Reputation
6,838
Next privilege 10,000 Rep.
Access moderator tools
Badges
2 17 28
Newest
 Nice Answer
Impact
~843k people reached

  • 0 posts edited
  • 0 helpful flags
  • 223 votes cast
Dec
3
comment Can Office365 (Enterprise) sync from a remote LDAP server?
Just to be clear, the info that gets synchronized with Office365 does not contain passwords; only the info necessary to do Exchange related stuff. When users are authenticating against Office365, it just passes the request back to your on-premise AD via ADFS. So yes, you'll always have a local AD as your authoritative identity source that other applications can use for authentication. Whether those other applications integrate directly with AD or are like Office365 and go through ADFS is specific to the application in question.
Sep
25
comment Why is file sharing over internet still working, despite all firewall exceptions for filesharing being disabled?
A down vote with no explanation? Bad form.
Sep
24
comment Active Directory Cross-Site Replication Speed - Should I select Preferred Bridgehead Servers?
I was going to post this as an answer myself, but I don't want to steal your thunder, Shane. You should definitely post it as a full answer though. Or perhaps joe can update his.
Jul
27
comment Using SSL to Encrypt LDAP Queries - Windows 2008 R2
How to generate certificates using ADCS should probably be it's own question. It's kind of a 101 topic. And like jscott said, your DCs should auto-enroll if your environment hasn't been modified too much from the default config. Once a DC is using a certificate the non-SSL ports (389 and 3268) do still work. But there's a group policy setting you can set to require LDAP signing. More info here
Jul
27
comment Remove specified OCSP responder from certificate
OCSP can be great for enterprises running their own PKI infrastructure. But yes, it seems a bit silly for public certs from third party CAs.
Jul
20
comment How to allow IIS website user to execute .cmd program
This question is probably a better fit for StackOverflow.
Jul
18
comment Immortal application
It would probably help if you were more explicit about what "online service" means (i.e. web site, web service, other?). It would also help if you gave more detail about the current stack your application runs on.
Jul
15
comment How to stop brute force attacks on Terminal Server (Win2008R2)?
This is pretty sweet, Evan. I've got half a mind to re-implement it in C# so you could run it as a native windows service rather than hacking around with srvany and the like. If I ever do, I'll throw it up on Github or something as well.
Jul
11
comment Pushing Information into a Networked/Shared Read-Only Excel File Used by Multiple People
YES! A thousand times, yes! Stop using Excel as a database.
Jul
6
comment Email Administrator on failed login
So you want hundreds of email notifications?
Jul
3
comment Running IIS 7.5 on 64-bit, but which config file to edit?
Just to clarify, System32 is actually where 64-bit related files live. SysWOW64 is where the 32-bit related files live. Yes, it's confusing. Blame Microsoft.
Jun
27
comment What is Active Directory Domain Services and how does it work?
I have to respectfully disagree about suggesting people never use existing DNS infrastructure and run Microsoft DNS. Many companies have well functioning DNS infrastructures and IPAM solutions that support DDNS from AD DCs just fine. Not running Microsoft DNS means one less thing to deal with for a new admin. And it's really easy to screw up DNS when you don't know what you're doing. I've also had plenty of experience in environments using ancient versions of BIND that don't even support DDNS and things work just fine once you import the proper entries from netlogon.dns.
Jun
18
comment Unable to login with a domain account
When you ran sysprep on the VM, did you check the box for "Generalize"?
Jun
18
comment Unable to login with a domain account
Were your domain controllers also built from non-sysprep'd images?
Jun
15
comment Active Directory: Viewing “Attribute Editor” after finding an account via ADUC's “Find” option
You forgot to include ADSI Edit which is also built-in. =)
Jun
15
comment Active Directory: Viewing “Attribute Editor” after finding an account via ADUC's “Find” option
Holy hell, this bugs me to no end as well. I tend to use @Shane Madden's answer, but it's still highly annoying.
Jun
4
comment Keep getting the password complexity error for a OU that should have it disabled
Shadow groups only mirror the members of an OU for as long as the domain admins are diligent about keeping them up to date. Sadly, there's no built-in way to automate this.
May
30
comment Keep getting the password complexity error for a OU that should have it disabled
And just to add some detail to this answer, Fine Grained Password policies can't be applied to an OU. They're only applied to users directly or via groups that users are a member of.
May
9
comment What is a good SSH server to use on Windows?
@Tyson If the user logging in is a real windows local/domain account, it uses that security context. If it's a "virtual" user, it runs in whatever security context that virtual user has been configured against. It's also configurable what type of login is used (i.e. Network or Interactive). More info available in the docs.
Mar
29
comment HKEY_USERS entry for service account
The HKCU hive is created as soon as your task starts running as that user for the first time on the machine. You don't need to pre-create anything. Just include a line in the script right before the pscp calls that writes the value you need.