
41 views

Zone delegation

I'm running a bind 9.8-server and want to delegate a sub-domain to a different dns-server (also administered by me), but I can't seem to get bind to accept my config and I can't figure out why. Below ...
1
vote
1answer
911 views

How can I delegate “Attributes 1-15” in Exchange / AD?

The following attributes are present on an Exchange user, and this is what my colleague sees: (notice the locks) How can I properly delegate Read access (or Read write if it must be) to these ...
0
votes
1answer
66 views

Nameserver delegation to private subnet

I'm currently having some problems delegating a subdomain, e.g. lan.example.com, to a nameserver in a private network. My private network is split in to subnets 192.168.0.1/24 <--- 192.168.0.1 ...
0
votes
0answers
27 views

Reporting Services 2008 and kerberos delegation/impersonation

I've spent quite some time configuring the use of Kerberos and Windows 2008 SQL Reporting Services - I've registered all the SPNs, configured the various authentication options in the XML files and ...
3
votes
2answers
1k views

Limiting view of Active Directory Users and Computers

I am delegating a group of users to a specific person to be able to keep up with thier account management, and I have delegated them the authority to do this to just this group. Is there a way that I ...
6
votes
1answer
347 views

In Active Directory, how do I delegate write permissions on specific attributes of protected user accounts?

We have a tool being developed that will keep specific attributes of Active Directory user objects up to date with an authoritative source of employee information truth elsewhere, so that when ...
5
votes
2answers
420 views

Active Directory Permissions: Delete vs Move

I want our help desk to be able to move user accounts but NOT delete them. Here is the summary of our current permissions set on the affected OU's (this DOES allow them to delete user accounts): ...
2
votes
1answer
16 views

Delegate Access and Subfolders

Sometimes when a user leaves a company the manager will request access to the former employees mailbox on our Exchange 2013. I can use mailbox delegation to give them full access, but if there are any ...
1
vote
1answer
186 views

Delete entry from Exchange calendar when delegate denies meeting request

I created a Room-Mailbox in Exchange. This Mailbox will be used to manage vacation Days. I delegated control to a user to deny and accept vacation requests. The requestee is informed correctly about ...
0
votes
0answers
46 views

How can I utilise resource based delegation

Windows 2012 comes with an extension to the existing Kerberos Constrained Delegation, called resource based delegation (RBCD). There are a number of great articles that explain how it works for ...
1
vote
0answers
220 views

Account Operators built in group and “User Cannot Change Password” property

I have a question about configuring of "User Cannot Change Password" property. Does default "Account Operators" domain group has ability to change this property? If not can it be delegated via AD ...
0
votes
0answers
19 views

Enabling constrained delegation on DC computer account

Is it necessary to have constrained delegation enabled on Microsoft AD domain controller computer account? If yes then why and what are consequences of disabling it? I'm mainly interested in current ...
2
votes
1answer
64 views

Azure - Is it possible for global administrators to enforce per-subscription resource limits?

My company is moving all its internal production and development servers to Azure, and needs a way to delegate administration while at the same time keeping track of resource usage; thus, we are going ...
0
votes
1answer
1k views

Delegation issue

I have a small vps in the Netherlands and a domain registered with bluehost. I added this domain account (WHM) to my vps by changing the nameserver of the correspondent domain on bluehost to ...
0
votes
0answers
83 views

Triple hop authentication

Trying to setup impersonation for web application running in IIS that connects to a web service that connects to SQL server, where all the layers are on different machines. Here is the setup Web ...
0
votes
0answers
117 views

Any other option than HTTPS + Basic auth for reverse proxied IIS site that uses double hop authentication to SQL server

We've been struggling for a while to get, what I had assumed would be a relatively common scenario to work and would appreciate any pointers. We have 2 x Windows 2012 Servers running IIS Server SQL ...
5
votes
1answer
421 views

Different ACLs on two OU's with same “protect object from deletion” setting

Background After I configured our Active Directory so that the ability to move computers was delegated to helpdesk staff, I started hearing reports that computers would get "stuck" in specific OU's. ...
4
votes
1answer
617 views

DNS referral / delegation: which DNS is responsible; How to delegate the right way?

Introduction I bought the domain earechnung.at with Hetzner and am using my webspace at All-Inkl. I want to use the nameservers of my webhost (All-Inkl). Zonefiles and Nameservers As I registered ...
1
vote
1answer
47 views

Unable to delegate Replicating Directory Changes to a user in AD - option missing from wizard

Disclaimer: I originally asked this over at SharePoint SE, but I figured I'd ask it here too as it's more of an AD problem than a SP specific one. I'm trying to delegate the Replicating Directory ...
0
votes
1answer
170 views

Set Country / Region field Access via Active Directory Delegation

After creating a security group for special permissions (edit User Objects fields like Street, ZIP etc.) I have a problem of not being able to delegate permission for the field "Country/Region" on a ...
1
vote
0answers
75 views

IIS 7.5 connect to a web site using IIS Manager using the current user credentials

I am trying to use IIS Manager to connect to a site or an application but would like to pass through or use the current authenticated user's credentials. There is only a username and password option ...
5
votes
2answers
598 views

Risks of Kerberos Delegation

I've been spending hours upon hours trying to learn and understand Windows Authentication, Kerberos, SPNs, and Constrained Delegation in IIS 7.5. One thing I just don't get is why it is "risky" to ...
1
vote
1answer
71 views

Active Directory, delegating control for specific class

There are objects in my AD that have objectClass set to device, and I would like to delegate control to non-admin users so they will be able to add new and delete existing objects with objectClass set ...
3
votes
1answer
1k views

How to proper delegate domain in BIND for Active Directory servers

I have to delegate domain for AD serwers. Let say example.com and I'm using Bind(dns.bind.com) on CentOS. I added proprer configuration to named.conf and using A,NS records delegate domain to AD ...
5
votes
5answers
2k views

IIS Strategies for Accessing Secured Network Resources

Problem: A user connects to a service on a machine, such as an IIS web site or a SQL Server database. The site or the database need to gain access to network resources such as file shares (the most ...
1
vote
1answer
507 views

Difference between “Descendant User Objects” and just “User Objects”

i am trying to delegate permissions on a cetain OU to a certain group. All i find is "Descendatn User Objects" and not just "User Objects" ; we have those available in other domain; please do let me ...
0
votes
1answer
506 views

Cant find “Read Lockout Time” and “Write Lockout Time” for delegation on OU

Trying to delegate permissions to a group on a OU; but cant find 2 properties in special permissions for "User Objects" they are "Read Lockout Time" and "Write Lockout Time" any reason i couldnt see ...
2
votes
2answers
105 views

Delegating Administrator Control in AD

My IT environment is growing, and I want to delegate Domain Admin control to specific OU's. This way at each site, the admin in that location can only make changes in his site-specific OU. In my ...
1
vote
0answers
64 views

bind9, Resolve example.com but forward *.example.com to a forwarder possible?

is it possible in bind to resolve example.com with a zone but resolve all subdomains of example.com with a forwarder? If somebody knows how this can work or has some simple sample configurations i ...
2
votes
3answers
22k views

BIND: how to delegate subzone to other DNS server?

I'm in the process of migrating from a workgroup served by a BIND9 DNS server, to a AD Domain based on Windows Server 2008 R2, and I'd like to keep using the BIND server until the AD infrastructure is ...
0
votes
1answer
77 views

Why would delegated nameservers ever be different to authoritative nameservers?

If you go on intodns.com and type in stackoverflow.com, the parent server tells me that nameservers for the domain are here: ns1.serverfault.com. ['198.252.206.80'] [TTL=172800] ...
1
vote
2answers
599 views

delegating /24 and /64 reverse zones

I'm sure I'm overlooking something so simple, but I'm just not seeing it... I'm trying to delegate the /24 and /64 reverse zones for our Test network to hosts within the Test network. I'm seeing the ...
0
votes
1answer
61 views

rDNS entry on a separate name server from forward dns - is this okay?

Our reverse DNS lookup is delegated to our name server (ns.example1.com) by AT&T, who leases us our IP address (1.2.3.4) and our forward DNS lookups were on the same name server (ns.example1.com). ...
1
vote
1answer
284 views

Internal DNS delegate to external host

We have been facing an issue with internal DNS delegation. Here is a description of our architecture and the issue: Architecture Domain1 DHCPDNS1 and DHCPDNS2 (Windows Server 2012) Domain2 ...
3
votes
1answer
160 views

SPNs and Kerberos Delegation

I would like to check my understanding. This is a fully hypothetical scenario below as I am currently studying for a certification. I have an IIS App Pool with a basic website, which accesses data ...
0
votes
1answer
975 views

Multihop Kerberos delegation on IIS7 / Windows 2008

So here I am again dealing with probably the number one support question on IIS, SPNs. I am not a novice when it comes to this, having lived the pains of getting SSRS front ends to delegate for SQL ...
2
votes
0answers
274 views

Delegate rights to AD security group to Add UNIX Attributes

We have several Linux servers that are AD integrated, all our DC's are Server 2008R2 running at 2003 DFL and FFL with MSSFU installed. I wish to delegate the population of the UNIX Attributes tab to ...
-1
votes
1answer
934 views

Delegate software install/uninstall power to users/groups [closed]

I would like to have support personnel install and uninstall software across the domain, with no less and no more admininstrative capabilities. How do I do so?
1
vote
1answer
189 views

AD: delegating computer log access

I would like to setup the following audit scenario: A large Active Directory domain is scattered among various phisical sites, each contained in its own organizational unit. The members of a ...
0
votes
1answer
84 views

DNS config to handle email for third party subdomain

Our customers host their own email (e.g. company.com), but need our service to handle email addressed to a specific subdomain (e.g. sub.company.com) We'd like to control DNS for their subdomain, ...
0
votes
1answer
2k views

How to do delegation on BIND server

continuing the last question about Windows AD + Linux BIND. I decided to create a subdamain for AD to run on. It's ad.wxxx.xxxxx. My configuration is okay, but I don't think it does the delegation ...
0
votes
2answers
387 views

Automate setup of constrained kerberos delegation in AD

I have a web app that uses some backend servers (UNC, HTTP and SQL). To get this working I need to configure ServicePrincipalNames for the account running the IIS AppPool and then allow kerberos ...
0
votes
1answer
611 views

Exchange 2010 and Delegate Oddity

I've tested and reproduced a problem that goes like this: Jo is a delegate for Steve. When Steve gets an invite, Jo receives a copy and accepts (or declines). Jo cannot accept or decline on her Mac ...
2
votes
5answers
1k views

Managing per-user rc.d init scripts

I want to delegate SysV init scripts to each user. Like the SysV init, each item in ${HOME}/rc.d starting with S will be launched on server start-up with the start argument. The same for the server ...