Tag Info

New answers tagged

0

Then I want my users in AD on my DC to be able to access the NAS with the appropriate permissions from home by using a Web browser, so to authenticate with AD. Just make a VPN that authenticates against Active Directory. Once a user is on the network through the VPN utilize a NAS that has a web interface, preferrably one that itself can also ...


2

I found that the firewall's built-in rules aren't always accurate and sufficient. I researched a little this subject once, and found this article. This are the ports the article says are generally required: UDP Port 88 for Kerberos authentication UDP and TCP Port 135 for domain controllers-to-domain controller and client to domain controller operations. ...


1

To find the root cause of account lockout, you need to get logon failure event information where its get originated. See the below articles To track Account Lockout Source for different Logon Types. Logon Type 3: http://www.morgantechspace.com/2014/11/How-to-Find-Account-Lockout-Source-for-Logon-Type-3.html Logon Type 8: ...


1

Either you want to throttle the bandwidth on your network, by using your routers / switches to set a max cap on bandwidth usage per interface. Effectively stopping any one PC from utilizing such a large amount of bandwidth as to render the others inoperable. Or you want to monitor bandwidth activity with for example Nagios bandwidth check. This will allow ...


0

There is no way to do automatic sync from Azure AD back to AD. You have to do this yourself using Azure AD graph API


-4

Remove all the DNS server entries from your IPv4 network configuration. Then add your dns server IPv4 address as the only one. Also may need to flush dnscache.


2

I'm assuming that this means, for example, not logging in with your domain administrator credentials in order to do your daily work on your workstation. If so, you would have a "normal" user account to do your "normal" work and a domain admin account that you use specifically for domain admin activities. For your DNS admin example, same thing--there's a ...


1

The registry key, that MDMarra is referring to should be HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI (assuming later than XP). Look in LastLoggedOnUser.


0

Basically, I'm heading in the same direction as joeqwerty I have experienced the symptoms you are describing at a few companies. In my experience, it usually happens when there is more than one site. One way to troubleshoot a potential issue with sites and services is the following. On a computer which just experienced a slow logon, go to command prompt, ...


5

Be lazy, just get the Manager attribute on your first pass and juggle it through the pipeline to your calculated property. Search-ADAccount -AccountExpiring -TimeSpan "7" | Get-ADUser -Properties Name, AccountExpirationDate, Manager | Select-Object Name, AccountExpirationDate, @{ name = 'Manager'; expression = { (Get-ADuser $_.Manager -Properties ...


0

I would suggest building a temporary "place holder" server on whatever hardware you have that can support the OS, a workstation maybe? All you're looking for is a temporary staging platform to allow you to move everything to the newly installed 2012 OS. While you can upgrade I think most recommend fresh builds over upgrades.


3

If you have multiple filters, you have set filter in quotations marks csvde -f search.txt -p subtree -l "sAMAccountName,cn,distinguedName" -r "(&(objectClass=User)(sAMAccountName=jon.doe))"


0

Provided you have an installation of Windows Server 2008 R2 64-bit you can probably get away with an in-place upgrade. Domain controllers that run 64-bit versions of Windows Server 2008 or Windows Server 2008 R2 can be upgraded to Windows Server 2012. Technet article


0

Adding to Nathan C's answer. The proper supported way of cloning an AD joined computer is by using sysprep. While normally you can safely say that your new machine will get a new RID, microsoft recommends using sysprep. So unless you can be absolutely sure you won't cause any unforeseen issues it's generally better to follow the recommendations. However it ...


3

With all servers that are domain-joined, you need to sysprep them first. Revise your steps to the following: 1) Clone the machine using VMWare tools. 2) Boot without network connection. 3) Run C:\windows\System32\sysprep\sysprep.exe and tick "Generalize". Allow it to reboot. 4) Name the machine and connect it to the network and join as normal. The ...


0

As for ADFS and ADFS Proxy, no it is not possible to install an ADFS and ADFS Proxy on the same server. (Last time I researched this was 2013, it might have been changed but I highly doubt it) However it is possible to install ADFS on a DC especially because the ADFS server itself does not present significant load. But you still need to properly ...


3

Firstly, I will use FreeIPA and Red Hat Enterprise IdM interchangeably. If this causes discomfort, let me suggest a drink. FreeIPA should be a separate Kerberos realm from Active Directory, and should use a separate DNS zone corresponding to the Krb5 realm. If your AD Domain uses the DNS zone "domain.com" with child zones "dev" and "prd", you would want to ...


5

OK, it's pretty seriously hacky to mess with sAMAccountName it's defined in the Windows spec: http://msdn.microsoft.com/en-us/library/ms679635%28v=vs.85%29.aspx http://msdn.microsoft.com/en-us/library/ms677605(v=vs.85).aspx It exists for compatibility reasons, and I can't honestly think of a good reason to trample it - you can modify your LDAP schema and ...


4

I managed to fix this issue by going to the following location in ADSIEDIT Domain > Configuration > Services Right Click CN=Microsoft Exchange > Properties Found and Removed a bad entry from the GlobalAddressList1 attribute.


1

I agree with Nitz, and if you got loopback processing for user setting that target computer, powershell or wmi can't guess that, a bit why the gpresult need the user logged on to list the actual policy.


1

You can use powershell group policy commandlets. You can get the users information using Get-ADUser. You can then follow this up by using Get-GPInheritance on the users OU. After this you can run Get-GPOReport on the resulting GPO's. I haven't tried this before, but it should be possible with the new commandlets. However this will be quite a bit of work ...


3

Group Policy: The user's policy isn't solely dependant on the user object - it can be affected by wmi filters, foreign domain groups or Authentication Mechanism Assurance, meaning your group membership is changed according to the way you provided your credentials. In short - the only 100% accurate way is actually logging in and checking GP results. You ...


0

We have lot of possibilities to create or extend a DC to cloud. firstly, we have EC2 services to host a new AD or extend your AD to cloud. Please refer to the AWS directory services. AWS Directory Service Now you could also launch a windows server with AD service configured over a VPN connection(you can use direct connect or linux server VPN) to the ...


0

Take a look at opsi (opsi.org) for a deployment solution that does not require AD. It is free (opensource, gpl) and works great, but you definitly want some help in setting it up, depending on your inhouse know how with linux and windows. There are some advanced features that cost money,too.


8

How would this be setup connection wise without forcing all traffic through the domain controller? With site to site VPNs. You'd set up your cloud assets as a site, and then establish a site-to-site VPN between your cloud site and each of your physical sites. An alternate option, that Microsoft uses, but is generally ill-advised (unless you really, ...


-1

Hopefully this may help: Guide to Custom MMC


0

I ended up changing a few options in there and ended up with this: Dim WshShell Set WshShell = WScript.CreateObject("WScript.Shell") 'German WshShell.RegWrite "HKCU\Keyboard Layout\Preload\2", "00000407", "REG_SZ" 'Japanese WshShell.RegWrite "HKCU\Keyboard Layout\Preload\3", "00000411", "REG_SZ" 'Chinese WshShell.RegWrite "HKCU\Keyboard ...


0

Use the mapped network drive policy in group policy and preferences http://blogs.technet.com/b/askds/archive/2009/01/07/using-group-policy-preferences-to-map-drives-based-on-group-membership.aspx


1

Check for any user or computer log in/start up scripts that might be failing. One of those might be looking for some kind of interaction or be pausing to display some kind of error.


2

The Microsoft article KB247811, How Domain Controllers Are Located in Windows is useful here. That said, here's a list of things I'd check if you haven't tried them already: Run dcdiag.exe on all domain controllers to see if they've been having trouble replicating. You may also want to check the event logs -- sometimes I find them easier to read than the ...


0

Basically, setspn in a proper functioning AD shows no duplicates. I think you should remove 'em at least for the troubled machine. Start with the troubled machine SPN's which miss the realm part.


1

Backup your DCs to Azure. It's extremely cheap (100GB costs $10/month) and super easy to use. Then the recovery of AD only requires the following: access to your Azure subscription - shouldn't be a problem the passphrase used for encrypting the Azure backups - save it offsite, to your pendrive where you store SSH/BitLocker/etc keys, or something Then you ...


-1

Onedrive cloud backup integration.


1

The thumbnail photo is not really related to the users profile as such. It is a property that was added with Exchange2010 to allow for a central, manageable repository for user pictures within outlook. As it was quickly determined that you don't want your IT department to be responsible for hundreds of user photos (you're bringing back bad memories of my ...


5

This is doable, but only through the command line tools - the UI is incapable of making the changes (and of figuring out what those ACEs actually are once they're in place). In order to grant access to a specific user object attribute, for example telephoneNumber, use dsacls: dsacls "CN=AdminSDHolder,CN=System,DC=example,DC=com" /G ...


5

Nothing, the only real "functional" loss is that computers will no longer sync the application and user configurations across machines, and some software from the store will prompt for credentials when run.


28

features of Windows will not work unless a Microsoft Account is used? None. You only lose features of various software, and 99% of that is conveniences that nobody will miss. You lose the "Store" completely, and applications like "Weather" need to have the location configured (they can't just pull that data from your account). Are their any gotchas ...


3

What are the pros and cons of keeping such local (non-domain) admin accounts on domain-joined workstations in respect to: Security There's little difference. An account with administrative privileges can destroy a machine. This is true whether we're talking about a domain or local account. Some would argue that the local Administrator account is more ...


10

Provided you have a Windows 2012 Domain controller, yes! Where can we find group membership details? When you look into the member attribute of an AD group you’ll find a list of all members in distinguished name format. But that’s it. There is no smoking gun or finger prints that tell you how they got there. However, there is a little-known piece of ...


5

The only thing I can think of to solve this is a trick where you use an intermediate group as a dynamic object and then nest that into the primary group so that the user has the permissions conferred to the primary group by way of nested group membership, however, the intermediate group has a TTL (time to live, the entry-TTL attribute) and when that TTL ...


1

Sure. I suppose if it's 'WINDROID device' then check you mail server (Exchange?) enable netlogon on it: nltest /dbflag:2080ffff Netlogon.txt file is created in %systemroot%/debug directory correlate timestamps inside log with time when account lockout happens... don't forget to disable netlogon logging at the end nltest /dbflag:0 Also you can try ...


1

It is possible, one way to do this is: 1) Create a one-way trust from your CustomersDomain to your InternalDomain. 2) Install your SharePoint farm in the CustomersDomain. Because there is a trust between the domains, internal users will be able to connect to it as well. 3) Configure your DNS, firewalls, reverse proxies & co to route traffic to your ...


1

You'll need both the Domain Functional Level and the Forest Functional Level to be 2008 R2. To understand the differences, consult this page from Microsoft: http://technet.microsoft.com/en-us/library/understanding-active-directory-functional-levels%28v=ws.10%29.aspx You'll note that there's no difference between 2008 R2 and 2012 R2 FFL - so that should be ...


0

These are all guesses, but: Is there anything weird going on with the NTFS permissions in users? Is C:\Users\Default corrupted? Is the disk full? Is there something weird going on with the registry permissions in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList? Lastly, Is it your antivirus? Microsoft says, "Occasionally, ...


2

There's a lot more detail to this than a simple question can answer, so I'll add the disclaimer that you really need to hire an AD consultant to walk you through this. There hasn't been a "primary domain controller" in years, thanks to Active Directory. Everything is handled by FSMO roles, which are services provided by the domain controllers. One of ...


1

The checkbox seems to just give Write permissions to the manager, for the membership of the group. You can't do it with the New-ADGroup cmdlet, but should be able to do it with a second line using Set-ACL.


0

Response from MSFT: Case 114120112106756 Any application which looks for client authentication will require client authentication certificate( A certificate issued to Computer via Computer or workstation template). It is an application configuration whether to check for client certificate or not. For example SCCM could be configured to check for client ...


1

Your clients... do they use other DNS resolvers besides just the domain controller that you took offline? The redundancy in Active Directory does no good if your clients have no failover DNS server with which to locate an alternate domain controller... Personally, I would recommend configuring all your domain members to use two domain controllers in their ...


3

Scary the situation you're in, but not impossible, and can be solved easily by enabling "SMTP matching", which is a process of transferring the source of authority from your Office 365 to your local active directory. this can be achieved by matching the SMTP address of your Office 365 accounts to the SMTP address of your Active Directory accounts, and using ...


3

What are the Workstation Certificates used for? Kerberos? they can be used for client authentication during secure channel negotiation (for example, in IPsec or in L2TP VPN). They are not used for initial client authentication, when machine starts up. Will users/machines be able to login Monday morning (post expiration date)? yes, why not? ...



Top 50 recent answers are included