Tag Info

New answers tagged

1

No, you can't use AAD to store logon information for VMs. If you need central authentication for Windows VMs in Azure, do what you would do on-prem. Create a new Active Directory domain using one or more VMs as domain controllers and join your other Azure VMs to the domain. If you already have AD on-prem, you can extend it across a site to site VPN or ...


0

You are looking for configuration management. A good step in the right direction would be to create a domain controller and add these computers to a domain. Then, you could use GPOs for the majority of configuration management tasks, often including installing software. That is a broad area and there is a learning curve associated with it. For other ...


-1

The best option i found for this was RRAS role on a 2008R2 Virtual server. this blog here helps explain the process, http://blogs.msdn.com/b/canberrapfe/archive/2013/04/23/routing-traffic-between-subnets-in-your-hyper-v-lab.aspx i used Vmware rather than Hyper-V but the same applies, it was a surprisingly painless process and allowed me to replicate a ...


5

You can use the Get-MsolUser PowerShell cmdlets to export user data from Azure Active Directory and then use the New-ADUser cmdlets to take that data and create the accounts on-premises. That said, there's no turnkey way to do this. You'll have to script something.


0

If any of the DCs of the domain is down i'll never be able to add a new DC to domain? An unreachable domain controller doesn't necessarily prevent the addition of a new domain controller, unless the domain controller that's down provides the link between the new domain controller and the rest of the domain. is there any workaround without fixing the ...


1

It looks to me like you've got a DNS problem. I don't think there's anything FSMO-related really happening. Start by making sure that the AOBVADC001 machine is getting good DNS resolution for the domain.


0

If there is no network traffic at all, it might be an issue with hosts/lmhosts file. Otherwise, there might be NetBIOS-NS name resolutions going, and looking into packet details might show more clues.


6

If the clients are resolving the hostname properly then you've got another problem. DNS is out of the picture once the hostname is resolved by the client. Some things to think about: Are clients using any kind of HTTP proxy to access the Internet? Does the proxy have the correct DNS information available? What's the DNS cache look like on the client after ...


2

VMware is a company, not a product. What VMware product are you using? Yes, pfSense would work, as well as RRAS, or anything else that has routing capability to route between the two subnets. Create two vSwitches. Connect the relevant VM's to the appropriate vSwitch. Connect your pfSense or RRAS (or whatever) VM to each vSwitch. Configure routing in pfSense ...


0

What you are asking: how can I change the Active Directory of the Samba share (from A to B) without modify all the permissions in the filesystem of the samba share server? Isn't possible. The new AD domain will need to be referenced. You'll have to replace the permissions on the existing SAMBA server with permissions for the new domain manually. ...


1

The problem was in the Windows Kerberos setup. I think our Active Directory is set up funky, I don't really know I'm not a Windows admin. But I fixed the problem by manually configuring Kerberos using ksetup in the Windows 7 CLI. After a reboot to my remote workstation I couldn't log in to my PC. That is because in the original configuration the TLD ...


4

Possible but only with the Basic authentication protocol. It is listed here that the Enterprise edition allows the use of Windows Integrated Authentication (Kerberos, NTLM). A little information on Basic authentication: Basic authentication Basic authentication is part of the HTTP 1.0 specification. With Basic Windows Authentication users are ...


1

First double check that your klist output on the Windows box running PuTTY shows a valid TGT. Then in the config for your PuTTY session, make sure Attempt GSSAPI authentication is enabled in Connection - SSH - Auth - GSSAPI. Finally, make sure it's configured to login with your username automatically in Connection - Data. You can either explicitly specify ...


4

The ActiveDirectory module has clever logic that calculate "popular" properties like whether a user account is Enabled or have PasswordNeverExpires set and presents them like regular attributes. Internally, they're derived from actual account attributes like userAccountControl and pwdLastSet. Account Settings userAccountControl is a bitfield, and contains ...


6

If you really want to know what exact LDAP queries are being performed by the Powershell Cmdlets, then you can decompile them by using DotPeek, using the method I outline here: https://www.myotherpcisacloud.com/post/2013/07/08/Taking-a-Peek-Inside-Powershell-Cmdlets.aspx Use $(Get-Command Get-ADUser).DLL to see what DLL the Cmdlet is being imported from. ...


4

I think you'd have the best luck spending some time learning about the AD schema and building queries yourself, rather than trying to reverse-engineer Microsoft's own tools. AD is enough of a plain-vanilla LDAP directory that reference articles that speak about LDAP generally will be applicable. There are some oddball things like bit fields in attributes ...


1

OpenSSL can be a bit.. twitchy.. about what certificates it trusts - sometimes it won't use the system's trusted certificate store. Adjust its config in the openssl.cnf if you're so inclined to make it trust the right store. For ldapsearch, same kind of deal - you'll want to set the trusted certificate in ldap.conf to make it actually use the trusted ...


6

Joe's got the right answer (and should have posted it as an answer.) You'll need at least a one-way trust, with domain B trusting domain A. That way, domain A users can login to domain B workstations (requirement 1). A trust will not, in any way, affect how domain B users continue to login to domain B workstations, so you don't have to do anything for ...


1

When you run ipconfig /all what is the node type? It sounds a lot like you have the wrong node type and possibly no WINS server on your network, a similar situation to what happened to this person.


1

If you don't mind losing dynamic DNS updates from client computers you could install Windows DNS or BIND-based secondary DNS servers in the remote sites. Unfortunately, only AD-integrated replica DNS servers (running on Domain Controller computers) will be capable of receiving dynamic updates from clients. I suppose that, as a bit of a middle-ground ...


4

This will open AD Users and Computers as a user on the remote domain. Requires RSAT be installed. From elevated CMD: runas /netonly /user:REMOTEDOMAIN\REMOTEUSER "mmc dsa.msc /server=REMOTEDC" Shamelessly stolen from: https://blog.ed.gs/2013/09/08/rsat-cross-domain/


3

That T in "VistaT" is no T at all - it represents a trademark symbol: ™ (U+2122 or #8482 in Unicode) Try this: Get-Computers -OperatingSystem $("Windows Vista" + [char]8482 + " Business") Why Microsoft chose to abuse the ability to store unicode symbols in string value attributes in this way is beyond me. Here is how I found out: (When you cast a ...


9

All computer accounts that were created as of December 1, 2011 (12/01/2011) in the Active Directory: Get-ADComputer -LDAPFilter "(&(objectCategory=computer)(whenCreated>=20111201000000.0Z))" -Properties whenCreated | Format-Table Name,whenCreated,distinguishedName -Autosize -Wrap PowerShell, of course. Edit date to line up with your definition of ...


0

If you like GUI tools please chceck AD Info Free, it have many useful reports. AD INFO FREE


0

At first glance, in the manual, Kerberos with SPNEGO is supported out of the box: Similarly to Hadoop RPC, Hadoop HTTP web-consoles can be configured to require Kerberos authentication using HTTP SPNEGO protocol (supported by browsers like Firefox and Internet Explorer).


2

Another method to try to identify those servers might be to run something like Network Monitor on the Domain Controllers and run a capture, filtering for authentication traffic. You could then further filter by the ip addresses of your servers to narrow the displayed results. The trick is going to be determining what authentication traffic is related to your ...


1

One thing you could do is remove the A record and the other DNS Mnemonics. This would result in the usual DNS records for a DC not being registered, and not returned for normal authentication or group policy connections. Then run a packet capture to identify where any traffic may be originating from. How to optimize the location of a domain controller ...


0

I agree with the comments that the tech creating these clones needs some re-education. Maybe some push back on your part, especially if the test servers are on the same network as production servers. In the mean time, this might help you to identify VM guests with duplicate IPs already in your environment. You will need PowerCli, and keep in mind that ...


1

There is no substitute for good IP management policies, ever. The End. Fin. FIN-ACK. Regardless of context, there is no way to prevent people from being stupid with IP addresses unless the software goes out of its way to forbid it -- and it generally can't. How does it know you don't need multiple VMs to hold those addresses, and will only ever online one ...


5

Shut down each DC for a couple of days and wait for the screams. Seriously, it's the only way. Whoever/whatever wants to talk to Active Directory should be able to find a domain controller using the proper process. But some application developers are definitely foolish enough to want a statically-defined DC; well, it's their fault, and they should pay for ...


1

I am a little late to your party here, but I am a full time consultant who logs into many different domains. In my RSAT tools, I use a line like this: runas /netonly /user:domain\userid dsac.exe The domain is the domain of my client, or your lab. This works great, except it throws an error, unable to connect to the domain. It still opens the console ...


1

KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN means the KDC has no idea who holds the SPN, at your case the requested SPN is HTTP/self-test.example.com The two common reasons for this are: the SPN doesn't exists on any account in the Active Directory Forest (doesn't seems to be your case) there are more then one account that is holding the same SPN (duplicate SPN) ...


-1

You have to add the user to the group "Remote Management Users" on the WinRM server.


4

There most likely were logs in event viewer that indicated IP conflicts. Any monitoring system that gathers and filters event logs should be able to detect that and trigger alerts. On physical managed switches you could probably detect and warn about the duplicate MAC address - I am not familiar enough with vmware virtual switches to know what options you ...


5

When you clone a virtual machine in a vSphere environment, you have an option to "customize guest" when cloning or deploying VMs from a template... This is where you can specify a name, change network settings, specify domain membership and generate a new SID (for Microsoft operating systems). That's all you need to do going forward.


0

You can either let the ADFS wizard make necessary configuration for gMSA account or you can pre-create your gMSA account with correct SPN (which is your adfs Service name). Same name needs to be also at certificate subject and SAN fields. -Sami


0

To test an AD Object in general by DistinguishedName, you can use the following: [bool](Get-ADObject -Filter {DistinguishedName-eq "CN=Users,DC=domain,DC=local"}) Or, when you want to search by another property like samaccountname: [bool](Get-ADObject -Filter {sAMAccountname -eq "Administrator"}) Both will return only a boolean ($true or $false) and can ...


0

Active Directory runs in-process with the Local Security Authority (lsass.exe) in Windows Server 2003. There's no way to restart it without rebooting. What you're seeing is definitely odd behavior. I'd be checking out the Directory Service and System Event Logs, as well as attempting to run some simple LDAP queries (using the dsquery tool, or the ldp tool ...


0

You can also disabled the Admin Approval mode for administrators via GPO or in the Local Security Policy. Local Security Policy\Security Settings\Local Policies\Security Options\User Account Control: Run all administrators in Admin Approval Mode - Disabled


3

The first container names lack the container type from your third statement on down to the bottom, and you don't have the first one quoted (for consistency). For example, it should be "ou=Chicago Admins,ou=Chicago,ou=IL,dc=sawahcompany,dc=com".


5

As already commented, the "Account is sensitive and cannot be delegated" flag is a user account attribute, not a GPO setting. If you've checked this box and want to make sure that the change is immediately replicated everywhere, you can use repadmin to force it: repadmin /replsingleobj * source-dc01.domain.tld CN=SensitiveUser,OU=Users,DC=domain,DC=tld


7

This sounds like someone or something deleted the accounts, and then restored them. (Picture an admin saying "oh shit" - we've all been there.) This is the same kind of behavior you'd see when you restore/reanimate objects that have been deleted, back in the old days before the AD Recycle Bin. The object is restored with a blanked password and is disabled as ...


1

Multiple email certificates can cause issues but manual enrollment is a major inconvenience. Instead, there is an option within the certificate template that can help. It requires that certificates be published to AD. Check the box "Do not automatically reenroll if a duplicate certificate exists in Active Directory" Full details here on TechNet: ...


2

The user accounts have been put into a protected group and have their adminCount property set to 1. This prevents the user accounts from inheriting permissions from their parent container. This is preventing your inheritance from working. You can reset the adminCount property to 0 on these accounts and re-enable inheritance, but if they're members of any ...


1

It would be very odd for a Domain Controller or, frankly, any Windows Server machine in general, to not be listening on TCP port 445. The "Server" service handles listening on TCP port 445. You should see the "System" process ID reflected as the PID assigned to the listening socket on TCP port 445 in a netstat -a -o. Verify the "Server" service is ...


4

Active Directory is unusual among LDAP directories in that it is not uncommon to have very large payloads. In fact, the largest payload you can send is 12 Mbytes. This seems outlandishly large, but there you go. On the input side, it's possible someone may send a query like (|(samAccountName=jsmith)(samAccountName=jdoe)(...)(samAccountName=zsmith)) and ...


1

This is what is commonly called a "hub and spoke" topology; you should tell Active Directory how it looks like, and then AD itself will take care of setting up replication conections accordingly. In order for this to work, you need to define multiple sites: Create an Active Directory site for each city. Map the local IP subnet(s) to each site. Define site ...


1

I'll start w/ an assumption: I'm assuming, based on your bullet points, that you've created Site and Subnet objects in Active Directory (AD) that represent your physical locations and subnets. If you haven't that's the first thing you need to do. You really should be allowing AD to create replication connections automatically. I understand why you've been ...


2

The server likely had the RSAT tools for ADDS installed at some point. "Install-WindowsFeature RSAT-ADDS" basically. Probably because the person(s) that installed Exchange ran the AD prep from the Exchange server which requires the RSAT-ADDS tools to run.


3

Adding another answer, since my current answer is based on the currently logged on user's groups...and the OP stated in a comment: Example: "MyReallyLongDomainGroupName" is a member of the local Admins group. So, who has admin access to the system? Or "AnotherVerboseDomainGroupName" is in some file share permissions - who has access to that share? ...



Top 50 recent answers are included