Hot answers tagged

10

No, this is not possible if the OU is located at the root level in the parent domain (there is instead no issue if the OU is located in a subtree). Reference: http://support.microsoft.com/en-us/kb/240147. The KB article is very old and only mentions Windows 2000, but the limitation still applies as of Windows Server 2012 R2. Oddly, the official guide ...


8

As pointed out by @MDMarra, using a VM is a great way to go because blocking time synchronization can cause significant problems for authentication, TLS certificate validity, etc. However, for true testing, you probably will want to test this on a machine that is joined to the domain as it would be in a "real world" case. Either way, it is always helpful to ...


7

You really don't want to do this. Time sync is critical to Kerberos functioning properly. Unless you want authentication failures, you'll leave the system clocks where they are. Perhaps a non-domain joined VM running inside of client Hyper-V is a better solution.


6

Azure active directory cannot be used like this. It is not a replacement for Active Directory (well, at least it isn't at the time of writing). What you want to do is use the intune service in combination with AAD to achieve what you want. I do not believe you will be able to do full GPO, but there are a ton of settings you can configure.


5

A forest is a security boundary. A domain is a management boundary. With modern delegation, fine-grained password policies, and item-level targeting in GPO, its entirely possible to create management boundaries within a single domain as well. There's no "right" answer. Evaluate your situation and choose whichever is most appropriate based on your ...


5

you could replace that with LAPS


5

2 ways so far: canonical name: get-adgroup -identity "your group" -properties canonicalname | sel -property canonicalname [enter] canonicalname Your.Domain/ou name/ou name/your group using the distinguishedname: $group = get-adgroup identity "your group" [enter] ($group.DistinguishedName -split"," ,2)[1] [enter] ou=name,ou,name,dc=your,dc=domain,dc=...


4

Microsoft documented most of the internals of this in [MS-SAMR]. Here are some definitions from that document: account: A user (including machine account), group, or alias object. Also a synonym for security principal or principal. alias: An alternate name that can be used to reference an object or element. alias object: See resource group. ...


3

You current design of logon then connecting over VPN is flawed. You may want to consider using shortcuts instead of drive mappings. Or configure the VPN clients to connect before logon. http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107598-sbl.html


3

No such thing as primary and secondary domain controllers. All domain controllers are equal. Exchange should find the domain controller automatically. Ensure the DNS within the OS is configured correctly and that the second domain controller is also a global catalog. If the original DC has gone away (so cannot be recovered) then you will need to seize ...


3

Sounds like your local Administrators group is managed via Group Policy or some other scheduled script. Talk to your IT department.


3

With Powershell you can do something like this : Get-ADComputer -filter {*} -searchbase "OU=xx,OU=xx,DC=xx,DC=xx"| Where-Object {$_.name -like "CMP*"} | Move-ADObject -TargetPath "ou=Com,dc=xx,dc=xx" Get-ADComputer selects the computers of your AD. Where-Object only with their name corresponding to the wildcard Move-ADObject and finally you your ...


3

OK, the problem is that the client has an APIPA address (169.254.139.214), which means that it isn't getting an ip address from DHCP. I can see in your screenshots that the DHCP server has a red arrow, which means it hasn't been authorized, which means it won't assign ip addressing information to clients. You need to authorize the DHCP server and then things ...


2

You can try this put the list of servers on text file or filter from AD #$computer="get-content computers.txt" #computers=Get-ADComputer -Filter {OperatingSystem -Like “Windows Server*”} foreach ($Computers in $computer) { Get-WmiObject -query 'select * from win32_product' | where {$_.name -like "Ccleaner*"} |ft Name, Version,PsComputername | export-csv "$...


2

Another way to think it would be to create dynamic distribution group if you don't want to change your groups. Dynamic distribution groups are mail-enabled Active Directory group objects that are created to expedite the mass sending of email messages and other information within a Microsoft Exchange organization. Unlike regular distribution ...


2

I'm afraid this is an unsupported option you can provide either /netonly or /savecred but not both: runas [{/profile | /noprofile}] [/env] [{/netonly | /savecred}] [/smartcard] [/showtrustlevels] [/trustlevel] /user: " " more info: https://technet.microsoft.com/en-us/library/cc771525.aspx


2

The scheduled task must be created in the GPO's console while sitting in the same OS core version that you will target. In example for 2008R2 you need to edit with a 2008R2 server or to use the RSAT tool on a Windows 7. At each new OS version they add new scheduled task settings, and thus the task become not valid if the GPO target a OS that does not know ...


2

Just had this issue on a few computers I administer. In case it helps anyone: PCs built from scratch with Windows 10 (education edition) using Lite Touch Installation from Windows server - the issue did not arise. Some (but not all !?) PCs upgraded to Windows 10 (education edition) - exact same source media as used for the LTI build - from Windows 8.1 ...


2

Don't do this with traditional AD DS. If you have to go cloud-only, you should use the Azure Active Directory SaaS solution with Intune for management and Windows 10 on the desktop. You lose things like Kerberos, GPO, etc, but you gain a great amount of flexibility and have no infrastructure to manage. As I said, this isn't a 1:1 comparison of features ...


2

The issue is that the domain that was required for the SignInAccelerationDomain wasn't the domain used as the UPN for office 365 but the full domain name of the Windows domain. So i had to enable in my example the acceleration for "corp.B.com" and not for "B.com".


2

You need to add your external domain (email domain) as an alternate UPN suffix for internal Active Directory users. To add UPN suffixes (from TechNet) Open Active Directory Domains and Trusts. To open Active Directory Domains and Trusts, click Start , click Administrative Tools , and then click Active Directory Domains and Trusts. In the console tree, ...


2

When you sync with Office 365 your internal domain must be a routable address and this should be assigned to users UPN suffix. When you sync users you will then use the same logon as you would internally (user@internal.com) to login to Office 365. it's fine to have your Federated endpoint accessible from external.com (i.e. sts.external.com), as the server ...


2

As far as I know, userAccountControl will always have a value even if it's zero. Your issue might be that the user making the query doesn't have permission to read the attribute for some reason. That would be strange if you haven't changed permissions in AD from the defaults. It's also easy to test by using a Domain Admin account to do the query. It may ...


2

It might be more accurate to ask, "Is there any situation where one would want to log in as the local administrator account on a domain-joined server, and not a domain account?" I never log in as the local administrator account of a domain-joined server. I prefer to give it a complex password and then disable it, but my current colleagues prefer to give ...


2

I believe you are looking for the "omit recovery options from the BitLocker setup wizard" policy setting. Best Practices for BitLocker https://technet.microsoft.com/en-us/library/dd875532(v=ws.10).aspx Policy: Choose how BitLocker-protected removable drives can be recovered Set to enabled, save BitLocker recovery information to AD DS for removable ...


2

I recently was and still am in your shoes. You don't only need the list folder permission. You will need Travese Folder List Folder Read attributes Read extended attributes Read permissions see here. Unfortunately there is no Windows equivalent to the functionality that Novell offers. Additionally letting users manage permissions is not ...


2

Yes, you can add a member server to a domain that is using a Windows Server 2008 R2 Foundation as its DC and "primary" server. To "try before you buy" and eliminate the worry of burning money, you can download a free evaluation copy of Windows Server 2012 R2 and then purchase a product key after you confirm that it works.


2

The easiest, cleanest thing to do would be to wipe the server and start from scratch.


2

You can demote your DC and run sysprep with generalize option. "C:\Windows\System32\Sysprep\sysprep.exe". Demoting will reset Windows security database, sysprepping will regenerate all SIDs. Time needed for this will be approximatelly the same as rebuilding it from scratch. Somehow it doesn't look like the migration problem is with your new domain if it's ...


2

dsquery uses the credentials of the logged in user to authenticate (bind) to the directory. ldapsearch does not. Look at the -D and the -W/w options for ldapsearch.



Only top voted, non community-wiki answers of a minimum length are eligible