How to detect group membership delta changes using LDAP query

April 30, 2019, 3:49 pm

≫ Next: netlogon logs

≪ Previous: Display-Name vs Display-name-printable

$

0

0

Hi,

I'm writing an LDAP plugin to detect AD user/group membership changes. For detecting any changes to the user objects, I'm depending on 'uSNChanged' attribute. So when I query next time, I'll only get delta changes.

However, if I make any changes to the group membership like adding a user/removing a user from a group, the user's 'usNChanged' doesn't change.

I tried querying the group based on the modifyTimeStamp and it does return a list of groups that may have changed the group membership. However, it gives the full list of members belonging to that group at that particular instance but not the delta.

Is there a way to the delta of group membership changes using LDAP? I see many people implemented AD plugin to monitor audit events on the AD and then create a delta but I cannot create any AD plugin at the instance.

Any help is highly appreciated.

---

netlogon logs

May 1, 2019, 12:44 am

≫ Next: AD Migration Issue

≪ Previous: How to detect group membership delta changes using LDAP query

$

0

0

Hi,

Last week we did move the FSMO roles from a server 2008 R2 DC to a server 2012 R2. I have enable the netlogon debugging logs on both Dc's. From what I can see in the netlogon logs it looks like that still all of the login process goes trough the old DC even the old DC is not anymore PDC, saying that the old DC like the new one is a GC.

Any idea why I dont see any info regarding login process in the server 2012 R2 netlogon logs?

Thanks

---

Shahin

AD Migration Issue

April 29, 2019, 12:04 am

≫ Next: Getting DHCP server and Range configuration for each

≪ Previous: netlogon logs

$

0

0

Team,

In our environment Primary AD was running in 2008 SP@ and we have introduced a 2012 server as  a secondary AD server , after added the server , we have moved all the FSMO rules to the new server (Win2012)  , but the Sysvol not showing in the new server.. kindly help on this.

Getting DHCP server and Range configuration for each

May 1, 2019, 2:37 am

≫ Next: Object Delete notification is not coming when LDAP_SCOPE_SUBTREE is used

≪ Previous: AD Migration Issue

$

0

0

Dear all,

I need to actually get in an excel sheet the list of Servers acting as DHCP server and for each of those servers get the DHCP configuration and IP range they use.

The idea is that I will use then the ActiveDirectory datasource from Excel and then build a Power query to get the data, but for than I need to know from which table I can get the DHCP config from a given Server.

For instance I can list from the AD andComputer table all machine wich are Server based

I am not familiar with how to find the DHCP configuration information in Active Directory.  

Does anyone can inform how to get those information ?

regards

Object Delete notification is not coming when LDAP_SCOPE_SUBTREE is used

May 1, 2019, 2:54 am

≫ Next: Verification of prerequisites for Domain Controller promotion failed. You cannot install an additional domain controller at this time because the RID master is offline.

≪ Previous: Getting DHCP server and Range configuration for each

$

0

0

Hi,

I am using LDAP change notification control to receive notifications of changes in Active Directory using the guidelines indicated in the following link:

https://docs.microsoft.com/en-us/windows/desktop/ad/example-code-for-receiving-change-notifications.

Change notifications about (Insert and Update) are coming fine but delete notification behavior is not consistent between using LDAP_SCOPE_ONELEVEL and LDAP_SCOPE_SUBTREE.

If I set the base object to be root of naming context then no matter whether LDAP_SCOPE_ONELEVEL or LDAP_SCOPE_SUBTREE is specified I always get all three types of notifications (Insert, Update and Delete). 

However, If I use any other container (such as Users) or Organization Unit (OU) as a base object then using LDAP_SCOPE_ONELEVEL always returns all three types of notifications (Insert, Update and Delete) but using LDAP_SCOPE_SUBTREE level ONLY returns (Insert and Update) notifications but does not send Delete notifications. 

Above tests were run against both Active Directory as well as AD LDS separately and the behavior is consistent.

Just wondering if it is an expected behavior or if I am missing anything. Any help would be greatly appreciated.

Thanks,

Nasir

Verification of prerequisites for Domain Controller promotion failed. You cannot install an additional domain controller at this time because the RID master is offline.

August 14, 2015, 3:07 am

≫ Next: PowerShell Script to Generate One month report for Popularity and Search Reports in SharePoint 2016 site

≪ Previous: Object Delete notification is not coming when LDAP_SCOPE_SUBTREE is used

$

0

0

Any suggestions? Help please



PowerShell Script to Generate One month report for Popularity and Search Reports in SharePoint 2016 site

May 1, 2019, 5:18 am

≫ Next: Unauthorize DHCP servers

≪ Previous: Verification of prerequisites for Domain Controller promotion failed. You cannot install an additional domain controller at this time because the RID master is offline.

$

0

0

Hi All,

By default "Popularity and Search Reports" can fetch reports to the maximum of 15 days, but our client is expecting the report to be generated for last one month.

I heard that there is a PowerShell script for generating the One month report of the Analytics. Could you please help me out with the exact PowerShell script please?

Thanks,

Raj

Unauthorize DHCP servers

May 1, 2019, 6:13 am

≫ Next: The Search Filter cannot be recognized. Try again later, or choose another DC by selecting Connect to Domain Controller on the Domain Context menu.

≪ Previous: PowerShell Script to Generate One month report for Popularity and Search Reports in SharePoint 2016 site

$

0

0

Hi,

I tried to unauthorize offline DHCP servers from DHCP console but got some error like "No object in this server". So i went to ADSI configuration for NetServices and in that DHCProot entry i can see only offline DHCP servers in the DHCPServers attribute. Is it always shows like that or any other problem with this one. For working DHCP servers, i have CN entry in NetServices.

 

---

The Search Filter cannot be recognized. Try again later, or choose another DC by selecting Connect to Domain Controller on the Domain Context menu.

April 30, 2019, 8:14 pm

≫ Next: changing validity period on standalone root CA

≪ Previous: Unauthorize DHCP servers

$

0

0

I created a group called sales in active directory administrative Center as well as created manually two users.. now inside of the active directory users and computers I'm receiving this dialogue...

"Data from Users is not available form Domain Controller because: 

The Search Filter cannot be recognized. Try again later, or choose another DC by selecting Connect to Domain Controller on the Domain Context menu."



changing validity period on standalone root CA

May 1, 2019, 10:33 am

≫ Next: RSAT Active Directory Amin Center is not opening for me

≪ Previous: The Search Filter cannot be recognized. Try again later, or choose another DC by selecting Connect to Domain Controller on the Domain Context menu.

$

0

0

I have a Windows 2012R2 standalone root CA running in my Windows 2016 native AD domain/forest.  It's certificate is not set to expire until 2026

I am bringing up a enterprise subordinate CA on a Windows 2019 server.  when I request a certificate fromthe above mentioned standalone root CA, its validity period is set by default to one year.  How do I change this and on which CA do I make the change?  I suspect it is the CApolicy.inf file.

---

Edward Ray

RSAT Active Directory Amin Center is not opening for me

April 25, 2019, 1:01 pm

≫ Next: Fail login on IOS/Android device will not Lock account after failed attempts

≪ Previous: changing validity period on standalone root CA

$

0

0

I am running Windows 10 version 1809. 

I have ran the downloads and installed (WindowsTH-RSAT_WS_1709-x64.msu,WindowsTH-RSAT_WS_1803-x64.msu, and WindowsTH-RSAT_WS2016-x64.msu)

I have followed all the instructions in the Windows support material named "Remote Server Administration Tools (RSAT) for Windows operating systems"

When I search for and find RSAT Active Directory, I click on it, and nothing happens.

Any suggestions would be great. 

Thanks

Fail login on IOS/Android device will not Lock account after failed attempts

April 26, 2019, 4:48 am

≫ Next: DFS access problem

≪ Previous: RSAT Active Directory Amin Center is not opening for me

$

0

0

Hi Guys,

I have an issue where a User with login to the Android/IOS and if they make a failed attempt 3 times, there AD account should lock them out but it is not.

About our environment:Users are located in China.  We use Gmail but as the users are in china weactive-sync Gmail with Outlook 365.When in the office they we have VPN to access google.  When they leave the office and use there phones for email and they have a failed login 3 times they cant be locked out for some reason.

So the question is how can i lock there accounts after 3 login attempt on the outlook app without using a mobile VPN?

Note: we have policies in place to lock the accounts but China Users devices ignore thesepolicies.

DFS access problem

April 26, 2019, 1:14 am

≫ Next: Segregation - Administrators

≪ Previous: Fail login on IOS/Android device will not Lock account after failed attempts

$

0

0

Hi,

I have a problem with access to DFS using name space \\domainname\dfs\share using Excel, Word or other Office applicartions. The shared drive is mapped usiong groupo policy and I can navigate through the shared drive using explorer without any problems.

I can access share direcly from server \\dfs-01\shared without any problems. We have 280 users but not all of them have this problem (it's around 20-20 of them) .

If I use my DA account the problem dosn't exists and I can open Excel or Word files without any problems. Can you please help? 

Regards,

Jan

Segregation - Administrators

April 25, 2019, 12:09 pm

≫ Next: Delete bulk empty OUs from csv file through PowerShell

≪ Previous: DFS access problem

$

0

0

There was a recent divestiture and we are in the process of amalgamating systems under a single domain

Based on the requirement from the Department of Energy listed below:

"Ensure individuals will have access to the controlled information governed by
Part 810 only as needed for their responsibilities and that they will not have access to classified information, or
information deemed to be sensitive nuclear technology, while employed by company"

Is there away to grant a system administrator access through ADUC so that they can do everything they need in a specific region (Canada / US) without allowing them access to commercially sensitive data or classified information? ACL's and security groups should be suffice correct?

Some of the "Administrators" duties would include:

ADUC administration (limited capacity, group management, adding servers, login scripts, powershell), Troubleshooting, Backup and Restores, SCCM administration, Networking, Software Installations, VMware, configuration management, Server deployment, among a few others.

Could the forest be setup the following way to enable this based on the model below?

https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/using-the-organizational-domain-forest-model

Also a rough non-biased opinion, this is a smaller company1000 employees, how long would this take to configure and setup?

Delete bulk empty OUs from csv file through PowerShell

May 1, 2019, 9:00 pm

≫ Next: Who will be announced as the next Windows Server Directory Services Guru? Read more about May 2019 competition!!

≪ Previous: Segregation - Administrators

$

0

0

Hi,

This script won't seem to delete my empty Organizational Unit, and for some reason my setting of ADobject to remove ProtectedFromAccidentalDeletion will not work onsome empty OUs. Please have a look at my script:

  

------

Import-Module activedirectory

$OUs = Get-ADOrganizationalUnit -Filter * -Properties DistinguishedName | 
Sort-Object -Property DistinguishedName -Descending

$report = @()
foreach ($ou in $OUs) { 

    $objectList = Get-ADObject -Filter * -SearchBase $ou.DistinguishedName -SearchScope OneLevel |
        Where-Object {$report.DistinguishedName -notcontains $_.DistinguishedName} |
        Set-ADObject -ProtectedFromAccidentalDeletion:$false -PassThru |
        Select-Object -First 1

    # If we didn't find any objects underneath the OU, add it to the report
    if (-not $objectList) {
        $report += $ou
    }
}

$report | Sort-Object -Property DistinguishedName |
Select-Object Name, DistinguishedName |
Export-Csv "$env:USERPROFILE\Desktop\EmptyOUs.csv" -NoTypeInformation 
Invoke-Item -Path "$env:USERPROFILE\Desktop\EmptyOUs.csv"

foreach ($item in $objectList) {
Remove-ADOrganizationalUnit -Confirm:$false -Recursive
}

-----

This is the content of my notepad/csv file:

"Name","DistinguishedName"
"OU_TEST1","OU=OU_TEST1,OU=CORTANA,DC=cortana,DC=com,DC=ph"
"OU_test2","OU=OU_test2,OU=OU_test3,DC=cortana,DC=com,DC=ph"
"OU_Test4","OU=OU_Test4,OU=USERS,OU=CORTANA,DC=cortana,DC=com,DC=ph"
"OU_Test7","OU=OU_Test7,DC=cortana,DC=com,DC=ph"

Please help, thank you in advance.

Rolaine

---

Who will be announced as the next Windows Server Directory Services Guru? Read more about May 2019 competition!!

May 1, 2019, 9:19 pm

≫ Next: Group policy not able to applied on clients system

≪ Previous: Delete bulk empty OUs from csv file through PowerShell

$

0

0

What is TechNet Guru Competition?

Each month the TechNet Wiki council organizes a contest of the best articles posted that month. This is your chance to be announced as MICROSOFT TECHNOLOGY GURU OF THE MONTH!

One winner in each category will be selected each month for glory and adoration by the MSDN/TechNet Ninjas and community as a whole. Winners will be announced in dedicated blog post that will be published in Microsoft Wiki Ninjas blog, a tweet from the Wiki Ninjas Twitter account, links will be published at Microsoft TNWiki group on Facebook, and other acknowledgement from the community will follow.

Some of our biggest community voices and many MVPs have passed through these halls on their way to fame and fortune.

If you have already made a contribution in the forums or gallery or you published a nice blog, then you can simply convert it into a shared wiki article, reference the original post, and register the article for the TechNet Guru Competition. The articles must be written in May 2019 and must be in English. However, the original blog or forum content can be from before May 2019.

Come and see who is making waves in all your favorite technologies. Maybe it will be you!

---

Who can join the Competition?

Anyone who has basic knowledge and the desire to share the knowledge is welcome. Articles can appeal to beginners or discusse advanced topics. All you have to do is to add your article to TechNet Wiki from your own specialty category.

---

How can you win?

1. Please copy/Write over your Microsoft technical solutions and revelations to TechNetWiki.
2. Add a link to your new article on THIS WIKI COMPETITION PAGE (so we know you've contributed)
3. (Optional but recommended) Add a link to your article at the TechNetWiki group on Facebook. The group is very active and people love to help, you can get feedback and even direct improvements in the article before the contest starts.

---

Do you have any question or want more information?

Feel free to ask any questions below, or Join us at the official MicrosoftTechNet Wiki groups on facebook. Read More about TechNet Guru Awards.

If you win, people will sing your praises online and your name will be raised as Guru of the Month.

PS: Above top banner came from Rajeesh Menoth.

---

https://social.technet.microsoft.com/wiki/contents/articles/37872.sql-server-installation-on-centos-linux.aspx

Group policy not able to applied on clients system

April 11, 2019, 2:20 am

≫ Next: CNAME Record Across Domains

≪ Previous: Who will be announced as the next Windows Server Directory Services Guru? Read more about May 2019 competition!!

$

0

0

Dear Support,

We are unable to applied group policy on clients system so please help us to resolve the same.

Regards,

Itsupport

CNAME Record Across Domains

April 23, 2019, 5:04 pm

≫ Next: Secure Channel issue

≪ Previous: Group policy not able to applied on clients system

$

0

0

Hello,

I have a network where EVERYTHING is being run inside the sub domain. sub1.domain.com

There is no domain controller / DNS server inside the root domain of domain.com.

I have been asked to create a CNAME record to point server1.domain.com to server2.sub1.domain.com

How would i go about accomplishing this? For temporary fix i have added a line into the host record to resolve the name. However do i need to create a new domain called domain.com inside the same forest, and then create a dns forwarder?

Secure Channel issue

April 24, 2019, 10:55 pm

≫ Next: NPS as a Radius Servee 802.1X WPA2 - How many servers for 9000 devices

≪ Previous: CNAME Record Across Domains

$

0

0

I have 3 AD sites configured in my network. Site A, Site B and Site C. When I join any client computer to domain in any Site, computer establishes secure-channel connection with site C domain controllers. Why do machine not create secure channel connection to domain controller in its own AD site.

Please help me to understand how client machine find domain controller in network with AD sites defined.

NPS as a Radius Servee 802.1X WPA2 - How many servers for 9000 devices

April 26, 2019, 7:34 pm

≫ Next: Active Directory forest function level 2016 downwards compatability to intergated windows authentication service 2003

≪ Previous: Secure Channel issue

$

0

0

We used to use FreerRadius, but recently deployed Windows Server 2019 in our organization, and felt it was best to use NPS for our radius server now. We have approximately 8000+ devices that could be authenticating with 802.1X WPA 2 enterprise to the NPS server.  Right now NPS is deployed on one domain controller and registered against AD.  How many NPS servers would be needed to authenticate this many devices, and prevent timeouts? How robust is NPS?  Is it as robust as FreeRadius?