Hot answers tagged

8

Maybe you're asking the wrong question. Instead of trying to disable a bunch of local user accounts on a bunch of different computers, perhaps instead you should use Restricted Groups in Group Policy to define exactly who is allowed to be a member of the Administrators group on the computers. It will strip out all accounts who are in the local Administrators ...


5

There is a wealth of public information on how the DC Locator process works. Essentially it performs a series of DNS lookups and LDAP pings, and also attempts to stratify the results by selecting the closest domain controller. It's unusual for Windows DC Locator to continue to use a failed domain controller, unless the domain controller is passing the ...


3

Here's the general idea: Run get-aduser to enumerate the accounts that you want. Maybe use a filter to get only accounts with an OfficeNumber. Save this result to a variable. $users for example. Use a foreach($user in $users) block to loop through the list of users. Inside of that foreach block, grab the Officenumber, prepend your 1-800 number, and save ...


2

Most likely you cannot : the typical situation is that your server is on a private subnet behind the firewall, and any outbound traffic to the Internet (such as a "What's My IP" site) is NATed on the firewall to the latter's public IP Address. The website has no way of knowing what your server's original IP was.


2

If the problem is in NIC teaming initialization, I'd suggest adding a dependency on whatever service is responsible for it; there probably is a service installed by your NIC drivers which handles NIC teaming. Another guess would be the netlogon service, which handles domain membership and authentication; I suspect it can start fine even if networking is not ...


1

This is because it is a multivalued attribute try the following date = (Get-Date).AddDays(-7) Get-ADUser -Filter * -Properties * |where { $_.whenCreated -ge $date } | select Name, @{name=”MemberOf”;expression={$_.memberof -join “;”}}, whenCreated, DisplayName, Surname, EmployeeID, mail| ConvertTo-Html | Out-File D:\test.html


1

First, make sure auditing is enabled. How to enable Audit Failure logs in Active Directory? Next, use the Security Event Log, filter for account logon events. (You can start with 4624 (logon) and (4625 (logon failed)) Check out https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/Default.aspx?catid=1 and ...


1

Why are you paying for Exchange? If you're simply using it for management and not transport or mailboxes, this is included at no cost with your Office 365 subscription. That said, you should absolutely maintain at least a single Exchange server on prem in hybrid mode for the management console, otherwise managing things like dynamic DLs is a real pain.


1

Here you'll find the official documentation about how and when to decommission your on-premises Exchange servers. If you need DirSync to stay in place, then all Exchange-related attributes can't be managed in Exchange Online, and need to be managed in your local AD and then synced; doing this without an on-premises Exchange server is a royal pain, as it ...


1

I know this is very old, but found this while searching for a solution to this very topic. The settings are stored in a REG_BINARY in the registry at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections in the Entry WinHttpSettings This can be applied as a group policy object. Don't yet know how portable (win7 win8 ...


1

The _msdcs.domain.local under the domain.local (which is the first domain in the forest) is delegated authority by right-clicking the domain.local and choosing "New Delegation..." wizard. Run the wizard to point to the same PDC as the SOA. It may seem fruitless to do, but it has a definite purpose. Normally, domain controllers throughout the network ...


1

If you're looking to do it in PowerShell, assuming you have the ActiveDirectory Module loaded (ipmo ActiveDirectory) you can do Get-ADUser ($env:UserName) The logon Username should be unique on the domain and Get-ADUser will use the current domain by default


1

Although I change the minimum password age in the password policy but I still had to change the minimum password age to 0:00:00 in the ADSI Editor for the DC i'm in. @JimB and @Craig620, your help is greatly appreciated.


1

Domain controllers ignore password, lockout, or Kerberos policy settings defined at an organizational unit, such as the Domain Controllers OU. You should define legacy password policies in the Default Domain Policy or another top-level GPO. As a test I created password policy settings in both the Default Domain Policy and Default Domain Controllers ...



Only top voted, non community-wiki answers of a minimum length are eligible