Tag Info

New answers tagged

0

DNS and DHCP are the best way to check since there can be Unix/Linux machines on the network managed by the AD domain controller or acting as the domain controller. Plus, considering active directory is nothing more than Microsoft's version of Kerberos, LDAP, dhcp and dns. It would be better to understand and debug things at lower layers than layer 7+. ...


1

Use the Credential Manager / Vault (search for it in start) to add a Windows credential for the AD server. Be sure to specify the username as DOMAIN\User. This worked for me just now. [This thread was a top search result but did not have a working answer for me, so I posted despite it being many years old...]


0

logon as a domain administrator click start administrative tools>Group Policy Management find the policy that deals with the password settings most likely the "defualt domain policy" right click then left click edit on the menu that comes up Computer configuration>windows Settings>security settings> Account Policies>Password Policy and change the minimum ...


0

A Windows Image is not tied to a domain account at all. The only supported way for personalization is to customize the Default profile. This is done by personalizing Local Administrator account and specifying that it's settings should be copied at the end of the SysPrep to the Default profile. This requires basic answer file. You cannot skip ...


0

The problem can be caused by many reasons. Here's what to check: Ensure the GPO configuration applies to that server (gpresult /v). You can also check if WU settings are applied correctly on that particular server with regedit, under: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate. There you can ensure that targeting is correct ...


0

The script is now working, with two little modifications: Adding "-Identity" before the first variable $usuario Setting the permission "Reset Password" of the "SELF" object in the "Security" section of the user properties.


0

I would highly recommend that you follow the troubleshooting guides from Microsoft on this topic, will not copy/past them as they're long and very will formated from the source. they have two well know knowledge base articles that will solve almost all of your problems. KB 2647098: Duplicate or invalid attributes prevent directory synchronization in ...


0

Do not adjust the DNS or DHCP properties of your VMs in Azure. You just need to make sure that the virtual network you created in Azure has your internal IP address of the domain controller listed. In this case, 10.0.0.4. This way your second machine can located the first DC to join the domain. From that point on, your DC will be responsible for resolving ...


0

I realize this is really old and this may or may not be part of your problem, but I have noticed in the past that if you don't capitalize the following in krb5.conf, you may run into issues: [realms] MYDOMAIN.COM = { kdc = mydomain.com admin_server = mydomain.com } [realms] MYDOMAIN.COM = { kdc = MYDOMAIN.COM admin_server = MYDOMAIN.COM }


1

Sounds like the DNS configuration is incorrect. If you only have 1 domain controller, set the DNS server on its network adapter to 127.0.0.1. If you're using more than one, set the primary DNS server to the IP of the other DNS/AD server, and the secondary to 127.0.0.1.


0

In your comment, you said there are only SOA and ND records. It sounds like you have you DNS server configured as a stub zone. Right-click the zone under Forward Lookup Zones and pick Properties. On the General tab, click Change next to Type. Set your zone type to Primary and check the box at the bottom for Store the zone in Active Directory.


1

One way to accomplish this goal would be through the use of AppLocker. An excerpt from the link above: AppLocker helps administrators control how users can access and use files, such as executable files, packaged apps, scripts, Windows Installer files, and DLLs. Using AppLocker, you can: ... Create exceptions to rules. For example, you can ...


0

You could create a group policy that makes Remote Desktop Users a restricted group and only include people you want in that group. Be aware, however, that administrators are, by default, allowed to use remote desktop (so if your domain users are administrators they'd be allowed to remote desktop anyway). Conversely, you can use group policy to turn off ...


0

You can use Allow, Deny methods but you have to do correct scoping in your GPO. Instead of adding in remote desktop users group, do it by a GPO (enable remote access) and allow and deny as per the need. Do remember the following. 1. Do not deny all or do not allow all 2. Do not move domain controllers out of the DOMAIN CONTROLLERS OU. 3. Restrict GPOs ...


0

I also learned Kerberos beginning with Achim Grolms' mod_auth_kerb tutorial, really a good piece of documentation. The keytab file only replaces the password authentication. Password is encoded in the file and these bytes are used in authentication challenge with KDC. Any password change on the service account will invalidate keytab authentication, and also ...


1

Active Directory doesn't emulate an LDAP server, it is an LDAP server, with some Microsoft extensions. Yes, some services simply use the provided credentials to do an LDAP bind, and authenticates the user if it succeeds. There are half a dozen ways you can authenticate SAMBA access against AD - a quick google search should bring up step by step ...


0

Issue is due to the server running SBS Server 2008. I believe that DirSync is not officially supported on SBS 2008 or 2011. Resolved issue by installing Azure Active Directory Connect on a Server 2012 host that is connected to the same domain. A much better tool to configure that DirSync. Azure Active Directory Connect is also not supported on SBS 2008 or ...


0

This is tricky, especially since the 4771 event from Windows doesn't contain a logon ID. It's surprising how difficult it can be to track this down, considering how many events Windows logs. Have you looked at scheduled tasks? What I'd recommend is process monitoring, but only enable the network activity monitoring. I think you can also reduce the impact ...


1

After 14 builds of this and going almost crazy I have finally cracked it. Such a simple thing. By default a new server of course registers the adapter with DNS. But specific to SoftLayer this tick box and the suffix tick box are "Unticked". So when building an AD service in SoftLayer you need to do this before adding the Roles & Features: Go to Network ...


0

If you want interoperability between AD and any system that can ever be connected to it, to be on the safe side use only alphanumeric characters and underscores in all names. It doesn't hurt much to avoid spaces and (especially important) diacritics. If you do opposite, the problems may arise when you try ie. integrated login with some software, even despite ...


3

Active Directory has been historically compliant to RFC 2253 for naming conventions; I don't think that has changed for Windows 2012 (info about Windows 2003: https://technet.microsoft.com/en-us/library/cc776019%28v=ws.10%29.aspx ) The RFC lists the following characters: o one of the characters ",", "+", """, "\", "<", ">" or ";" That list ...


1

If you only have 1 AD server, then set the DNS settings on the NIC to only 127.0.0.1. If you have more than 1 AD server, the first DNS server on the NIC should be another AD server and the second DNS server should be 127.0.0.1. Then on your workstations, set the DNS settings to only the IP address of your domain controller(s). Do not list any additional DNS ...


2

It is theoretically possible for a user to exceed the maximum number of login attempts defined by policy. (Especially by using password change attempts.) For instance, say your lockout policy is 5 bad login attempts. A user could attempt 4 logins against DC1, then they could attempt 4 logins against DC2, and still not get locked out after the first bad ...


5

Yes, the account will be locked out. As documented in the Advanced Replication Management documentation: Account lockout is a security feature that sets a limit on the number of failed authentication attempts that are allowed before the account is "locked out" from a further attempt to log on, in addition to a time limit for how long the lockout is in ...


1

20 mailboxes does not seem like a lot to manage so it may not be worth addressing. But if this is needed, there are AD password synchronization tools out there, that bypasses federation. A quick search returns several options: okta, igoodworks, messageops,... The one we tested was set up in about an hour and allowed to sync other AD attributes as well. And ...


1

I ended up editing the values below, removing the forest name from the values, then rebooting. All fixed now. No idea why it happened though! 'NV PrimaryDnsSuffix' & 'PrimaryDnsSuffix' in HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\System\DNSClient 'PrimaryDomainName' in ...


1

Just as a user needs to log out and back in to reflect group membership changes, a computer needs to reboot to reflect group membership changes.


0

In addition to running OpenVPN on AWS you could also use a VPC Virtual Private Gateway. http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_VPN.html You would set up a deice on your side (usually the router or firewall) and connect it to the VPC via a VPN tunnel to an Amazon VPN endpoint. This solution would make it easy to add multiple hosts on your ...


1

If the domain controllers were not able to communicate when you demoted DC01, then you need to take the followings steps. You can google the specifics of each step. 1) Use DC02 to seize the FSMO roles (assuming they belonged to DC01 before the demotion). 2) Clean the orphaned DC from active directory 3) Promote DC01 to a domain controller 4) Move the 5 ...


0

Is starting over an option? Usually you install only the AD DS role from server manager. You'll be prompted to install the DNS role later when you promote the server to the first DC. I suspect your problems came from running DNS before there was a domain. Since you already tried dcdiag /fix, your only other option continuing on would be to manually create ...


0

I found an answer in this link saying you should change the port number to 3268. It is working now! My /etc/httpd/conf.d/subversion.conf file looks like this now: LoadModule dav_svn_module modules/mod_dav_svn.so LoadModule authz_svn_module modules/mod_authz_svn.so <Location /svn> DAV svn SVNParentPath /var/www/svn AuthType Basic ...


2

While you specify "where a user is", Microsoft does recognize the need for identify where a computer object is location wise. There is a location field in these objects that can be formatted and used for scripting queries, assigning printers, settings in GPOs, etc. You can find more information here on SF about it: What is Location field in Active ...


5

In addition to Arthurs answer, which has a slight weakness in utilizing an attribute which may already fill its given function in an organisation, I would submit two alternative possibilities: 1) Using the Exchange custom attributes, if the Exchange schema has been added to the AD. The original custom attributes are described here and the newer custom ...


2

You can do an "install from media" promotion on server01. To quote from TechNet's description (I edited out references to 2008 because you're using 2012): IFM has the following requirements: You cannot use IFM to create the first domain controller in a domain. The media that you use to create additional domain controllers must be taken from a ...


1

Active Directory specifies an "office" field under the general profile information for any given user that could be used for this. You could also create a dummy security group for each room and do it that way. This would clutter AD, but reduce processing load for the warning system (since you're not iterating so much).


0

You could do it with powershell but you would need to change the file type to csv Take a look here. https://gallery.technet.microsoft.com/scriptcenter/Update-DNS-records-with-da10910d and you will find the following powershell script, just set it as a regular scheduled task or something users can run themselves. I used this recently to do a mass update of ...


0

By default, no. (You only see failure logon by default) You need to activate Success Audit in your default domain policy. Which in turn make a lot of log. •In the DC go to Group Policy Management Editor > Default Domain Policy > Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Audit Policy •Set the ...


1

You can try forcing a full password sync using powershell.. Open the DirSync PS console (C:\Program Files\Windows Azure Active Directory Sync\DirSyncConfigShell.psc1) and run: Set-FullPasswordSync then Start-OnlineCoexistenceSync


1

Just go through the normal promotion steps and add the machine to an existing domain. Once it has been promoted go into your AD users and computes, Right click the domain and select Operations Masters. Change these to your DC01 and you are done


-1

Windows 2012 R2 In a Group Policy applied to these workstations, navigate to: Computer Configuration > Policies > Administrative Templates > System > Group Policy Enable the Specify startup policy processing wait time. Set Amount of time to wait (in seconds): = 120


1

I've always done split DNS, because I feel like it's less confusing for users inside the company. If you manage your internal and external DNS appropriately, it shouldn't be an issue.


-1

Best self-explanatory YouTube Video for installing OpenVPN for this you need to use AWS Marketplace AMI - OpenVPN


0

A pretty standard site to site type VPN should do the trick. IPSEC or OpenVPN from a gateway on your premises to an instance on AWS that is bridged / routed onto your private AWS network.


1

This is not odd at all and very common. One easy way to do that is to use an vpn solution, e.g by deploying an openvpn VM from an openvpn AMI (almost everything is configured by default), or by installing another vpn solution on one of your instance. Then, you will only have to log to this vpn and you will be able to resolve your instances with their private ...


1

GptTmpl.inf is where the security settings are stored, so if that file is not present that would explain why the settings were gone. Hard to determine who or what did this unless you have auditing enabled. Restoring the GPO from backup using Group Policy Management Console is preferred over re-creating it. I would check the antivirus product to ensure it ...


2

In all cases Kerberos delegation configuration is a sensitive operation and should be done with caution, manually and by a trusted administrator. Because the SPN contains the name of the computer that offers particular service, it's not possible to specify "all DCs" at once. That's because you cannot know in future what will be the name of your next DC. So ...


1

LDAP zone msdcs_domian.com.com was missing from zone. When drive crashed and windows did a checkdisk it must have rebuilt the file with the missing msdcs.


0

I think i found the solution to this problem. Open this in the workstation where you want to connect, Control Panel\System and Security\System, click Advance System Settings. On the Remote tab, on the Remote Desktop group, click the button Select Users... Click Add and add the user that you want to have access. If you are using AD, make sure you can ping ...


0

You will need to do an authoritative restore for that user. That's going to be the most effective way to repair the user account without affecting any other users in your OUs. The official guide to doing that is here - https://technet.microsoft.com/en-us/library/cc779573(v=ws.10).aspx


4

No, there's nothing wrong with that. The primary advantage to that is that it bypasses the default location for new computers. That advantage (or another that I haven't thought of) may or may not be compelling to you, depending on what policies you have in place in various OUs.



Top 50 recent answers are included