Tag Info

New answers tagged

0

Take another look at the sssd.conf I gave you on your Wheezy SSSD-AD question over on StackExchange. You need the ldap_group_nesting_level = 5 entry to enable nested groups.


0

Separating the computer and user configuration from each GPO doesn't really make much sense. Each GPO is applied in a processing order, and whether each of them contains user, computer or both kinds of settings doesn't affect that. Though in general, it's fair to say that computer configuration is applied first, since it's processed at computer startup ...


0

Per Andy(who didn't provide an answer I can mark correct), I ended up using Powershell to do this: powershell Import-Module ActiveDirectory New-ADObject -Name auto.folder2 -Path 'CN=autofs,DC=example' -Type nisMap -OtherAttributes @{'nisMapName'='auto.folder2'} New-ADObject -Name /testldap/folder2 -Path 'CN=auto.master,CN=autofs,DC=example' -Type nisObject ...


1

Just disable the second NIC, join the domain, and restart. Then you can re-enable the other NIC.


3

Enable Audit Policy in the DC, and check the security log (vent ID 4624). Be aware your log will fill space really fast. Auditing can be enabled on the Domain Controller as follows: Log on using an administrator account. Open the Active Directory Users and Computers tool. Right-click the container holding the domain controller and click Properties. Click ...


13

In addition to @jscott's reference (+1) and slightly too long for a comment: something similar is done with the case, as although the username is stored in the correct case, you can log on with a username in all small, upper and even mixed case. HBruijn = hbruijn = HbRuIjN, AD is case aware but not case-sensitive in some of the fields. The correct term (in ...


27

This is by design. In short, Active Directory maps the accented/diacritical characters to their "simple" form. Please see the following Microsoft Support article. Windows logon behavior if your user name contains characters that have accents or other diacritical marks: If your user name in the Active Directory directory service contains one or more ...


2

First of all, there's no such thing as a PDC or a BDC anymore, and hasn't been for a long time. Secondly, the easiest way to replace a domain controller is to build a new server, promote it to a domain controller and allow the Active Directory databases to replicate over. If necessary, the FSMO roles can be transferred (or seized) to the new domain ...


3

The existing answer didn't satisfy my curiosity and I didn't want people getting more than they needed from my directory. So I did a little more digging. Main Info here: http://support.microsoft.com/kb/891995 Breakdown: If you want to synchronize your program's database with AD (like sharepoint/FIM) you have two ways of asking AD what's changed since ...


1

As suggested in the comments, having a scheduled powershell script run would be the best course of action. How you schedule is up to you, I would suggest some time late in the evening, so any changes you've made during the day will take place overnight. Now the script... I think it would be prudent to have the script pull all the users from the OU and ...


3

No, not unless you re-build the MSI (with third-party software). What you can do is distribute the file with Group Policy Preferences, or even with a computer startup script. I strongly suggest GPP, as it's very easy to set up.


0

Very old question but I want to leave my opinion here. I work as system and network administrator (and security adviser too) on a government institution with 600+ computers in 7 buildings. There is a lot of government (very old code) software that is installed ONLY to the specific user. So when I need to troubleshoot something I need to log in to remote ...


1

Check for dns config on client (first dns server1 and secondary server2 etc). Check domain fsmo problems (dcdiag and other tools). Check time and date on dc. Because time is sometime a problem on physical server(motherboard battery down... ). And check ntp config on the two dc(time source).


0

I would recommend against using the filter based access control filters for most deployments for two reasons: they are hard to get right the filters are applied on the user entry that is logging in. This might have interesting consequences especially if the filter contains a memberof attribute while the user is a member of nested groups - since the user ...


0

Turns out, this was a bug in ADFS 3.0. I do not know if it has been resolved in a more recent release.


0

There is a cmdlet you can use to accomplish this. To update your GAL Update-GlobalAddressList -Identity "Default Global Address List" -DomainController "YourDomainControllerName" To hide disabled users in your GAL get-mailbox "Disabled_User" | set-mailbox -HiddenFromAddress ListsEnabled $true Or this will do this operation for all disabled mailboxes: ...


5

What you're talking about is a feature called "fine-grained password policies", and requires a domain functional level of Server 2008 or higher. There's a nice, easy step-by-step instruction guide on enabling and using fine-grained password policies on the Technet blogs, if you'd like to take a look, but it's not all that complicated. The thing that trips ...


0

Honestly, 100 computers (five locations with 20+ each) really aren't very many. You could write a script in batch or powershell to add them to the new domain remotely. (PowerShell 3's version of add-computer allows you to add a remote computer to the domain.) No, the part that makes me nervous is the five identically named DCs in identically named ...


0

Physical hardware is best if possible. I have seen a lot of chicken and egg type scenarios where people are having problems getting their virtual machines to boot up. They can't log into their virtual machine hosts to fix the problems because the domain controllers aren't running to authenticate them (because they are on the VM hosts having issues). How ...


0

DCDiag /fix and restarting netlogon did not work for me... I was able to find the netlogon.dns file and recreate all of the dns records. It was pretty painful... took me about 30 minutes to manually create and test them but it ultimately seems to have fixed the problem. Thanks for your thoughts


0

In your sssd.conf configuration file, you can modify the access filter to meet your needs: Under the domain/default section, try the following: access_provider = ldap ldap_access_filter = memberOf=cn=GroupName,ou=Groups,dc=domain,dc=com


0

After doing some more RTFM I found the details in sssd-ad(5) - I must have missed them the first time: the default access_provider is permit, so every user that can authenticate is given permission to login to the system. This is explained in sssd.conf(5). to manage specific permissions you must set access_provider = ad you then use ad_access_filter as ...


-1

Probably the best reply would be: "The current proposal for a solution is to use "get-mailboxstatistics | fl Displayname, ServerName" or "get-mailbox | get-mailboxstatistics |fl Displayname, ServerName". If Displayname is too ambiguous, you may use Identity or PrimarySMTPAddress instead." Read the full explanation here.


1

That field is most likely being used to track licensing or plans from Microsoft / other SaaS solutions. Do the other users you have who have 'Yes' next to their name use something like Azure AD Premium, Office 365 or access to one of the Apps in the Azure AD SSO-supported list?


3

It's unusual for DNS records to be deleted (unless a person deleted them). Usually they are dnsTombstoned, so the records may still appear if using another tool like ADSIEdit even if not visible in DNS Manager or nslookup. There are edge cases where scavenging can cause this (and a lot of other problems if scavenging is not configured properly). ...


8

1. Restart the Netlogon service on one of the Domain Controllers OR 2. Run DCDiag /fix OR 3. Manually create the records from the netlogon.dns file from one of the Domain Controllers


1

check there: http://technet.microsoft.com/en-us/library/virtual_active_directory_domain_controller_virtualization_hyperv(v=ws.10).aspx The bug I seen in the past was if the DC die, my hyper-v console refused to open. So, like they told try to not create a single point of failure.


0

Try this tool - LDIFDE, you can export and import users and objects LDIFDE


4

First off, please read the VMware docs available here and here. Your question clearly shows that you didn't read it at all. vCenter is how you manage ESXi Servers professionally in a multi-ESXi-host environment, it provides lots of features like host profiles, VM and Host Management via a web client, powerful scripting API, inventory etc. On to your ...


0

Thanks to all who responded. The problem was that I was attempting to install using my original media and various updates had already changed the Active Directory organization configuration version. After downloading the latest cup (http://www.microsoft.com/en-us/download/details.aspx?id=45221) both the above errors were sorted. To the folk that warned me ...


0

Anyone can attempt to authenticate from any workstation. By way of analagy, you are trying to prevent the janitor from putting the wrong key in any door. The only way stop that is to prevent the janitor from doing so is to simply tell him which key in what door, but you can't stop him from trying without physically stopping him. I'm not sure why you ...


2

You cannot do this, unless you start blocking ports, which won't be limited to a specific user. Sorry. Think of it this way - a Windows system doesn't know who a connecting user is, until they authenticate.


0

Samba means different things to different people. To some, it is a way to implement LanMan-style networking without tithing to Microsoft, using WinBind to provide pseudo Domain Controller services without actually running a Windows Server. This is perhaps why ‘drookie’ made the comment “Seems like you have AD running but for some reason you don't want to use ...


0

I doubt the missing shell is the problem, the config file specifies a local override for the shell using the override_shell directive. Do you see any errors in /var/log/secure (or your distribution's equivalent) ? Can you turn on the debug_level for the [pam] and [domain] sections and see if there's anything of interest? Checking whether the AD users are ...


2

You'll need to establish a working connecting to the domain to log in as a domain user - at least for the first time, subsequent times may be able to use cached credentials if they're enabled. You should probably log in as a local user, establish a VPN connection, hit 'switch user' and log in as a domain user.


0

My guess is that the the problem is the auth required pam_shells.so line in your /etc/pam.d/vsftpd config. This requires that all users have a default shell which is listed in /etc/shells and your AD authentication might not be providing that correctly. I would test by simply commenting that line out and then if it works make a decision about whether ...


1

@Rogerl You need to open the Exchange error log located usually c:\Exhcangesetuplog (or similar directory), view the last section of the log, it should provide you with some information. Since you stated that you have ran the install already in the past, you either didn't remove/uninstall it properly or your AD DCs are out of sync, which is quite a big ...


2

Setup encountered a problem while validating the state of Active Directory: The Active Directory organization configuration version (15870) is higher than Setup's version(15844). You're using install media that's older than the previous time you installed. That won't work, switch back to the newer media. Global updates need to be made to Active ...


2

because I've logged in with an account that has access to pretty much everything. You're not being very precise here. Go into ADUC and confirm if this account is a member of Enterprise Admins. This isn't rocket science, it's spelled out quite explicitly in the documentation and in this error you're getting. But that's if you were having a problem with ...


2

It may be that the account is both a valid Microsoft Account (formerly Live ID) AND a valid Organisational Account (Azure AD). This can happen (you have a Live ID for years then your company signs up for Office 365) and leads to all sorts of fun and games because 'home realm discovery' defaults to Azure AD. In the first login box provided by Azure try ...


0

If you want to send to Exchange (Online or otherwise) without needing a mailbox, Exchange Web Services will be your best friend. http://msdn.microsoft.com/en-us/library/office/jj536567(v=exchg.150).aspx You will not need a full licensed mailbox to leverage EWS, however there are restrictions. Learn more about those here: ...


0

Back up everything! AD is one complex and picky beast. You don't want to be responsible for bringing down a whole domain. If your using exchange the first step is usually too change the mail domain for all of the users of the company which was purchased to the head companies domain. You will have to set up shared address space SMTP and Mail routing for this ...


0

Creating a cross-forest trust. This can be complex, and I would recommend bringing in an Active Directory expert. Here's some basic reading on Active Directory trusts.


3

Anonymous LDAP queries are usually disabled on Active Directory domain controllers, and for very good security reasons. Any authenticated user can perform LDAP queries (as long as they are only reading non-sensitive data); the best approach is thus to create a generic user account for this purpose and use it whenever some application or device needs to ...


0

Any luck trying this? If you exported the self-signed root Certificate from the previous CA, you could create a GPO to automatically add this Certificate to every device's "Trusted Root Certificate Authorities". This would mean that any certificates signed by this CA will be trusted, because the root certificate is a trusted root certification authority. ...


0

This depends on the wifi hardware you are using. Modern decent hardware, like Cisco, has a way to supply access points with a correct ssid using radius, which is now called NPS in Windows. So basically - yes, this can be done. What is more disturbing, - according to your description it seems like both domain users are mixed in the single network. This is ...


0

As I understand it, you're looking for a way to create a time window that would force only users logging to a computer, but not a phone. I don't think it's possible, but I have several thoughts: Create several Password-Policy-Objects (PSO) and apply them to the different users according to their needs. In all PSOs set the notification so users will receive ...


0

I would send an email to users that haven't changed their password within the threshold and tell them to change their password by a specified date, after which Password Never Expires will be turned off. When that date arrives, remove Password Never Expires for users that have changed their password. Repeat until finished.


0

How about just communicating the policy change with a decent notification email, defining a reasonable grace period? Notify a couple of times, including on the last day of the grace period. You should be able to pick up most people, based on this If you must enforce it, after the grace period, run a one-time script against all users that have a 'password ...



Top 50 recent answers are included