Tag Info

New answers tagged

0

Varonis DatAdvantage for Windows is a great way to solve this issue. It monitors all file system events (create, open, delete, move, modify, permission change) and builds a searchable audit trail. You can setup recurring reports or real-time alerts based on trigger criteria, such as a permission change on your DC or when someone is elevated to Domain Admin. ...


2

Hosting Active Directory (AD) off-site is a pretty atypical configuration, even with the most current versions of Windows. You're not going to find a lot of people who recommend it. From a security perspective, AD wasn't designed with the threat model of being directly exposed to the Internet. You're going to need some kind of secure tunnel from clients to ...


2

A better article for what you're trying to do is: How to remove data in Active Directory after an unsuccessful domain controller demotion. Based on your screenshot of the ntfsutil command you just need to continue with the procedure. Your next step is a select site 0, followed by a list servers in site and a select server x (where x is the ordinal returned ...


7

A third VM would, obviously, be the most desirable but, obviously, another Windows Server license costs money. Active Directory will only disable write caching on volumes where the database files are located. Adding a dedicated volume for file service would be fine in that respect. Of all the roles to "share" on a DC a file server is probably the least ...


2

The domain controller owns that PC once it joins the domain. Admin has 100% full control of every aspect of that machine. He can launch scripts, install software or any form of remote administration. Yes, admin will have access to your nudey files.


1

Don't use a manual peer list if you're syncing from the domain hierarchy. Sync your PDCe from an external time source - not the Hyper-V host. Disable Hyper-V host time sync for your virtual DCs.


1

Selecting "Entire Domain" in the "Find..." dialog causes the search to be run against the Global Catalog partition of the Active Directory. Selecting the domain causes the search to be run against the domain's partition. It's unclear to me why you're seeing older data in the domain partition than in the Global Catalog. It sounds like you're looking at a ...


0

If you have a test system without a real hostname (like ldap.example.org) and name it just ldap, the default configuration of OpenLDAP on Debian(?)/Ubuntu (which I guess you use) will assume an LDAP tree with the name dc=nodomain and create appropriate ACL rules. Really, your best approach is to set a complete FQDN and let dpkg --reconfigure slapd do it's ...


1

Personally I believe the "DNS Island" problem still exists, depending on how you have each DC configured for DNS. I've seen several instances where all DC's were turned off and had the issues you described when turning them back on. Here's what I would recommend: Configure each DC to use the other DC for primary DNS and itself for secondary DNS. Add ...


1

Assuming that you're keeping the test VMs in a private network what you're trying to do is a totally reasonable and valid exercise. Your "AD under glass" environment on the backup server should be isolated into a private virtual switch, and everything the AD environment needs to function must be present there. It sounds like you had some kind of name ...


0

You'll probably need to clarify what "...connect to the outside world..." means. You'll also need to clarify "...without disturbing any other machines...", too. If you mean "access websites" by "...connect to the outside world..." and "...without disturbing any other machines..." as "don't interact with other computers aside from the web servers that the VM ...


1

Is there a solution to allow AcmeService to authenticate a user with SSPI if that user is in an external domain and there is no defined trust relationship? No. If you are constrained to working with the .NET NegotiateStream class, then you will see in the MSDN documentation for the NegotiateStream class, [MS-NNS]: The .NET NegotiateStream Protocol ...


1

If you aren't certain whether those issued certs are used by anything, then you can do this in a phased approach. Revoke the certs, ensure that the DCs know that they've been revoked (using the Certificates MMC snap-in on each DC), and then wait a few weeks. If nothing breaks, then go ahead and remove the CA role.



Top 50 recent answers are included