Hot answers tagged

9

If you only have a single domain and all of your domain controllers are global catalogs, there isn't much impact. Best practice is all domain controllers should be GC's. In large forests with multiple domains, it can be advantageous to limit what groups are universal. This is due to the member attribute of universal groups are replicated to the global ...


4

If you are using legacy password policies, those apply to the entire domain. You may want to research fine-grained password policies.


3

When you attempt to boot from the drive and the TPM doesn't have the key, BitLocker will prompt you to enter the recovery key. You then look it up in Active Directory and type it in. If you hook up the drive as a secondary drive, then when you open it in Explorer, it will ask you for the recovery key.


2

Try installing and running msktutil (it is available through EPEL). To install: yum -y --enablerepo=epel install msktutil To run it: msktutil --auto-update --server my-ad --verbose And run a kinit after that: kinit -k server-new$ Also, You should cron these two jobs to run every 6 hours or so. That way your tickets do not expire. Answer to EDIT4: ...


2

Yes, you can set up IPsec policies based on computer group membership or IPs. Depending on your AD version and clients, you could also use authentication silos.


2

According to Microsoft TechNet, you don't want to add the user to the Remote Management Users group. You want to add the user to the WinRMRemoteWMIUsers_ Group. WinRMRemoteWMIUsers_ Group will give the user the ability to run remote PowerShell commands. Remote Management Users Group is for managing the server using Server Manager.


2

I have very little experience with IIS, but this looks like what you want: http://www.iis.net/learn/manage/managing-your-configuration-settings/shared-configuration_264 This one is more recent: https://technet.microsoft.com/en-us/library/jj129390(v=ws.11).aspx


1

I wouldn't use the security tab direct, Instead Right click the OU and use the delegation of control wizard. Through there you can delegate the right to create, delete and manage user accounts or if you only want to give someone the ability to create use accounts, choose to create a custom task and then only assign the right to create user accounts. As for ...


1

Those descriptions are a bit vague. There are two tokens. A process Access Token, and a Kerberos token. The process token is specific to the local computer. "In Windows implementation, the application server derives the authorization data (PAC) and requests Windows OS to generate an access token." https://blogs.msdn.microsoft.com/openspecification/...


1

Create a zone for the name that you want to resolve. For example: cloud.joewebster.com Then create an A record in the zone leaving the name blank (same as parent). See my screenshots for an example: So cloud.joewebster.com is resolved to the internal ip address and all other DNS records in the joewebster.com DNS zone are forwarded externally to the ...


1

It is an issue with MS16-072. All user GPO's must have at least read permission for Authenticated Users. https://support.microsoft.com/en-us/kb/3163622 MS16-072 changes the security context with which user group policies are retrieved. This by-design behavior change protects customers’ computers from a security vulnerability. Before MS16-072 is ...


1

Manual (non-script) In Active Directory Certificate Services console, right-click Revoked Certificates, select Export List... and save the file. Open file in Notepad Make sure you have Format - Word Wrap option turned off Make sure you have View - Status Bar option turned on Press Ctrl+End to go to the end of the file and position your cursor on last line ...


1

AD replication honors Replication Interval set on the Site Link between two sites. Which can have minimum interval of 15 minutes. But to you can enable Change Notification for site links. To do this: Open ADSIEdit.msc. In ADSI Edit, expand the Configuration container. Expand Sites, navigate to the Inter-Site Transports container, and select CN=IP. Note:...


1

The only reason to have a disjointed namespace is because you do not have control over the other DNS namespace OR have a need to separate control of the other namespace, while maintaining control over the AD objects on both. The issue wih disjoint namespaces is that most (if not all AD aware apps) use the assumption that the UPN suffix will be the same for ...


1

This is usually caused by canonicalization. Try adding: rdns=false to krb5.conf and also SASL_NOCANON true to ldap.conf (both are already the default in RHEL-7).


1

If I understand your question, you would like to have connection between two your servers and at the same time you want to have connection to your servers from Internet. Look like you have two NICs with default gateway. In that case server could send traffic to wrong gateway and could be unreacheble. Usually removing default gateway on one NIC(usually it ...



Only top voted, non community-wiki answers of a minimum length are eligible