# Tag Info

10

You might be surprised by the response that you get from Microsoft support, since this problem seems to not be so much about supporting Server 2003, as it is about a roadblock that's preventing you from moving to 2012 R2. At least, you should spin it that way. I am also almost sure that this is due to schema customization. It's usually by 3rd party ...

8

Maybe you're asking the wrong question. Instead of trying to disable a bunch of local user accounts on a bunch of different computers, perhaps instead you should use Restricted Groups in Group Policy to define exactly who is allowed to be a member of the Administrators group on the computers. It will strip out all accounts who are in the local Administrators ...

7

The Administrator account was not renamed. The reason you see Administrator.ZARRAFE is that you have logged on with the local Administrator first and then with the domain Administrator. Since they cannot share the same profile folder, because they are different accounts, the operating system will append a suffix (the domain name the account belongs to) to ...

5

I'm guessing you've a 32 bit install of Perl on a 64 bit OS. There isn't a 32 bit version of dsquery.exe in C:\Windows\SysWOW64\ on Windows 10 AMD64. From the 'Run' dialog compare the results of the following. With 32 bit cmd: C:\Windows\SysWOW64\cmd.exe /K C:\windows\system32\dsquery.exe Then explicitly using 64 bit cmd: C:\Windows\System32\cmd.exe /K ...

5

Group membership changes are not classified for urgent replication so it is normal to see the delay. Maybe you can use the -Server switch to point to the same DC that you are viewing in ADUC and you will be able to view the change instantly.

5

There is a wealth of public information on how the DC Locator process works. Essentially it performs a series of DNS lookups and LDAP pings, and also attempts to stratify the results by selecting the closest domain controller. It's unusual for Windows DC Locator to continue to use a failed domain controller, unless the domain controller is passing the ...

4

Technically, this means you can't resolve DNS names for the external domain from inside your network, because your AD DNS servers will assume (correctly) they are authoritative for that zone, and so they will never query the public DNS servers which actually manage that domain; if you need to resolve names such as www.companyint.com from your internal ...

3

The servers DNS needs to point to itself, and the clients DNS needs to point to the server. Servers DNS should be 10.0.0.5 (or 127.0.0.1) Clients DNS should be 10.0.0.5

3

It sounds like it's the domain SID. Essentially the SID of the domain itself. https://msdn.microsoft.com/en-au/library/cc228090.aspx domain security identifier (domain SID): The SID of the root object of a domain NC. The relative identifier (RID) portion of the domain SID is always zero. Every security principal object in a domain NC has an ...

3

After a user account object is deleted, the SID will be removed from all groups the object was a member of. That is the reason why I personally prefer to disable user accounts, instead of deleting them. However, if you enabled the Active-Directory Recycle Bin feature, you will be able to restore the user account object and all group membership information ...

3

Here's the general idea: Run get-aduser to enumerate the accounts that you want. Maybe use a filter to get only accounts with an OfficeNumber. Save this result to a variable. $users for example. Use a foreach($user in $users) block to loop through the list of users. Inside of that foreach block, grab the Officenumber, prepend your 1-800 number, and save ... 2 Most likely you cannot : the typical situation is that your server is on a private subnet behind the firewall, and any outbound traffic to the Internet (such as a "What's My IP" site) is NATed on the firewall to the latter's public IP Address. The website has no way of knowing what your server's original IP was. 2 If the problem is in NIC teaming initialization, I'd suggest adding a dependency on whatever service is responsible for it; there probably is a service installed by your NIC drivers which handles NIC teaming. Another guess would be the netlogon service, which handles domain membership and authentication; I suspect it can start fine even if networking is not ... 2 After digging a little deeper from this article here I was able to figure it out. Here is what I came up with.$domain = $env:USERDOMAIN$uddn = "cn=user-display,cn=409,cn=displayspecifiers,cn=configuration,dc=$domain,dc=com"$ud = [ADSI]"LDAP:// $uddn "$ud.Put("createDialog","%<sn>, %<givenName>") $ud.SetInfo() 2 This is because it is a multivalued attribute try the following date = (Get-Date).AddDays(-7) Get-ADUser -Filter * -Properties * |where {$_.whenCreated -ge $date } | select Name, @{name=”MemberOf”;expression={$_.memberof -join “;”}}, whenCreated, DisplayName, Surname, EmployeeID, mail| ConvertTo-Html | Out-File D:\test.html

2

The answer to your question is not related to DNS. When you create an Active Directory domain, amongst other things, you need to specify the domain name and the domain NetBIOS name. The domain name is the FQDN of your domain (acme.local). The domain NetBIOS name is by default (and usually never changed) the first part of your FQDN (acme) and also referred ...

2

https://technet.microsoft.com/en-us/library/dd835564%28v=ws.10%29.aspx Enable the GPO where the Registry Key is "EnableLua" to only use this for Windows 10, add the following wmi filter to your GPO but attention! - the wmi filter is for the whole GP, not just for EnableLua! So if you put a WMI filter into your GroupPolicy Object, only windows versions ...

2

You can't check anything at all after a user account is deleted, because then AD no longer has any information about it; your only option is to check group membership (or any other info you might need) before deleting the user account.

2

Check this https://technet.microsoft.com/en-us/library/ee617261.aspx.... There is -Oldpassword param which along with -Newpassword param can achieve this. Remember if you are not a Domain Admin then you need to know the old pwd to do this. Plus when you use the -Oldpassword param ,dont use -reset param.

2

if the thing you want to do doesn't require a restart, sure. Check this: https://technet.microsoft.com/en-us/library/dd851779.aspx It's an instruction how to set up an immedaite task via AD (only for windows server 2008 and newer, not server 2003 though - you'll need to update ;-) - many things that make your life a LOT easier you cannot get on Win Serv ...

2

To perform a powershell search of all users with the msExchRecipientTypeDetails equal to 2, the following should get you started Import-module ActiveDirectory get-aduser -filter 'name -like "*" -properties * | where{\$_.msExchRecipientTypeDetails -eq 2} | select distinguishedname,msExchRecipientTypedetails | Export-csv LinkedMailboxes.csv You might want to ...

2

PwdLastSet is a restricted attribute that cannot be set manually or individually. Only domain controllers can update that attribute when the user changes their password.Sounds like MS designed ADSync to work this way for accounts with the "must change" flag set. https://support.microsoft.com/en-us/kb/2853347 When you reset the user's password, make sure ...

2

You definitely need a static IP address for the DHCP server, period; it just wouldn't work any other way. You also need a static IP adddress for the physical server, because of course it starts before any VM and so it would be unable to contact the DHCP server upon starting. So, you have two servers, and both of them need static IP addressing. End of the ...

1

Steps to move Exchange 2010 servers to the new AD Site: Open the AD Sites & Services console and select the Subnets folder. Right click the Subnets folder and select New Subnet. Add the individual IP addresses of the Exchange 2010 servers with a /32 prefix. Assign the IP addresses to the RTL AD site. Add the individual IP addresses of the Exchange ...

1

Although I change the minimum password age in the password policy but I still had to change the minimum password age to 0:00:00 in the ADSI Editor for the DC i'm in. @JimB and @Craig620, your help is greatly appreciated.

1

Domain controllers ignore password, lockout, or Kerberos policy settings defined at an organizational unit, such as the Domain Controllers OU. You should define legacy password policies in the Default Domain Policy or another top-level GPO. As a test I created password policy settings in both the Default Domain Policy and Default Domain Controllers ...

1

This is the document you are looking for: Active Directory and Active Directory Domain Services Port Requirements Default dynamic port range In a domain that consists of Windows Server® 2003–based domain controllers, the default dynamic port range is 1025 through 5000. Windows Server 2008 R2 and Windows Server 2008, in compliance with Internet ...

1

Every Windows O.S. starting with Windows 2000 will be able to authenticate against any Active Directory domain controller; you can only have issues if you still have NT 4.0 systems lingering around, because they only support old-style NTLM authentication which is not in use anymore on recent DCs. That said, you really shouldn't keep Windows 2000 systems ...

1

I copied the old policy to a new name and unlinked the default policy. You link disabled the Default Domain Policy? Not a best practice, not recommended, probably not even supported. Would explain why it is missing from RSOP and your erratic results. You may want to use the DCGPOFix tool to repair the DDP. ...

1

Use the Net command in your logon script. Example: NET USE P: \\dfsroot\path\to\folder The GPO for drive maps is at User Configuration/Preferences/Windows Settings/Drive maps

Only top voted, non community-wiki answers of a minimum length are eligible