Tag Info

New answers tagged

1

I would check the HOSTS file (http://en.wikipedia.org/wiki/Hosts_%28file%29#Location_in_the_file_system) on the machine doesn't contain any entries for the hosts you're trying to get to. I think the NSLOOKUP tool bypasses the hosts file but the web-browser will not. I would also check you do not have a proxy configured in the web-browser as some types of ...


0

On your Dirsync server, click Start, click Regedit in the search box and press Enter. Click Yes. Locate the following registry subkey: HKEY_LOCAL_MACHINE\Software\Microsoft\MSOLCoExistence Change the value of the entry fullsyncneeded to 1. If the value is 1, the full sync is enabled. When all the data is synced, the value for fullsyncneeded will be changed ...


1

If it is enforced at the same or higher priority level, yes. Here is the order of execution. The setting applied last wins: Local > Site > Domain > OU > OU Enforced > Site Enforced > Domain Enforced The winning enforced settings at the same level are determined by precedence order.


1

Yes - if two enforced policies are applied at the same level, the one that is higher in the list will win. Therefore, if you filter everyone else out of your test policy, this should have the effect that you're looking for.


0

I'm unaware of any stock functionality in the DNS server to do what you want. I'd consider using Windows Firewall rules.


3

You don't give out too many useful information about what Operating System you are using, but these procedures will be similar for Vista/7/8/8.1: To find out what groups you are a member of: Log on to your virtual machine (assuming it is joined to the domain) with your AD user account Open up a Command Prompt Type in whoami /groups and hit enter The ...


0

Sure... this is kinda' creepy IMO, but you can do it. First you need to identify a good attribute to use that can store the kind of a data you want, and extending the AD schema is usually a last resort. Prefer to use an existing attribute if possible. So a fingerprint image... like a JPEG, right? Well there just so happens to be a handy jpegPhoto ...


0

By "applications have been roaming" I think you're saying that EXEs stored in the portion of the user's profile that is "Roaming" are being copied to the server and back down to client computers when the user logs-on. (Hopefully I'm understanding what you're saying. If not, please let me know and I'll edit accordingly.) This is normal behavior. Roaming ...


1

I found that we'd get this error where a mailbox had been moved to another database (leaving a soft deleted mailbox in the the database) and then the moved mailbox had also been disabled. The guid given couldn't be found using get-mailbox (becasue the mailbox has been disabled) but both the disabled and the soft-deleted mailboxes could be found using ...


0

In the case you outline, it should work. You can use a keytab across multiple machines as long as the clients all have some way to figure out what service principal to request a service key for. Kerberos requires that both sides of the connection figure out the service principal via some out of band means. Usually this is a convention based on the DNS name ...


4

What Microsoft said is right: the sync process is one-way, and some (well, a lot of) settings can not be managed by Office 365 in your scenario: they need to be configured on your local AD and then synced; however, your environment lacks any Exchange deployment, so those attributes don't even exist in your AD objects. As joeqwerty said, extending the AD ...


7

I don't think you need to actually install Exchange to accomplish this. What they're referring to is extending the AD Schema for Exchange, which adds the Exchange related Schema data to AD. I don't necessarily see this as particularly risky. Here's a link to details on how to extend the Schema for Exchange Server 2013: ...


3

That's not how it works - the 'user must change password at next login' flag 0s out the pwdLastSet attribute, so that the user is forced to change at next login. When this happens, there's no timestamp, so the minimum age requirement is always considered to be met. You can test this by changing your own password, then (without logging out) checking the ...


0

Here is what we did: On the server Login as Administrator on the server that has the redirected folders... Copy the old folder to somewhere else... Create a new folder with that username Make sure the user has control of the folder Right clicked \\somersrv\x$\Redirected\<username> and selected properties from the menu. In the <username> ...


0

Its not technically possible to have more than one PKI hierarchy on one server and its a bad idea from a security perspective as has been mentioned (single point of failure). The ADCS role ties into the server's identity in AD such that the only way to alter the DN of the hierarchy would be to blow the role away and start over. As far as licenses go, I ...


6

Q: is there another way to do this? A: Do yourself a favor and backup his old data and then delete his profile and redirected folders. Then allow Windows to create his user profile and redirected folders on first login. Then restore the data to the new redirected folders. Currently you're dealing with two different security entities (SID's) even though the ...


0

I was able to fix the import file by removing the line: objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=FreeSMIME,DC=com


7

Does what i am doing above make sense as LDAP connectivity check Running this every 2 seconds is overkill. It's too much. If you're going to do this, consider lengthening the interval to only checking once every 5 minutes or so. LDAP servers are not so prone to crashing that you need to check them every 2 seconds. Does the above code confirm that ...


1

This is a list of useful attributes available on user objects in Active Directory. You're going to want to populate the TelephoneNumber attribute. DirSync or Azure AD Sync will synchronize this to the GAL in your Office 365 tenant.


3

Yes it is. Your internal DNS server will be authoritative for ad.foo.com. Your external DNS server(s) will be authoritative for foo.com.


1

Without more details this is difficult to answer. There are myriad ways to connect to an LDAP server. Validate that the connection URI is correct for the platform that you're using. Also, if you believe a firewall issue to be at fault, check this port list against your open ports. Active Directory and Active Directory Domain Services Port Requirements


0

I don't think you can do anything without changing code. Azure AD does not allow Windows Authentication and stuff like that from IIS servers because you cannot join them to the "Windows Azure Domain". You would need to go over OAuth / ADFS or stuff like that. (requiring code changes)


2

The article does not really distinguish between 2003 and 2008, but it lists 2008 as supported for this procedure. So I'd just go ahead and do everything that's stated in "Procedure 1". This includes using ntdsutil as well as AD Sites + Services, so you actually need both.


4

Yes, it is possible. But the only good way that I can think of to do it using Active Directory is to modify the AD schema. Modifying the AD schema is one of those things that administrators shy away from doing because one, it is basically irreversible (by "irreversible" I mean without an authoritative restore) and two, making irreversible changes to a ...


0

ADFS is one way to realize Single Sign-On (SSO) capabilities. There are other products as well. ADFS provides this ability through SAML based authentication, your applications need to be adjusted to work with that model, it does not "magically" do SSO. In the most current version of ADFS (2012 R2), you can even proxy the SSO Authentication to ...


-1

You can safely add a Windows 2012/2012 R2 DC to an existing 2003 AD domain and use the native tools to manage it; 2012 will run in 2003 AD compatibility mode. One caveat: 2012 servers should not be added to a forest containing Exchange 2003 as there are many schema incompatibilities. It's much easier to upgrade Exchange first. You will probably want to ...


5

It's right where it has always been. The Active Directory Schema mmc snap-in works the same way in 2012 R2 as it always has. You have to install the Remote Server Administration tools first on any server on which you want to use these snap-ins. Server Manager -> Add Roles and Features -> Features: [X] Remote Server Administration Tools ...


0

If they are both Global Catalog servers (and the respective AD DC Roles), both have DNS and Exchange is configured to point to both DNS servers, I can't see there being an issue.


0

Share permissions can be exported via registry key: http://blogs.technet.com/b/askds/archive/2008/11/24/how-to-back-up-and-restore-ntfs-and-share-permissions.aspx NTFS permissions should be copied across via robocopy as described above. If at all possible, try not to use share permissions, as NTFS permissions do everything share permissions do, and are ...


0

I was doing RDP connections, so I needed to allow the groups to connect remotely/lower the remote security level.


1

Actually, the whole netdom bit is quite unnecessary; you can safely rename the DC from the System Properties dialog box, just like any other Windows machine. Be sure to reboot it two times, though, to make sure all references both in AD and DNS are updated correctly. Don't, I repeat don't, mess with SRV records; they are managed automatically by AD, and ...


2

To enable a smooth transition I was thinking of retaining the old name to avoid any systems that reference the OldComputerName to still connect while they are tracked down Rename the DC as planned and add a CNAME for the old name into DNS. Domain authentication will use the new name even for clients that were authenticating off the old. Don't mess ...


1

It sounds like you want to avoid building a new machine with your current naming conventions. This may create more work than anticipated. There are many items in AD DS that are tied to your DC's name. I am not sure that everything in DNS would be updated once you changed the name. A cleaner and more controllable approach would be to stand up a new Machine ...


3

First, if they are XP, I don't think it'll work at all. But yes, there are firewall settings that must be allowed/set in order for Remote Refresh to work properly. See here: http://technet.microsoft.com/en-us/library/jj572986.aspx Also note: Configure firewall rules by creating a GPO from the Group Policy Remote Update Firewall Ports Starter GPO ...


0

Thanks for your answer. It turns out I had to save the script mapping to a text file, uninstall all versions of asp.net on the machines and reinstall asp.net, then replace the script mapping. I may have been overkill, but that's what it took using aspnet_regiis.exe. Best Regards, Steven


-1

This web page shows how to create msi files of Firefox yourself: http://www.klaus-hartnegg.de/gpo/msi_firefox_wix.html The usual method is to disable the auto-updater, and deploy a new msi-file whenever a new version is available. Firefox has since learned to update itself with help of an updater service that runs with system rights. So an alternative ...


0

After more research I found that the answer to my quiestion is Roaming User Profiles. In case any one else is facing similar problem. And here is how to configure it http://technet.microsoft.com/en-us/library/jj649079.aspx


1

The subdomain has it's own password policy, you need to change this as well. A password which always works for testing purposes is something like WeLcOmE123$!, try this. Also, windows can be bitchy about passwords which have anything from your username in them.


0

Do you have a CNAME record set for autodiscover.yourdomain.com pointing to autodiscover.outlook.com? If it's not set, it needs to be. If it's set, then ping autodiscover.yourdomain.com from the client machine and confirm that it's pointing to the right spot. You may need to clear the DNS cache if it isn't.


2

Yes, this is possible. It's a very standard setup. If you don't know where to start, I'd suggest hiring someone if you need this done quickly and/or correctly. This site is intended for people who are already, to some degree, systems administrators in a professional position, and it doesn't sound like you are - which is why my advice is to find someone ...


1

This could easily turn into either opinion-based or "minimal understanding required" to be honest. Since this isn't a one size fits all thing. It will depend on your environment, options at your disposable, downtime allowed (which you stated), size of environment, IP network provisioning and overlap if any, and many other factors. However, given your ...


1

I use this script. You can easily add in another filter for samaccountname. $month = (Get-Date).AddDays(-30) Get-ADUser -Filter * -SearchBase "OU=Users,OU=NFD,OU=US,DC=americas,DC=ad,DC=flextronics,DC=com" -searchscope onelevel -Properties * | where { $_.whenCreated -ge $month } | select SamAccountName,Name,whenCreated | sort whenCreated


0

There's no way to disconnect client immediately as you lock their account. Consider periodic re-authentication to at least ensure that authenticated session won't last longer than configured timeout. See how it works on cisco for example:


0

here's a quick batch script to take care of this issue in about 0.2 seconds, you could then deploy it in their login scripts if you see fit. please note that if something has already been configured using preference locking in firefox this will overwrite it. set loc=no if exist "C:\Program Files\Mozilla Firefox" set loc=c:\Program Files\Mozilla Firefox if ...


1

I haven't had occasion to use the AuthLDAPMaxSubGroupDepth directive. I've always used the LDAP_MATCHING_RULE_IN_CHAIN search control instead. You might have a look at that. It should perform better, in terms of network traffic between the DC and Apache, because the DC itself will resolve the nested groups.


0

Postfix is not an IMAP server, so what are you actually using as an IMAP server currently? I don't know this "Transport suite" tool or Exchange at all, but if it only needs the password for the old IMAP server and not the Exchange password, what might work is to configure the old IMAP server to use another auth source instead of AD and create fake users in ...


0

It was a stupid fault ... In the user's properties -> account -> log on to ... was set to 'The following computers'. I just changed it to 'All computers' and viola. I'll look further into the errors, now that I know what caused it, and see if it does actually tell me that it is related to not being allowed to log onto a certain client.


1

I've seen this fairly often when someone shuts the computer down incorrectly (held power button) after the machine password has been reset. The startup repair runs at next boot and restores the computer to a prior state (before the password change) causing this error. The easiest way to fix this that I have found is to log in or remote in as a local admin ...


1

There are also commands such as "New-RemoteMailbox" and "Enable-RemoteMailbox" which can be run from OnPrem powershell (Exchange Shell) to create a 365 mailbox directly on the cloud while also associating it to an AD Account. Check it out.


1

My understanding is that you can only have one ADCS instance per host and up to 3 CAs in the AD Forest. The "\CA Name" is more about the name of your PKI Tree and should not be confused with \INST1 type instances seen in MSSQL Configuration, which is what I think you may be thinking of. It would be good practice to keep your CAs separated, because if all ...



Top 50 recent answers are included