New answers tagged

1

First, make sure auditing is enabled. How to enable Audit Failure logs in Active Directory? Next, use the Security Event Log, filter for account logon events. (You can start with 4624 (logon) and (4625 (logon failed)) Check out https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/Default.aspx?catid=1 and ...


0

Some attributes are are owned by the system and can never be updated through other methods. https://support.microsoft.com/en-us/kb/276382. That is the cause of your first "lastLogon" error. The other error looks like an access denied message (0x5), 4003 is another error for INSUFF_ACCESS_RIGHTS. Try making the change with a more powerful account to modify ...


0

Go into your DNS server and find the zone for your company website and update the appropriate record to the correct IP from an external DNS server.


0

Active Directory policy "User Configuration\Administrative Templates\Start Menu and Taskbar: Remove and prevent access to the Shut Down command" can state who can't see the Shut down and restart buttons.


0

I solved this by using the following GPO setting: Computer Configuration -> Policies -> Administrative Templates -> Network -> DNS Client -> Dynamic update -> Enabled Which is strange, since the behaviour when not configured is enabled. I double checked and we don't have any other Group Policies active concerning DNS, except for the suffix search list.


0

I found a simple solution to the problem. If I first "reset" the attribute to $null it works as expected... Set-ADComputer -Identity someClient -DNSHostName $null Set-ADComputer -Identity someClient -DNSHostname someClient.contoso.com


1

I know this is very old, but found this while searching for a solution to this very topic. The settings are stored in a REG_BINARY in the registry at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections in the Entry WinHttpSettings This can be applied as a group policy object. Don't yet know how portable (win7 win8 ...


1

The _msdcs.domain.local under the domain.local (which is the first domain in the forest) is delegated authority by right-clicking the domain.local and choosing "New Delegation..." wizard. Run the wizard to point to the same PDC as the SOA. It may seem fruitless to do, but it has a definite purpose. Normally, domain controllers throughout the network ...


7

Maybe you're asking the wrong question. Instead of trying to disable a bunch of local user accounts on a bunch of different computers, perhaps instead you should use Restricted Groups in Group Policy to define exactly who is allowed to be a member of the Administrators group on the computers. It will strip out all accounts who are in the local Administrators ...


5

There is a wealth of public information on how the DC Locator process works. Essentially it performs a series of DNS lookups and LDAP pings, and also attempts to stratify the results by selecting the closest domain controller. It's unusual for Windows DC Locator to continue to use a failed domain controller, unless the domain controller is passing the ...


0

You can use this free GUI tool: "Get Local Admins GUI" Source: http://www.sysadmit.com/2016/02/windows-buscar-administradores-locales.html This tool permits to see the members of the local Administrators group on multiple remote computers. You can export results to CSV and import a machine list from Active Directory OU.


1

Domain controllers ignore password, lockout, or Kerberos policy settings defined at an organizational unit, such as the Domain Controllers OU. You should define legacy password policies in the Default Domain Policy or another top-level GPO. As a test I created password policy settings in both the Default Domain Policy and Default Domain Controllers ...


1

Although I change the minimum password age in the password policy but I still had to change the minimum password age to 0:00:00 in the ADSI Editor for the DC i'm in. @JimB and @Craig620, your help is greatly appreciated.


1

I was finally able to get the script to work. The script was being run however it failed when it attempted to make a call to the Active Directory. The solution was to add the Active Directory module to Powershell. I found the instructions on how to do that here. I also added set-executionpolicy remotesigned and import-module activedirectory to the top of ...


0

Make sure the proper services in the domain controller is on, and run analyzer to ensure your DC is healthy Make sure your DNS is properly advertised Best Practices Analyzer Active Directory Best Practices Analyzer Test telnet port 389 and 3269 from this new machine to the DC


0

Getting a PowerShell script to run as a scheduled task on Server 2008 R2 can be a tricky task. Here is what I did and it works. Scheduled Task Settings General Security options: Run whether user is logged on or not (selected) Do not store password. The task will only have access to local resources (unchecked) Run with highest privileges (checked) ...


1

After implementing various hotfixes from microsoft and testing each, the one which seemed to solve my problem was https://support.microsoft.com/en-us/kb/968372 Im not sure why changing the cache from 24 to 48 hours fixes resolution issues for a DNS record with a TTL of only an hour, but my issue has gone. Thanks for any help offered.


1

I copied the old policy to a new name and unlinked the default policy. You link disabled the Default Domain Policy? Not a best practice, not recommended, probably not even supported. Would explain why it is missing from RSOP and your erratic results. You may want to use the DCGPOFix tool to repair the DDP. ...


0

That's correct. A traditional failover cluster may contain multiple instances, and each instance may contain multiple databases. A database is part of only one instance, and an instance only runs on one node at a time.


0

You can't join to the DC with a computer with the same name that another previously added in the AD and is already running. You get an error when you try this in Windows OS.


0

Instructions below are for how to authenticate to a Samba server using Kerberos from a Windows 7 client. I have not tested for other version of client and server: On the Windows 7 client, "Run As Administrator" cmd.exe. Then enter this command to supply Windows with knowledge of the Kerberos domain controller (KDC) for the kerberos REALM.COM: ksetup ...


1

Use the Net command in your logon script. Example: NET USE P: \\dfsroot\path\to\folder The GPO for drive maps is at User Configuration/Preferences/Windows Settings/Drive maps


0

The other solution, that has worked for me is to unbind the computer from the domain, then rebind it. You may end up with a legacy computer record in the AD Users and Computer DB, but this does seem to resolve the disconnect.


0

instead of cn=prahallad.kulkarni,dc=rezblr,dc=local , try to replace it with : Domaine/administrator , and fill the password with the Domain admin password account. worked for me...


0

if you want to do this via powershell (the way i'd do it) you'll need invoke-command to connect to every server. In order to do that, you need to have the WinRM Service running on every server you want to access, and WinRM must be allowed by local firewall. You can deploy WinRM via group policy ComputerConfiguration > Policies > Windows Components ...


0

You can use the powershell cmdlet get-adgroupmember to get the members of a group. Get-ADGroupMember -Identity 'Your Group' Maybe pipe this to Select-Object Name for a more human-readable list. Get-Command can be useful for finding commands. You can even filter by powershell module (discoverable via Get-Module).


0

What I ended up doing was: Configure AD sites for Site A and Site B. Installed Exchange 2010 SP1 on Windows 2008 R2 machine in Site B. Applied SP2 and SP3. Site A server is configured with mail.domain.com so I configured site B server with mail2.domain.com. Added MX record with lower priority for mail2.domain.com. Ensured that my SPF record contained the ...


5

Group membership changes are not classified for urgent replication so it is normal to see the delay. Maybe you can use the -Server switch to point to the same DC that you are viewing in ADUC and you will be able to view the change instantly.


0

If you are using SSSD you should be able to add a DenyGroups (or AllowGroups) in your sshd_config. See man sshd_config for more but it's pretty straightforward.


4

Technically, this means you can't resolve DNS names for the external domain from inside your network, because your AD DNS servers will assume (correctly) they are authoritative for that zone, and so they will never query the public DNS servers which actually manage that domain; if you need to resolve names such as www.companyint.com from your internal ...


1

Every Windows O.S. starting with Windows 2000 will be able to authenticate against any Active Directory domain controller; you can only have issues if you still have NT 4.0 systems lingering around, because they only support old-style NTLM authentication which is not in use anymore on recent DCs. That said, you really shouldn't keep Windows 2000 systems ...


0

Depending on your AD functional level. For a Windows 2003 Ad functional level, the Audit Policies have to be configured as @Jake said, those are Basic Audit Policies. When it comes to Windows 2008 or higer, you already have Basic Audit Policies and Microsfot added a more complex/grained Audit flavour (Advanced Avanced Security Audit Policy. As @Kombaiah M ...


1

This is the document you are looking for: Active Directory and Active Directory Domain Services Port Requirements Default dynamic port range In a domain that consists of Windows Server® 2003–based domain controllers, the default dynamic port range is 1025 through 5000. Windows Server 2008 R2 and Windows Server 2008, in compliance with Internet ...


0

As described, it's not possible. If other people are "doing this" then you should ask them. Otherwise, the only answer is to manually enter those records in to your DNS. And this is just one of the reasons that you should create your Active Directory forest in a subdomain.


0

I managed to get it done by Stopping the instance detaching the drive created a new instance with new keypair stopped it detached drive attached original drive started instance in the web console previous employees keypair gone, replaced with new keypair name. downside is that the new keypair will not allow me to get the windows admin password. moral of ...


0

Im posting as an answer due to lack of reputations, but its more of a thinking-out-loud response. Apple Configurator and Profile Manager has a "Always-On VPN" options. However, it only works on "Supervised" devices. I dont know whether laptops can be supervised. Also you need a VPN server that supports IKEv2


1

Steps to move Exchange 2010 servers to the new AD Site: Open the AD Sites & Services console and select the Subnets folder. Right click the Subnets folder and select New Subnet. Add the individual IP addresses of the Exchange 2010 servers with a /32 prefix. Assign the IP addresses to the RTL AD site. Add the individual IP addresses of the Exchange ...


1

Ok I can now, after the testlab, answer this myself. The initial request for a TGT from the system being logged into to the domain controller contains the username in clear text in the kerberos payload of the network packet(s) (that much was already known). But: When logging in with domainname\username, this will be the username. When logging in with the ...


0

Actually, the package you need is login_krb5. The other package you need is the heimdal package. You will also need to upgrade to 5.7 as heimdal isn't available as a package in 5.6. Once you've done that, copy /usr/local/libexec/auth/login_krb5* to /usr/libexec/auth. You'll need to do this or the login process won't be able to find them. Finally, an ...


2

You definitely need a static IP address for the DHCP server, period; it just wouldn't work any other way. You also need a static IP adddress for the physical server, because of course it starts before any VM and so it would be unable to contact the DHCP server upon starting. So, you have two servers, and both of them need static IP addressing. End of the ...


1

Mail shouldn't be delivered to the second server if you have AD sites and services configured correctly. My instinct is that you don't. As Exchange is AD site aware, it is important that you have the subnets applied to the correct site, so that Exchange and the domain controllers can see the correct site that they are located in. Although personally I ...


0

This occurs when a GPO has changed on the local computer but a replication event has not completed to the other participating Domain Controllers. You can force replication to the other DCs in the Forest "Get-ADDomainController -Filter * | %{repadmin /syncall /edjQSA $_.hostname}" or simply wait for 15-20 minutes and refresh the GPMC. This is by design and ...


3

The servers DNS needs to point to itself, and the clients DNS needs to point to the server. Servers DNS should be 10.0.0.5 (or 127.0.0.1) Clients DNS should be 10.0.0.5


10

You might be surprised by the response that you get from Microsoft support, since this problem seems to not be so much about supporting Server 2003, as it is about a roadblock that's preventing you from moving to 2012 R2. At least, you should spin it that way. I am also almost sure that this is due to schema customization. It's usually by 3rd party ...


2

if the thing you want to do doesn't require a restart, sure. Check this: https://technet.microsoft.com/en-us/library/dd851779.aspx It's an instruction how to set up an immedaite task via AD (only for windows server 2008 and newer, not server 2003 though - you'll need to update ;-) - many things that make your life a LOT easier you cannot get on Win Serv ...


0

If you need to see your own groups, there's whoami /groups: Displays the user groups to which the current user belongs. The advantage of this command over net user /domain username is that implicit group memberships are also displayed with whoami.


0

I had the same issue, couldn't deploy a printer via GPO to Windows 10 clients. The fix was to download and add the most up-to-date printer driver that works with Windows 10 to the print server, then update the driver in the printer instance.


1

RADIUS (and NPS, its Windows implementation) is your friend. You can start from here: https://technet.microsoft.com/en-us/library/hh994700.aspx. If you have more specific questions, feel free to ask. As it is, this question is way too generic to be properly answered.


0

An update to the instructions above as a few things have changed since then. In OpenBSD 5.6, a decision was made to remove Heimdal from the base distribution due to concerns about code quality and nobody being willing to spend the time to audit it. In 5.7 it was made available as a package (For 5.6 you'll need to build from source or figure out how to ...


1

To perform a powershell search of all users with the msExchRecipientTypeDetails equal to 2, the following should get you started Import-module ActiveDirectory get-aduser -filter 'name -like "*" -properties * | where{$_.msExchRecipientTypeDetails -eq 2} | select distinguishedname,msExchRecipientTypedetails | Export-csv LinkedMailboxes.csv You might want to ...



Top 50 recent answers are included