Tag Info

Hot answers tagged

7

All computer accounts that were created as of December 1, 2011 (12/01/2011) in the Active Directory: Get-ADComputer -LDAPFilter "(&(objectCategory=computer)(whenCreated>=20111201000000.0Z))" -Properties whenCreated | Format-Table Name,whenCreated,distinguishedName -Autosize -Wrap PowerShell, of course. Edit date to line up with your definition of ...


5

As already commented, the "Account is sensitive and cannot be delegated" flag is a user account attribute, not a GPO setting. If you've checked this box and want to make sure that the change is immediately replicated everywhere, you can use repadmin to force it: repadmin /replsingleobj * source-dc01.domain.tld CN=SensitiveUser,OU=Users,DC=domain,DC=tld


5

When you clone a virtual machine in a vSphere environment, you have an option to "customize guest" when cloning or deploying VMs from a template... This is where you can specify a name, change network settings, specify domain membership and generate a new SID (for Microsoft operating systems). That's all you need to do going forward.


4

There most likely were logs in event viewer that indicated IP conflicts. Any monitoring system that gathers and filters event logs should be able to detect that and trigger alerts. On physical managed switches you could probably detect and warn about the duplicate MAC address - I am not familiar enough with vmware virtual switches to know what options you ...


4

Shut down each DC for a couple of days and wait for the screams. Seriously, it's the only way. Whoever/whatever wants to talk to Active Directory should be able to find a domain controller using the proper process. But some application developers are definitely foolish enough to want a statically-defined DC; well, it's their fault, and they should pay for ...


3

The first container names lack the container type from your third statement on down to the bottom, and you don't have the first one quoted (for consistency). For example, it should be "ou=Chicago Admins,ou=Chicago,ou=IL,dc=sawahcompany,dc=com".


2

This will open AD Users and Computers as a user on the remote domain. Requires RSAT be installed. From elevated CMD: runas /netonly /user:REMOTEDOMAIN\REMOTEUSER "mmc dsa.msc /server=REMOTEDC" Shamelessly stolen from: https://blog.ed.gs/2013/09/08/rsat-cross-domain/


2

That T in "VistaT" is no T at all - it represents a trademark symbol: ™ (U+2122 or #8482 in Unicode) Try this: Get-Computers -OperatingSystem $("Windows Vista" + [char]8482 + " Business") Why Microsoft chose to abuse the ability to store unicode symbols in string value attributes in this way is beyond me


1

There is no substitute for good IP management policies, ever. The End. Fin. FIN-ACK. Regardless of context, there is no way to prevent people from being stupid with IP addresses unless the software goes out of its way to forbid it -- and it generally can't. How does it know you don't need multiple VMs to hold those addresses, and will only ever online one ...


1

Another method to try to identify those servers might be to run something like Network Monitor on the Domain Controllers and run a capture, filtering for authentication traffic. You could then further filter by the ip addresses of your servers to narrow the displayed results. The trick is going to be determining what authentication traffic is related to your ...


1

One thing you could do is remove the A record and the other DNS Mnemonics. This would result in the usual DNS records for a DC not being registered, and not returned for normal authentication or group policy connections. Then run a packet capture to identify where any traffic may be originating from. How to optimize the location of a domain controller ...


1

KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN means the KDC has no idea who holds the SPN, at your case the requested SPN is HTTP/self-test.example.com The two common reasons for this are: the SPN doesn't exists on any account in the Active Directory Forest (doesn't seems to be your case) there are more then one account that is holding the same SPN (duplicate SPN) ...



Only top voted, non community-wiki answers of a minimum length are eligible