Tag Info

New answers tagged

-1

@mortenya (was not able to reply to your post directly, not enough reputation :-] ): To get the file into a CSV, just replace "Out-File c:\PSResults\$file.txt" in your code with "Export-CSV -path c:\PSResults\$file.csv -NoTypeInformation" So it would look something like this: $users = Get-ADUser -Filter * -Properties * -SearchBase ...


6

Kerberos tickets granted for authentication are very time sensitive and the mechanism breaks down absent accurate time sync between clients, servers and ticket grantors.


2

Many authentication protocols check for time skew. Kerberos (AD Auth) being a notable one.


0

AWS has their own set of cmdlets for the AWS Directory Service that you may be able to use in concert with the AD module. Of particular interest is Get-DSDirectory, which returns a DirectoryDecription object with the property AccessUrl for the directory.


0

Do you have transitive trusts in place? If it's just a two way trust then that is why your issue is occurring. Transitive lets users trusted by one domain be trusted by your other domain that's not explicitly trusted.


4

Turned out this is a lot easier than I expected. Any Exchange 2013 database can be mounted on any Exchange 2013 server, regardless of the organization and/or Active Directory domain (although the same or higher CU level is probably required for the server). If a foreign database is mounted on a server, it will work perfectly and can even be used to store ...


2

What you want to do is easily achievable, but you will need to do some research. AD is complex and there is no silver bullet for meeting everyone's requirements. One thing to bear in mind is connectivity - you mention that each site has it's own internet connectivity. Obviously it's a requirement that all these computers (workstations and server) can ...


3

If the svn_auth_file doesn't already exist, you probably need the "-c" option on the htpasswd command for the first user (and only the first user). Note that this will truncate the file if it already did exist, so check first to make sure you're not obliterating an existing file. Also, on Windows you need to run this as Administrator (it is not enough that ...


0

Got it to work. It's actually really simple. Just put the two LDAP servers in the same string: AuthLDAPURL "ldaps://dc01.xxx.xxxx.xxx.xxx dc02.xxx.xxxx.xxx.xxx/xxx,DC=xxx,DC=xxx,DC=xxx,DC=xxx?saMAccountName?sub?(objectClass=*)"


0

Never tried it for DFS, but sounds like you should add an UPN on you Active Directory Domains and Trusts: that adds an "alias" for the domain, so DFS should be redirected properly. Again, never tried it for DFS.


3

If all you want to do is recover items, then yes, it is as simple as you say, but your steps are a bit off. Install new Exchange server. Create new mailbox databases. (Make sure they are circularly logged to speed up the restore time.) Mount old databases as recovery databases. Restart-Service MSExchangeIS For each mailbox: run the ...


0

This article gives some background: https://technet.microsoft.com/en-us/library/cc771756(v=ws.10).aspx There is a SRV record type for TS licensing, which you should be able to leverage to help via NSLOOKUP. My google-fu is weak today, I'm having trouble finding the SRV type. It's similar to how you would discover a KMS licensing server on a network. ...


1

You can do this in a limited fashion in Windows 7 without installing anything extra. Open File Explorer, select Network, and you should see a button in the toolbar labeled "Search Active Directory". Depending on your permissions, it will let you search users and groups by name, and view the membership of those. It won't show you a tree though; you have to ...


3

When you join a computer to an AD domain, a domain controller assigns that computer a unique RID/SID from a pool. The computer then updates several pieces of state information with that new RID. The computer also establishes a machine account password and uploads that to the domain controller. The computer also writes to the Service Principal Names attribute ...


-3

Enable-DistributionGroup -Identity 'acquisitions email' -Alias 'acquisitions-email' The first answer given for this question applies an email address but doesn't provide any MSExchange attributes that are required for an accurate email address.


4

Thanks to all the help here I got to the bottom of this odd behavior, much appreciated! Turns out the "-Filter" argument accepts "åäö" interchangeably with "aao". This is not the doing of PowerShell but further down the stack (thanks @RyanRies for looking into it). That's the reason why the following snippet works: $Company = "aao" Get-ADUser -Filter ...


0

Something like this should work (powershell) Import-Module ActiveDirectory (Get-ADForest).domains | % { Get-ADUser -filter * -SearchBase "OU=Accounts,$((Get-ADDomain).DistinguishedName)" | Select Name, sAMAccountName | Export-CSV "C:\$_ User Accounts.csv" -nti } Just edit the select section for the details you want.


0

As the previously accepted answer is just wrong I will post the correct one here. Microsoft expects you to integrate Office into your Windows deployment image so they removed support for GPO-MSI deployment in order to integrate other features into the installer that are not supported in every MSI deployment situation. You expect everyone that has a need for ...


0

The issue was indeed related to DNS. I was 100% sure it wasn't (as I confirmed it before), apparently it was incorrect.


0

After doing some google search, I found a tutorial that specified pointing fqdn and server name to the localhost in the hosts file i.e. 127.0.1.1 hostname.domainname.org hostname Hope this helps.


1

You might try building the names via code point surrogates: http://stackoverflow.com/questions/4834291/how-to-encode-32-bit-unicode-characters-in-a-powershell-string-literal It's not much better, but at least it allows you to contain the entire script within the source file.


2

I might help you with a workaround. Create a Unicode encoded text file and insert the Company name. Then use Get-Content to store the company name in a variable. $companyName = Get-Content .\companyName-unicode.txt Get-ADUser -Filter { company -eq $companyName } I tested with chinese text (中國哲學書電子化計劃) it and it worked on my server.


2

Daniel answer is correct, but you can do better. TFS has a little know utility to manage user identities described at https://msdn.microsoft.com/en-us/library/ms253054.aspx. TFSConfig Identities /change Probably is too late, but imagine this sequence of actions. Account DOMAIN\user is deleted (SID 1234) from AD TFS will mark the identity deleted in its ...


0

Make a backup of the whole server Make a backup of your "NTDS" Folder Delete "NTDS" Folder Restart DC should be repaired Try some repadmin /kcc and dcdiag /r (maybe with /fix too)


0

I recently ran into this issue when attempting to install Exchange Server 2013 into an environment that previously had Exchange Server 2010. I found the following site very helpful in resolving the issue as they had pinpointed the fix for this error. ...


0

I encountered this same issue and what I found helped was running it as an administrator. it doesn't make any sense, since the information should be available to any authenticated user, but there it is.


4

If you delete a user account three things happen. The account is deleted. More importantly, the SID of the user account gets deleted. The account's SID reference is removed from all security groups. The account's SID reference in any resource permissions becomes an orphan. If you recreate a user account with the same name it will have a different SID. ...


2

For Group Policy "Not Defined" is NOT the same thing as "NOT SET", FALSE or any other meaning. Not Defined means the group policy at the level you are analyzing makes no change to the Windows default. You may also need to looks at - is there a lower security scope (local on a non-domain member) that IS defined. What is the Windows Default action when ...


3

RSOP support has been deprecated. According to http://deployhappiness.com/gpresult-or-rsop/ "Beginning with Windows Vista SP1, Microsoft made the GPResult command the primary tool for troubleshooting Group Policy on a client." Basically, to ensure that you are getting the full result of policies on the machine, you need to use GPResult instead of ...


0

It's not clear to me what you mean when you say that you see all the domains in the forest, but you need to configure the DNS client settings on the server you're trying to promote to use a DNS server that hosts your AD DNS zone. The server you're trying to promote needs to locate a domain controller for the domain in question, and it does so by querying the ...


4

Yes you can install and use with no reboot required. Install-WindowsFeature RSAT-AD-PowerShell Also I want to be clear that this is only for installing the Powershell module. Not all of Active Directory in its entirety. Installing Active Directory is an entirely different thing.


0

I think I have found out what the problem was. By default it seems the new server wants to use the other DCs as forwarders for queries not cached, which is why internal queries worked and public ones did not. I simply removed those posts and just left public DNS as forwarders, and it's running much smoother now. I'm guessing the timeout occured because I ...


3

Active Directory (past Windows 2000) does not allow anonymous operations other than rootDSE searches, by default. So, if you are able to bind anonymously to Active Directory, that means one of two things. Either You are connecting to RootDSE, for which anonymous binds should be allowed by design. You have already modified Active Directory to allow ...


0

As EEAA suggested, it's just a Windows VM and yes you can. There are, however, some best practices you might want to understand. Here is guidance from AWS on their recommended reference architecture: http://aws.amazon.com/windows/resources/whitepapers/ad/


1

What you are looking for is an Identity Manager. There's a few around e.g. OpenIDM. Essentially Identity Managers provision users, manage roles, handle password issues etc. STS like ADFS allow authentication against those users. ADFS sits on top of AD. You could provision directly against AD using ADUC, via LDAP, via C# libraries etc. but these are all ...


1

I always name my internal ad domains ad.companyname.com so I'm not using .local or a made up TLD. using a real TLD so I can get appropriate Certs and avoid DNS issues.


0

All your DNS records for AD point to the old server with a different name, even if same IP. You should have added the new DC with a new IP. That's probably why you're having issues. Try doing an "ipconfig /registerdns" from your new DC if you haven't done so yet. Also GCs are mainly used for inter-forest/domain object searches. Since you only have 1 domain I ...


0

I have found that although the name resolution works with nslookup or the domain name resolution is cached locally, if one does not have a route to the destination ping will fail and never show the IP. I encountered this issue in another lab without multi-homing. Removing the default gateway would cause ping to fail with "cauld not find host" when pinging a ...


0

No, nor should you need to. They should federate with your instance and manage their own users.


2

Can I create my own active directory in a EC2 instance of Windows 2012 without using AWS AD? Sure - why couldn't you? It's a windows server, and you're free to do whatever you like with it. Like any AD deployment, you should have at least two DCs, and you'll need to sort out how to get your clients secure access to the server.


1

With netlogon debugging enabled I found the same result in my Win7 SP1 machines (domain controllers are 2008r2SP1). It also caused an 8 second delay in processing so far as I can tell. Looks like a faulty API call from netlogon to me. You can replicate the same 1355 error by running the following on a workstation: nltest ...


2

Use GPO to set a minimum password length for the domain and then flag everyone's password to be changed at next logon to ensure that the change happens immediately. Update your service accounts, etc, manually.


0

Unless you've configured it manually, empty passwords are not allowed in AD by default (and the flag you mentioned is only half of the required configuration - the other is in the AD Configuration partition). IMHO it has something to do with your implementation, so you question should be in StackOverflow.


3

Running certutil -pulse before gpupdate made the workstation re-install the certificates.


1

This is totally possible to create a policy ruling incoming connection attempts with a GPO. here is the Microsoft documentation pages on how to do that. Go to Computer configuration, Windows Settings, Security settings, Windows Firewall with advanced security. Right clic on Windows Firewall with advanced security. On global policy, you can chose to set it ...


-1

I was able to clear all stored passwords by setting all of the NL$ entries to the same as the last one (the last few NL$ entries were the same so it looks like they are just placeholders). I tested this on Windows 7 PRO 64bit computers, I have not tested it on anything else. Just copy the below into notepad and save it as a .reg then run regedit /s ...


2

We ran into the same issue. USB Drive Letter Manager is a decent tool to use, it'll 'reserve' certain drive letters. Be aware that you do need to pay for commercial use. Otherwise, you might be able to do this with Powershell v3's New-PSDrive -Persist switch?


1

I see this is answered already, but I wanted to follow up. This is a best practices issue. Run the BPA for DNS, and you'll see that it's no longer recommended to have the loopback address as the first DNS server. The IP of the server, in a single DNS server environment, should the the primary, then if you want you can have the loopback address in the ...


1

You've got 127.0.0.1 listed as the only DNS server in the TCP/IP settings of the server. The DCPROMO process does make that setting, but the BPA will generate a warning if 127.0.0.1 is configured as the first DNS server. Set the servers actual ip address as primary DNS and set 127.0.0.1 as secondary DNS, then reboot the server and check it again


0

This problem is caused by 2 Windows updates: KB3000850 KB2992611 To fix the problem: Uninstall these 2 updates. Confirm you can add new users. Install this update as a replacent for the above 2 updates: http://support.microsoft.com/kb/3000850 Confirm you can still add new users. Note: The above resolution was given to me by AWS Support when I ...



Top 50 recent answers are included