Tag Info

Hot answers tagged

6

I would advise (temporarily) setting up your new domain on Server 2008 R2, as I've done with my current employer's new forests. Set up your new forest on a (temporary) Server 2008 R2 domain controller. Join your Server 2012 server to the new domain, and promote as a domain controller. Transfer all FSMO roles to the 2012 Domain Controller. "Migrate" SBS ...


5

If you can't use rendom.exe because you have an Exchange organization in your environment, you have to create a new Active Directory domain and use a tool like ADMT to migrate users, groups, and computers into the new domain. Some applications do not support migration in this manner - Exchange is one of them. You will have to configure an Exchange ...


4

This is caused by "Domain Controller Stickiness" and causes the clients to prefer one domain controller over another. You can adjust this by forcing the clients to choose another controller at intervals. The GP setting is under Administrative Templates\System\Net Logon\DC Locator DNS Records\ Entry Name: Force Rediscovery Interval. This setting should ...


4

The Server for Network Information Service (NIS) Tools option of Remote Server Administration Tools (RSAT) is deprecated. This comes as no surprise to me -- NIS is evidence that Sun hated us and wanted us to be miserable. Use native LDAP, Samba Client, Kerberos, or non-Microsoft options. This is good advice. Given the choices I would say "Use ...


4

re: "The commercial solutions like Centrify and Likewise always worked, but seemed unnecessary, since this capability is baked into the OS." Well I think most of us have been hearing for years that XYZ operating system finally cracks the AD integration puzzle. IMHO the problem is that for the OS vendor, AD integration is a checkbox feature, i.e. they need ...


4

In March 2014, Red Hat published a reference architecture for integrating Red Hat Enterprise Server with Active Directory. (This material should certainly be current and relevant.) I hate to post this as an answer, but it's really just too much material to transfer into the answer field. This document is hot off the press seems to focus on the new features ...


3

By default the client itself does its own DDNS update if it is XP or newer. A DHCP server can perform proxy updates for DNS clients that don't support updating their own client records. You can also force a client registration via ipconfig /registerdns Here's a good link, simple enough: http://technet.microsoft.com/en-us/library/cc771255.aspx Domain ...


3

Use the command you posted in the linked question, and schedule it using a scheduled task. Command using dsquery/dsmod: dsquery user "OU=Sales,OU=New York,dc=internal,dc=AcmeCorp,dc=com" | dsmod user -pwd ChangeThisNow! -mustchpwd yes -u Admin -p APassword PowerShell: users = Get-ADUser -Filter "*" -SearchScope Subtree -SearchBase 'DC=contoso,DC=com' ...


2

Your DNS servers are authoritative for ds.usepowershell.com, that is where their authority ends. Queries for any other domain, including the parent domain, need to be resolved either through the use of forwarders (conditional or otherwise) or through the root hint servers. So the answer in a nutshell is: Yes you can set up conditional forwarders for ...


2

From what I understand, MS clients can update their resource records (Understanding Dynamic Update) via secure, AD integrated updates. Also, MS DHCP can do this on behalf of a client (e.g. non-MS devices). This requires non-secure updates, IIRC.


2

If you want to stay on the supported path: migrate to Server 2012 Essentials transition to Server 2012 standard set up trusts to the destination domain set up Server 2008 R2 DCs in source and destination domains (unless a newer version of ADMT supports Server 2012) Use the 2008 R2 servers to migrate your domain using ADMT You might consider taking a ...


2

You cannot see the OUs that a particular user has access to from the actual User object in AD. You can however use a powerful tool in PowerShell called DSACLS. You'd run PowerShell as admin and then use this command: dsacls "ou=nameofou,dc=domainname,dc=com" replacing nameofou and domainname with your desired OU and your AD Domain. See the section under ...


1

You would be much better served to put some sort of dual-WAN router up front (there are plenty of them available on the market today), instead of putting a server there. Especially if the server is also going to contain your internal resources that should be secured, like your AD. You can still use your DC VM guest as the DHCP and DNS server for the LAN ...


1

Not enough info for a proper answer (need to know Samba level, Active Directory version and windows client version). However, check the version of SMB authentication supported by your flavour of SAMBA and your Windows clients. You may need to upgrade your Samba distro or down-level the supported levels of SMB authentication on your clients. Other thoughts ...


1

No, the user account/object does not contain an attribute for ~"things this object can manage." Permissions are handled by ACLs/ACEs (Access Control Lists/Access Control Entries) on the objects themselves, which define what other objects have permissions to do what to with the object holding the ACL. To figure out what all OUs a given user has permission ...


1

Found this thread that helped me get what I wanted. To get any AD users attributes into environment variables. This script takes all wanted attributes from logged in user and sets a corresponding environment variable. I prefixed the variables but that is optional, so variable name becomes "AD[attribute name]". Attributes is of your choice, just add or remove ...


1

If you don't have a keytab on the host, you really aren't using kerberos properly and are wide open to a relatively simple attack if the attacker can poison your DNS caches. Kerberos is a shared secret system and to work effectively any server that accepts kerberos tickets needs to have a local copy of the shared secret that the kerberos KDC also has. This ...



Only top voted, non community-wiki answers of a minimum length are eligible