Tag Info

Hot answers tagged

7

A third VM would, obviously, be the most desirable but, obviously, another Windows Server license costs money. Active Directory will only disable write caching on volumes where the database files are located. Adding a dedicated volume for file service would be fine in that respect. Of all the roles to "share" on a DC a file server is probably the least ...


6

Add the specified machines to an Active Directory Security Group and add the Group to the GPO with a "Deny" for "Apply Policy" (Don't fall for doing a full deny as it will stop the GPO name from enumerating, making troubleshooting difficult). Then, add the machines to that Group as required.


5

Simply use the "Apply to All users except local administrators" setting in the Software Restriction Policies Enforcement... you don't let all your users run as Administrator... do you??? As an alternative, perhaps you could define the Software Restriction Policies in the User Configuration portion of the GPO, then use Security Filtering to allow that GPO ...


5

Your plan looks fine. Ish. 10 Domain Controllers for less than 100 users is a very high ratio of DCs to users. Strictly speaking, you don't need a Domain Controller at every office. Not having a Domain Controller at a site will result in increased traffic across the site link, as a result of authentication and other domain service traffic traversing ...


4

There is absolutely no relationship between these objects "out of the box". Windows 8 / Windows Server 2012 introduced a concept of a "primary computer" Active Directory schema attribute but I highly doubt you're going to find that being used. Getting the logged-on user on a remote machine is one of those things that sounds like it should be really easy ...


3

Existing profiles on a Windows computer are listed in the following registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList It contains a subkey per user profile, and the name of each subkey identifies the corresponding user by a Security Identifier. You could "discover" user profiles by enumerating the subkeys and ...


3

I'm sorry, in advance, for the rambling nature of my commentary. I want to use one domain for all of the users without subdomains. Am I right? Actually I don't see the advantage of using more domains, not even subdomains. Single-domain is nearly always the way to go for organizations of almost any size, large or small (especially since Microsoft added ...


3

Very short answer: Unless you have really, really oddball connectivity (connections with time-limited availability, connections with excessively high bandwidth costs that warrant tuning replication traffic) you really don't need to manually adjust anything about Active Directory (AD) replication. It just works (rather well, actually). Microsoft has ...


3

A suppose the answer here was a bit of voodoo... Some sick combination of trawling German-language Microsoft forums, digging through errors and Googling/Binging/Altavista-ing... produced: leaving/rejoining the Exchange server to the domain. working with a new clean account with the right group membership (couldn't trust the existing Administrator ...


3

The idle time shown in your screenshots can indicate user inactivity. If the user were to leave a program that periodically accesses the file server this number wouldn't indicate time where a user is not present providing input to the computer. One quick-and-dirty idea comes to mind: Use the creation time of a screensaver process Assuming the user is ...


3

I've always understood SBS to be the "Windows Server for small businesses when you don't have an IT department but want an all in one server". SBS makes sense in some shops, not so much in others. If you want to be 100% Microsoft, have no desire to go to the cloud yet, and have fewer than 25 employees, then it could make sense for your company. While ...


2

I generally include the full subnet in the scope and exclude addresses as needed. 80% seems a little extreme, but for a small set of users, it's not unheard of. It's not required though and SBS will work just fine with a larger pool or a smaller scope. OU's are an organization thing - I've seen many places that don't seem to know how to properly use them ...


2

Hosting Active Directory (AD) off-site is a pretty atypical configuration, even with the most current versions of Windows. You're not going to find a lot of people who recommend it. From a security perspective, AD wasn't designed with the threat model of being directly exposed to the Internet. You're going to need some kind of secure tunnel from clients to ...


2

Are you using Powershell or Exchange console? Even if you import the exchange tools into Powershell, the add mailbox feature won't work (I never got it to work). For 'add mailbox' you must use the exchange console only.


2

This occurs because two objects with the same name were created on different domain controllers before the change was replicated to the other. Duplicates cannot exist so the first one got renamed. (Possibly an admin made the computer account manually on one DC and then joined using the other DC?) Pick the one that is in use and delete the other.


1

You can temporarily jump back by adding a routable interface to the IPSpace- then you could join the domain and then remove that interface from the IPSpace.


1

$outfile = 'Groups.csv' $groups = Get-ADGroup -Filter * -SearchBase "OU=customOU,DC=panic,DC=org" foreach ($group in $groups) { Get-ADGroupMember -Identity $group | Select name, objectClass, @{Expression={$group.Name}; Label='Group'} | Export-CSV -Path $outfile -NoTypeInformation ` -Encoding ...


1

By far the most important thing with grails and AD is to use ActiveDirectoryLdapAuthenticationProvider rather than LdapAuthenticationProvider as it will save a world of pain. You can then set up AD authentication in just a few lines: In resources.groovy: // Domain 1 ldapAuthProvider1(ActiveDirectoryLdapAuthenticationProvider, "mydomain.com", ...



Only top voted, non community-wiki answers of a minimum length are eligible