Tag Info

Hot answers tagged

31

Yes, you own and control the entire namespace below the domain you purchase, because DNS is hierarchical. Creating mail.example.com and blog.example.com is just a matter of adding entries to the DNS zone that you control. Since you asked about the name. domain, I'll address that specifically: You cited its eligibility requirements and have confused this ...


16

No, there is no "global" list; every company maintains their own classifications. So you will have to contact each one individually.


12

What you're doing in heading down a route that will bring you nothing but pain, heartache and absolutely no sympathy from any support personnel. While you can join a Microsoft PC to a non-Windows Domain, there are few scenarios when this is actually a good idea. So, basically, what I'm saying is - don't do this. Build a Windows Server Domain Controller, not ...


12

I think the concept you're struggling with is glue records. From that linked article above: For example, if the authoritative name server for example.org is ns1.example.org, a computer trying to resolve www.example.org first resolves ns1.example.org. Since ns1 is contained in example.org, this requires resolving example.org first, which presents a ...


10

Let's break this down one by one It's just anorther thing to go wrong. No, it's about 10,000 less things to go wrong. One place to sort out logins, instead of 90. One place to manage printers, instead of 90. Apply settings to 90 computers at once, instead of 90. A machine in a domain is slower to login. No it's not Less stuff is better. And ...


9

The latter. .uk is a CCTLD, or Country Code Top-Level Domain; .co.uk is a subdomain thereof. The whole of the .uk namespace is operated by Nominet Ltd. For many years, direct registration under .uk hasn't been allowed, and the namespace has been split into the subdomains we know and love (including .co.uk, .org.uk, .net.uk, .me.uk, .parliament.uk, and so ...


8

Do not even bother trying to use an old-style domain. No reason. Samba 4 running as an Active Directory Domain Controller is a perfectly viable setup that works without problems. We have it running in quite a few locations now without problems. There is support for group policies, and the various management tools from Windows work for managing the users, ...


7

I was hoping that this would die on SU, but since it's moved here, I will give you my professional opinion on the situation. If an end user needs to log into this server, it should not be a domain controller. Period. Nevermind the whole time nonsense and everything else, which only reinforces this statement. End users should not log into servers that are ...


7

Quite a few things will happen with no DC available: If the domain controller is the only DNS server, the first complaint you will get is that the internet is broken, because the clients have no DNS. Since DC's usually also run DHCP, computers won't be able to connect to the network at all. Computers that are already connected will keep working for ...


6

You should go the other way around. Dedicate the physical server to only being a virtualization host and run your domain controller as a VM.


6

I'm going to assume you're talking about an internal AD domain and your public web presence having an overlapping root namespace here. This is because you've not followed Microsoft's best practice for naming your AD domain. You'll either have to Live with it. Run a web server on all of your domain controllers and redirect all HTTP requests for your ...


6

No, that is not possible. If you create a local account with the same username+password, that should work for many activities. It's fairly easy to setup and test, so you may want to try that.


5

This is where I think a lot of people get this wrong. When you hear or read There can only be one SBS server on the network what you should understand is that they're using the term network in the colloquial sense. What they mean is There can only be one SBS server joined to, and a member of, the same Active Directory domain. You can have, and I've seen ...


5

Nothing is wrong, this is the way permissions with UAC work. Try the search function next time :-) User in domain admin group cannot access directory the group has permission to access


5

In order to find a Domain Controller so that the clients can join the domain they need to query the DNS server that holds the DNS SRV records for the domain. The only way to do that is to set the clients to use the DNS servers that hold the AD DNS zones. It might be possible to configure the clients current DNS servers to forward queries for the AD DNS zone ...


5

What am I doing wrong? The backtick ` is the line continuation character, and the first error you get 'missing expression after unary operator' appears to be PowerShell not seeing the -Query line as part of the previous line. Possibly you are missing the ` at the end of the previous line in your copy of the script, or have got it replaced with an ...


5

The profile is linked to a SID, which changed when the user was deleted and re-created in AD. The path of least resistance here is to copy the contents of the old profile to the new profile.


5

You need to create additional domain controllers. Each domain needs its own Domain Controller, you cannot create multiple domains using the same domain controller. I would like to create a new domain along with root domain. This also requires a new domain controller. In addition, this can be configured as a new forest, or as a child domain with another ...


5

If you can't use rendom.exe because you have an Exchange organization in your environment, you have to create a new Active Directory domain and use a tool like ADMT to migrate users, groups, and computers into the new domain. Some applications do not support migration in this manner - Exchange is one of them. You will have to configure an Exchange ...


5

Why is xy.com the default if you don't want it to be? Add a new default virtual host that does nothing but return a 404. Then add xy.com as a virtual host entry. It'll only get used if requested.


4

Why not simply change the default VHost to a deny one? <VirtualHost *:80> ServerName lol.no DocumentRoot /var/empty/httpd <Location /> Deny from all Allow from none </Location> </VirtualHost> <VirtualHost *:80> ...your VHost goes here... </VirtualHost>


4

Per Microsoft, this is not possible: When you deploy a new forest, you are prompted to set the forest functional level and then set the domain functional level. You cannot set the domain functional level to a value that is lower than the forest functional level. Forest takes precedence as the minimum functional level of each domain in the forest: ...


4

Most software installation programs for Windows require Administrator rights to function properly. This is an artifact of the design (or lack thereof, some might say) of the Windows platform. While there is an increasing trend toward software that installs only within the writable directories accessible to a limited (i.e. non-Administrator) user (things like ...


4

iptables doesn't work like that. It's a layer-3 subsystem (and to some extent layer-2) and doesn't know about things like domain names in any meaningful way. You can block access to an IP address, and if it so happens that the hostnames domain[12].com and sub[12].domain2.com resolve to IP addresses which themselves host no services for other domains, you ...


4

Why does the error occur only when the 2012 DC is on? Because the computer is connecting to the Windows 2012 Domain Controller, which does not have a record of it. This points to an Active Directory synchronization problem between that domain controller and the rest of your domain controllers. How is the user able to log into the Windows 7 machine ...


4

Depends on the duration. Once you remove a service from the network things become unreliable but may not break. If you just want to reboot a DC then authentication/authorization should not really be interrupted. People will log in with cached credentials, boxes that are already communicating will keep doing so with their existing Kerberos tickets etc. So ...


4

I personally like AD, but you've already said you've decided against it. So... VPN Connections to connect them to the office. (Routing and Remote Access/OpenVPN/Cisco AnyConnect/What came with your router/etc.) LogMeIn or something similar on the clients. You can run WSUS outside of a domain. There are registry keys to help you with that, and they can ...


4

It seems that you have already thought of everything. Simply turning them off will make the AD balk at you at most, and might slow some operations in edge cases. Nothing should break. The only danger (and it's not clear from the available information wether it's a real danger) I see here is that your virtualization platform might have dependencies on your ...


4

As with most things, the best (and first) precaution you should take is ensuring you have proper backups, and that they are restore-tested. Otherwise, I can't think of any precautions you need to take before demoting your domain controllers. You ran (and passed) dcdiag, you're not demoting a FSMO role holder, they're not the last DCs in the domain, your ...


4

Fix your website first. Both can be blacklisted, but it's usually just the IP. Different lists keep different information.



Only top voted, non community-wiki answers of a minimum length are eligible