Reputation
1,813
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
8 13
Newest
 Caucus
Impact
~688k people reached

  • 0 posts edited
  • 0 helpful flags
  • 159 votes cast
Sep
9
comment Windows Active Directory naming best practices?
Office365 only requires that your users logon with their UPN with a suffix matching your tenant domain. Since the default Exchange mailbox address policy can be defined to be anything, as can your UPN suffix, it is trivial. We have EXAMPLE.COM as our company name (and tenant in Office365), EXAMPLE.NET (also registered) as the forest, CORP.EXAMPLE.NET as the primary account domain (with other regional sub-domains, e.g. EU.EXAMPLE.NET) with EXAMPLE as the NetBIOS name, all users in the forest Exchange org use Name@EXAMPLE.COM for UPN and for email. Office365 is perfectly happy with this.
Sep
1
awarded  Caucus
Jul
2
comment Can I disable DHCP client on my Windows 2012R2 server (which uses static IP)?
"The NLS and NLA services being dependant" ... This is a HUGE gotcha that I recently ran into. If NLS and NLA are not running, the network stack cannot determine if the server is in a "public" or a "private" network, so the Windows Firewall assumes "Public", which then causes things like WinRM to break for connections for other subnets.
Jul
2
comment Can I disable DHCP client on my Windows 2012R2 server (which uses static IP)?
Yes. The DHCP Client service is also responsible for registering/unregistering Dynamic DNS records. You'd think the DNS Client service would do that, but DNS Client is your DNS cache.
Jun
1
awarded  Yearling
Nov
24
awarded  Caucus
Aug
31
awarded  Nice Answer
Aug
21
answered Automatically reconfigure WinRM HTTPS listener with new certificate?
Jun
1
awarded  Yearling
Jun
25
awarded  Good Answer
Jun
1
awarded  Yearling
Oct
27
answered Method to integrate Powershell scripts with non-Windows workflow?
Oct
27
comment Is there a free tool that syncs files in both directions, on a schedule?
Not that I know of, but I'm not an rsync expert. You'd need to rsync newer files only in both directions I think. However, DFSR will do two-way sync, but you'll want to have a monitoring solution in place to alert you on errors since DFSR is a service that runs continuously.
Oct
10
awarded  Good Answer
Jun
1
awarded  Yearling
Jan
27
answered IIS and Integrated Windows Authentication - login doesn't work for domain.com, works for IP address, localhost, 127.0.0.1
Jan
27
comment IIS and Integrated Windows Authentication - login doesn't work for domain.com, works for IP address, localhost, 127.0.0.1
As @trismarck commented below... Neither of the computers in this question are members of an Active Directory domain. So SPNs, Kerberos, Negotiate, Integrated Auth, etc. do not apply.
Jan
5
comment Confusion about Kerberos, delegation and SPNs
User accounts DO NOT have delegation enabled by default. You must enable it, Allow a user to be trusted for delegation
Jan
5
comment help using setspn and ktpass
The web service's SPN has to be associated with a user account because the client is going to ask the KDC for a service ticket (ST) for "HTTP/ubuntu-ad1.wad.eng.hytrust.com". The KDC must already know that SPN attached to the service account in order to issue the correct ST. The client then presents the ST to the web service to prove it was authenticated by the KDC. NOTE Your client request must be using the URL of "ubuntu-ad1.wad.eng.hytrust.com" to successfully authenticate. If you're using NetBIOS names or hostnames, you will need to add an additional SPN like "HTTP/ubuntu-ad1".
Jan
5
comment IIS and Integrated Windows Authentication - login doesn't work for domain.com, works for IP address, localhost, 127.0.0.1
The setspn.exe should probably specify the service for the SPN: setspn -S HTTP/domain.com ADDomainName\servername