Tag Info

Hot answers tagged

9

Because Get-ADObject does not retrieve all attributes by default: The Get-ADObject cmdlet returns a default set of ADObject property values. To retrieve additional ADObject properties, use the Properties parameter of the cmdlet. The objectGUID property has a value because it's part of the default property set You can specify additional properties ...


7

Not quite. Every DC/DNS server hosting AD-integrated zones should contain '127.0.0.1' in its list of DNS servers, but only as the last entry. Ideally, you want the "Preferred DNS" to be a different DC in the same site, followed by a different DC in a different site if possible, and then localhost at the end of the list. In your case where you only have 1 ...


5

To retrieve only the members that are users, and not groups: foreach($group in $groups) { Get-ADGroupMember $group | Where-Object {$_.objectClass -eq "user"} } If you want users who are members of the groups indirectly (through nested group memberships), user the -Recursive switch parameter: foreach($group in $groups) { Get-ADGroupMember $group ...


5

I assume you're using DHCP, right? Use DHCP to specify the default gateway and DNS servers. You can even use DHCP on your DC and keep it all in one place. DNS should be provided by the domain controller(s). They can forward unknown requests to your ISP's DNS servers.


5

Explicit deny permissions always take precedence over explicit or inherited grant permissions, so, yes, a deny will do what you ask; however, an user with effective administrative rights will be able to forcibly change those permissions by taking ownership of objects and resetting ACLs, so a deny will only block an administrative user as long as he/she ...


4

Try this: foreach ($group in $groups) { Get-ADGroupMember $group | select Name } Get-ADUser is looking for an Active Directory User object, what you're essentially trying to do is use that cmdlet on an Active Directory Group object.


4

One notable difference in Windows Server 2012 R2 is the performance optimization of complex LDAP queries, however this has been back ported to Windows 2008 R2. You can read about it here: https://technet.microsoft.com/library/dn535775.aspx#BKMK_LDAPQuery There are Directory Service Event Log id's 1633/1644 for logging LDAP query performance, and you ...


4

The answer is yes, and there's no conflicting information. Any person, article or resource that claims this doesn't occur is just plain wrong. The linked article explains the process. This has not changed from Windows 2000 and carries forward all the way through Windows Server 2012 R2. Make note of these sections: The transfer of an FSMO role is the ...


4

You clearly have 5 sites there, so that eliminates option 1. Sites don't necessarily have to correspond to geography, but in reality it practically always works out that way. There is no connectivity between several of the sites. I.e., the network is not fully meshed. That means you have to unbridge all site links and create specific site links, so that ...


4

Yes you can install and use with no reboot required. Install-WindowsFeature RSAT-AD-PowerShell Also I want to be clear that this is only for installing the Powershell module. Not all of Active Directory in its entirety. Installing Active Directory is an entirely different thing.


3

RSOP support has been deprecated. According to http://deployhappiness.com/gpresult-or-rsop/ "Beginning with Windows Vista SP1, Microsoft made the GPResult command the primary tool for troubleshooting Group Policy on a client." Basically, to ensure that you are getting the full result of policies on the machine, you need to use GPResult instead of ...


3

Active Directory (past Windows 2000) does not allow anonymous operations other than rootDSE searches, by default. So, if you are able to bind anonymously to Active Directory, that means one of two things. Either You are connecting to RootDSE, for which anonymous binds should be allowed by design. You have already modified Active Directory to allow ...


3

The security risk of a domain trust are that your environment is compromised it could be possible to use sidhistory for privilege escalation. Most secure is cross forest trust as that allows for the secure transmission of foreign security principles (and more importantly they are identified as foreign). You can also use selective authentication to ensure ...


3

Your vendor would not have access resources in your forest with a one-way trust, so the risk to your environment is somewhat minimized on ad AD functional level. On a network level, there are a truckload of ports that need to be opened between your domain controllers and the vendors domain controllers. If their domain controllers or application servers ...


3

You can find a list of the new Active Directory features in Windows Server 2012 here; and here is a corresponding list for Windows Server 2012 R2.


3

I'm going to make several points here. Some are related to your specific question and some are general information about AD DNS. The default behavior for DNS in an AD domain is for the _msdcs zone to be set to Ad-integrated and replicated to all DNS servers in the Forest. This means that all DNS servers in the Forest will hold a copy of this zone. The ...


3

Creating a single, clustered Domain Controller isn't creating highly available AD services. It's creating a highly available VM, regardless of the services that VM is serving. If you lose the VM (OS failure, data corruption, etc.) then you've lost the services that VM was serving, so those services were not highly available to begin with. Don't confuse a ...


3

Running certutil -pulse before gpupdate made the workstation re-install the certificates.


3

This actually is fairly common in larger environments where there may be a separate domain or forest for administrative accounts. In that case, you definitely cannot add them to Domain Admins and you probably don't want everyone in Enterprise Admins. Paul Williams had a good article documenting the various objects and the permissions required. ...


3

Your self-posted answer is incorrect. That is how you remove the metadata for a failed domain controller, not an orphaned child domain. This Microsoft support article details the steps to do this correctly: https://support.microsoft.com/en-us/kb/230306/en-us Essentially, you use use ntdsutil with different options than the article that you linked to. This ...


3

Basically, nevermind if your are using DHCP or not. Using a single DC in your domain, you have to make it a DNS Server also. Install and configure DNS role on your Domain Controller. Then configure your clients' DNS to point to the IP Address of your DC. The most important thing is that you have to setup your DNS Server to forward unknown names queries to ...


3

Unless you have your auditing policies set up to audit Success events in the User Account Management subcategory (or just Account Management events, if using legacy auditing) and you actually have Security Logs that has data stretching back far enough on your DC's, you won't be able to tell. You'll want to search for events with Event ID 4723 (Password ...


3

Try rename field in csv from mail to EmailAddress New-ADUser accepts a property of EmailAddress, but not mail. Some of these correspond to an AD attribute, but not all. New-ADUser https://technet.microsoft.com/en-us/library/ee617253.aspx


2

Double check DNs you provided in the command line. Assuming the statements we read was exactly what you used, the group belongs to a domain called "ou.ad3.ucdavis.edu", while the user belongs to "ad3.ucdavis.edu". Not that you can't add foreign user into your group (as long as it's domain local), but it looks more like you had a typo. Read the user into a ...


2

Why are you using deny ACEs? You should be doing something like this: Root of the share (Authenticated Users - Read - This Folder Only) | | ----Subfolder1 (Subfolder1 Users - Read/Write - This folder and Subfolders) | | ----Subfolder2 (Subfolder2 Users - Read/Write - This folder and Subfolders) And so on. You should not be using deny ACEs regularly. In ...


2

If there is a jake user on each domain with the same password, jake from one domain will be able to access shares on the other domain because the password is the same. It works like this: If jake@domain1 is accessing resources in domain1, a password is not sent to the system hosting the resource because jake got a security token when he logged in to the ...


2

Check the simple things first. Make sure the times match on all the computers (They should since it is Hyper-V, but it's a quick thing to check). Kerberos authentication can fail if they don't, and a failed login by the computer could be sending the trust message when trust isn't really the issue. Also, make sure the DNS servers specified in the host IP ...


2

Not sure if you are legitimately asking for help or asking for somebody to do your homework. I'll get you started by telling you the commands you need. If your CSV file has a column labeled usernames... [load the AD module here] $userlist = Import-Csv [supply options here] foreach ($user in $userlist.usernames) { $userObj = Get-ADUser $user -prop * ...


2

The generally accepted practices are: Use a login banner. This would have to be somewhat concise, but the user cannot login until they click "OK". The legal enforceability of this (or any popup) may vary by jurisdiction. Make them sign the Acceptable Use Policy before they're given their username/password. This is highly enforceable, since it's basically ...


2

This is not at all what Group Policy is designed to do. I think the closest thing to what you are asking for is Network Access Control / Network Admission Control / 802.1x. These solutions are vendor-specific. Microsoft has one, Cisco has one... other vendors do too. You can do neat things like put the user in a "quarantine network" unless that user has a ...



Only top voted, non community-wiki answers of a minimum length are eligible