Tag Info

Hot answers tagged

13

You should have your Small Business Server (Server Essentials) doing DHCP and DNS. SBS will automatically disable its DHCP service when it detects another DHCP server on the LAN. (You can verify this by checking the event logs, there will be DHCP errors, and the service will likely be stopped) Since your router is likely handing out the ISPs DNS, your ...


7

As a best practice, you should be running AD DS and AD-Integrated DNS zones (ADI zones) on the same server. This is because the DNS records in ADI zones are replicated using AD DS replication and are stored in the directory, rather than using things like a zone transfer to get records across multiple DNS servers. If you want to use ADI zones for your ...


6

There isn't built-in functionality in the product to do what you're looking for. Security groups don't have an ACL mechanism to control which members are added, only who can modify the membership. What you've got is an interesting conundrum. In the filesystem world Dynamic Access Control (DAC) could solve the problem you've got handily, but DAC-like boolean ...


6

Group membership is ascertained by the client at logon, hence the requirement for logging off and on again. You must log off and on to refresh group membership, if adding a user directly to a folder for permissions then when they browse to the share the client reads permissions and matches their GUID against the permissions you have set, their group ...


5

The name of the domain is not important. The cryptographic secrets behind the scenes that the computers and servers use to authenticate each other are what defines if they are in the "same" domain. When you create a new domain, all of those secrets are different. Otherwise, someone could just plug in their own server to the network and pretend to be your ...


4

What do you need to access from the domain controller? Since you have a firewall between member1 and the domain controller, you could block all access to dc1 and dc2, then put something like a read-only domain controller or a web front end on the outside of the firewall that member1 can access.


4

I'm not aware of a way to push cached credentials out, and that would mean the word "cached" was poorly chosen, if such a way existed. What about putting LogMeIn or any other remote control software on each computer before it goes out the door and having each user remotely log on to their machine before you send it out? In my experience, the best way to do ...


4

Q: Is there anyway I can move the active directory? A: No there isn't.


4

Do you have backups? (It sounds like the answer is no, but...) If so, restore the 2008 server (to a VM if necessary), add the 2012 machine as a second DC in the old domain, then demote and remove the 2008 server. Then raise the functional level of the domain on the 2012 DC. For more details on this process, see MSDN. This article might also help. I ...


3

Unfortunately, it doesn't work this way. The Exchange/Outlook/Lync ecosystem is an exception because it will download the thumbnailPhoto of other users from AD into the Outlook or Lync applications, but Windows doesn't. There exists no out-of-the-box mechanism that will download the pictures of all users in AD and store the images locally as profile images ...


3

Short answer: No. When a user (user A) has permission to change another user's (user B) password, they can set it to anything they want. This is effectively your scenario. There are reasons for this. For example, AD doesn't know that (in this case) user A and user B are in fact the same person. If it presented user A a message saying that the password they ...


3

This is not possible. If you join a domain, the domain is allowed to sign users into existence on your computer and apply GPOs to it. GPOs can cause software to be installed from the network and modify arbitrary registry entries. Using an RODC in the enclave will protect the domain from your enclave, but it will not protect the enclave from your domain. ...


3

I shall assume your problem box has these settings: IP = 192.168.10.36, default gateway = 192.168.10.1, DNS = 192.168.10.2 (otherwise adjust the numbers accordingly below). Now proceed as follows, using two boxes TEMPAD (with ip 192.168.11.100, say) and TEMPDNS (with 192.168.11.200, say): RDP to TEMPAD and install the AD role on TEMPAD On TEMPAD set a ...


3

Once a server is promoted to a DC (i.e the DC role is installed), the "default" administrator account you mention no longer exists. The Administrator account now exists in the domain. Any account created on the DC from now on will exist only on the domain. The DC no longer has the concept of "Local Users". The fundamental reason that a DC should have other ...


2

I'm not I can give a more qualified answer without seeing the sssd debug logs, but the bug report you're referring to only had performance implications, not functional. The reason you're able to su to the account from root is that the PAM stack normally includes pam_rootok.so module that bypasses authentication with pam_sss. Given the auth from root works, ...


2

You fix your connectivity to your domain's PDC Emulator. You can locate it by running netdom query fsmo. Once you know which server has the PDC Emulator role, you can check its health using dcdiag /v.


2

On linux you can use kvno command to retreive it from KDC [root@XXXX XXX]# kvno host/XXXX host/XXXX@TEST.COM: kvno = 13


2

Just a complementary solution to the accepted answer, as I ended up here more or less with the same need. The difference is one gets the level name decoded: Import-Module ActiveDirectory $ForestRoot = 'top.domain' (get-adforest -identity $ForestRoot).ForestMode (get-adforest -identity $ForestRoot).Domains | ForEach-Object {Get-ADDomain -Identity $_ | ft ...


2

$ADUser = Read-Host "Provide the AD User account" Get-ADPrincipalGroupMembership -Identity $ADUser | Sort-Object name | Format-Table -Expand name


2

You could attack this problem from another direction, by simply blocking all executables (exe, bat, ps1, etc.) from running on your DCs using either SRP or AppLocker, except those you approve beforehand. That way even if they do get access, they would be seriously hindered. But assuming someone does have Admin privileges, they can do anything they want to ...


2

Active Directory increments KVNO pursuant to RFC 4120. Microsoft documented their implementation of it in the document MS-KILE section 3.1.5.8. Active Directory essentially ignores KVNO. (Except on Read-Only DCs - if an RODC is compromised, the keys it holds can not be reused against another DC.) So my point is AD generally doesn't care what your KVNO is - ...


2

Why can't we link GPO to an AD container? Primarily because a container object lacks the necessary gpLink and gpOptions attributes required to link a group policy object to it. Active Directory uses an LDAP database, and in that LDAP database are different kinds of objects and a hierarchy of inheritances such that certain objects can inherit attributes ...


2

Nothing to do with WSUS. You're probably seeing this due to you have View > Advanced selected. InfrastructureUpdate object holds the infrastructure master for the domain. Infrastructure-Update class https://msdn.microsoft.com/en-us/library/ms682283%28v=vs.85%29.aspx


2

It's impossible, at this moment, to install Exchange Server on a Samba 4 Domain Controller. But in the future the SAMBA guys intend to support Exchange Server, but it's a lot of work to do. You can check the status of Exchange Support through the SAMBA4 Wiki: https://wiki.samba.org/index.php/Samba/Status And at this moment Exchange Server is described ...


2

That means the setting was Enabled at one time, then changed to Not Configured. You will need to change the setting to Disabled to revert back. You may also want to enable the setting: Administrative Templates > System > Group Policy Security Policy Processing: Process even if the group policy objects have not changed And do the same for ...


2

If the server is connected to a port on the router and you turn off the router, how would you expect the workstations to communicate with the server? You should connect the server to the same switch as the workstations.


2

NPS as Radius server uses the Active Directory to perform authentication. When using PEAP (MSCHAPv2), the client sends the radius server a hash of its password. This hash is eventually compared to the contents of the directory (no decryption here). You could consider NPS as some sort of passthrough here. I can't see why communication between both couldn't ...


2

I suspect that the problem is due to Enhanced Session Mode being enabled. When so, I'm pretty sure that the Virtual Machine Connection console uses RDP to connect to the VM, which requires the connecting user to be a member of the local Remote Desktop Users group, the local Administrators group or to have the appropriate user rights and RDP protocol ...


1

No, having AD recycle bin enabled does not prevent LDP from showing you the tombstoned (deleted) object. I have verified this just a few minutes ago. I have AD recycle bin enabled and was able to find my deleted object in AD Admin center and via the LDP tool. The tool can be used only if the Deleted object is under tombstoned life. If the deleted ...


1

When working with a workgroup rather than a domain setup, you will have to make sure that each user is added on each machine in the workgroup, or alternatively create one general user, add it to each computer and use it, otherwise a user on a certain machine will not be recognized by another machine unless the user is also added there. I believe you are ...



Only top voted, non community-wiki answers of a minimum length are eligible