Tag Info

New answers tagged

0

As for seeing that a domain rename operation took place, yes. Event ID: 1875 Level: Warning Source: ActiveDirectory_DomainService Log: Directory Service Active Directory Domain Services has detected that the replication epoch (as indicated by the msDS-ReplicationEpoch attribute of the following object) of the local domain controller has been ...


0

If I understand your question, the answer is no. Linux can use AD via Kerberos + LDAP and SSSD or various other methods to get account login details, and account authentication. Linux doesn't, out of the box, get any policies. Policies or authorization are set in the system that you're authenticating against. So if you're accessing a Windows fileshare, you ...


0

Ok, figured it out. The previous IT staff neglected to add Server C to the domain. I went to System and noticed the Domain was instead set to a Workgroup, so I added the server to the domain, rebooted C, and now I can login using a domain account and everything is where it should be. I suddenly have some issues with SQLServer on that box starting, but that's ...


1

To avoid disabling disabled accounts you can filter them out: Get-ADUser -Filter {Enabled -eq $true} -SearchBase "ou=TheOU,dc=contoso,dc=com" ` | Disable-ADAccount


1

Unfortunately Alfresco's repository is not designed to support namechanges for users and groups (authorities). You may change the displayname by using the Alfresco API but this is not what you are looking for. By default a namechange of a group in AD will result in a delete an recreate with all consequences (any grants to these groups would be removed). In ...


1

It depends on how the users are using the workstations in question--are they supposed to be saving files, or are these generic workstations? Is the problem that you don't want them listening to music, or that they're downloading viruses with their music? (I also don't know your budget.) Depending on this, I'd probably use multiple approaches. Proxy ...


5

My opinion in these cases is to port block every single port except those that are required for the server to perform it's primary purpose (http/s, ftp, sql server), and even then, restrict those ports to only certain IP blocks when possible. Don't configure any remote connectivity for these servers except for those necessary services. Then deploy a bastion ...


-1

RPD should be used only via VPN. SQL can connect with a specific port, so it should be safe. Why would one run AD on internet side ? If you have to run it on the same server connected to the internet, you should thoroughly check the security policies before doing so. WSUS is bugged and unsafe. WSUS can even report that everything is current while having ...


3

The typical technical approach is to install a HTTP proxy server where you implement your download restrictions/policies. Then you can use a GPO to enforce that the proxy server gets used (assuming that your computers are all AD domain members) and as the next phase you block direct internet access at your gateway/firewall. Normally you precede the ...


0

As Daniel mentions you could use a DFS namespace for this, especially useful if you wanted to replicate the same data to each location and have them access it only locally. If you specifically have a need to map a particular drive to a particular server, the site name the computer is a part of is stored in the registry at: ...


8

Here's how I'd do it. Get-ADUser -Filter * -Properties Enabled, AccountExpirationDate, LastLogonDate | ? { ` ($_.Enabled -EQ $False) -OR ` ($_.AccountExpirationDate -NE $NULL -AND $_.AccountExpirationDate -LT (Get-Date)) -OR ` ($_.LastLogonDate -NE $NULL -AND $_.LastLogonDate -LT (Get-Date).AddDays(-90)) } One call to AD, gets only the properties that we ...


2

Yes, if you use Red Hat or any other RHEL-based distro (Feodra, CentOS, Scientify, Oracle Linux to name a few): $ authconfig-tui This would walk you through the setup. Use: User information: LDAP Authentication: Kerberos (with Shadow and Local authorization being set as well) This should get you up and running pretty quickly.


1

According to Microsoft, that would be the expected behavior. https://technet.microsoft.com/en-us/library/cc507878.aspx "You need to reboot the machine to enforce software restriction policies when Software Restriction Policies are created for the first time"


1

Your solutions here are either FreeIPA or Centrify/PowerBroker. FreeIPA is part of your standard RHEL subscription so there is already some savings in place. FreeIPA can be run in a mode where all users and groups can come from Active Directory. You would only keep mapping of those users and groups to POSIX-specific environments in FreeIPA, like SUDO rules, ...


1

what about winbind + samba + kerberos? Authentication via AD credentials (letting a user in the door) checked Authorization once authenticated (granting a user access to areas of the system) checked Audit (being able to tie user actions back to their AD credentials) /var/log/secure? checked Support for AD groups (not just vanilla LDAP and ...


2

Your understanding of what BASL does may be incorrect here. BASL should be turned off for networks that are not fully routed. With BASL enabled (i.e. the default), the KCC assumes that all sites are able to communicate directly. If you have a network which is not fully routed, then you should turn BASL off and define your replication links according to your ...


3

I recommend iterative changes. Create the new desired structure (groups first) and add existing items there. You can then unit test removing the legacy groups one or two at a time, while knowing exactly where to look if things break. A cut-over approach will likely be a huge headache for an organization of any size. I will say that OUs are probably ...


2

This is very hard to find out. I'm not entirely sure if it's possible to find out if a particular group is being called. Regardless, even if you did manage to find out if a specific group is being used, and from where, most applications don't actually use the group name. They use the SID of the group. Chances are if you were to find out exactly where all ...


0

Up first sry for my late feedback. At the moment the problem does not exist anymore. I've just done a reboot of all DC's and since there it looks like the problem is "solved". I've got no report from a user in the last 10 Days and there are at least 4 Users who had to renew their password. If the Problem occurs again I will post the solution here(if we can ...


0

The account that I am using is the built in Administrator account. You have to use an account which is part of the Domain Admin group to join a client to your domain. Also make sure the DNS settings on the client are correct.


1

I would really like to hear what you mean by "real AD groups" when talking about SSSD. The newer versions of SSSD don't require the groups to have POSIX attributes and mostly read the group memberships from TokenGroups if the AD provider is used. Also, in RHEL-7.1 (upstream 1.12+), the SSSD gained the capability to do access control checks using GPO ...


0

Problem SOLVED! I was logging into client machines as domain user with Enterprise/Domain admin privileges and able to access a shared folder containing MSI installation packages without any problem. Though, at some point tried accessing it via \IP\share_path_to_msi_packages_folder from another non-domain PC and kept getting a login pop-up. Basically, even ...


0

Powershell, gives a nice and clean output. (get-aduser USER -Properties MemberOf | select MemberOf).MemberOf | % {$_.split(",")[0].replace("CN=","")}


0

I use the Open Source version of PBIS. In version 6, I found that if I was not logging on to a machine for a while (like months), when I would log on, it would time out. At least it was the case for many machines. I haven't had that issue with version 8. I found PBIS good enough. It allowed me to set the options I cared about (default home dir, assume ...


0

The Redhat offering is covered well here: Common wisdom about Active Directory authentication for Linux Servers? In my recent installations, this has been done via SSSD (built-in) and ldap or sssd.conf group filters. What exactly do your Linux users need to do on the systems?


2

In response to your comment: I'm not trying to solve something, I was just wondering if I could spoof a username of "HOUSE\JOHN" (domain\user) without knowing the domain's "HOUSE\JOHN" password. (pcname\user) I assume that you're referring to accessing shares or whatever. No, if you name your computer DOMAINNAME and use a local user account with ...


5

Yes it will let you create a domain computer object with the same name as the domain. However, the default context (at the login screen) will be domain login, rather than local login and will require valid domain credentials to authenticate. If you manage to login locally to the PC, it will not grant you domain level access. The names of the domain and ...


0

Unfortunately I have seen many people struggle with trying to get single-NIC mode working on a DirectAccess server. This was really only intended for quick POC setups, and for a production (or any) environment, you should really go with dual-NIC installation. You will have fewer issues this way. In fact, I have seen more than a couple cases where I have ...


0

It's 2015, check out some PowerShell. if (!(Test-Path -Path "$Env:ProgramFiles\Microsoft Security Client" )) { Write-Host "Not Installed, Installing..." iex "\\192.168.1.104\Programs\Microsoft Security Essentials\Microsoft Security Essentials.exe /s /runwgacheck" } if (!(Test-Path -Path "${Env:ProgramFiles(x86)}\Adobe\Reader 10.0" )) { ...


0

I have fixed the problem. The Windows Server 2003 was English and the Windows Server 2008 was German. The Adprep.exe needs to be the same language like both servers. Now it works fine.


3

You'd use netdom. Assuming you don't want to give yourself carpal tunnel... and the most boring day ever. If you had a text file with all the computer names in it, (one per line) you could whip up a batch script like the below to do it all at once. FOR /f %%i in (C:\mylistofcomputers.txt) DO (netdom join /d:mydomain.tld ...


5

No - the admin permissions are due to a group membership. A group membership is stored in a user's kerberos ticket, which will persist until they log out or the ticket expires and is renewed (its lifetime is 10 hours by default but may be customized in your domain). Logging them off or waiting for the expiration are the only ways to take away the group ...


0

One thing you can do is to remove the drive letter from the external HDD, in Disk Management or via diskpart.exe remove the drive letter and mount the partition to an empty NTFS folder instead. Put the mount-folder somewhere deep in your file structure and ACLe it, name it, so a normal user wouldn't suspect anything.


0

As mentioned in the comments by Joe, what you're probably seeing is Windows moving the redirected folders to a new path when the user logs in. It's also possible, but less likely, that one of those is just a junction point that you copied when you used the GUI (!) to do this. Either way, it shouldn't cause the problem you fear, but it will probably result ...


0

--> ADPREP /Forestprep on the w2k/w2k3 schema master (both w2k/w2k3 forests) --> ADPREP /rodcprep on the w2k3 domain master (only w2k3 forests) --> ADPREP /domainprep on the w2k3 infrastructure master (only w2k3 domains) --> ADPREP /domainprep /gpprep on the w2k infrastructure master (only w2k domains) --> on the server execute: DCPROMO and ...


0

If you are not familiar with the Netdom command line tool then try using the Netdom rename computer GUI from colosify. It will help you rename multiple computers on your domain by uploading a .csv file without the need to remember or learn any command line code or create any scripts. This GUI saved me a lot of time.


0

Add proper forward and reverse entries to Windows domain DNS for all the servers, as Kerberos requires them. It's likely that until now domain DHCP server used to do it automatically, now it doesn't happen due to no DHCP. Also make sure /etc/resolv.conf only lists Windows domain DNS servers.


2

This is almost certainly a file permission problem on the wallpaper image file, or the wallpaper image file not being on the workstations or accessible to them via a network share.


3

You can't do it without manually creating secondary zones on this new server. These are the steps you need to follow: You need to add this new server to the name servers tab for each zone you want it to hold a secondary copy of. Then you need to allow zone transfers for each zone to all servers listed on the name servers tab of the zone. Then you need to ...


1

You have to reboot the computer (or issue a klist purge) in order for it to recognize that it's a member of a new group. (This isn't something that happens if you wait, in other words.) (Here's an msdn blog post on updating computer group membership without a reboot. See also this Server Fault post.)


0

I had a client with the same issue, after looking through their DNS settings for their adapter which lists the host file, I discovered that they had migrated from an external IP config to an internal IP config and forgot to update the DNS address'. Once I made the changes to both the PDC and the secondary DC\DNS server all was well. Did have to reboot the ...


5

When and only when a new access token is created. This does not occur when a TGT is refreshed at 10 hours. It also does not occur automatically when the ticket expires after 7 days. You have to actually get a brand new one. This is why you must either reboot or do the klist trick.


4

You should be able to manually remove them from AD. If the previous print servers computer object still exists you can delete the printers from the servers computer object in ADUC by selecting the option to view Users, Contacts, Groups and Computers as objects, then find the computer object for the previous server, select it in the left pane and delete the ...


2

Edit: Not sure why we are not on the same wavelength here. Maybe I misunderstood your question. What is the nature of the device at 10.0.0.87? Is it Linux or Unix running an Active Directory or OpenLDAP client of some sort? Because Linux servers that are integrated with Active Directory do tend to issue queries a little differently from regular Windows AD ...


0

No need to fix, these lookups are being done to find the corresponding LDAP server for your AD tree.


-1

On Windows 2012 R2 there was an orphaned object on DC2 inside C:\Windows\SYSVOL\staging\domain..... that wasn't present on DC1 and caused missing \HOST\netlogon and \HOST\sysvol problems on a newly joined clean DC3. So many hours wasted by such a small thing - Microsoft! Why didn't DC1 and DC2 indicate any inconsistencies in SYSVOL in the first place on DC2 ...


0

This is an old question that now has easier solutions. Products like OneLogin and Okta can sync to your AD and allow your users to log into Google (via SAML) with their AD passwords. These products are increasing their provisioning capabilities, so that when you add a user to AD they are automatically given a Google Apps account (and accounts on other ...


4

There can be only one Account policy per domain and it must be configured in a GPO linked to the Domain, not to an OU. If your domain is Windows Server 2008 or higher you can implement Fine-Grained Password Policies in order to apply different Account Lockout settings to different users. https://technet.microsoft.com/en-us/library/cc757692(v=ws.10).aspx ...


2

You can use a script that Microsoft developed over on Technet: Check a setting in all GPO's (Security, ADMX, and more) You can export an existing GPO like the Default Domain Policy as XML (right click the GPO in GPMC and "Save Report" as XML) to look in and see the various "choices" based on how the script functions. For example, here's some output from a ...


0

Please, test command at workstation in domain, and add output in answer, change dns suffics to domain.com in output: ipconfig /all nslookup %USERDNSDOMAIN% net view %USERDNSDOMAIN% cd \\%USERDNSDOMAIN%\ cd \\%USERDNSDOMAIN%\SYSVOL\%USERDNSDOMAIN%\ cd \\%USERDNSDOMAIN%\SYSVOL\%USERDNSDOMAIN%\Policies dsquery server -domain %USERDNSDOMAIN% -isgc ...



Top 50 recent answers are included