Tag Info

Hot answers tagged

7

Add the specified machines to an Active Directory Security Group and add the Group to the GPO with a "Deny" for "Apply Policy" (Don't fall for doing a full deny as it will stop the GPO name from enumerating, making troubleshooting difficult). Then, add the machines to that Group as required.


6

I've always understood SBS to be the "Windows Server for small businesses when you don't have an IT department but want an all in one server". SBS makes sense in some shops, not so much in others. If you want to be 100% Microsoft, have no desire to go to the cloud yet, and have fewer than 25 employees, then it could make sense for your company. While ...


5

Simply use the "Apply to All users except local administrators" setting in the Software Restriction Policies Enforcement... you don't let all your users run as Administrator... do you??? As an alternative, perhaps you could define the Software Restriction Policies in the User Configuration portion of the GPO, then use Security Filtering to allow that GPO ...


4

It adds support for the new ms-DS-Member-Transitive (LDAP display name msds-memberTransitive) schema attribute. This attribute contains the contents of the Member attribute for the object and all the Member attributes of those objects in the Member attribute (and objects specified in their Member attribute). Basically, it contains the fully-expanded group ...


3

The idle time shown in your screenshots can indicate user inactivity. If the user were to leave a program that periodically accesses the file server this number wouldn't indicate time where a user is not present providing input to the computer. One quick-and-dirty idea comes to mind: Use the creation time of a screensaver process Assuming the user is ...


3

I generally include the full subnet in the scope and exclude addresses as needed. 80% seems a little extreme, but for a small set of users, it's not unheard of. It's not required though and SBS will work just fine with a larger pool or a smaller scope. OU's are an organization thing - I've seen many places that don't seem to know how to properly use them ...


3

It's not recommended at all to do it the way that you are asking about, especially if there is a chance that machines from either domain will ever have network connectivity to each other again. There's some operational and security risk for this plan. That said, it's possible to go with your plan, pretty much exactly as you described. Assuming that AD is ...


3

Powershell Active Directory Web Services. Comes with all Domain Controllers 2008 R2 or better by default. # This foreach loop enumerates through all members of the AAA group. Foreach ($Usr In Get-ADGroupMember -Identity 'CN=AAA,CN=Users,DC=Contoso,DC=com') { # If the 'MemberOf' array of $Usr's group memberships contains 'BBB', then... If ...


2

"ou=users" is not sufficient. You have to supply the full distinguished name of the OU you want the new account to be created in. It's also incorrect if you're talking about the Users container at the base of the domain, which is not an OU, but a container. Here are some examples. CN=Users,DC=domain,DC=com OU=MyOU,DC=domain,DC=com ...


1

According to MS: Windows 2000 .. sends option 81 and its fully qualified domain name to the DHCP server and requests the DHCP server to register a pointer resource record (PTR RR) on its behalf. The dynamic update client registers an address resource record (A RR). .. the DHCP server can be configured to instruct the client to allow the server to ...


1

You can skin this cat a few different ways. From a domain member computer run the command net group /domain | clip and a list of all the Global and Universal Security Groups in the domain of the logged-on user. A net localgroup /domain | clip will give you all the Domain Local Security Groups. The legacy net command won't interact with the Global Catalog. ...


1

First off, don't use the Software Installation GPOs. They suck. Second off, make sure you have the proper "offline" Java installer. Then, create a startup script, and put it a GPO at \Computer configuration\Policies\Windows Settings\Scritps\Startup to install it. Must be a startup script, not a logon script, since startup scripts run under SYSTEM ...


1

We figured out that it was a replication issue across our two Domain Controllers and that our firewall was blocking DFSRS (Distributed File System Replication Service). That caused all sorts of subtle things to break in our environment.


1

To answer your second question first: Since you're still using NTLM, reading about the flow of NTLM in a multi-domain environment might help you out a bit with this. IIS will contact a Domain Controller (DC) in its domain, which will in turn contact a DC in the trusted domain. The trusting DC does a DNS lookup against the trusted domain's name and sends ...


1

$outfile = 'Groups.csv' $groups = Get-ADGroup -Filter * -SearchBase "OU=customOU,DC=panic,DC=org" foreach ($group in $groups) { Get-ADGroupMember -Identity $group | Select name, objectClass, @{Expression={$group.Name}; Label='Group'} | Export-CSV -Path $outfile -NoTypeInformation ` -Encoding ...



Only top voted, non community-wiki answers of a minimum length are eligible