Hot answers tagged

7

There are two components required for users to log on to a server via RDP: User Rights and Permissions. Rights: Users must have the "Allow logon through Remote Desktop Services" user right. Permissions: Users must have the "User Access" and "Guest Access" permission set to Allow on the RDP-Tcp protocol. By default, users or groups in the local Remote ...


5

You've fallen victim to a bad decision made by whoever set up your AD environment internally. More discussion here. Windows Active Directory naming best practices? But the gist is that internally, your AD owns the name example.com in DNS. That name will always and forever (unless you rename the domain) point to your domain controllers. So the only way to ...


2

You can create an internal DNS zone called bar, and then create a CNAME record in this zone, so that foo.bar points to foo.bar.acme.com. Repeat for each host which needs this kind of aliasing. Another option would be to configure the network interfaces on your computers to use additional DNS search suffixes other than the default domain one, so that when ...


2

I don't know the details of your application, but it sounds to me like it is not compatible with Active Directory. Read the public documentation for ADS_NAME_TYPE_ENUM. Those are the login name formats that you are allowed to log in with. "EXT123456" is not one of them. I know that you think "EXT123456" is logging in with a sAMAccountName, but it actually ...


2

The two most common problems I see with this are either permissions related or template version related. The user logged into the certsrv site needs to have both Read and Enroll permissions on the certificate template. If they don't, it won't show up in the list of available templates. Also when duplicating the template, you were likely asked what version ...


1

If you create a bunch of users on your domain, they will by default by added to the ACME\Domain Users security group (using your example domain name). Normally, users should be left in that group and that group should be their primary group. If someone else has made accounts on the domain before you, they may have taken steps to remove users from the ...


1

If your environment is healthy and properly redundant as you say, this is fine.


1

Of the methods suggested, let me give you a pros/cons list Staight up Kerberos/LDAP : Pros : Works great when configured properly. Rarely breaks, resliant, will survive network glitches. No changes need in AD, no schema change, no Administrator access needed to the AD. Free Cons : Relatively difficult to configure. Multiple files need to be changed. Will ...



Only top voted, non community-wiki answers of a minimum length are eligible