A message from our CEO about the future of Stack Overflow and Stack Exchange. Read now.
18

You can use ldapsearch to query an AD Server. For example, the following query will displya all attributes of all the users in the domain: ldapsearch -x -h adserver.domain.int -D "user@domain.int" -W -b "cn=users,dc=domain,dc=int" Command options explained: -x use simple authentication (as opposed to SASL) -h your AD server -D the DN to bind to the ...


13

I think the extent flag is exposed as an attribute mainly so that you can set it with chattr, which will cause the ext4 driver to reallocate the file using extents instead of block lists. If you've converted an existing ext3 filesystem to ext4 (by using tune2fs to enable the new feature flags), you'll probably want to convert the existing files to use ...


11

I use this on any directory that is only intended to be a mount point. It prevents files from mistakenly getting written if the file system isn't mounted.


10

The compressed indicator is stored in the "attributes" property. This Powershell will report compressed files. gci -r C:\search\path | where {$_.attributes -match "compressed"} | foreach { $_.fullname } -- Begin Edit The file size is stored in the length property, which is in bytes. You can use whats called a "calculated property" to display the size in ...


10

The security.selinux extended attribute is not shown by default by getfattr; you must explicitly request it. $ getfattr -d Work $ getfattr -n security.selinux Work # file: Work security.selinux="unconfined_u:object_r:user_home_t:s0"


9

I've seen this used in virtual hosting setups where file(s) need to remain in directories that users have access to, e.g. php5.fcgi. I also occasionally use it to add an extra step to deleting important files, to protect them from my own absent-mindedness.


8

You want to use the Delegate Permissions option in Active Directory Users and Computers. You can apply the delegation to whatever OU you want, including the domain root. This will allow you to delegate whatever attribute-level permissions you want to whatever users/groups you define. These permissions apply like any other and respect inheritance.


7

In ADUC, the Delegation of Control wizard will allow you to do this, using a custom task for delegation. Pick just the fields you want them to have Write access to.


7

find can't search for file attributes (this is something else then permissions!) on it's own. One way: find /location -type f -print0 | xargs -0 lsattr | grep '^...S' On my system, the S is in the third column of the lsattr output, so to make it more flexible, we can use a more complicated regular expression: find /location -type f -print0 | xargs -...


5

As you've found, the instanceType attribute is marked "system-only", since you could potentially mess with the replication state of the directory replica in which you modify this attribute. You probably shouldn't be doing this! To circumvent this protection, add the following registry value on a Domain Controller: Key: HKEY_LOCAL_MACHINE\System\...


5

Groups are a different kind of object from users, so differentiating them is already possible, even easy. Built-in accounts are usually left in the Users container, while user accounts and service accounts are typically sorted into separate OUs either under the Users container or outside of the Users container. Either way, sorting by OU would be a visual ...


4

The employeeNumber field while not viewable via the GUI is still able to be queried by anyone with read access to AD if I'm not mistaken. It may take more effort than "Outlook" though. But honestly...it's the last 4 of the SSN...so I think your approach, if management is fine with it, is good enough. Just make sure you don't care about an actual employee ...


4

It's quite handy for for hacking someone else's systems and keeping your trojaned binaries from being deleted!!


4

This is an example for a single user. Use filters or otherwise get a list of users, explicitly request the regulationMatrix property and then pipe the whole thing into the Set-ADUsercommand. Use -Replace or -Add to modify the property. Get-ADUser j.doe -Properties regulationMatrix | Set-ADUser -Replace @{regulationMatrix="Hurz"}


3

I don't know of any existing tools that actually trigger on creation. Though like Nic mentioned, it is hypothetically possible to write something that could do that. But realistically, how often are users/groups getting created outside of already automated processes? If they're not already, your existing provisioning processes should be augmented to add the ...


3

The default, out of the box schema already contains both an employeeNumber and an employeeID attribute... Reading the attributes: PS H:\> Get-ADUser jbob -Properties EmployeeId,EmployeeNumber DistinguishedName : CN=JoeBob,OU=Users,OU=Bros,DC=contoso,DC=com EmployeeID : A1B2C3 EmployeeNumber : 1234556 Enabled : True GivenName ...


3

As SvenW says, format the USB drive in the native filesystem for FreeNAS, and you should be fine. Alternatively, tar up the files from NAS1 to the hard drive. That should insulate the attributes regardless of the the filesystem of the hard drive. I think attribute changes will not cause rsync to transfer the file again, anyway. rsync should just be ...


3

No, AD schema attributes should be considered permanent. If you only want the attribute to not appear in the Attribute Editor tab, or other dialogs where an object may present the list of possible attributes, you may want to try editing the User class object in AD Schema MMC, and removing the attribute from the list of optional attributes. You would need ...


3

In addition to @Todd Wilcox's excellent answer, I'd like to add the idea of a naming convention for the objects in AD. Certain aspects of the "attributes" you want to create for the users/groups can be inherently applied by having a very strong naming convention for objects and infrastructure, and not deviating from it. Users Regular user names should be &...


2

What does your environment file look like? Are you setting default or override attributes? If you're setting default, note that is a fairly low priority level in the attributes chain, so it might be overridden by a recipe, or a role. The precedence of the attributes is as follows, from low to high: default attributes applied in an attributes file default ...


2

There are several possible causes. The likely cause is that your domain functional level is not yet set to windows 2003. Once that's been established check out this KB article: http://support.microsoft.com/kb/886705


2

As for finding what's using the attributes, I think your best hope is some rather severe logging of the directory service access events by enabling the setting for it in the audit config of the Domain Controllers GPO, as well as setting aggressive audit ACLs to inherit throughout the domain. The logs will likely get very noisy. If possible, the new ...


2

I don't know FreeNAS, but if you can connect an USB disk with an ext3/4 filesystem (or whatever is native to it), the attributes should be transferred correctly. \


2

Hmm. There should be chef output that indicates what's wrong. Looking at the cookbook, I see that it's trying to download maven 3 as: http://www.apache.org/dist/maven/binaries/apache-maven-3.0.3-bin.tar.gz (as specified in maven/attributes/default.rb, as the maven.3.url attribute). If you try to wget that URL, you'll get a 404. So, the cookbook is broken ...


2

Find doesn't have any way of obtaining this information directly but you don't need to use it as lsattr has a -R switch so lsattr -R /path/you/care/about 2>/dev/null | grep -- 's---ia-------' should do what you want. Note the -- to grep isn't required for your specific set of attributes but if for example you wanted to search for '----ia-------' then ...


2

AFAIK scp doesn't. rsync has the -X, --xattrs switch for extended attributes (think SELinux contexts) and the -A, --acls to preserve ACL's, which are what you modify with setfattr.


2

First, put your specific timestamp in a file with touch and then, use the find command. The following code will search for the files and directories in the current directory, recursively. Complete code: touch -t 200001010000 /tmp/timestamp find . ! -newer /tmp/timestamp


2

NFS protocol does not support extended attributes and. as a result, you can't transfer local extended attributes to the server. There are some effort in NFS community to make it possible, but it will take some time until it will be available.


2

Most of the environments I've worked in don't do this with attributes on accounts. They do it via OU organization and/or naming standards. A simplified example might be: (domain root) All Accounts Humans Shared Accounts Service Accounts You can sub-divide the different account types if it makes sense. But most of the time, group memberships are all you ...


2

The attributes can't contain any logic, they have to be populated by "something else". In fact, you can see Active Directory (or at least, the part we are talking about here) as a database, with fields and records, and when you extend the schema, you add more "fields" to this database. In order for you to populate your newly created attribute, you can ...


Only top voted, non community-wiki answers of a minimum length are eligible