Tag Info

Hot answers tagged

16

One rationale for retaining one physical DC per domain is if there is a major incident that affects the host or trashes the frame storage for the virtualized DC's, you would have at least one physical DC with local storage to perform recovery and maintain continuity. Microsoft continues to perform this check and make this recommendation during Active ...


8

What's the question? The first one is the user logon name. The second one is the pre-Windows 2000 user logon name. The third one is the User Principal Name. All three are valid and exist by default for every user account. All three can be used to log in to the domain. You don't have to assign them at all. Based on your edit, when you created the UPN did ...


8

You should use TCP ports 389 and/or 636. Port 636 is for LDAPS, which is LDAP over SSL. Encryption on port 389 is also possible using the STARTTLS mechanism, but in that case you should explicitly verify that encryption is being done. Microsoft's KB article says: Start TLS extended request LDAPS communication occurs over port TCP 636. LDAPS ...


7

I too wouldn't make the Hyper-V host a DC. As for whether or not you should have a physical DC, my opinion is that with the changes Microsoft has implemented regarding virtualized Domain Controllers in general and DC-less cluster bootstrapping specifically, I don't personally see the need for, nor do I advocate having a physical DC. Maintaining a physical ...


6

Greg's answer is alright, but your question specifically states that you want to check this from the client, not from the domain controller. So I'll take a crack at it. First way, enable Kerberos logging on your client: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters LogLevel DWORD 0x1 Once Kerberos logging is enabled, ...


5

Office 365 for non-profits: MS Corporate Citizenship page. There's a free tier if you qualify, which might just meet your needs entirely. Otherwise the paid options should be significantly discounted. At only a handful of users, the subscription model should be easy to swallow. I like where you're going with managing mail contacts (Exchange term) for ...


5

This is probably nothing to worry about - this will occur when the original local profile folder doesn't unload or is otherwise corrupted. Basically, the first profile will be C:\Users\username If there's an issue with the username folder, it'll append the domain name: C:\Users\username.domain If there's an issue with the username.domain folder, it'll ...


5

You mention client-facing systems. This to me means your first priority is uptime on the systems that make you money. Networking and storage sound like #1 and #2. (Edit:) Oh, and resiliency. Get your backups checked out, in-line and tested. Make sure you can restore them! Prioritize internal network and AD next, you need a solid foundation. Based on ...


5

You can specify the managedBy attribute, and check the box for "Manager can update membership list". (This grants write permission for the Member attribute.) The person(s) who need to edit the group may be able to do it with the DSQuery widget, for which you can create the following shortcut: rundll32 dsquery,OpenQueryWindow They can search for the ...


5

I feel like you're looking for a one line answer, so here it is: You should have a physical DC if you do not trust your virtual environment's ability to withstand failure. We could wax on about the peculiarities and exceptions with each scenario, but I think this strikes the root of the question.


5

Okay, i resolved it myself. For future google-users, here's the solution: Open AD FS Management Center -> Trust Relationsships -> Relying Party Trusts -> Right click the requried trust -> Edit Claim Rules -> Issuance Authorization Rules -> Delete "All" Rule -> Add Rule "Permit or Deny User Based on an Incoming Claim" -> Incoming Claim Type: Group SID -> ...


4

Looks like I'm running into (a variant of?) this issue: the promotion completes successfully if I use "long" logon credentials, i.e. A0.lab\AdmA0 instead of A0\AdmA0. However, based on the article, this issue should only happen if NetBIOS over TCP/IP is disabled, but it's actually enabled, and this can be verified in the ipconfig output. I also tried ...


4

A Powershell Remoting/WinRM session is a network logon. So if you want to prevent that user from logging in to a computer interactively, deny him or her the ability to log on to the console and deny the ability to log on through Remote Desktop. Do this through either the local security policy, or through Group Policy if the computer is in a domain. This ...


4

In addition to denying interactive logons, you might want to restrict the remote users access to a remote endpoint that exposes a constrained runspace. Essentially, you configure an endpoint on the remote system that when connected to, removes all cmdlets from the session and exports only the cmdlets you've white-listed. This also allows you to expose proxy ...


4

The Microsoft best practice for time keeping in a Windows domain is to configure the domain controller holding the PDC emulator role to get its time from a reliable source. By default, the rest of the machines in the domain will automatically sync up with the PDC emulator, either directly or second hand (or third hand, etc.).


4

.local was never a good idea and was never recommended. I'd be suspect of the other material in that book. In the vast majority of situations, your question doesn't matter because multiple domain forests are almost never necessary anymore. You need a new forest when you need a security boundary. A forest is a security boundary. If you require isolation ...


3

One way would be to check the domain controller Security event log for Event Id 4264 (logon) events, where the AuthenticationPackageName is NTLM or Kerberos. You should also verify that your domain controllers have auditing enabled, and are capturing the required auditing events. You can create custom Event Viewer filters to make this easier, and filter ...


3

As long as it LDAP auth only (and not AD/Kerberos etc.), 389 should be sufficient.


3

Let's take clusters out the equation and focus on the one line in your question that makes me shudder. Should I still be considering having a physical DC along-side my single, non-clustered 2012/2012R2 Hyper-V host that has a single virtualised DC on it? Why, why, why, would you want a single DC? In any given environment we try to avoid having single ...


3

As stated above, this is a question with a multitude of very long answer. So, I'll try to keep very short: backup: with no backup, if something breaks you really have a change of going out of business storage: check that your storage servers (and their disks) are in good healt networking: a careful policy audit should not take too much time (about 1-2 ...


3

There's only one best practice solution here: you need an additional Domain Controller with the Active Directory DNS service installed. You should then configure a forwarder within DNS to use whatever your preferred provider is. You then have full full redunancy for Active Directory and DNS. You should then configure your clients (Through DHCP ideally) to ...


3

Making changes to the firewall is probably the correctest answer. Multi-homing a DC is always problematic, and IIRC not support by Microsoft.


3

So I am sure you found the SYSVOL folder (where Group Policy files are stored) at \\my.dom.com. By default that is replicated between all DC's in the domain ('08 uses via DFSR [Distributed File System Replication] & '03 uses FSR [File Replication Service]) so clients can query the domain \\my.dom.com & whichever DC is closet responds I speculate ...


3

Your staff OU looks good, but you may want to put it inside an OU called users. this way you can have: ou=users ou=staff ou=contractors ou=service-accounts but this is all personal preference. for your hardware, you might want to consider grouping by type, so: ou=servers ou=cctv ou=client-machines ou=pc ou=accounting ou=mac ou=desktop ...


3

In general, I would never make a domain controller internet-accessible. If it was me, I would create a site-to-AWS VPN. AWS supports VPN connectivity to most industry standard stuff (Juniper, Cisco, many others). In the VPC dashboard: Create an AWS virtual private gateway Define your customer (on-site) gateway Create a VPN connection to associate the ...


3

A user account by default has read access to most other objects and their attributes in AD. You can minimize access by assigning a long random password, and creating a special security group for those accounts. In the Default Domain Policy, assign that group the following Windows rights located at Computer Configuration > Policies > Windows Settings > ...


2

The reason that you are being told to have redundant domain controllers is primarily for fault tolerance. There are a myriad of other benefits for having redundant domain controllers but being able to have the services offered by the domain controller stay up, always, can be very important to you moving forward. Regarding the multi domain advertisement ...


2

Yes, you can run AD all the way back to Windows Server 2003 functional level with all-Win2k12 R2 servers. https://technet.microsoft.com/en-us/library/understanding-active-directory-functional-levels(v=ws.10).aspx Whether your application requires the AD be at a functional level, or actually requires the DCs be no newer than 2008 R2, is for you to clarify.


2

Authenticated Users includes computer accounts. If you want the GPO to apply to only specific computers then remove Authenticated Users from the Security Filtering and add the specific computer object to the Security Filtering (or better yet, a security group containing the computer object).


2

We're heading down a similar path ourselves. I have not tested this answer yet, but according to the following page PowerShell via cfn-init cannot do what you're asking... but the SysInternals PsExec.exe utility can: Installing a Windows role as another user Hope this helps, Ant.



Only top voted, non community-wiki answers of a minimum length are eligible