Reputation
7,426
Next privilege 10,000 Rep.
Access moderator tools
Badges
2 19 30
Impact
~989k people reached

  • 0 posts edited
  • 0 helpful flags
  • 240 votes cast
Jul
3
comment Configuring Service Login Credentials with Group Policy following MS14-025
That was pretty much going to be what I fell back on if nothing else looked more...elegant. Powershell DSC looks fun though. I'll definitely look into that. I'm also now looking at the gMSAs introduced with 2012. Though I'm finding conflicting information as to whether pre-2012 OSes support using them.
Jul
3
comment Configuring Service Login Credentials with Group Policy following MS14-025
So they have to be domain accounts because the services are accessing external resources that require domain authentication/authorization. A script that configures the services is certainly not out of the question, but would ideally be deployable via group policy. The idea is that new hosts are added somewhat regularly and we'd like group policy to automatically configure the services on the hosts once they exist rather than needing to kick off a manual process.
May
8
comment Subject Alternative Name when internal and external hostnames differ
When you generate the CSR, it's going to be a custom request where you put whatever name you want as the common name. It's not going to include the internal name unless you add it. That sort of thing only comes into play if you're using an internal Enterprise CA with certificate templates that auto-generate names based on AD data. The site you're purchasing the cert from should also have pretty explicit instructions on how to generate the CSR properly.
Apr
3
comment Can AD Domain Services authentication be influenced by custom code?
Or more succinctly, there's very little reason these days to have user passwords exist in more than one place even in multi-platform environments.
Apr
3
comment Can AD Domain Services authentication be influenced by custom code?
Seconded. Both sides are mature enough these days that you can go either way. Either have your Windows machines authenticating against an MIT Kerb realm with authorization still happening via AD. Or have your Linux machine authenticate and authorize against AD and its LDAP implementation.
Mar
21
comment Start program on computer startup when nobody is logged on and show the window when someone does log on (OS: Windows)
No disrespect (or downvote), Marcus. But if this is really the type of answer you were looking for, this question would've been more appropriate for SuperUser.
Mar
20
comment Start program on computer startup when nobody is logged on and show the window when someone does log on (OS: Windows)
Amen. I wish more app vendors grasped this concept.
Mar
19
comment How do I disable the sudo password prompt?
UAC doesn't break production systems. It merely highlights poorly written software.
Mar
18
comment Restrict windows server 2008 R2 remote mmc
Curious. Why would you purposefully kill productivity by disabling useful remote administration methods?
Mar
18
comment How to assign ESXi permissions to Windows AD user, to operate with VMware vMA?
Also, the ESX Admins group in AD isn't a requirement. It's just a default configuration item in ESXi. You can change the group name or remove it entirely if you wish.
Mar
18
comment How to assign ESXi permissions to Windows AD user, to operate with VMware vMA?
You may want to create a new question for your new problem.
Feb
27
comment Use Active Directory Administrative Center outside domain
Yeah. If your DC is going to be the only permanent machine in your lab domain, it makes sense to install the full GUI version rather than Core.
Feb
12
comment “Deny Logon Locally” effects
Deny settings in Windows environments always seem to have unintended consequences which is probably why you're posting this question. Have you considered trying to limit the Allow settings first?
Feb
12
comment Configure custom SSL certificate for RDP on Windows Server 2012 in Remote Administration mode?
You're most welcome.
Feb
3
comment How to troubleshoot Cisco VPN Client Authentication Error 413?
Thanks. Sorry you still don't have your answer though. That legacy Cisco client has always been a PITA. If it's an option, you might save time by just re-installing Windows on that dev machine.
Jan
18
comment Windows Clients connecting to DC in wrong site?
Good point Charles.
Jan
17
comment Windows 2012 R2 scripted access to freespace of physical disks?
There we go. Looks like I had more time than I thought.
Jan
17
comment Windows 2012 R2 scripted access to freespace of physical disks?
If I get some more time, I'll try to piece together something that will associate these with their parent virtual disk.
Oct
28
comment Windows 2008 R2 Active Directory login fails first time, but succeeds second time
Glad to here it. Consistent time is critical to a well functioning AD. I'm not sure how large your organization is, but you might check if they have a dedicated NTP server you can sync your DC's to rather than going across the WAN to pool.ntp.org.
Oct
28
comment Windows GPO Restricted groups append
No, but it's a better idea to use a group anyway. Then you don't have to go mucking around with group policy again (and waiting for the GP refresh cycle) if you ever decide you want to change who is granted access. Give the group a name that reflects what it is granting access to. Give it a more verbose description if the name you pick doesn't seem descriptive enough. Then the next guy who comes along (or you in a few years) will be able to remember what the heck it's for.