Tag Info

Hot answers tagged

5

Enable Advanced auditing on the domain controllers for Account Management: Audit User Account Management Note that if you enable Advanced auditing, you must not use legacy auditing. Here are some of the events of interest: 4723: An attempt was made to change an account's password ...


5

I assume you're using DHCP, right? Use DHCP to specify the default gateway and DNS servers. You can even use DHCP on your DC and keep it all in one place. DNS should be provided by the domain controller(s). They can forward unknown requests to your ISP's DNS servers.


3

Basically, nevermind if your are using DHCP or not. Using a single DC in your domain, you have to make it a DNS Server also. Install and configure DNS role on your Domain Controller. Then configure your clients' DNS to point to the IP Address of your DC. The most important thing is that you have to setup your DNS Server to forward unknown names queries to ...


3

Unless you have your auditing policies set up to audit Success events in the User Account Management subcategory (or just Account Management events, if using legacy auditing) and you actually have Security Logs that has data stretching back far enough on your DC's, you won't be able to tell. You'll want to search for events with Event ID 4723 (Password ...


3

No danger I can think off. Some official reading: New Windows Vista–based or Windows Server 2008–based policy settings can be managed only from Windows Vista–based or Windows Server 2008–based administrative machines running Group Policy Object Editor or Group Policy Management Console. Such policy settings are defined only in ADMX files and, as such, ...


3

You aren't going to be able to synchronize GPO's across forests, although you can copy GPO's across forests if a suitable trust exists. I don't think DFS replication works across forests. DFS Replication: Frequently Asked Questions (FAQ) https://technet.microsoft.com/library/cc773238(WS.10).aspx Must members of a replication group reside in the same ...


2

The documentation for LockoutStatus defines the field like this: Orig Lock: Displays the domain controller that locked the account (the domain controller that made the originating write to the LockoutTime attribute for that user). You can access the attribute properties from replication metadata. $LockedAccount=Get-ADUser [username here - no quotes ...


2

Try rename field in csv from mail to EmailAddress


2

Try this: foreach ($group in $groups) { Get-ADGroupMember $group | select Name } Get-ADUser is looking for an Active Directory User object, what you're essentially trying to do is use that cmdlet on an Active Directory Group object.


2

To retrieve only the members that are users, and not groups: foreach($group in $groups) { Get-ADGroupMember $group | Where-Object {$_.objectClass -eq "user"} } If you want users who are members of the groups indirectly (through nested group memberships), user the -Recursive switch parameter: foreach($group in $groups) { Get-ADGroupMember $group ...


1

Active Directory objects are stored in the NTDS database with many attributes, the name is just one of them. They are actually identified by a SID (security identifier), which is what AD uses to identify the object. The name, or any of a number of other attributes, can be changed, and AD will still recognise it as the same object. SIDs are generated ...


1

Generic solution: I think the Microsoft-centric solution to this is to license using volume keys, and then simply use your KMS server to report on license activation status. Windows 7 and above-solution If volume licensing is not an option, and all of your clients are Windows 7 or newer, you could just query the SoftwareLicensingProduct WMI class on each ...


1

Verify that the ESX host's domain account isn't disabled. If that's OK, try dropping the ESXi host from the domain, deleting it's computer object in the domain and add it back. Failing that, try updating your host to 5.1 or later. Version 5.1 is working perfectly for us, I don't have a 5.0 host to check.



Only top voted, non community-wiki answers of a minimum length are eligible