Tag Info

Hot answers tagged

51

ICANN explains this pretty well in their blog (http://blog.icann.org/2008/09/abkhazia-kosovo-south-ossetia-transnistria-my-oh-my/): As at this time, Abkhazia, Kosovo, Transnistria, Somaliland, South Ossetia and others are not in the ISO 3166-1 standard, so ICANN is not in a position to grant any corresponding country-code domain for them. By ...


23

Yes, the hostname really is case-insensitive, as specified in RFC 3986 § 3.2.2, because hostnames in general are case-insensitive in the DNS. This RFC also gives recommendations on how to avoid the problems you mentioned: Although host is case-insensitive, producers and normalizers should use lowercase for registered names and hexadecimal addresses ...


14

Yes, you will have to buy another certificate* The asterisk wildcard character * will only match 1 label in a resolved FQDN. This behavior reflects RFC 4592 Section 3.3, in its description of DNS label matching and fallback to the asterisk label. If you only need to secure a single endpoint under the .internal.mycompany.com. namespace, you don't need a ...


10

The General Case: How do I remotely issue a CLI command to thousands of Windows domain computers at once? As with most things in our profession, your easiest approach is generally to break the job down into simple, discrete tasks, and then either perform those tasks in sequence, or string them back together (such as by putting them all into a single ...


10

The first MX means that the IP addresses in the MX record(s) for the domain you're actually attaching the SPF record to should be accepted as valid. The second one means that IP addresses in the MX record(s) for the domain mail.mydomain.com should be accepted as valid. If this SPF record is for the domain mail.mydomain.com, then the second one is redundant. ...


9

You will not need to rejoin clients or re-create users if you are doing a domain rename. I don't know what step-by-step guide you're looking at, but the step-by-step guide to domain rename from Microsoft doesn't contain such instructions. I've done several domain renames in Windows 2003 single-forest, single-domain environments with and without Exchange ...


6

Stop using terminology that hasn't been in use in 14+ years. Domain Controllers are no longer referred to as PDC and BDC. If the server is unrecoverable then you'll need to create a new domain on a new server. You can create it using the same FQDN and NetBIOS name as the previous domain but you'll need to join all of the clients to the new domain. There's ...


6

Most software installation programs for Windows require Administrator rights to function properly. This is an artifact of the design (or lack thereof, some might say) of the Windows platform. While there is an increasing trend toward software that installs only within the writable directories accessible to a limited (i.e. non-Administrator) user (things like ...


5

Postfix is highly configurable. so much so that rtfming seems only slightly more advantageous than perusing the source (only joking). There are in fact numerous ways of dynamically overriding the static configuration. At a very minimum, some understanding of the Postfix workflow is required. this is in the overview. It is also useful to understand: ...


5

Strict-Transport-Security - includeSubdomains The problem is the scope of the HSTS header, it includes all subdomains. If accessing http://demo.xml-director.info with a browser first it'll work fine. However, upon first access to https://xml-director.info/ or https://www.xml-director.info the browser will receive a HSTS header for all subdomains set to ...


5

Oddly enough you're not the first person to do this. Dell even has a guide on how to register your DC back into DNS. You really should review everything though, a domain controller is the key part of your infrastructure that needs to be consistent and reliable. Renaming a DC is something I've avoided at all costs in the past, and reluctantly executed with a ...


5

You cover a number of points here, I shall try to address each of them in turn. Is it ok to delete the computer called USER from active directory? It depends. If the old computer has gone, never to return, then probably. Bear in mind that once you delete it (or any object in AD) then you cannot get it back just by recreating a new object with the same ...


5

I hadn't heard of Univention before. It looks like it's a distribution of Linux and Samba with some "baked-in" management tools. It looks like you can install either Samba 3 or Samba 4 (per this screenshot. There appear to be known issues with Windows Server 2012 joining a Samba 3 domain, so that may be your problem. I'd compare the DNS settings on the ...


5

Hopefully, this will be a little clearer for you, even though it's a bit wordy. That part of the slide is slightly incorrect -- the root servers don't ask any other servers for records on your behalf. In that example, all of the heavy lifting is done by Google's 8.8.8.8 server To better explain this, you first need to know the difference between an ...


5

While you can create 2,147,483,393 unique entries in a domain, you probably won't create even a fraction of this in most environments. Regardless 2,147,483,393 is the only hard limitation you have in AD. When it comes to members in a group, there are soft limits which are simply recommendations based on stress tests done by Microsoft and practical use cases ...


5

This is probably nothing to worry about - this will occur when the original local profile folder doesn't unload or is otherwise corrupted. Basically, the first profile will be C:\Users\username If there's an issue with the username folder, it'll append the domain name: C:\Users\username.domain If there's an issue with the username.domain folder, it'll ...


4

I blame UAC! In a default install, the local admin account is exempt from UAC elevation requirements, while administrator accounts via group membership aren't. Try launching the installer with admin permissions or temporarily disable UAC on the system completely, and see if that helps.


4

You should get the UCC SAN certificate as GoDaddy suggests. You need AT LEAST two FQDNs - autodiscover.domain.com and mail.domain.com. Never had an issue with Godaddy certs.


4

Because Kosovo is not (fully) legally recognized. As a result it doesn't have a UN seat either. Quite a political question for SF :)


4

This is actually surprisingly difficult to do. There are a couple workarounds, namely that you can create a new site for your client(s) and the Domain Controller you want them to use as a logon server, or that you can set the LdapSrvPriority registry setting on your domain controllers to give the highest priority to the DC you want used as the logon server. ...


4

It is possible that there are secondary GPOs in more specific deployments (for example, applying only to a specific group of computers) which have more strict password reset requirements. I would recommend running gpresult from a shell run with administrative privileges on the affected machine(s), to ascertain which GPOs were processed. From a command ...


4

The whois database shows that this domain has a status of clientHold: Domain Name: CHOPSEE.COM Registrar: GANDI SAS Whois Server: whois.gandi.net Referral URL: http://www.gandi.net Name Server: NS-1245.AWSDNS-27.ORG Name Server: NS-2014.AWSDNS-59.CO.UK Name Server: NS-835.AWSDNS-40.NET Name Server: NS-86.AWSDNS-10.COM Status: ...


4

Why does the error occur only when the 2012 DC is on? Because the computer is connecting to the Windows 2012 Domain Controller, which does not have a record of it. This points to an Active Directory synchronization problem between that domain controller and the rest of your domain controllers. How is the user able to log into the Windows 7 machine ...


4

Your understanding is not correct. The time for an A or CNAME record query does not depend, in any way, on how many other A or CNAME records might also point to the same IP address. The hosting company may not have enough bandwidth (or CPU, or RAM, etc) to support good response times for all clients if one of the clients is particularly popular, but that is ...


4

iptables doesn't work like that. It's a layer-3 subsystem (and to some extent layer-2) and doesn't know about things like domain names in any meaningful way. You can block access to an IP address, and if it so happens that the hostnames domain[12].com and sub[12].domain2.com resolve to IP addresses which themselves host no services for other domains, you ...


4

Per Microsoft, this is not possible: When you deploy a new forest, you are prompted to set the forest functional level and then set the domain functional level. You cannot set the domain functional level to a value that is lower than the forest functional level. Forest takes precedence as the minimum functional level of each domain in the forest: ...


3

"Free-running System" or "Local CMOS Clock" = not synchronizing with the domain hierarchy. You may want to enable w32tm debug logging to get more information. Also check the domain controller it is synchronizing with, if it is having a w32tm issue/not advertising, it will not be able to sync clients. w32tm /debug /enable /file:c:\Windows\debug\w32time.log ...


3

First and foremost, it's usually recommended that you replace your "domain.com" hosting to be a permanent and visible redirect to "www.domain.com". Usually, it's done either inside your web panel or in your webserver's configuration file with something similar to that (apache2 example) : <Virtualhost *:80> ServerName domain.com RewriteEngine ...


3

You are missing some configuration in your virtual host settings. As explained in Apache docs you need to specify following options for your named virtual host: ServerName www.domain.tld ServerAlias domain.tld *.domain.tld DocumentRoot /www/domain ServerAlias is optional, but usually you will want to use it. In your case you need to specify: ServerName ...


3

SPF records are per-domain, not per-server. They're essentially a list of IPs that are specifically allowed to send mail on behalf of a particular domain. Your SPF record for server.com handles emails with from addresses of @server.com. If you want to apply SPF to emails with addresses of @different-domain.com, then you need to add an SPF record to ...



Only top voted, non community-wiki answers of a minimum length are eligible