1,688 reputation
711
bio website
location California
age 40
visits member for 5 years, 4 months
seen 2 days ago

Aug
31
awarded  Nice Answer
Aug
21
answered Automatically reconfigure WinRM HTTPS listener with new certificate?
Jun
1
awarded  Yearling
Jun
25
awarded  Good Answer
Jun
1
awarded  Yearling
Nov
16
answered error reading keytab file krb5.keytab
Oct
27
answered Method to integrate Powershell scripts with non-Windows workflow?
Oct
27
comment Is there a free tool that syncs files in both directions, on a schedule?
Not that I know of, but I'm not an rsync expert. You'd need to rsync newer files only in both directions I think. However, DFSR will do two-way sync, but you'll want to have a monitoring solution in place to alert you on errors since DFSR is a service that runs continuously.
Oct
10
awarded  Good Answer
Jun
1
awarded  Yearling
Jan
27
answered IIS and Integrated Windows Authentication - login doesn't work for domain.com, works for IP address, localhost, 127.0.0.1
Jan
27
comment IIS and Integrated Windows Authentication - login doesn't work for domain.com, works for IP address, localhost, 127.0.0.1
As @trismarck commented below... Neither of the computers in this question are members of an Active Directory domain. So SPNs, Kerberos, Negotiate, Integrated Auth, etc. do not apply.
Jan
5
comment Confusion about Kerberos, delegation and SPNs
User accounts DO NOT have delegation enabled by default. You must enable it, Allow a user to be trusted for delegation
Jan
5
comment help using setspn and ktpass
The web service's SPN has to be associated with a user account because the client is going to ask the KDC for a service ticket (ST) for "HTTP/ubuntu-ad1.wad.eng.hytrust.com". The KDC must already know that SPN attached to the service account in order to issue the correct ST. The client then presents the ST to the web service to prove it was authenticated by the KDC. NOTE Your client request must be using the URL of "ubuntu-ad1.wad.eng.hytrust.com" to successfully authenticate. If you're using NetBIOS names or hostnames, you will need to add an additional SPN like "HTTP/ubuntu-ad1".
Jan
5
comment IIS and Integrated Windows Authentication - login doesn't work for domain.com, works for IP address, localhost, 127.0.0.1
The setspn.exe should probably specify the service for the SPN: setspn -S HTTP/domain.com ADDomainName\servername
Dec
23
answered Gaining administrator privileges in PowerShell
Oct
26
comment PKI Issuing CA on Domain Controllers
Another good reason not to combine the DC and CA roles is that it is difficult/impossible to implement effective role-based separation for your CA on a DC. There are likely far more people that need admin access to the DC for support than you want to have access to your CA.
Oct
11
comment Hidden Features of PowerShell
You can access the [console] object directly to change these defaults in your $profile if you want to. Take a look at the settings with this command: [console]::OutputEncoding | format-list *
Oct
11
comment Command line to list users in a Windows Active Directory group?
ADFind.exe is a third party tool you have to install anyway. The ds* commands are installable via the Admin Tools pack.
Oct
11
comment Command line to list users in a Windows Active Directory group?
You're correct that the ActiveDirectory module doesn't require the Quest ActiveRoles AD snap-in, but it does require that you have the RSAT tools installed and that your AD has at least one DC with either the Active Directory Web Service (for 2008 R2) or the Active Directory Management Gateway Service (for 2003, 2008 DCs) installed. See my answer above for details and links.