Tag Info

Hot answers tagged

4

Yes you can install and use with no reboot required. Install-WindowsFeature RSAT-AD-PowerShell Also I want to be clear that this is only for installing the Powershell module. Not all of Active Directory in its entirety. Installing Active Directory is an entirely different thing.


4

If you delete a user account three things happen. The account is deleted. More importantly, the SID of the user account gets deleted. The account's SID reference is removed from all security groups. The account's SID reference in any resource permissions becomes an orphan. If you recreate a user account with the same name it will have a different SID. ...


3

Active Directory (past Windows 2000) does not allow anonymous operations other than rootDSE searches, by default. So, if you are able to bind anonymously to Active Directory, that means one of two things. Either You are connecting to RootDSE, for which anonymous binds should be allowed by design. You have already modified Active Directory to allow ...


3

RSOP support has been deprecated. According to http://deployhappiness.com/gpresult-or-rsop/ "Beginning with Windows Vista SP1, Microsoft made the GPResult command the primary tool for troubleshooting Group Policy on a client." Basically, to ensure that you are getting the full result of policies on the machine, you need to use GPResult instead of ...


3

Running certutil -pulse before gpupdate made the workstation re-install the certificates.


2

Use GPO to set a minimum password length for the domain and then flag everyone's password to be changed at next logon to ensure that the change happens immediately. Update your service accounts, etc, manually.


2

Can I create my own active directory in a EC2 instance of Windows 2012 without using AWS AD? Sure - why couldn't you? It's a windows server, and you're free to do whatever you like with it. Like any AD deployment, you should have at least two DCs, and you'll need to sort out how to get your clients secure access to the server.


2

For Group Policy "Not Defined" is NOT the same thing as "NOT SET", FALSE or any other meaning. Not Defined means the group policy at the level you are analyzing makes no change to the Windows default. You may also need to looks at - is there a lower security scope (local on a non-domain member) that IS defined. What is the Windows Default action when ...


2

Daniel answer is correct, but you can do better. TFS has a little know utility to manage user identities described at https://msdn.microsoft.com/en-us/library/ms253054.aspx. TFSConfig Identities /change Probably is too late, but imagine this sequence of actions. Account DOMAIN\user is deleted (SID 1234) from AD TFS will mark the identity deleted in its ...


2

I might help you with a workaround. Create a Unicode encoded text file and insert the Company name. Then use Get-Content to store the company name in a variable. $companyName = Get-Content .\companyName-unicode.txt Get-ADUser -Filter { company -eq $companyName } I tested with chinese text (中國哲學書電子化計劃) it and it worked on my server.


1

I always name my internal ad domains ad.companyname.com so I'm not using .local or a made up TLD. using a real TLD so I can get appropriate Certs and avoid DNS issues.


1

With netlogon debugging enabled I found the same result in my Win7 SP1 machines (domain controllers are 2008r2SP1). It also caused an 8 second delay in processing so far as I can tell. Looks like a faulty API call from netlogon to me. You can replicate the same 1355 error by running the following on a workstation: nltest ...


1

This is totally possible to create a policy ruling incoming connection attempts with a GPO. here is the Microsoft documentation pages on how to do that. Go to Computer configuration, Windows Settings, Security settings, Windows Firewall with advanced security. Right clic on Windows Firewall with advanced security. On global policy, you can chose to set it ...


1

What you are looking for is an Identity Manager. There's a few around e.g. OpenIDM. Essentially Identity Managers provision users, manage roles, handle password issues etc. STS like ADFS allow authentication against those users. ADFS sits on top of AD. You could provision directly against AD using ADUC, via LDAP, via C# libraries etc. but these are all ...



Only top voted, non community-wiki answers of a minimum length are eligible