Tag Info

New answers tagged

2

If there is a jake user on each domain with the same password, jake from one domain will be able to access shares on the other domain because the password is the same. It works like this: If jake@domain1 is accessing resources in domain1, a password is not sent to the system hosting the resource because jake got a security token when he logged in to the ...


5

Explicit deny permissions always take precedence over explicit or inherited grant permissions, so, yes, a deny will do what you ask; however, an user with effective administrative rights will be able to forcibly change those permissions by taking ownership of objects and resetting ACLs, so a deny will only block an administrative user as long as he/she ...


0

Event Log Readers builtin domain local group usually works for vanilla access using tools such as Event Viewer. You may want to check your security log (with auditing enabled) to confirm the identity that is actually failing access. In some cases, this may be the Network Service well-known identity. You may be able to add this to the Event Log Readers ...


2

Yes, under specific circumstances: If they can connect directly to another site's domain controllers, they can still log in despite their own site's domain controllers being down (assuming they have alternate DNS to find a domain controller) If their credentials are cached on the local machine, they can log in despite potentially no domain controllers at ...


0

I ran into the a similar set of errors recently when my primary DC's system volume filled up (I'd just taken the job, and the DC was previously sitting at less than a gig of HD space and I hadn't gotten around to freeing space). When it happened, the nt file replication system (ntfrs) on the PDC got corrupted. Make sure that the structure of the sysvol ...


0

I think the real issue is that the domain name is a single-label DNS name (one word (billsgs) and then a valid tld (.net)). By default, DNS clients will not register with these domains because they are likely to be public domains. https://support.microsoft.com/en-us/kb/300684 has instructions to override that.


0

The smb.conf manual page needs to be updated! Indeed it refers to the old Samba-specific encryption mechanism that applies to SMB1 only and is done via unix extensions. This can for example be used by smbclient. But nowadays, the 'smb encrypt' options also controls the SMB-level encryption that is part of SMB version 3.0 and newer. So it is correct that ...


-1

No need to waste time for searching. Demote Outdated domain server Metadata cleanup Promote it again


1

It's been a while since I used SBS 2003, but I believe if you demote it, you will still be violating the licence (because it's not a DC and doesn't hold the FSMOs), and therefore you will still have the issue of the server trying to shut itself down. Best recommendation would be to install Exchange server elsewhere and migrate mailboxes and public folders to ...


1

I would leave the second DC RW. In case of hardware failure, the SBS server might be down for [a day/four hours/whatever your support contract says] while you get the replacement part.


0

Once the 2nd server is restored, was it still part of the domain? you will need to connect this server to the domain and add AD role. It can be RW domain but all FSMO roles will remain with SBS.


2

Installing a new domain controller is just fine. Install, join to the domain, run dcpromo, follow the standard Microsoft guide for it, fine. Migrating DNS and DHCP services? Relatively easy. For all intensive porpoises, you're creating the second domain controller that you should have had in place to begin with. You mentioned that you want to change the ...


4

I didn't know the answer to your question off the top of my head, since after managing 5000+ user workstations and 30 servers without AD I kind of feel like any network larger than two workstations needs AD, ;) so I went and looked. The ADFS requirements at Technet say: Domain Requirements All AD FS servers must be a joined to an AD DS domain. ...


1

You need to set up Conditional Forwarders on each DC/DNS server for the other AD domain. So the mycorp.local DC/DNS server forwards DNS queries for the mycorp.hq domain to the mycorp.hq DC/DNS server and vice versa. When setting this up, you can ignore the following error if you are sure that the server allows Zone Transfers for your DNS Server.


2

Have you used the same hostname and IP address for the secondary? If so you need to remove the secondary as a DC, remove all GUID/references in DNS/ADDS to the old name...or you can use a unique name.


2

Based on my experience of removing items from AD, group policy continues to apply and settings do not revert. Since there was an policy disabling the local administrator account in group policy, this caused no end of vexation at $former_employer. I cannot, of course, speak to every item you might have defined via group policy. You might want to ...


0

DFS namespaces use some referral magic to find \\my.dom.com\somecrap if it is on any of the domain controllers -- not just the ones where the namespace is specifically hosted. Non-DFS shares do not have this feature. Normally, you would make each DC a replica for the somecrap namespace by adding them to the Namespace Servers tab on your DFS Management for ...


2

You ask very interesting question that may need deeper technical investigation. My opinion is that Windows "thinks" \\my.dom.com\SimpleSharedFolder is a part of some DFS namespace. But it cannot find related AD information to build a list of target servers that offer folder's contents. Explorer just displays it as empty folder. What happens is (I suppose): ...


0

Given the size of our environment, we kept it to a single domain and used OU's to segregate the two branches of business.


4

The Microsoft best practice for time keeping in a Windows domain is to configure the domain controller holding the PDC emulator role to get its time from a reliable source. By default, the rest of the machines in the domain will automatically sync up with the PDC emulator, either directly or second hand (or third hand, etc.).


3

So I am sure you found the SYSVOL folder (where Group Policy files are stored) at \\my.dom.com. By default that is replicated between all DC's in the domain ('08 uses via DFSR [Distributed File System Replication] & '03 uses FSR [File Replication Service]) so clients can query the domain \\my.dom.com & whichever DC is closet responds I speculate ...


2

Turn off and delete the failed DC. Perform a metadata cleanup. Rebuild the failed DC. https://technet.microsoft.com/en-us/library/cc816907(v=ws.10).aspx



Top 50 recent answers are included