New answers tagged

2

I don't know the details of your application, but it sounds to me like it is not compatible with Active Directory. Read the public documentation for ADS_NAME_TYPE_ENUM. Those are the login name formats that you are allowed to log in with. "EXT123456" is not one of them. I know that you think "EXT123456" is logging in with a sAMAccountName, but it actually ...


4

You've fallen victim to a bad decision made by whoever set up your AD environment internally. More discussion here. Windows Active Directory naming best practices? But the gist is that internally, your AD owns the name example.com in DNS. That name will always and forever (unless you rename the domain) point to your domain controllers. So the only way to ...


1

If your environment is healthy and properly redundant as you say, this is fine.


1

Of the methods suggested, let me give you a pros/cons list Staight up Kerberos/LDAP : Pros : Works great when configured properly. Rarely breaks, resliant, will survive network glitches. No changes need in AD, no schema change, no Administrator access needed to the AD. Free Cons : Relatively difficult to configure. Multiple files need to be changed. Will ...


0

The issue turned out to be that I used the "Quick Install" of RDS which checks the DNS role automatically. Thus I had two DNS servers... which may be possible with DHCP as I understand... but I was not configured for two DNS servers, and really I only needed one in this two server domain. All I had to do was uninstall the DNS server that was located on the ...


0

Actually, if you're not a domain admin (or account admin), it's relevant: for an account with expired password, you must do an interactive logon to change the password. Otherwise, if you know the other user's password, you may launch a Powershell session with those credentials and use the code that @Ryan Bolger just posted. Or even easier: ...


0

If you know the LDAP distinguished name (DN) value for the user you can do it with Powershell like this: $oldpass = 'XXXXXXX' $newpass = 'XXXXXXX' $user = [ADSI]"LDAP://CN=myuser,OU=MyOU,DC=example,DC=com" $user.ChangePassword($oldpass,$newpass) I should note that this method works even if the password has already expired which is a nice bonus. If you ...


0

Expand Default naming context > DC=(domain),DC=(local) > OU=Domain Controllers > CN=(DC name) > CN=Domain System Volume


0

Through Group Policy Management you can create a GPO (or use an existing one) that covers all of the machines required and add the following setting: Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignments Add "Domain Users" to "Allow log on through Remote Desktop Services" All users will be ...


7

There are two components required for users to log on to a server via RDP: User Rights and Permissions. Rights: Users must have the "Allow logon through Remote Desktop Services" user right. Permissions: Users must have the "User Access" and "Guest Access" permission set to Allow on the RDP-Tcp protocol. By default, users or groups in the local Remote ...


0

No, you will need to use a host-based or network firewall. As an alternative, you could specify the "Log On To" on the Account of the user account, and specify the "Logon Workstations", the domain controllers/administrative computers. That may work if you do not have that many.


0

Windows firewall advanced settings allow you to restrict RDP to certain source IPs. Alternatively, you can use certificates on the clients.


0

The Domain and Forest functional levels can only be upgraded to 2012R2 once you have Migrated all of your DCs to 2012R2. Remember that you can go back down to 2008R2 functional level once you have upgraded to 2012R2. Don't forget to Transfer all the FSMO roles to your new DCs before decommissioning the older 2008R2 DCs. Any existing servers with static IP ...


1

The way my Big 4 client does it is by creating rules in each client NSG that lets them talk to a specific management server (or servers) for monitoring, alerting, antivirus, updates, etc. Each NSG only allows communication for specific ip addresses for the specific ports required for each VM to talk to the "management" server. So there's no centralized ...


1

Eventually found out myself. The Windows permissions are stored in "Extended attributes". The raw data of these attributes can be displayed by xattr from Debian package python-xattr: xattr -l <local_path> To display and manipulate these permissions, you can use smbcacls from Debian package smbclient: smbcacls //localhost/share ...


0

I would go with the Inventory feature of Pandora FMS Enterprise. Apart from their tremendous server monitoring capabilities (http://pandorafms.com/monitoring-solutions/server-monitoring), they can collect Inventory information of Software, Patches, Services, Hardware and basically, what ever you want!


0

If users don't have write permission on the parent share they don't have write permission on the subfolders. You need to give Users Change permission on the share. Useful blog post here discussing share and NTFS permissions: http://www.basvankaam.com/2013/06/15/share-vs-ntfs-permissions/ When you create a shared folder you apply share permissions and ...


0

Set both these policies for members of local Administrator group to be able to change files and connect to admin shares:


0

You have 3 options here. Option 1: Rename your domain with a subdomain like ad.yourdomain.com, with the NetBIOS set as yourdomain. Option 2: You will have to set DNS records to point to www.yourdomain.com as the www is not present in your DC, then place shortcuts on everyone's computer for the website pointing at www.yourdomain.com. Option 3 I know ...


1

This can happen when you rename a DC during a migration. Best Practices would be to install DNS first then you shouldn't see this error. Hack around is to choose remove role, it will fail, close and the error will be removed.


0

You could manage several local user accounts at the time through powershell, with a few useful scripts. You can find inspiration in the two articles below. https://mcpmag.com/articles/2015/04/15/reporting-on-local-accounts.aspx?m=1 https://mcpmag.com/articles/2015/05/07/local-user-accounts-with-powershell.aspx?m=1


1

The CNAME will not work, because it will still point to your domain name, which will be resolved as your DC. You could possibly make another a-record for your company website, if your webserver allows for it. A = alternate.example.com -> [webserver ip] edit: typo


2

AD Trusts don't have any direct relationship to networks or subnets. Your problem is more than likely due to a lack of Conditional Forwarders or Stub Zones on one side of the proposed Trust. In each domain you need to configure Conditional Forwarders or Stub Zones) for the other domain that directs DNS queries for that domain to the DNS servers for that ...


0

Finally I found the answer,you can use following command to achieve this dsget group "Group DN Name" -members To get group DN Name you need following command dsquery group -name "Groupname" By using Both command you can get the result. To run dsget and dsquery command you must have Windows Remote Server Administrative Tool Installed and enabled in ...


2

There are 2 possibilities, DNS issues or firewall issues. Try changing the domain firewall on the new DC. If that fails make sure the new forest resolves properly from the old PDC emulator.


-1

As you may have figured out already, your solution passes ideally through Active Directory. Your servers should be included in domains managed by local Active Directory Domain Controllers. You may organize them in domains separated per site, if your sites are isolated or distant from each other. Now, the topology risks to be complicated. This is the reason ...


0

The problem also appeared to occur on debian and ubuntu after samba was upgraded from 4.1 to the 4.3 minor version. Which means it was not redhat specific. As an aside I did contact redhat support. I was not able to find a solution, but I found a work around which is good enough. For some reason when the particular failure occurs the keytab is not created ...


1

Drivers are stored on the print server itself. You could push out an installation of these via GPO or other software deployment tool if you want to pre-install them from a central source. Using either of these methods, you could specify which server the drivers are installed from, or let AD do it automatically for you based on AD sites.


4

This answer falls into your 2nd option of querying the username from AD. If you're open to a powershell solution you have a few options. Your situation feels like you want to do this from each users workstation, and PS AD Module may not always be available across those targets. In that case you can get the same info like this: ...


1

Thanks for the great PowerShell Script. One thing I had to change (encoding from txt from utf to ascii) because BGInfo cannot display UTF TXT-Files. $Searcher = New-Object System.DirectoryServices.DirectorySearcher $Searcher.Filter = "(sAMAccountName=$($Env:USERNAME))" $Searcher.SearchRoot = "LDAP://$Env:USERDNSDOMAIN" $Searcher.SearchScope = 'Subtree' ...


0

This is easy with Powershell: Get-ADUser -filter {enabled -eq $false} -properties memberof | where { ($_.memberof | measure).count -gt 1} | select samaccountname,name The first part, you get all the users that are disabled, and you get the memberof property (not included by default). The second part, you measure the memberof property, then get the count ...


0

You can perform software monitoring using 10-Stike Network Inventory Explorer. The program scans your computers automatically, and when it scans the PCs again, it compares the results and finds changes, so you can track all the changes. AD is supported. For data collecting you can use WMI (Windows Management Instrumentation) or logon-script. All the ...


0

First of all, this is strongly dis-recommended (if that's English!) by Microsoft (and you're supporting Microsoft clients). Second, you'd have done that when you put in place your AD, as your domain controller would have skipped the creation of its own DNS. It's anyway possible to do it, if your BIND DNS is compatible. If you're clients are slow to login, ...


1

As you said, you need to add the to the local Remote Desktop Users group. If you want to set it up "server side", the solution is to create an AD group, add the needed accounts to that group, then create a GPO setting "Restricted groups": http://social.technet.microsoft.com/wiki/contents/articles/20402.active-directory-group-policy-restricted-groups.aspx


0

If it's just monitoring and nothing else (not deploying or block installations), I suggest to deploy OCS Inventory Server, and installing the agent in your clients.


0

Still big companies, universities and schools let you log in with your work account from home. How do they do it without leaving a big security hole? There are several mechanisms that allow authentication to Active Directory from outside the LAN that are relatively secure. I've never seen a situation where the directory services ports, even read-only ...


1

It sounds to me like you have configuration issues rather than it being an issue with AD. If the DC holding the FSMO roles (including PDC emulator Role) goes down then things will be a bit tough but if you have a second DC users should be able to authenticate, you should be able to create new users and features like GPOs should still process. Presuming ...


2

The domain Remote Desktop Users group is for granting access to your Domain Controllers, not your RDS servers. You need to add your domain users and/or groups to the local Remote Desktop Users group on each of your RDS servers. This article was written for Windows Server 2003 but is applicable as it relates to the usage and purpose of the domain Remote ...


5

In ADSIEDIT: Configuration [.contoso.com] ◦CN=Configuration,DC=contoso,DC=com ◦CN=Services ◦CN=Microsoft Exchange ◦CN=OrganizationName ◦CN=Address Lists Container ◦CN=All Global Address Lists Reference


0

Every Exchange mailbox is always associated with an Active Directory user object; when you create a room or resource mailbox from Exchange, a corresponding (disabled) AD user account is created. The attributes for the mailbox are stored in that user account.


0

You'll need to make 3 changes: First, change $searchScope from OneLevel to Subtree. Next, because you're now searching subtree, you'll also want to put a check within the foreach loop to only attempt the move if the current user location does not match $fullOU. Otherwise it will attempt to move each object to its current location, which will error, and is ...


5

Using get-ADServiceAccount there is an attribute for hostComputers: Get-ADServiceAccount -Filter {HostComputers -eq "CN=SQL-Server-1, DC=contoso,DC=com" } Enabled : True Name : service1 UserPrincipalName : SamAccountName : service1$ ObjectClass : msDS-ManagedServiceAccount SID : S-1-5-21-159507390-2980359153-3438059098-29770 ...


0

I found using get-adgroup -properties member to be more reliable for returning all objects. To get objects from different domains I do the following: get-adgroup -properties member | select -expand member | get-adobject From this get the distinguished name of the object, this will tell you what domain to search, so in the end you should have something ...


0

You either have a corrupted profile, or the security settings on your profile are wrong. Before using any of the below fixes, I'd highly recommend you to take a backup of the machine in question to avoid losing data in case something went wrong. There is a lot of talk on the steps that you need to follow, to save time and formating, I'll just post you a ...


0

I solved this problem with the following method: Type 192.168.1.1 to enter modem settings. Type username and password. Go to Setup Go to Wireless Go to Wireless Basic Un-check the Enable MultiAP Isolation option. Apply.


0

This is from above notes. Looks like the initiator of this post stated on his last comment. Java calling vpxd.exe process. Further notes Yes, "Success/Failure" Logon Audits are enabled on the DC in question -- no failure events are logged until the account is actually locked out. Further digging shows that LSASS.exe makes a KERBEROS call to the DC in ...


3

You can look at the Event Viewer, if you want to check manually. Under Windows Logs > Security you can see both successful and failed logins and you can see logouts. See the Task Category column in the screen capture. . You could write some PowerShell code or .NET / WMI code to pull relevant "most recent" items across multiple servers if you have WinRM ...


2

If the guest user account is an Active Directory account, why don't you go to the user account in Active Directory, go to Properties, go to the Account Tab, Click the Log On To... button, and enter the names of the computers you are going to allow the guest user to logon to? Todd's points should also be considered before you decide how to implement this. If ...


3

Assuming you have not granted the Everyone object access to any resources, you can just make a local account on the computer(s) that the guest will use. They log on to the computer(s) with that account, and they have not even logged on to the domain, so by default they have no access to any domain resources. If you must use a domain account, create a brand ...


12

I think the only reason it's not enabled by default is because in order to use it the AD Forest function level needs to be raised (minimum 2008 R2) and it's this particular piece of administration that requires all of the preparation - that is, if the domain was created on NT or 2003 for example, then you won;t be able to enable it until the forest function ...



Top 50 recent answers are included