New answers tagged

5

Rename-Computer -NewName 'NewComputer' -ComputerName 'OldComputer' -Restart For further reading, Get-Help Rename-Computer -Full (You might need to specify the -DomainCredential explicitly, just test it and use the Get-Help if you get stuck.)


1

Have you checked to see if there is a GPO with Restricted Groups settings for Members? That would delete the added groups. You could also set a GPO with Restricted Groups settings for Members Of and if someone deleted the group, it would come back at the next GPO refresh. https://support.microsoft.com/en-us/kb/279301


0

You're new to AWS, but I am going to assume you understand how to install a domain controller and add servers to a domain already in your on-premise environment. Otherwise, you will need to go back to basics first. In AWS, when you create a server, it puts the server into the default security group or ones you created. You can create your own security ...


0

we have migrated several users home-folder and network shared, printers several times. The best thing we use to copy is Kls backup software we use sync option to keep data update, use for 30days you can directly upload to azure,amazon for roaming profile we you can set profile path and make it null later. But before doing clean up temp folders and files, ...


0

A previous employer migrated a bunch of user profiles when they moved from workgroups (with 5000+ PCs) to active directory. A couple of years before that, we also upgraded the machines from Windows 2000 to Windows XP. In both cases, we used a third party tool named PC Transplant. The OS upgrade involved (fully scripted): Back up old machine to server ...


0

Prepare the new machine and send it to the user, and ask him to plug it to a second port. Ask him to leave both started and migrate the data (with a simple copy) We do that at my job, but we have an Exchange, thus except some work document and IE favorite, their is nothing much to save. (and we push most of the application too) The only thing that some ...


0

So I just ran into this question while searching for an event ID for Win Ser 2008. Just in case any one else is still in question about Bang account. A bang account is merely a way of granting and tracking people that have/need access to certain resources. Since most of these are administrator accounts, A specific Admin might just need rights to access one ...


0

Ensure you have multiple DNS servers configured Add DHCP_HOSTNAME=<hostname_of_machine> in /etc/sysconfig/network-scripts/ifcfg-eth0 file (if the interface is in fact eth0). Run service network restart. Run net ads join -U administrator command. Also; In the /etc/hosts file can you confirm the 127.0.0.1 entry has your intended hostname.. for ...


0

It seems that It's just a certain firmware or something that doesn't let recursion happen. With a previous version of ipmi it works fine. I'll update this with future findings


0

I think it is better to test for the existence of the sAMAccountname not only for users, groups can also have the same sAMAccountname. This can be done by using Get-ADObject This way there is no exception thrown, but you can throw one yourself. $sAMAccountname = "TestToTest" if(@(Get-ADObject -Filter { sAMAccountname -eq $sAMAccountname }).Count -ge 1){ ...


1

Further to TheCleaner's suggestion of Software Restriction Policies, Microsoft have since released a more "hard core" version called AppLocker. https://technet.microsoft.com/en-us/library/ee424367(v=ws.10).aspx AppLocker is a new feature in Windows Server 2008 R2 and Windows 7 that advances the features and functionality of Software Restriction Policies....


2

Assuming you are going to use a domain and use GPOs, then the recommended (albeit a PITA, but since you are starting from scratch it would be much easier to accomplish) path is Software Restriction Policies. This also has the added benefit of preventing malware/ransomware effectively. https://technet.microsoft.com/en-us/library/hh831534(v=ws.11).aspx ...


0

There are a few ways to do this, but most truly lock a system down. If you implement Group Policy on your server, add your restricted users to the group that will have the limitations. In the GP Editor there a virtually every single parameter available to prevent users from performing certain operations. Including using a USB drive, you can disable them ...


0

I got this error while trying with connecting that machine from one domain to different domain. Editing /etc/krb5.conf also didn't work. Then I tried the following command to reconfigure stuffs for different domain # sudo dpkg-reconfigure -plow krb5-config with desired options and settings which stopped giving the above error in kinit command. Resolved.


0

First you need to authorize DHCP https://social.technet.microsoft.com/Forums/office/en-US/0f666c60-ae59-4ea1-b233-80c2e5f01ac5/unable-to-authorize-dhcp-server-under-active-directory?forum=winserverNIS https://technet.microsoft.com/en-in/library/cc781697(v=ws.10).aspx


3

OK, the problem is that the client has an APIPA address (169.254.139.214), which means that it isn't getting an ip address from DHCP. I can see in your screenshots that the DHCP server has a red arrow, which means it hasn't been authorized, which means it won't assign ip addressing information to clients. You need to authorize the DHCP server and then things ...


0

First check that the DNS record in the error does in fact exist. If not: Make sure the DC is using itself as its primary DNS server. Restart the netlogon service on the DC to re-register the SRV records. Check the records now exist. If they do, ensure your client is using the DC as its primary DNS server and try to join again (but first run 'ipconfig /...


0

Assuming PowerShell scripts are acceptable, here's one courtesy of Matt Vogt. https://gallery.technet.microsoft.com/scriptcenter/Get-Inactive-Computer-in-54feafde # Gets time stamps for all computers in the domain that have NOT logged in since after specified date # Mod by Tilo 2013-08-27 import-module activedirectory $domain = "domain.mydom.com" $...


1

The GPO's are applied because both Computer and User configuration settings are evaluated unless you configure the GPO Status (on the Details tab of the GPO) to User configuration settings disabled. Only then would they not be applied. The group policy engine doesn't know that there are no User settings configured, so it applies the GPO, at which point the ...


0

There was a major change in how group policy permissions work. If you applied patch KB3163622, and you use security filtering to determine how GPOs are applied, you'll probably have to make some changes to almost every group policy's permission scheme. Here's an article that talks about what changed and how to resolve the issue: http://www.infoworld.com/...


1

I'm asking because during inavailability dc-A (FSMO owner) dc-B and dc-C wont replicate with each other. Not accurate. They aren't needed. If a connection stops working to one site due to network issues, the ISTG will create a connection to the other site. You may want to read the following: How Active Directory Replication Topology Works - ...


2

Don't do this with traditional AD DS. If you have to go cloud-only, you should use the Azure Active Directory SaaS solution with Intune for management and Windows 10 on the desktop. You lose things like Kerberos, GPO, etc, but you gain a great amount of flexibility and have no infrastructure to manage. As I said, this isn't a 1:1 comparison of features ...


0

Apparently there is difference in level of User Account Control sensitivity. Also, I think I've seen a Group Policy that would ask full credentials instead of prompting for yes or no when it comes to elevation. As per comments.


1

To make sure you are using your DNS and not other name resolution methods like NBT, I would suggest using Fully Qualified Domain Names in form of client.domain.local on clients, in that case, any AD object that is not on DNS wouldn't interfere.


2

You may have better luck promoting to DC from media, as described in this MS TechNet article Basically, you will move all necessary data in one go with a packed file, instead of establishing all those connections over your high latency connections. After promotion there will be need of regular replication, which will be retried continuously and, hopefully, ...


2

What blaughw said. You might want to look into group policy. Specifically, restricted groups--if you restrict the administrators group, this setting will add users and groups to to the administrators group as well as kicking other users and groups out--or a start up script that includes a line along the lines of net localgroup administrators yourdomain\...


3

With Powershell you can do something like this : Get-ADComputer -filter {*} -searchbase "OU=xx,OU=xx,DC=xx,DC=xx"| Where-Object {$_.name -like "CMP*"} | Move-ADObject -TargetPath "ou=Com,dc=xx,dc=xx" Get-ADComputer selects the computers of your AD. Where-Object only with their name corresponding to the wildcard Move-ADObject and finally you your ...


2

Domain Admin should have permissions. Typically, the Administrators built-in group on a workstation lists Domain Admins group for the domain in question. Has the user logged off and logged back on to the workstation since having rights assigned? Open up lusrmgr.msc (Local Users and Groups) on the target workstation and ensure the domain groups in ...


3

Sounds like your local Administrators group is managed via Group Policy or some other scheduled script. Talk to your IT department.


0

Import the PST file through Outlook, rather than Exchange. Therefore extract the email via Outlook connected to Mail Enable. Once you have it all, reconfigure the Outlook client with just the Exchange account. Confirm it works, import the email with the wizard. I would make the switch on email delivery to the new server before you do the import though. ...


2

you can use NTDSUSTIL and try a Metadata clean up. if there are any references in AD to your failed DC then the Metadata clean up can remove them. check out the link below https://technet.microsoft.com/en-us/library/cc816907(v=ws.10).aspx


0

I had to add .name after $group to make this work for me. $Arrayofmembers = Get-ADGroupMember -identity $Group.name -recursive | select name,samaccountname


0

The answer can be complicated: Security wise I would always prefer domain vs local policies, it also gives you a certain control for them You said that the users are local and they will not be in domain. Anyway I would prefer to have everything centralized but I can see why someone would do that - non connected workstation to the domain (ask about that) ...


0

SysMon should be able to surface this information, including the executable image and parent image. It would be recorded as an event Id 1, ProcessCreate. https://technet.microsoft.com/en-us/sysinternals/sysmon


10

No, this is not possible if the OU is located at the root level in the parent domain (there is instead no issue if the OU is located in a subtree). Reference: http://support.microsoft.com/en-us/kb/240147. The KB article is very old and only mentions Windows 2000, but the limitation still applies as of Windows Server 2012 R2. Oddly, the official guide ...


2

Azure AD Directory Services is a new preview feature that functions more as a Domain Controller as a Service offering and does allow you push GPO's. The GPO and OU structure is more limited to classic AD, but it can be done. It is in preview so bear in mind the SLA consequences for that.


0

The removal of certificates worked in my case too for clearing off the pre-requisite failure. I'm pasting a powershell command in case the GUI does not work PS C:\WINDOWS\system32> Remove-WindowsFeature -Name AD-Certificate


6

Azure active directory cannot be used like this. It is not a replacement for Active Directory (well, at least it isn't at the time of writing). What you want to do is use the intune service in combination with AAD to achieve what you want. I do not believe you will be able to do full GPO, but there are a ton of settings you can configure.


0

using this command "NLTest /DSGetSite" I just solved the problem. thanks for reply


2

You could probably use the ADMT if you wanted to create a new domain, but as you want to have a minimal impact on your user base then the logical thing to do is to join the samba host as a new domain controller (DC) in the same AD domain. After that the AD objects should be replicated to the new DC and you should replicate the sysvol and netlogon shares ...


1

Here's the link to the AD Schema Documentation: https://msdn.microsoft.com/en-us/library/ms675085(v=vs.85).aspx


0

Create a Preferences powerplan for computer object and link it to computer OU. Make sure you create a powerplan for the correct OS type, hopefully you are running Vista+ :-) Computer Configuration > Preferences


0

I recommend moving DNS services to a Linux system. Windows Domains are not the same thing as Internet domains, but I see clients confuse this all the time. And, the less exposed your Windows environment is exposed to the Internet, the happier you'll be.


1

In my experience, I've had to qualify the domain of the group in /etc/sudoers So my sudoers declaration would look more like this: %adgroup@domain.local ALL = (root) ALL Since you've got spaces in the group name, something like: %it\ -\ shared\ services@domain.local ALL = (root) ALL


0

Alas, there is not. It seems the only solution is to find an alternative such as the old ADUC, or PowerShell.


4

Microsoft documented most of the internals of this in [MS-SAMR]. Here are some definitions from that document: account: A user (including machine account), group, or alias object. Also a synonym for security principal or principal. alias: An alternate name that can be used to reference an object or element. alias object: See resource group. ...


1

You should be able to change the user account that is used by worker as described in the article Application Pool Identities on iis.net ... Open the IIS Management Console (INETMGR.MSC). Open the Application Pools node underneath the machine node. Select the application pool you want to change to run under an automatically generated ...


2

dsquery uses the credentials of the logged in user to authenticate (bind) to the directory. ldapsearch does not. Look at the -D and the -W/w options for ldapsearch.


3

No such thing as primary and secondary domain controllers. All domain controllers are equal. Exchange should find the domain controller automatically. Ensure the DNS within the OS is configured correctly and that the second domain controller is also a global catalog. If the original DC has gone away (so cannot be recovered) then you will need to seize ...


0

This is Max token size. The token will only consume that much memory if necessary. It doesn't mean that ALL Kerberos tokens will always be 48000 bytes. This problem is usually only found in large enterprises with many security groups, that have been accumulating for years. In Windows2012, there is a new hard limit for the number of groups a user account ...



Top 50 recent answers are included