Reputation
21,754
Next privilege 25,000 Rep.
Access to site analytics
Badges
3 23 48
Newest
 Good Answer
Impact
~2.2m people reached

Apr
25
comment Noob Q: Active Directory GPO not applied immediately
Did gpresult /h show the policy as in scope?
Apr
21
comment RPC Server is unavailable while trying to promote a domain controller. Open firewall
Those scans do not show all of the required ports. Instead of NMap, use PortQueryUI and provide the text results.
Apr
20
comment Exchange 2013 running on 2012R2 changes time to about 5 hours ahead for a short time
I sure hope there aren't any NTP implementations that use/affected by time zones.
Apr
20
comment every 5th AD query is very slow, why?
Thanks, it's good to know that ldapsearch is broken and dysfunctional in that way when working with Active Directory :-)
Apr
19
comment IIS Windows Integrated Auth, not passing domain\user
You need to confirm with a packet capture or Fiddler if the server is sending the WWW-Authenticate response, and if the client is sending the Authenticate: XXX request. More info here: blogs.msdn.microsoft.com/benjaminperkins/2011/09/14/…
Apr
13
comment IIS7 Digest authentication credentials forgotten between pages
Hopefully because Digest authentication is disabled in the operating system. Digest authentication is a terrible security practice due to it stores plain text credentials in memory. This should never be used.
Apr
11
comment How can a system hold more then 65535 concurrent TCP connections?
65,535 per tuple
Apr
4
comment Active Directory User Attribute List
There's nothing inherently risky about doing it.. When the schema is updated, clients must download the updated ADSI schema cache (about 3 MB). If an organization has a lot of clients with a low-speed connection to a remote domain controller, the additional utilization may saturate their connection if there are many concurrent logons.
Mar
22
comment Windows Service with dependency cannot start automatically
Maybe Service A should have a startup type of Automatic (delayed).
Mar
22
comment Import Certificate to Machine\personal script/automation?
I just tried it and it works. It defaults to the personal machine store. You may want to try it using psexec -s cmd.exe command prompt to see if that works.
Mar
22
comment Import Certificate to Machine\personal script/automation?
Where store is the certificate imported to?
Mar
20
comment Using the same SSL Certificate of a Domain on different IIS Servers?
Does the friendly name/Subject of the certificate match the domain name of all the web sites?
Mar
18
comment Fine grained password policy with msDS-MaximumPasswordAge set to 2 days asks for reset immediately
When you set that policy, you effectively expired the password of any account in scope that had a password age over two days.
Mar
14
comment Fine grained password policy with msDS-MaximumPasswordAge set to 2 days asks for reset immediately
And what is the age of the password?
Mar
10
comment Load balancing LDAP from a Domain Controller via F5
Round robin DNS would also be a failed/flawed design. Just because a record exists in DNS doesn't mean that the host is functional. The application owns fault tolerance and recovery. It doesn't matter if the recovery strategy is called DC Locator or Trailer-Park Locator.
Mar
10
comment Load balancing LDAP from a Domain Controller via F5
@user339468: The application does not need to use a full blown DC locator. It could be something as simple as specifying multiple domain controllers in the configuration, and using an alternate if one fails. It isn't rocket science to recognize that only using one domain controller or relying on a straight DNS lookup is a flawed design.
Mar
10
comment Load balancing LDAP from a Domain Controller via F5
That is the upshot, yes. Relying on a straight DNS lookup is a common mistake when attempting to utilize Active Directory. I've seen this mistake even with very common commercial products.
Mar
9
comment Internal user cant reset external user password
You need to create an ACE for Descendant User Objects.
Mar
9
comment Internal user cant reset external user password
Probably need to grant Read/Write permission on pwdLastSet attribute.
Mar
9
comment Internal user cant reset external user password
What is the operating system version?