New answers tagged

1

Further to TheCleaner's suggestion of Software Restriction Policies, Microsoft have since released a more "hard core" version called AppLocker. https://technet.microsoft.com/en-us/library/ee424367(v=ws.10).aspx AppLocker is a new feature in Windows Server 2008 R2 and Windows 7 that advances the features and functionality of Software Restriction Policies....


2

Assuming you are going to use a domain and use GPOs, then the recommended (albeit a PITA, but since you are starting from scratch it would be much easier to accomplish) path is Software Restriction Policies. This also has the added benefit of preventing malware/ransomware effectively. https://technet.microsoft.com/en-us/library/hh831534(v=ws.11).aspx ...


0

There are a few ways to do this, but most truly lock a system down. If you implement Group Policy on your server, add your restricted users to the group that will have the limitations. In the GP Editor there a virtually every single parameter available to prevent users from performing certain operations. Including using a USB drive, you can disable them ...


1

Welcome to the club. Getting domain joins to work can be a black art, sometimes... Samba needs an OS-level user for the machine, too. This user needs to have the format name$, where name is the machine name which you're trying to join, and $ is exactly that -- a dollar sign. If you use winbindd this happens automatically, but if you don't then you need to ...


2

You may have better luck promoting to DC from media, as described in this MS TechNet article Basically, you will move all necessary data in one go with a packed file, instead of establishing all those connections over your high latency connections. After promotion there will be need of regular replication, which will be retried continuously and, hopefully, ...


2

you can use NTDSUSTIL and try a Metadata clean up. if there are any references in AD to your failed DC then the Metadata clean up can remove them. check out the link below https://technet.microsoft.com/en-us/library/cc816907(v=ws.10).aspx


0

This is a rather broad question so this is a very broad answer: From experience managing various things in IT, creating a sub-domain for each customer will make your life easier in the future. With a few clients 1 domain will be fine, but with many clients(probably 20+) it will become very difficult to do things like implement features per customer (ie: ...


10

No, this is not possible if the OU is located at the root level in the parent domain (there is instead no issue if the OU is located in a subtree). Reference: http://support.microsoft.com/en-us/kb/240147. The KB article is very old and only mentions Windows 2000, but the limitation still applies as of Windows Server 2012 R2. Oddly, the official guide ...


2

You can demote your DC and run sysprep with generalize option. "C:\Windows\System32\Sysprep\sysprep.exe". Demoting will reset Windows security database, sysprepping will regenerate all SIDs. Time needed for this will be approximatelly the same as rebuilding it from scratch. Somehow it doesn't look like the migration problem is with your new domain if it's ...


2

The easiest, cleanest thing to do would be to wipe the server and start from scratch.


0

None of the configuration you provide relates to the issue you're getting. Mail being rejected based on DMARC rules means that the SPF rules are not respected. You should revise your SPF for both domains to include the other one so that both servers can send for both domains. When doing SPF changes, it's always a good idea to loosen the DMARC rules so ...


1

No, nothing unexpected will happen, since the system uses the SYSTEM principal and you aren't planning to delete that. However, what you are planning to do won't stop an administrator from modifying or removing the object. Administrators always have the SeTakeOwnershipPrivilege privilege, which allows them to set the owner of any object to themselves (or a ...


2

It might be more accurate to ask, "Is there any situation where one would want to log in as the local administrator account on a domain-joined server, and not a domain account?" I never log in as the local administrator account of a domain-joined server. I prefer to give it a complex password and then disable it, but my current colleagues prefer to give ...


0

It looks like you don't have www record. Create CNAME record with www pointing to the abc.com.


0

When I create a Group Policy Object, I cannot link it to the container as it is a group and not an OU. Security Groups and Organizational Units are not the same thing. GPOs are linked to OUs not Security Groups. So link the GPO to the OU that has the computers in it. If the computers are in the same Security Group but not OU then link the GPO to the top ...


5

A forest is a security boundary. A domain is a management boundary. With modern delegation, fine-grained password policies, and item-level targeting in GPO, its entirely possible to create management boundaries within a single domain as well. There's no "right" answer. Evaluate your situation and choose whichever is most appropriate based on your ...



Top 50 recent answers are included