The delegation tag has no wiki summary.
5
votes
4answers
871 views
What to do with user mailboxes in Exchange 2003 after they leave organization?
Over the ages we've accumulated mailboxes of users who have since left the company. Due to concerns at the time (they have important stuff in the mailboxes, we need to get to it) the SOP was to leave ...
5
votes
2answers
1k views
Is there a way to get Kerberos credentials to delegate twice? Why not?
All my nerdly life, I've dealt with this limitation of Windows Domains
Login - console
Integrated auth to something (usually web app)
My credentials can't move to another server (e.g. database or ...
5
votes
1answer
145 views
Risks of Kerberos Delegation
I've been spending hours upon hours trying to learn and understand Windows Authentication, Kerberos, SPNs, and Constrained Delegation in IIS 7.5. One thing I just don't get is why it is "risky" to ...
5
votes
3answers
1k views
Delegating account unlock rights in AD
I'm trying to delegate the rights to unlock user accounts in our Active Directory domain. This should be easy, and I've done it before... but every time the user tries to unlock an account (using the ...
4
votes
2answers
160 views
Active Directory, control to users
I'm responsible by Active Directory (AD) where I'm working, and I'm trying to figure out, how can I allow, that sector managers of the company, may add and delete users from its departments ...
4
votes
2answers
2k views
Is it possible to grant Read-Only Access to all Event Logs on Domain Controllers
I would like to grant Read-Access to event logs on all my domain controllers, ideally at a domain level using GPO. I would like members of a group to be able to view the Application Log, the System ...
4
votes
1answer
65 views
Services Accounts
We have a service account that is a member of the domain admins group. This is something that makes me exceptionally uncomfortable.
I am looking to change this as soon as possible but am fairly new ...
3
votes
1answer
77 views
How do I avoid Lame DNS or other issues when switching between 3rd party DNS servers?
I have 800 DNS zones at many different providers, and am trying to centralize them to either UltraDNS or Dynect.
Is is possible for me to configure each NS to nameserverX.MyCompany.com and avoid ...
3
votes
3answers
912 views
Kerberos Delegation for SQL Bulk insert (access denied)
I have a problem when trying to bulk insert to SQL under the following situation:
Running management studio on Workstation A
SQL Running on Server B
File to bulk upload from located on Server C
...
3
votes
4answers
196 views
Active Directory Delegation Help
I am trying to get a junior team mate setup with rights on AD to create accounts, change passwords and create emails on exchange. What would be the best way to do this?
I tried half assing a ...
3
votes
1answer
495 views
DNS, subdomain, and IPv6 — possible to add subdomain.example.com NS record to an IPv6 host?
example.com is listed with a registrar -- specifically, answerable.com.
I want to host a subdomain in-house, specifically home.example.com.
I am using an ipv6 gateway, specifically gogo6, to have a ...
3
votes
2answers
181 views
DNS delegation on same server with DDNS and second slave server
I have two servers running BIND, the first is setup as the master of two zones and the second as a slave for those zones. The zones are example.com and ddns.example.com. I have DDNS running and ...
3
votes
4answers
1k views
IIS Strategies for Accessing Secured Network Resources
Problem: A user connects to a service on a machine, such as an IIS web site or a SQL Server database. The site or the database need to gain access to network resources such as file shares (the most ...
2
votes
1answer
71 views
Delegating Administrator Control in AD
My IT environment is growing, and I want to delegate Domain Admin control to specific OU's. This way at each site, the admin in that location can only make changes in his site-specific OU.
In my ...
2
votes
5answers
712 views
Managing per-user rc.d init scripts
I want to delegate SysV init scripts to each user.
Like the SysV init, each item in ${HOME}/rc.d starting with S will be launched on server start-up with the start argument. The same for the server ...
2
votes
1answer
915 views
When changing name server delegation - how long is the update delay? How can I test the new value
I just changed our delegated name sever though our registrar MelbourneIT.com.au
The updated nameserver value shows in the whois report - does this mean that the update has completed?
If not how long ...
2
votes
1answer
79 views
Limiting view of Active Directory Users and Computers
I am delegating a group of users to a specific person to be able to keep up with thier account management, and I have delegated them the authority to do this to just this group. Is there a way that I ...
2
votes
1answer
96 views
Delegation Permissions to admins in Active Directory/Taskpads
I am trying to provide taskpads to few admins to operate on few tasks delegated to them at OU level.I ran into the following problem;
lets say i delegated access to the admin on OU X and which is ...
2
votes
1answer
481 views
In Win/AD, does kerberos authentication require the services accounts to be the same?
I am trying to isolate the cause of a KRB5KDC_ERR_BADOPTION (13) that I am seeing come back in a WireShark trace.
I have set an SPN to associate xxx/server.fqdn:port with the domain account that ...
2
votes
0answers
283 views
Grant Kerberos Constrained Delegation to SQL Server 2012 running as Managed Service Account
I can't see how to grant Kerberos Constrained Delegation for a service identified by a Managed Service Account.
I have a Windows 2008 R2 functional level single domain single forest, two 2008 R2 SP1 ...
1
vote
3answers
110 views
What strategies do admins use to devolve/delegate control of Bind configurations on a single DNS server?
I have a relatively simple Bind/DNS configuration, and would like to allow some of my users to be able to add their own configurations (eg A records and CNAMEs). Even though I trust my users, I want ...
1
vote
1answer
1k views
Can I create DNS records for some hosts, delegate other queries in the same domain to another DNS server?
I have an internal DNS server. I've added a custom record for a domain name that is public.
I want to add local records but keep the public domain name resolved.
For instance :
foo.bar.com = wan ip ...
1
vote
3answers
3k views
Set up delegation trust for domain user
I have a domain user account (in mydomain.com, let's say) that is set to be the logon account for numerous instances of SQL Server 2005 on multiple machines. I want to have this domain account (not ...
1
vote
2answers
13k views
BIND: how to delegate subzone to other DNS server?
I'm in the process of migrating from a workgroup served by a BIND9 DNS server, to a AD Domain based on Windows Server 2008 R2, and I'd like to keep using the BIND server until the AD infrastructure is ...
1
vote
1answer
967 views
Granting Editor rights in Outlook 2007 via Exchange Management Console?
Am I missing something?
Do my individual users have to allow delegate access through the tools>options>delegates tab, or can I give individuals the rights to do so in EMC?
This is a new position for ...
1
vote
1answer
298 views
Asp.NET Delegation and Calling a SharePoint Webservice
I'm trying to make a call to the SharePoint Search Webservice from an Asp.NET 4.0 application that does not reside on the SharePoint server. Everything seems to work, accept it is using the AppPool's ...
1
vote
1answer
490 views
openID delegation - no endpoint found
I posted this query on staackoverflow main but it was suggested I should ask here. Sorry for the non-openID login, but as you can see, I'm having some issues.
In short:
A couple weeks ago I noticed ...
1
vote
1answer
256 views
Delegate “Read” Ability to GPO's
Is there a way to allow a non-administrator to "read" (as in browse and look at the settings) of domain gpo's?
I see in GPMC there is an option to allow delegation of "Read Group Policy Results ...
1
vote
1answer
360 views
IIS delegate credentials
On my machine (a win server 2003) I have an ASP.Net web application which call an ASP.Net web service on a different server (also a win 2003 server). The web application is set to impersonate and use ...
1
vote
0answers
16 views
Delegate rights to AD security group to Add UNIX Attributes
We have several Linux servers that are AD integrated, all our DC's are Server 2008R2 running at 2003 DFL and FFL with MSSFU installed. I wish to delegate the population of the UNIX Attributes tab to ...
1
vote
0answers
91 views
Kerberos: connection from win app running from IIS to SQL failed
I have an IIS web-application with Windows authentication and impersonation.
This application connects to SQL server.
In this case Kerberos works fine.
But there is a problem.
Web-application runs ...
1
vote
0answers
230 views
How to fix “SignTool Error: IStore2::Load returned error: 0x80090345”
I have a Jenkins job running the signtool utility on a remote node, the console log looks like so:
Started by user anonymous
Building remotely on vm-builder
[VE] $ cmd /c call "C:\Documents and ...
1
vote
2answers
489 views
Kerberos constrained delegation not working
I have a typical double hop scenario, User ->IIS->SQL.
I am using IIS 7.5, which is using Kernal Model Authentication, so I am setting up the IIS server account for delegation.
If I set this to ...
1
vote
2answers
622 views
Creating CNAME to delegated domain
We are trying to configure F5 to do load balancing on 4 sub domains similar to this article.
For Example
prod.wip.example.com. NS F5NS1.example.com.
prod.wip.example.com. NS ...
0
votes
2answers
547 views
What are best practices for giving users administrative access in Windows AD domain?
The title may be slightly misleading but I'm interested in best practices for delegating administrative access for two different scenarios:
giving developers local administrative access to certain ...
0
votes
3answers
792 views
How can I add a custom Powershell CMDLET to Exchange 2010?
I remember reading about how it's possible to add scripts or commandlets to Exchange 2010... in a way that as soon as Powershell imports the remote commands, your custom command is available as well.
...
0
votes
2answers
77 views
DNS delegation without changing WHOIS
I am hosting several domains on my own nameservers. Some I'd like to use with a third party webhosting provider that asked me to move the domain over to them as they don't support external ...
0
votes
1answer
124 views
How to do delegation on BIND server
continuing the last question about Windows AD + Linux BIND. I decided to create a subdamain for AD to run on.
It's ad.wxxx.xxxxx. My configuration is okay, but I don't think it does the delegation ...
0
votes
2answers
110 views
Permissions, rights, roles, user groups, delegations [closed]
I am looking for a good book, Internet resource that can clearly explain these terms.
Really, I would not like to read any Microsoft books or any book about windows or other operation systems. I ...
0
votes
1answer
39 views
DNS config to handle email for third party subdomain
Our customers host their own email (e.g. company.com), but need our service to handle email addressed to a specific subdomain (e.g. sub.company.com)
We'd like to control DNS for their subdomain, ...
0
votes
1answer
67 views
Question about delegating zone
A little question about DNS. Given a domain, say:
example.com
I want to setup a subdomain like this:
sub.example.com
I want to delegate this zone to third party Name Servers(secondaries), say:
...
0
votes
1answer
45 views
AD: delegating computer log access
I would like to setup the following audit scenario:
A large Active Directory domain is scattered among various phisical sites, each contained in its own organizational unit. The members of a ...
0
votes
1answer
368 views
Constrained Delegation works if App Pool is Local System but not if Network Service in IIS 7
I have an issue with Constrained Delegation and IIS 7 on Windows Server 2008.
We have a web application which uses impersonation to access a SQL Report Server. This has worked fine with IIS 6 with ...
0
votes
2answers
457 views
Create a linked SQL server across a domain
I am trying to create linked server on a SQL 2008 server to sql server on another domain. I tried following the advice given in this article: ...
0
votes
1answer
161 views
Outlook 2007 Mutliple Accounts
We have someone here set up with multiple accounts in Outlook 2007. We don't have an exchange server. When this person sends a meeting request from the non default account, it says it's from [non ...
0
votes
1answer
87 views
Multihop Kerberos delegation on IIS7 / Windows 2008
So here I am again dealing with probably the number one support question on IIS, SPNs. I am not a novice when it comes to this, having lived the pains of getting SSRS front ends to delegate for SQL ...
0
votes
0answers
52 views
Active Directory Administrative centre delegation with a Non-Administrator Account Server 2008 R2
I am running Server 2008 R2 in an Active Directory Domain Environment.
I have created a group in Active Directory and I have delegated management authority to that group to a user.
I want this user ...
0
votes
0answers
24 views
Kerberos delegation on SQL cluster
Here's my setup.
A web server running ASP.NET web applications.
A SQL Clustered server, with 2 physical nodes.
Both of these are on the same domain.
The web server has been enabled for kerberos ...
0
votes
1answer
157 views
Exchange 2010 and Delegate Oddity
I've tested and reproduced a problem that goes like this:
Jo is a delegate for Steve.
When Steve gets an invite, Jo receives a copy and accepts (or declines).
Jo cannot accept or decline on her Mac ...
0
votes
3answers
81 views
create dns delegation where new nameserver are to be in the delegation on windows 2008 os
We have a domain "muzzard.com" which has nameservers ns0 and ns1
I'd like to add a delegation aws.muzzard.com and have the nameservers for that delegation in there e.g. ns0.aws.muzzard.com etc.
...
