175 reputation
5
bio website cursohispano.com
location Spain
age 34
visits member for 10 months
seen Feb 17 at 14:42

I'm a Microsoft technologies enthusiast that enjoys sharing knowlage with others. I'm also doing my best on learning something about programming on iOS.


Dec
26
comment Secure and Unsecure Dynamic Update
@Param, do you also have deployed a Microsoft DHCP? Beside of that, you should check ACLs for those registers that do not updates.
Dec
4
comment What happens when one of the 2 DC's goes down
@user201420 in scenarios 2 and 4 seize is the only option. In the other scenarios it depends since transfering a fsmo role depends on communication between DCs so if downtime is a few hours, its better just waiting for the FSMO, but if downtime is a few days it highly depends on which do you understand for "few days", but in any case if you perform a seize operation that DC should never get online again, so it would be better not to recover the Computer Object for the DC and perform a metadata cleanup before the deployment of a new DC with the same name.
Dec
4
comment What happens when one of the 2 DC's goes down
"most critical" fsmo roles are PDC and then RID. Without a PDC you start getting errors with Kerberos tickets, password replications, etc... In any case you can use the "seize" option since there is always a transfer try before performing a seize operation.
Dec
2
comment Anyone know of a way to find all certs that weren't auto-enrolled?
As far as I know there is no attribute on the cert or the database that can easily identify those certs. I don't know if it could work for you but something that cames to mind is getting your autoenrollment template (if you use one) and using PSDrive Cert: query your workstations for those certs that matches your template's attributes. Hope this helps
Nov
27
comment Anyone know of a way to find all certs that weren't auto-enrolled?
if you are moving your CA you should also move/migrate the private key and database of that CA so those certificates that has been issued by that CA should still be valid, apart from had been autoenrolled or not. So why do you need to ask for those not autoenrolled certificates?
Nov
26
awarded  Autobiographer
Nov
22
comment Office 365 migration: should I use ADFS?
Think about this, if you use DirSync, and put O365 URLs on the Intranet Sites security configuration zone on the IE, your users will experience a SSO. Also bear in mind that O365 also deploy a Desktop agent that helps to get that SSO experience...
Nov
22
comment Office 365 migration: should I use ADFS?
…by O365 in order to get your users authenticated, because if O365 cannot contact your AD he cannot get the token that authenticates a user from your domain. In that scenario user are still in your domain, not in Microsoft's cloud. On the other side, when you use DirSync you are just "copying" your user's password to the user's account that really exists on Microsoft's cloud, so in this scenario is O365's AD which performs the authentication, not yours. I really think that, since you want to maintain your AD as the main authentication DirSync fits better than ADFS.
Nov
22
comment Office 365 migration: should I use ADFS?
@Massimo for your first question, the answer is YES, it's critical to get at least one DC of your domain to be reachable to get your users authenticated, but this problem is solved using Azure AD. I'm not sure if you get a free Azure AD instance when you purchase a O365 subscription, but it's a solution for your scenario. For the second question, in a Federated scenario actually is your AD who performs the authentication because there is an exchange of security tokens between your AD and the one on Microsoft's cloud. That's the reason why at least one DC of your domain must be reachable...
Nov
22
answered Office 365 migration: should I use ADFS?
Nov
18
comment replica between dc failed
@Luigi it was not a problem about the word itself ;) it was about the concept. Nevertheless you are right when you say that the problem is that the DB is too old. You definetelly should read my second link and also run the "DCDiag /alltest" command. I also think that this link could also be useful: support.microsoft.com/kb/824449. Hope this helps!
Nov
18
comment replica between dc failed
@Luigi, but is that server ("fs") actually a domain controller?. I'm sorry but I do not understand the term "desynchronized" if we are talking about AD, since if that is the situation, it is far from being a healthy situation for AD. If you are referring to another service, like DFS or something like this then it would be a different situation. Nevertheless it would be good if you could follow procedure I posted in my aswer or run the DCDiag /alltest in both domain controllers.
Nov
18
answered replica between dc failed
Nov
14
comment Upon failure of DC, force server to find Secondary DC
@CJM - glad to help!! :)
Nov
14
answered Upon failure of DC, force server to find Secondary DC
Nov
13
comment Upon failure of DC, force server to find Secondary DC
I think best way to prove that "failover" is to simulate a fail in the DC (for example, unplug the Ethernet if is that possible) and then check again the net logon secure channel with nltest (you should use the /force modifier in order to bypass any cached information)
Nov
13
comment Upon failure of DC, force server to find Secondary DC
Actually this "failover" mechanism should happen automatically. DNS client (whenever we talk about a Server o Workstation) will ask to its primary DNS server for a DC, so the mechanism is ask the DNS server for an aditional DC. You can use nltest /sc_reset to reset the Net logon secure channel and then restablish it again.
Nov
6
awarded  Critic
Nov
6
comment Accessing AD Domain Controllers for Login from an Isolated Network
Although I fully agree with @mfinni, you still can hardcode the site on those clients on the isolated network. Modify the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\SiteNam‌​e (REG_SZ) and put there the name of your "isolated" site. You can find more information at TechNet: Finding a Domain Controller in the Closest Site. Nevertheless I must insist on this is far from being a advisable or best practice. Hope this may solve your issue :)
Nov
5
comment Accessing AD Domain Controllers for Login from an Isolated Network
Hi Cactus, It seems that you have a problem with your sites definition. Do you have a AD Site defined for the "narrowed" and isolated network?. Bear in mind that you also should have associated its correspondant subnets objects in order to work properly.