Reputation
33,294
Next tag badge:
98/100 score
31/20 answers
Badges
2 47 109
Newest
 Necromancer
Impact
~1.2m people reached

6h
comment Is there a 'rule of thumb' for installing other software on the Hyper-V host?
Just remember that software running on the host partition can "unfairly steal" CPU cycles from and preempt threads running on VMs.
1d
answered What are the best practices for NIC teaming in Server 2012 R2? Broadcom or Windows software?
Apr
21
comment Does NT5DS time synchronization have any place in a mixed Windows / Linux environment?
One point that I didn't see mentioned here, was that many devices such as Cisco switches, just as an example, will refuse to sync with a Windows Server, even a 2008R2 or 2012 Windows Server, because they still don't use a reference NTP implementation. But I totally agree with everything you said.
Apr
21
revised What are ACEs called for system vs. domain users and groups?
added 21 characters in body
Apr
21
answered What are ACEs called for system vs. domain users and groups?
Apr
19
comment Event Id 4625 without Source IP
Also take a look at ts_block from @EvanAnderson: github.com/EvanAnderson/ts_block
Apr
19
comment Event Id 4625 without Source IP
The logs tell you who is connecting to port 3389 and what IP address they are coming from, 100% of the time. You can then add that IP address to a black list in Windows Firewall. What else do you want?
Apr
19
answered Event Id 4625 without Source IP
Apr
18
awarded  Necromancer
Apr
15
comment Windows Domain Controller Authentication Logon Logging and Forensics
A 4624 will simultaneously be generated on both the domain member and the domain controller. The Logon Type will be the same in both events.
Apr
15
comment Windows Domain Controller Authentication Logon Logging and Forensics
Yes, if you want to track who logged on to the domain, from where, when, using which security package (Kerberos vs. NTLM) and in what manner, all you need are the 4624s from the domain controllers. Keep in mind that if you have a lot of domain controllers, you need to either check all of them, or set up event forwarding so that all logon events go to a centralized location for easy searching.
Apr
15
revised Windows Domain Controller Authentication Logon Logging and Forensics
added 150 characters in body
Apr
15
answered Windows Domain Controller Authentication Logon Logging and Forensics
Apr
12
comment When do you need a new AD forest, and when do you need a new tree?
IMO, it's really more of a political decision than a technical one. You're talking about acquisitions and mergers, and who gets to retain what level of control over certain assets. You're asking too many questions to be answered in a comment. Please feel free to break up your questions and post them separately as their own questions. :)
Apr
12
comment When do you need a new AD forest, and when do you need a new tree?
Well, I wouldn't say that .local was "never" recommended. A long time ago, Microsoft did actually "recommend" .local several different times, and they have long since rescinded that advice but Microsoft did a lot of long-lasting damage by making that original recommendation. (en.wikipedia.org/wiki/.local#Microsoft_recommendations) Everything else I agree with. OP, follow the modern AD naming advice like you found on this site, and please try to keep things as simple as possible. Don't make additional forests or trees unless you REALLY need them.
Apr
11
revised Check Primary Authentication Protocol for Active Directory (NTLM or Kerberos?)
added 191 characters in body
Apr
11
answered Check Primary Authentication Protocol for Active Directory (NTLM or Kerberos?)
Apr
11
comment Check Primary Authentication Protocol for Active Directory (NTLM or Kerberos?)
Please see serverfault.com/questions/31850/…
Apr
11
comment Check Primary Authentication Protocol for Active Directory (NTLM or Kerberos?)
OP never mentioned disabling anything, and disabling NTLM completely isn't even feasible in most scenarios.
Apr
11
comment Check Primary Authentication Protocol for Active Directory (NTLM or Kerberos?)
Sorry sir but it appears that you didn't answer his question.