We suspect some specific AD attributes changed for many users, any way we can find this like what attributes changed for those users (or without knowing the users)
↧
finding the attribute changes
↧
Server 2012 R2 Password Hash
I have a client who's insistent that user passwords in Active Directory are hashed with sha 256. Is that possible and how would I configure it? Their accounts already support Kerberos AES 256 bit Encryption but apparently that is insufficient.
Vincent Sprague
↧
↧
Active Directory Certificate Services
I would like to verify various modules within our network. Active Directory Certificate Services seems to be the ideal way to do this.
Is there a charge for creating these certificates with AD CS? Any of the modules will be used only within our Active Directory domain...
↧
RODC in DMZ Client Issue
I have a new RODC in a DMZ. The RODC has all the ports required open to a RWDC which is on a secure network.
The RODC has it's own site, the DMZ IP address is assigned to that site is Sites and Services - I can logon to the RODC without issue and there are no errors, replication is also working correctly.
When I move a client machine onto the DMZ network (DNS is updated etc so the IP address is correct record) and written to the RODC, I am having problems with authentication. I log into the client, but it's using the cached account, and from what I can see the client is not using the RODC at all - The RODC is the only DNS server specified in the clients DNS settings.
Users without a cached account are unable to logon, even if they have their password replicated to the RODC. NLA is incorrectly detecting the network as non-Domain. If I try and list a domain group, I only see the option for the local machines - as if it's completely ignoring the RODC.
The clients have no ports open to the RWDC, all traffic should flow via the RODC.
All systems are Server 2016.
Should add the first things that fails is netlogon, event id 5719. Fails to setup a secure session with the DC.
Any thoughts?
Thanks
↧
Replacing Dead Domain Controller
I will be resetting the computer account of a dead domain controller in active directory and replace it with another computer with the same OS, IP, name. The goal is to decommission the server and remove it from AD entirely.
Is there anything I need to do besides the following?
- Reset computer account in AD
- Join new computer to domain.
- Promote to DC.
- Demote DC.
- Remove from domain.
Thanks!
↧
↧
Delegation for user
3) Take the security group "TestGroup" and add it to the created OU "TestOU". The only security rights i want "TestGroup" to have is the following:
Create User Objects
Delete user Objects
Apply to: This object and all descendant objects.
I appreciate any help regarding step 3 :)
Thank you.
Create User Objects
Delete user Objects
Apply to: This object and all descendant objects.
I appreciate any help regarding step 3 :)
Thank you.
↧
DFS and roaming profiles and home folders
Guys,
When in a DFS environment, how should i create roaming profiles and home folders ? Anyone who has a decent tutorial for that?
I dont think it would be wise to let the profiles be synced. The homefolders could be synced by DFS, i guess.
thanks in advance.
↧
Recovering Domain Controller
Hello friends,
which is the correct procedure for reestablishing an environment with multiple domain controllers in the same domain, where, for example, after applying an operating system hotfix to a domain controller, it presented a problem.
I have a snapshot or full server backup.
This being my main, with the master functions for example.
If it is a server that does not have master functions, I could follow the recommendation to clean the domain and promote a new one.
But I kept thinking, because we often patched many domain controller servers. If any problem arise how could we use the snapshot or the full VM backup?
Thank you.
which is the correct procedure for reestablishing an environment with multiple domain controllers in the same domain, where, for example, after applying an operating system hotfix to a domain controller, it presented a problem.
I have a snapshot or full server backup.
This being my main, with the master functions for example.
If it is a server that does not have master functions, I could follow the recommendation to clean the domain and promote a new one.
But I kept thinking, because we often patched many domain controller servers. If any problem arise how could we use the snapshot or the full VM backup?
Thank you.
↧
Deleted AD User by mistake
Hi, I just landed myself into major difficulties...
Basically upgraded a network from SBS 2011 to Windows Server 2019, including Microsoft Exchange Server 2019. After hours of battling, I eventually got all installed and migrated ok. I noticed some email accounts were showing on Exchange that I did not require, although I accidentally decided to remove some mailboxes which has also removed the users from AD.
Is there any method of recovering these users in AD?
Methods tried already:
- I have tried connectingto a deleted mailbox via EAC although there is no deleted mailboxes showing
- I have tried enabling the recycle bin
Any suggestions please??
Adrian Kelly
↧
↧
Bring in a new Domain Controller after roles has been seized from an old one.
Hey tech guys!
In our Environment ("ourServer1" and "ourServer2") we had lost one of two domain controllers (Hardware crash / without Backup) <- unfortunatly we have only backup of files on it.
Now we have forced the transfer of FSMO roles to DC2.
---
I had read about that you should never bring in a DC back after the role has been seized from it....
---
Then in next step I think i will first, have to removing the old "ourServer1" Domain Controller Server Manually from domain.
https://blogs.technet.microsoft.com/canitpro/2016/02/17/step-by-step-removing-a-domain-controller-server-manually/
But, would it be possible to install now a new DC (on new Hardware), with same name like the old one = "ourServer1" and same IP Address, and add it to the domain? .... or at least as a member server with the same Name / IP config?
↧
Enable Intranet zone enable
Hello,
i have create a group policy for internet explorer which is "*.domian.com" add in Local Intranet Site for auto login a application.
but now problem is internet security zone now disable and i can't add another site or domain. so, i need another GPO for enable.
see the below image.
↧
Active Directory Certificate Services disable
Active Directory Certificate Services is disabled automatically after 10-15 min
Dharmendra
↧
domain controller certificate expiring but CA gone
I have a domain with two domain controllers with certificates that will expire soon, but the issuing certificate authority has been demoted and the member server will be retired soon.
Certificate services have been removed and we don't plan on reinstalling if we can avoid it.
What happens to the domain controllers and active directory when the certificates expire? Do we need to do something manually before that happens?
Thank you.
↧
↧
View deleted object using ldp.exe
Hello,
I want to view deleted objects in AD using the ldp.exe in the primary DC but when I expand the CN=deleted objects, it is saying "No children". I tried it again on other DC but there is no deleted objects on the tree. Do I need Domain Admin to view
this?
↧
RMS - Word Client : Protect Document does not appear
Hi,
I'm setting up a Lab for Right Management Access :
2 Servers Windows 2016
- RMS1 : Domain Server w RMS Role
- DS1 : Domain Controler with Office
User : Jdoe (email : jdoe@contoso.com). Member of "InformationTechnology" group (emai : it@contoso.com) and Domain Admin
From DS1, I can connect to : https://rms1.contoso.com/_wmcs/licensing/license.asmx, https://rms1.contoso.com/_wmcs/certification/certification.asmx
On DS1 (DC), ADSI, serviceBindingInformation : https://rms1.contoso.com/_wmcs/certification
But....
from office (DS1), I still do not have to option to restrict access. I tried to download the RMS Client 2.1, same
I have no idea!
Thanks,
jasmin
↧
Harden the Active Directory Servers
Dear Team,
I have install the Active directory servers and find out the multiple ports are open on the system
Used netstat -a command and got multiple open ports are listening which is the risk
Can some one guide how to harden or shut those ports?
↧
Rename a Domain Joined Computer
i've created an OU higharcy and delegated access to a group with full control over all objects and descendant objects. Why cant a member of the group with delegated access rename a domain joined computer in the OU? i've verified the group is local admin on the server and even created a second delegation for the write all properties of descendant computer objects in the OU. I can see in the security setting on the server object all of the settings are as expected. there are no deny's in any of the settings on the OU. Could there be a GPO i'm not thinking of that is restricting this?
i've gone through multiple pages on technet looking for answer that isnt local admin / write all properties on the computer object.
thanks,
jason
↧
↧
Forest trust dissapears
Hello,
Forest trust between on-premises environment and AWS Managed Microsoft AD disappears from time to time on Microsoft domain side.
The previous time it has happened after domain controllers were patched and rebooted.
Are there any checks for trusts which in case of failure will remove connection on Microsoft side?
It does affect production environment and we want to find a root cause of this problem.
↧
2016 DC
Hello All,
We have 8 Domain which is currently running on 2012 R2 OS. We will be beginning to upgrade all the DC's from 8 Domain to 2016.
While going through the 2016 Documentation we have come across the PAM and JEA features.
I would like to have your advice which will be good to start it PAM or JEA. We have many sites were the Site support or not familiar with 2016 OS and also if we could able to manage it from central locations
Thanks
Thanks HA
↧
Forest / Domain split into 2 seperate entities
A part of our current company is split off and will start operating on its own. It has been agreed upon to split the current forest into 2 separate entities that will continue operating independently.
There will be no network connectivity between the 2 companies anymore.
I know this is not supported by MS, but it has been decided nonetheless for various reasons.
Does anyone have experience with this scenario? What would be the high-level steps to accomplish this? Any critical steps we definitely should not overlook?
↧