Tag Info

New answers tagged

7

Does what i am doing above make sense as LDAP connectivity check Running this every 2 seconds is overkill. It's too much. If you're going to do this, consider lengthening the interval to only checking once every 5 minutes or so. LDAP servers are not so prone to crashing that you need to check them every 2 seconds. Does the above code confirm that ...


0

If they are both Global Catalog servers (and the respective AD DC Roles), both have DNS and Exchange is configured to point to both DNS servers, I can't see there being an issue.


1

Actually, the whole netdom bit is quite unnecessary; you can safely rename the DC from the System Properties dialog box, just like any other Windows machine. Be sure to reboot it two times, though, to make sure all references both in AD and DNS are updated correctly. Don't, I repeat don't, mess with SRV records; they are managed automatically by AD, and ...


2

To enable a smooth transition I was thinking of retaining the old name to avoid any systems that reference the OldComputerName to still connect while they are tracked down Rename the DC as planned and add a CNAME for the old name into DNS. Domain authentication will use the new name even for clients that were authenticating off the old. Don't mess ...


1

It sounds like you want to avoid building a new machine with your current naming conventions. This may create more work than anticipated. There are many items in AD DS that are tied to your DC's name. I am not sure that everything in DNS would be updated once you changed the name. A cleaner and more controllable approach would be to stand up a new Machine ...


1

You're correct in that the current conventional wisdom (and widely considered best practice) is to use an unused subdomain of your public domain for AD. For all intents and purposes that's where the relationship stops. Your public DNS and your AD DNS do not need to interoperate. You don't technically need to delegate the subdomain to your AD DNS servers ...


3

Unless you are going to offer Active Directory-related services to machines using public DNS resolvers (which is ill-advised, because AD's security posture wasn't designed to be exposed directly to the public Internet) you don't need to expose your AD DNS namespace to the Internet. Typically all your domain member computers (including the Domain Controller ...


3

Speaking as someone who was once forced to put a server (not a DC, fortunately) in an unairconditioned closet with the door tied open, a hole in the ceiling through which one could see sky, and foot traffic walking by, I'm curious as to how insecure the location is. If they can hoist your server onto a shoulder and walk out in the middle of the day, there's ...


2

I would tend to agree with Shane, this is exactly why RODC exists. What is managements reasoning to prohibit the usage of a RODC? It's just such a bad idea to put the brains of your organization in an insecure location. As for BitLocker, its a good idea, but it doesn't look like its supported. I would suggest using TrueCrypt FDE (Full Disk Encryption) ...


7

This is pretty much exactly what the RODC was designed for - situations where the server might be physically compromised. Gaining physical access to an RODC will give an attacker a good bit of insight into your domain and its structure, as well as password hashes of users that have explicitly been set to have their password replicated to the RODC. However, ...


2

In a small/medium setup where clustering/HA are not a prime concern (esp due to complexities and costs involved in multiple licenses, need for higher/enterprise versions etc.), virtualization may not appear attractive option; that said, it all depends on the number of users and how critical the operations are. Since you have mentioned that "This setup is for ...


5

As @Sarge mentioned in his comment, virtualization is a good route to go for your use case. Please note that these are all mostly opinion and really high-level look at it. Pick a virutalization platform. There are many to choose from these days, I'd personally recommend one of the following: Microsoft's HyperV VMWare There are major pro's and con's to ...


0

Try adding the computer by putting the full domain address instead of just the domain name. This worked for me. Don't ask me why because it shouldn't make any difference but it and it joined fine after trying to connect it all day using just the domain name.



Top 50 recent answers are included