Tag Info

Hot answers tagged

7

Yes, Users should be able to change their expired passwords using the OWA site. In Exchange 2010, there was a registry REG_DWORD key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange OWA\ChangeExpiredPasswordEnabled that you had to set to 1. In 2013, this is a feature that's built in from the start.


6

I've dealt with similar problems in the past. That being said your organization doesn't look too far from ordinary. A lot of small business are built just like you outline. If you really want to restructure the best solution I have found is setting up an OU with block group policy inheritance at the root of your domain. Build your new structure under this ...


5

That's not a very sound recovery strategy. You cannot simply re-create the same naming and expect things to work. Every object in AD has a security identifier (SID). Creating a lot of objects with the same names might look the same to you, but to AD they are all completely different because the SIDs will differ. You should look into the proper way to backup ...


5

There isn't a technical reason. Devices that are not joined to Active Directory and don't use AD for authentication aren't going to leverage AD Sites and Subnets. One reason for doing it anyway would be thoroughness. Having all your subnets accounted for in AD, even if the subnet has no AD clients in it, is one way of having your environment being ...


5

Can a server running Windows Server 2012 R2 (File server, app server, etc.) exist on a network with Windows Server 2008 R2 domain controllers Yes. For that matter, you can join practically any version of Windows (from 2000 onward) to that domain without any problems, or touching the domain controllers. The operating system on your domain controllers ...


4

As you (correctly) guessed, AD LDS is the new name of the software previously known as ADAM; it's no longer a separate product: now it's built-in in the Windows Server OS, and you only need to enable it as you would do with any other server role. Here's the relavant documentation: http://technet.microsoft.com/en-us/library/hh831593.aspx. Caveat: there is ...


4

This is something that is only in AD, it does not get "pushed" to the member computers. So the end-users won't see it unless they open ADUC or some other AD query tool, as you point out.


4

Why does the error occur only when the 2012 DC is on? Because the computer is connecting to the Windows 2012 Domain Controller, which does not have a record of it. This points to an Active Directory synchronization problem between that domain controller and the rest of your domain controllers. How is the user able to log into the Windows 7 machine ...


4

I'm going to differ with Tim's answer and say that you ought to look at solving your problem by figuring out why your intended GPO settings aren't working, not by "restructuring" your current setup. Restructuring your current setup isn't going to solve your problem if you're configuring the wrong GPO to begin with. With the exception of a few additional ...


3

You could do this: $fileName = (Get-Date -Format ddMMyyyy) + ".txt" $location = "C:\All_Local_Admins\" New-Item -ItemType file -Name $fileName -Path $location And replace your out-file with this: out-file -append -FilePath (Join-Path $location $fileName)


3

The _msdcs.company.local zone is the one being used for lookups, since it's more specific - the copies in the company.local zone are not being used to answer queries (which you can verify by making a change there and checking the response) and can be safely dumped.


3

I think your plan is flawed. From my point of view, the "right" thing to do is: Put a Firewall in front of all of this Put a Router in front of all of this (can be the same as the FW, depends of course) Have all Servers as "internal", you can still segregate them into multiple networks of course Disable/Rip out the secondary NIC if you don't need the ...


3

Ok, no additional installs, I get it. The following is horrible, horrible, and I would suggest there must be a better way [use the AD module!] to do it. I didn't feel like writing this in batch just now, so here it is. Note there isn't even a hint of i18n, error handling or anything "sane" here. # Powershell $result = net group /domain "SomeGroup" ...


3

If you use ADSIEdit, connect to the Default Naming Context. DC=Domain > CN=System > CN=File Replication Service > CN=Domain System Volume (SYSVOL Share) The nTFRSMember references are under that location, and each has an attribute "serverReference".


3

Checking the Kerberos AES checkboxes for the users would cause authentication failures on pre-Vista clients. This is probably the reason that it's not set by default. The Kerberos AES support checkboxes correspond to the value set in an attribute called msDS-SupportedEncryptionTypes To change this for more than one user, you can utilize PowerShell and the ...


2

You can delegate control of this attribute by using the Delegate Control wizard in Active Directory Users and Computers. Right-click the OU containing the user accounts you want to delegate control of; select delegate control. Click Next at the "Welcome to the Delegation of Control Wizard" dialog. Enter the groups or users you would like to grant these ...


2

I have read about ADMT but doesnt work on 2012 and 2008 as far as i can tell.... any suggestions? This is no longer the case. You can install the latest ADMT 3.2 and PES 3.1 bits on 2012 and 2012 R2 as well as migrating to 2012/2012 R2 based domains with it. This is your tool of choice. That said, as @voretaq7 has pointed out, you seem to have larger ...


2

It looks like you want an easy way to find which user is logged into what machine so that when they call into helpdesk, you don't have to ask for their computer name. One easy solution is to create a login script (pushed out by GPO) which contains the following: ifconfig /all >> \\server\share$\%username%.txt Share$ needs to have write and modify ...


2

I had the same problem and solved it with the following recommendation: http://www.msprojectnow.com/Blog/tabid/142/entryid/752/Project-Server-2013-Active-Directory-Synchronization-Issues-and-Resolution.aspx "Make sure the PWA url you are accessing is Alternate Access Mapping default zone. For me it was in custom zone and it started working as soon as I ...


2

Manually editing DNS entries to try to get the local DC to talk to the remote one didn't work at all. All my replication links disappeared. So I'm just going to go with the assumption that the VPN will stay alive and the local DC knows nothing about the remote DC's public IP. It only converses over the VPN IP. I'll try to log in and check that it's still ...


2

This should get you started. Foreach($Policy In Get-ChildItem \\$((Get-ADDomain).DNSRoot)\sysvol\$((Get-ADDomain).DNSRoot)\Policies) { Get-GPO -Guid $Policy.Name | Select * # Now you have an individual GPO. Do something useful with it. # # DisplayName : Terminate Idle and Disconnected RDP Sessions # DomainName : ...


2

Assuming that your AD DNS infrastructure was implemented with Windows Server 2008 or Windows Server 2008 R2, and not a hold out from Windows Server 2000 or 2003, then the _msdcs.company.local sub-domain that you're referring to is a delegated zone. You shouldn't actually see anything in the sub-domain except for an NS record for the DC/DNS server that the ...


2

You're looking for Group Policy Loopback Processing. This ensures that the User Settings of a policy applied to a computer is applied to the user account logging on, even if that policy does not directly apply to the user account in question. Combine this with security filtering to ensure that only the members of the AD group that you want to get the ...


2

You may have to troubleshoot a little further. Are you able to backup other GPOs? Did you try using an alternative admin account? Can you create a test one and back that up? If you can, then I would check permission on the previous GPO where you are receiving the error. There is a powershell command you can use: Backup-Gpo -Name MYGPO -Path ...


2

Per my reading of it, no. It's like Password Policy - it's defined at the domain level. http://technet.microsoft.com/en-us/library/cc757692(v=ws.10).aspx#w2k3tr_sepol_accou_set_hpjo The policy settings under Account Policies are implemented at the domain level. Fine-grained password policies can't be used for this, because they don't include Kerberos ...


2

We occasionally get questions about how one can selectively look up DNS domains at the client level, but it's simply not the job of the client to do that. Resolver libraries are dumb by design and expect the upstream recursor to do the heavy lifting for them. The only way to solve this problem at the client level is for the client itself to operate a DNS ...


2

In my understanding, the current proper method for doing this is to have an Exchange 2010 server onsite. The 0365 account licenses you for a single server instance; this integrates with AD (populating all of the proper Exchange attributes) and then you federate with your O365 instance. Point 3 is not a problem at all.


2

1) The attributes for provisioning email addresses in O365 are Mail and ProxyAddresses. Populate the ProxyAddresses with SMTP:primaryemail@domain.com smtp:additionalemail@domain.com etc 2) I believe you need to populate Mail and ProxyAddresses 3) Not a problem. However, we prefer to add the email domain as a UPN suffix and set the users' UPN to match ...


2

DirectAccess would be ideal for you, but requires a certain amount of infrastructure at HQ. First, I would set up site-to-site VPN links from every site to HQ. No money for fancy network equipment? That's absolutely fine, as an IPSEC site-to-site VPN is not a fancy or demanding endeavour, you can do it with whatever SOHO routers take your fancy (we use ...


1

Yes, you can use the Meta backend for OpenLDAP to create a unified view of two directories. This article by user @larsks details the configuration.



Only top voted, non community-wiki answers of a minimum length are eligible