Tag Info

New answers tagged

1

I didn't know the answer to your question off the top of my head, since after managing 5000+ user workstations and 30 servers without AD I kind of feel like any network larger than two workstations needs AD, ;) so I went and looked. The ADFS requirements at Technet say: Domain Requirements All AD FS servers must be a joined to an AD DS domain. ...


1

Sidhistory was designed for migrations, not to enable equivalency. Since you have a trust, there is no reason to circumvent the normal authentication process.


5

You can specify the managedBy attribute, and check the box for "Manager can update membership list". (This grants write permission for the Member attribute.) The person(s) who need to edit the group may be able to do it with the DSQuery widget, for which you can create the following shortcut: rundll32 dsquery,OpenQueryWindow They can search for the ...


1

This command: c:/> ktpass -princ HTTP/vmproxy.mydomain.com@MYDOMAIN.COM -mapuser squid@MYDOMAIN.COM -crypto rc4-hmac-nt -pass P@ssw0rd -ptype KRB5_NT_PRINCIPAL -out krb5.keytab I believe sets HTTP/vmproxy.mydomain.com@MYDOMAIN.COM to be a service principal associated with the squid@MYDOMAIN.COM user in AD. Active Directory does not typically allow you ...


1

If you enable Moderation on the DL, users will not be able to click the "+" sign to expand the group. Attempting to do so in Outlook will result in the following message: Of course, this means someone (or a group of people, if desired) will then have to moderate all messages that are sent to that DL. In our case, we wanted moderation anyway, so this ...


1

The DS-Replication-Get-All-Changes extended right is very easy to work with, since it doesn't apply to individual objects, but to an entire partition! You only need to set it once, directly on the apex (or "root" object) of the partition - meaning that the InheritanceObjectType is totally irrelevant, since it's not to be inherited anyways. Import-Module ...


3

As stated above, this is a question with a multitude of very long answer. So, I'll try to keep very short: backup: with no backup, if something breaks you really have a change of going out of business storage: check that your storage servers (and their disks) are in good healt networking: a careful policy audit should not take too much time (about 1-2 ...


1

I'd search for the help of a project manager on a scenario like this. From my experience, tackling network (infrastructure and logic), backup and security first is a better way to pavement the changes. Also, document every aspect of the current state the whole thing runs before making any change to the environment (photos are great depending on the case). I ...


5

You mention client-facing systems. This to me means your first priority is uptime on the systems that make you money. Networking and storage sound like #1 and #2. (Edit:) Oh, and resiliency. Get your backups checked out, in-line and tested. Make sure you can restore them! Prioritize internal network and AD next, you need a solid foundation. Based on ...


1

I wouldn't migrate the VM at all. Create a new VM in the new region, use a media install for ADDS (https://technet.microsoft.com/en-us/library/cc770654(v=ws.10).aspx) then let the replication catch up. This could be from a disk you added to the existing DC that you move. Once complete, demote the old DC, and remove it.


3

There's only one best practice solution here: you need an additional Domain Controller with the Active Directory DNS service installed. You should then configure a forwarder within DNS to use whatever your preferred provider is. You then have full full redunancy for Active Directory and DNS. You should then configure your clients (Through DHCP ideally) to ...


-2

Right. As I see it you have a few options Leave all client machines with the DC at the primary DNS, leave the secondary empty but set-up DNS forwarding within the DNS server to use your public DNS server (ISP/Google/Etc.). This will give you local resolution and internet resolution, you have to remember if the DNS server doesn't respond within around 2 ...


2

By default, Active Directory will allow users to sign into their Windows machines while the Domain Controller cannot be reached, with the last password known to the computer in question. Once the domain controller is contactable, the client machine will check to see if any passwords for its users have changed. The only problem with this is that the client ...


0

I've managed to solve the issue. There are two things which made it work eventually: Adding to file /etc/sssd/sssd.conf the following directive: ldap_user_name = msSFU30Name Setting up a NTP server and making sure that the offset between the sssd clients and the authentication servers doesn't get above 3 seconds.


0

This really depends on SSSD configuration, in particular auth_provider. auth_provider=ldap requires either port 389 (with TLS) or 636 (ldaps). auth_provider=krb5 requires port 88. ipa and AD providers require both actually, because even identity data is encrypted with GSSAPI, so you need port 88 to prime the ccache to do a GSSAPI LDAP bind, then port 389 to ...


8

You should use TCP ports 389 and/or 636. Port 636 is for LDAPS, which is LDAP over SSL. Encryption on port 389 is also possible using the STARTTLS mechanism, but in that case you should explicitly verify that encryption is being done. Microsoft's KB article says: Start TLS extended request LDAPS communication occurs over port TCP 636. LDAPS ...


3

As long as it LDAP auth only (and not AD/Kerberos etc.), 389 should be sufficient.


0

Are you looking for Exchange server settings, contacts, mail to follow you. Are you are talking about personal dictionary, client side only rules, etc.? Are you using Outlook 2013 with on premise Exchange, Office 365, etc.?


0

If a machine is configured to look to LDAP or Active Directory for user information, local user management commands such as "useradd" will pick up on the existence of any duplicate uid/uidnumber entries in the domain and refuse to create the account. It does not store all domain user information locally (though it may cache it). Duplicate entries can be ...


-1

We really can't tell without logs. Follow https://fedorahosted.org/sssd/wiki/Troubleshooting to gather them. btw it's much easier to use realmd to configure the hosts. See https://fedorahosted.org/sssd/wiki/Configuring_sssd_with_ad_server for the recommended way.


0

It seems that MS has broken the Azman delegation of Hyper-V rights in 2012 R2. It used to work in 2008R2 and 2012 but is no longer working. I am going to open a case with MS for this issue since we require the ability to have non-admins use Hyper-V console for basic functions


-2

Check permissions: who's allowed to use these shares. Also, sharing something on DC is the bad idea.


0

The only thing I'll add to Dan's answer is if you choose to change the name of that profile folder, say back to C:\users\username, then you have to change the path in the registry as well, under HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\<GUID>\ProfileImagePath


1

Your question is overly broad, but to answer one part of it, it is possible for corp.com and newcorp.com namespaces to exist in the same forest. This is a "tree root trust" and occurs when creating a new domain tree in an existing forest, as opposed to the more common "parent-child trust" scenario where a new domain is added to an existing tree and is a ...


2

So called "dollar shares" are hidden, but automatically shared and access is granted to all local administrators of the computer. The fact that you can access it implies you are an admin on the remote machine. You cannot edit their security properties, but you can remove them. That said, you could technically delete the c$ share and recreate it as a ...


4

.local was never a good idea and was never recommended. I'd be suspect of the other material in that book. In the vast majority of situations, your question doesn't matter because multiple domain forests are almost never necessary anymore. You need a new forest when you need a security boundary. A forest is a security boundary. If you require isolation ...


6

Greg's answer is alright, but your question specifically states that you want to check this from the client, not from the domain controller. So I'll take a crack at it. First way, enable Kerberos logging on your client: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters LogLevel DWORD 0x1 Once Kerberos logging is enabled, ...


3

One way would be to check the domain controller Security event log for Event Id 4264 (logon) events, where the AuthenticationPackageName is NTLM or Kerberos. You should also verify that your domain controllers have auditing enabled, and are capturing the required auditing events. You can create custom Event Viewer filters to make this easier, and filter ...


-1

You can force your client to only use one or the other to ensure that you're using Kerberos (or NTLM if you prefer that for some reason). Microsoft has a guide which you may find helpful. It tells how to assess and restrict NTLM usage. Auditing and restricting NTLM usage guide


2

Assuming you have the privileges to do so, you would join the server to the domain. You would basically replace the workgroup with the domain, yes. Depending on how the domain is configured, you may or may not be allowed to do this.


0

What dbr wrote is valid for DNS but is not the real reason of the error message you get. Active Directory is a combination of several protocols (LDAP, Kerberos, DNS, etc.) Before we had Active Directory we had "workgroups" and along with the it the protocols NetBIOS (actually NBT) and WINS. Withing LDAP you have now different domains as well. Microsoft ...


0

If I understand your question correctly, then the answer is that yes, you would typically use DNS to "alias" different hostnames to the same computer, which might have a different name entirely. To take you example - assuming it's two different web servers, you wouldn't need to give either of them the computer name www, even though that's the beginning of ...


0

You cannot achieve what you want via Group Policies. You may find some useful hints here, but these are primarily programmer stuff: Calling regasm without administrative rights for COM interop in Excel VBA COM Interop without regasm Or you can try some application virtualization technologies.


1

At a previous employer, they tried to disable changing passwords via control-alt-delete and force password changing via a web page to address this particular issue. Sadly, you'll likely have to either invest in a third party product or write something (like the web page mentioned above) in order to sync the passwords.


2

Based on my experience of removing items from AD, group policy continues to apply and settings do not revert. Since there was an policy disabling the local administrator account in group policy, this caused no end of vexation at $former_employer. I cannot, of course, speak to every item you might have defined via group policy. You might want to ...


0

DFS namespaces use some referral magic to find \\my.dom.com\somecrap if it is on any of the domain controllers -- not just the ones where the namespace is specifically hosted. Non-DFS shares do not have this feature. Normally, you would make each DC a replica for the somecrap namespace by adding them to the Namespace Servers tab on your DFS Management for ...


2

You ask very interesting question that may need deeper technical investigation. My opinion is that Windows "thinks" \\my.dom.com\SimpleSharedFolder is a part of some DFS namespace. But it cannot find related AD information to build a list of target servers that offer folder's contents. Explorer just displays it as empty folder. What happens is (I suppose): ...


5

This is probably nothing to worry about - this will occur when the original local profile folder doesn't unload or is otherwise corrupted. Basically, the first profile will be C:\Users\username If there's an issue with the username folder, it'll append the domain name: C:\Users\username.domain If there's an issue with the username.domain folder, it'll ...


1

It is scriptable if you have no budget. Powershell script to pull logon info from event logs: https://gallery.technet.microsoft.com/scriptcenter/Find-user-logon-duration-667b8c48 Or very quick and dirty use logon and logoff scripts to write to a pile of text log files on a network share and then gather the data from there: REM Logoff Script: echo ...


5

Office 365 for non-profits: MS Corporate Citizenship page. There's a free tier if you qualify, which might just meet your needs entirely. Otherwise the paid options should be significantly discounted. At only a handful of users, the subscription model should be easy to swallow. I like where you're going with managing mail contacts (Exchange term) for ...


0

Given the size of our environment, we kept it to a single domain and used OU's to segregate the two branches of business.


0

As jlehtinen says above, Active Directory Group Policy Objects (GPOs) can be used to push software out to selected AD clients. It's not massively difficult, but relies on the software install to be packaged in an MSI format. This isn't normally an issue. However, the post-install configuration also needs to be carried out. There are two options here - ...


0

This is the kind of situation that Read-Only Domain Controllers are intended for. Since it's read-only, you would have to depend on your site-local DC to join the domain, but after that the RODC could handle logins for your colo servers. It would also handle read-only DNS, even when the tunnel goes down. This feature requires Server 2008 or higher, with ...


2

Unfortunately, at $previous_employer we ended up using a third party product to do this. Partly because we were the last people on earth to move to Active Directory ;) and we bought the product before we got AD, but afterwards we looked at getting rid of the third party product and it provided functionality we couldn't get without it--namely, the reports ...


0

No, it's not possible. I also suspect there might be some confusion leading you to think that this will address whatever may have prompted that requirement. An Office 365 subscription is contained in the Azure AD directory, and licenses for that subscription can only be assigned to users of that directory.


0

In my opinion, GAL sync and Calendar sharing should be accomplished via Exchange federation. I think this best nails down your 2nd question from both the "ease of setup" and "ease of teardown" requirements. I'm afraid I am ill equipped to answer on the SharePoint Online side. SPO-SPO should be doable, but interacting with a on-premise environment and ...


4

The Microsoft best practice for time keeping in a Windows domain is to configure the domain controller holding the PDC emulator role to get its time from a reliable source. By default, the rest of the machines in the domain will automatically sync up with the PDC emulator, either directly or second hand (or third hand, etc.).


1

I'm not sure you can achieve this - Item Level Targeting is a feature of Group Policy Preferences and, to my knowledge, there's no GPP way of assigning the "Log on as a service" rights. If you could find an equivalent registry key, you may be able to do this but a quick Google has turned up nothing. So, barring that, you'd need a GPO at each "System [x]" ...


0

I do not recommend to join your productive web servers located in the data center to your site-local Active Directory Domain! If the link is down or the connection to your office is bad, you risk losing access to those servers! You could configure DNS forwarding on your data center’s DNS server for your site-local Active Directory domain. For example, ...


5

I feel like you're looking for a one line answer, so here it is: You should have a physical DC if you do not trust your virtual environment's ability to withstand failure. We could wax on about the peculiarities and exceptions with each scenario, but I think this strikes the root of the question.



Top 50 recent answers are included