Tag Info

Hot answers tagged

35

One central component of Active Directory is LDAP, which is available on Linux in the form of OpenLDAP and 389DS (and some others). Also, the other major component Kerberos is available in the form of MIT Kerberos and Heimdal. Finally, you can even connect your machines to AD.


25

In the case of Debian and its related distros, adduser is a friendlier interactive frontend to useradd.


22

You can try with puppet for managing user: Why Use Puppet to Manage User Accounts? (and not NIS, LDAP, etc) One of the benefits to managing user accounts in puppet is the fact that it is decentralized. Each user account is just a normal user account on the managed server. There is nothing special about the user accounts puppet creates other ...


21

Open up "Control Panel | System and Security | System" In the dialog click on "Advanced system settings" (requires Admin rights) The "System Properties" dialog will be displayed Make sure you are in the "Advanced" register In the "User Profiles" section click on "Settings" The "User Profiles" dialog is displayed Select the account. Hit Delete. Faster: ...


18

I'm at a Tier 1 PCI vendor. We have something like this in place, with a few differences. The auditors are actually attempting to describe a very real problem, but doing an incredibly poor job explaining the implications and needs analysis. It is now more effective to compromise a system by using a hash of a password or an existing token. Put plainly, ...


18

The one place I can see it being justified is on service accounts. Typically you don't want a service account password to simply expire which could cause all the processes that account runs to fail. Interactive user accounts should always have passwords follow the password policy. You have to make sure if you do set service accounts to not expire that you ...


13

On Ubuntu, useradd simply creates an entry in the user database (/etc/passwd etc.). adduser on the other hand also creates a home directory for the user, populates it with the content of /etc/skel and lets you set the password interactively.


13

FreeIPA is probably what you're looking for. It's to Linux what Active Directory is to Windows. (It can also talk to AD if you have a heterogeneous environment, but shouldn't be used to manage Windows machines directly. Use AD for that.) Red Hat's documentation (they call it Identity Management) is very thorough and easy to follow, and should be mostly ...


11

This has thrown me for a loop in the past as well, as I had read (and experienced) this first hand. The answer is that Microsoft changed the behaviour of store.exe with 2 hotfixes. The 2 hotfixes that modify this behavior is 916783 and 903158. More information on the change can be found : ...


11

There are many ways that would help: remove the complete home directory and copy all files from /etc/skel back to the homedir. Change permissions afterwards. put the system in a virtual machine, make a snapshot and revert to the snapshot after lesson 1 find something like a kiosk mode in RHEL. Ubuntu has something like that, which automatically restores ...


10

It's a limitation of legacy Unix systems, and the NIS directory service in particular. Usually, this restriction is just in place if the organization is trying to keep usernames consistent across all applications (which is generally a good idea).


10

Q:How can I test that their account is being correctly redirected without logging into it? A: You can't. You'll have to test it with the user present. There's no way to test whether or not GPO, Folder Redirection, Roaming Profiles, etc. actually work correctly for the user without logging in as the user. You could certainly run GP Modeling from the GPMC to ...


10

In AD Users and Computers, inspecting the Object tab of the user account, there is a Created field. You would need to select View menu > Advanced to be able to see the Object tab.


9

No. You can't do this. It would be horrible security practice to do anyway since you'd be collecting a very long list of usernames and passwords that your user likely use for other services. What you can do is enforce a minimum password length of 9 characters in Group Policy, which seems like a sensible thing to do, given the problem at hand.


9

Microsoft Baseline Security Analyzer 2.2 - Run, "Check for weak passwords", Start Scan...


8

Under Linux, the usermod command changes user names. It modifies the system account files to reflect the changes that are specified on the command line. Syntax: usermod -l new-user-name old-user-name Only the user's (login) name will be changed, and nothing else. You may also want to change the user's home directory name, as below: usermod -l ...


8

The user ID of scan is set to 0 (root). Check if /etc/passwd contains two entries for scan. One mapped to root. Otherwise, if you are using any other name services check that these dont export scan as UID 0. And make sure you tell these people mapping multiple accounts to the same UID is not a good idea as you break the separation of privileges you would ...


8

Your question is not stated very clearly... howewer, here's how it basically works: Each process running on a Windows machine runs in the context of a user account; this can be one of the three machine accounts (more on this later), a local user account or a domain user account. A process can be started either by a logged on user, or as a service. A ...


8

Yes, it's certainly possible. Firstly you need to fix your usage of sudo, to execute a command as a user other than root (the default) with sudo the syntax is: sudo -u username command You can then lock down the users whose identity a user can assume via the /etc/sudoers config file, eg a fully privileged user looks like: jim ALL=(ALL) ALL Whereas a ...


8

Automated scripts may use it (I've run into issues on systems where scheduled tasks where failing silently because the owner's password had expired). Obviously this was for non-internet facing services.


8

Sounds like you want the Account Lockout tools http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=18465 Allows you to run a query against a domain controller's security logs to search for particular users - for example, to show where the failure audits are coming from.


7

If an attacker has a username and password on any system, their chances of successfully attacking that server have increased compared to the attacker who has no such details. There isn't anything mythical about this: Even if they can't directly use the compromised credentials, more information is always better than less information. Some systems might be ...


7

That's good enough if you have a reasonable password policy. If people can have a password of 1, that's probably going to be a problem. You've rate limited brute forcing the password to 1 password every 2 minutes. At that rate guessing a 7 character, all numbers password would take 19 years of straight hacking on average... and that's a pretty crappy ...


7

The data is in the SAM but it doesn't appear to be publicly documented by Microsoft and I'm not finding an official API to retrieve it. I can see, looking at the source code for the chntpw utility that the value is stored in the "F" registry key for each account. Quoth the source code: #define USER_F_PATH "\\SAM\\Domains\\Account\\Users\\%08X\\F" struct ...


7

What you're seeing is the SID (Security Identifier) of an object. Generally, Windows is nice enough to automatically translate this SID into a user's display name for you in the Security dialog, so that you don't have to hunt for it, but if a Domain Controller is unable to be contacted when the ACL is being viewed, you'll see a SID. You'll also see this SID ...


7

Using Puppet virtual resources is the right way to do it - but if you can't change the user definitions and need a workaround fix meanwhile, the following is horrible and hacky, but will work: exec {"foo somegroup membership": unless => "grep -q 'somegroup\\S*foo' /etc/group", command => "usermod -aG somegroup foo", require => User['foo'], } ...


7

The safest method is as follows. (Written on Windows 7, but applicable to XP onwards) Go to Start Right click "Computer and select Properties Select Advanced System Settings [Skip this step on XP] Choose the Advanced Tab Under User Profiles, select Settings (NB: This may take some time to enumerate) Select the username you wish to delete and select Delete ...


6

In case if user profile folder is/was deleted manually, you need to make changes to registry 1. Open "regedit.exe" 2. Navigate to "HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList" 3. Click the sub-key that corresponds with the profile you deleted and right click and delete it.


6

There is not a way to add Windows Live accounts to Server 2012. You can add some of the client features via the Desktop Experience sub-feature under User Interfaces and Infrastructure, but Windows Live authentication is not part of that feature set. Are you looking at running the server OS as a client machine? UPDATE: If you are looking to have some sort ...


6

This is a licensing issue: When remote desktop is used only to administer the server, no additional licenses are required but the number of simultaneous connections is limited to two. When remote desktop is used to do normal business work on the server (eg running LOB application) or when more than 2 simultaneous connections is required, you need to buy ...



Only top voted, non community-wiki answers of a minimum length are eligible