New answers tagged

0

We just tested SecureMFA SSP portal, looks like a free version gives enterprise-level features like MFA, multiple domains, RBAC, network filtering etc.


0

In my case the situation is slightly different - I'm using Samba as my DC with FreeNAS. I'm not sure if this is due to the FreeBSD build or Samba as DC, but either way the username to the script in @Sven's answer above prepends the Domain Name so $1 ends up being DOMAINuser not user, and the directory requested by the home share is DOMAIN\user not just user. ...


0

I don’t think you can use SecureMFA ADFS OTP provider to cover Microsoft VPN SSTP RRAS solution. As it requires RADIUS protocol and that provider is to enforce MFA on SSO protocols like OpenID Connect, Oauth2, SAML etc. Microsoft Azure has MFA provider for Microsoft NPS(Radius) server which can enforce second-factor authentication for RADIUS protocols. You ...


0

If you see different requester name, then it may indicate that either, you logged in with wrong account or application (MMC.exe or certmgr.msc) has hardcoded credentials to run in elevated mode with admin user credentials. This is configured through Compatibility tab in executable/shortcut properties.


1

In my case (AWS Infrastructure), issue with that the DC servers security group not added with the client servers IP source which are failing to communicate / resolve DNS with DC servers. After adding Inbound rule by allowing client servers Subnet CIDR with in DC servers security group, able to resolve DNS and join the client servers into the domain.


0

To add to @Massimo answer, if you could change the Windows service to use OpenID Connect with the client credentials flow(i.e. a service not a user so no explicit logon), then this would work. The other option is for the service to use the old-school WS-Trust i.e. WCF. Both of these are supported by ADFS.


2

Technically, yes, you can do that. But you really should not. A Domain Controller should do that and only that (and DNS of course). Additional technical detail: WSUS needs IIS, which means running a web server on the machine; definitely something to avoid on a DC. BTW, if you only have one DC, please create another one. Running a single DC is the biggest ...


2

Don't. Applications other than AD DS + DNS + file server increases the attack surface. Also, an update management database is managed quite a bit differently from AD DS, in terms of deployment, maintenance, and capacity planning. You would want a very good reason to override host level isolation here, and you have not provided one. Compliance checklists say ...


1

This is not possible without a domain trust. ADFS allows applications to authenticate against AD (or another Identity Provider) without direct access to it; but the applications must explicitly support this authentication method. Windows logon doesn't. In order to log on to a Windows system, you need to either: Log in using a local user account Log in ...


2

From a command prompt on the remaining Domain Controllers run the following command: nltest /dclist:YourDomain If they all have a consistent view of which DC's exist and none of them list the demoted DC, then just manually clean up the demoted DC in ADUC, ADS&S, and DNS.


0

For a simple setup I'd set up 2 DCs with DFS to sync files. A cluster is overkill for most lab scenarios and a bit to fiddly for my taste. The set up should look like this for simplicity: All clients should have their own DC as first DNS and the others LAB as their second. For file access you can either point them at the DFS Share or if you want point them ...


1

I have same issue in windows server 2012 and 2016. I resolved it myself. i ran the command sc.exe config lanmanworkstation depend=bowser/mrxsmb10/mrxsmb20/nsi and sc.exe config mrxsmb10 start=disabled Reboot the server; then run sc.exe config lanmanworkstation depend=bowser/mrxsmb20/nsi After reboot the server again, now I can start the workstation ...


0

Ciao, in short Azure AD is not a replacement for onpremises AD. Even though it can be extended with (Azure AD) Domain Services, it cannot replace a traditional AD with onprem infrastructure related services (DNS, DHCP won't be available to your local network). Refer to the documentation for a comparison.


1

You'll probably need to manually reconfigure the Windows Time service on the new PDCe and the old PDCe. You can run the commands below in an elevated command prompt on the respective servers to make this change. New PDCe net stop w32time w32tm /unregister w32tm /register net start w32time w32tm.exe /config /manualpeerlist:time.windows.com /syncfromflags:...


1

If your AD replication is working correctly, there is no risk at all; use dcdiag and repadmin to check everything is working correctly before moving a FSMO role, and make sure all DCs are online so that they can properly acknowledge the change. Also, make sure the server that will hold the PDC Emulator role has correct time settings, because it will become ...


1

You can use the Azure AD PowerShell module to get users and groups programmatically. This would allow you to write a query to get a user, and then list any groups a user is in. For example: Get-AzureADUser -SearchString user@domain.com | Get-AzureADUserMembership


0

This is specifically a function of Active Directory Users & Computers (dsa.msc), then again, only if the account performing the action has sufficient rights on the file system. Also, it would not (and likely should not) get created automatically upon user logon and the users should not have the appropriate permissions to create folders in that path.


0

KB162 was correct in that DC1 thought it was in a public network location rather than domain. As for the reason... Well the service NlaSvc (Network Location Service) is responsible for determining the network location of a device. In order to do that, it relies (maybe among other things) on DNS. This DC's NIC had 2 DNS entries as follows (in this order): ...


1

In the network settings on DC1, are you connected to the domain profile? Settings -> Network & Internet -> Network and Sharing Center -> Change advanced sharing settings -> Ensure Domain is current profile.


1

The 'targetAddress' attribute is used to deliver mail to the mailbox. With Exchange Online, this is where the mailbox@Tenant.OnMicrosoft.com SMTP will be located. I have fond accounts in my AD with the proxyAddress missing, yet still working OK. This link has how the proxyAddresses attribute is populated in Azure AD and scenarios on how it is completed: ...


0

I finally figured this out. First, I created a registry item on my domain controller. Then I created a new GPO, new registry wizard, selected the local system and browsed to the registry key I created. Then I clicked into the registry wizard folders that were created, edited the properties and changed the action from Update to Create. Ran gpupdate /force and ...


1

I found that this was due to the way the Windows service was configured. The Windows Service was configured as a standard service using a regular user account which happened to be gMSA account rather than Windows Service using a managed account. This can be verified with: >sc.exe qmanagedaccount ServiceName [SC] QueryServiceConfig2 SUCCESS ACCOUNT ...


1

Kind of late to this. I think you might need to check that the AD server support SSL and TLS, or STARTTLS port by talking to LDAP administrators. You can use the lpd tool or ADexplorer to make sure the required ports are open and able to connect to the LDAP server. Then you can use a command line openssl and try the command openssl s_client -connect ...


0

This ended up being a defective image of some sort. I downloaded a new ISO for server 2019 from Microsoft, reinstalled everything and it worked right out of the box.


0

Did you just promote a domain controller with the name of an existing domain without first joining it to the domain? That's a wrong order! You have just created a completely new AD domain with an overlapping name. First join the server to the domain and then promote it.


0

The guides you link don't seem to configure DHCP+DNS to cooperate for dynamic DNS updates. The way to do this: Define a user in whose context the DHCP server will run Simply add a domain user with no special rights, and give it a properly strong password. Then open the DHCP management console, right-click the protocol you want to change (IPv4 or IPv6), and ...


0

If an application pool crashes, the event will be logged in the "Application" section of the Windows Event Log, with added information about what happened (usually some kind of exception). You should start your troubleshooting there. The most common reason for a web application not working under a different identity is the user account not having ...


0

After some more digging, it seems that the provider-hosted server and its DNS has a wildcard DNS record (* -> nnn.nnn.nnn.nnn), presumably to facilitate subdomains on the public webserver (so you do not need a new A-record for each subdomain). However, Windows seems to try a DNS lookup with the domain postfix first, which the public server incorrectly ...


3

This checkbox is mostly unrelated to any password expiration policy. The effect of checking that box is setting the pwdlastset attribute to 0; which effectively manually expires a password, and accordingly requires an immediate password change. This cannot be performed on an account which is configured (on the account, not via policy) to never expire. If an ...


3

It's usually impractical to use the ADUC GUI to query an AD of any relevant size: Using Powershell to find accounts whose passwords are too old provides actionable output across entire OUs or even the entire Directory. However unless you have contractual obligations to enforce password expiry the current recommendations tend to follow those of NIST; to ...


1

-k Ignores errors during an import operation and continues processing. This parameter ignores all of the following errors: The object is already a member of the group The operation has an object class violation This violation means that the specified object class does not exist, if the object being imported has no other attributes. The object already ...


1

APIPA addresses won't be registered in DNS, so although your zone looks OK, my suspicion is that there's no corresponding A record for the Domain Controller. Therefore the client can't resolve the ip address of the Domain Controller. Assign the server and the client an ip address in the same subnet of one of the RFC1918 address ranges (take your pick). Make ...


0

You should set a fixed IP on the DC instead of utilising an autogenerated one. The IP needs to meet the IP range you have setup in your vNet on the hypervisor. Also set the DNS in the DC's IP settings to this address. When you run nslookup on the DC it must not return any issues and you should be able to resolve your NETBIOS domain name. Best setup a DHCP on ...


1

For the most important steps you can follow: Open a Group Policy Object that is targeted to your computers and go to Computer Configurations > Preferences > Control Panel Settings > Scheduled Tasks Create a new Scheduled Task to run with the shutdown.exe command. There are two text boxes to fill in the path and values. The first one is for the ...


0

If you want to upgrade the actual servers by performing an in-place upgrade (which I highly advise against), you need to go through multiple steps. But if you want to add new 2019 Domain Controllers to replace the existing ones, then yes, you can definitely add 2019 DCs in a 2008R2 domain, after the standard preparatory steps (adprep). Also make sure your ...


1

Are you sure this machine is listed as belonging to the correct time zone, and not in a time zone 2 hours ahead?


Top 50 recent answers are included