AD LDS Password Policy

June 27, 2011, 9:22 am

≪ Previous: Cannot remove missing NIS server

I have a AD LDS instance on a Win 2008 machine which is a member of the Domain.

We have created a user account in AD LDS , there is a security requirement that password for this account should expire in a year and should be changed.

How can we manage policy for this user and any other users within LDS.

↧

Scrip for AD computers

June 9, 2016, 3:18 am

≫ Next: Can I modify Department attribute without any issue?

≪ Previous: AD LDS Password Policy

dears,

We need to develop a script that will generate a report of all AD computers, with the following attributes:

PC name
Last logged on username
Last logged on username's office
Last logged on username's employee ID
Child OU
Parent OU

Can you help on this?

↧

Can I modify Department attribute without any issue?

June 9, 2016, 5:38 am

≫ Next: "Old" name of domain controller still shows up and is pingable after demotion and shutdown

≪ Previous: Scrip for AD computers

Hi All!

I should modify the rangeupper limit from 64 to 96 becuse of our HR application (Users department text longer than 64 char).

Have you got experiences with this? Have you ever modified this attribute rangeupper?

I haven't got representative LAB to test it, but if you say that this modification is very sensitive, then i have to test it before i change this in production.

Thanks,

↧

"Old" name of domain controller still shows up and is pingable after demotion and shutdown

June 9, 2016, 12:33 am

≫ Next: Active direcyory

≪ Previous: Can I modify Department attribute without any issue?

Hi,

just demoted an old 2003r2 domain controller (DC01) and uninstalled DNS and DHCP as well. Had installed a server 2012 r2 as a new domain controller (DC001) a few weeks ago with DNS and DHCP. So there was enough time to replicate and everything.

dcdiag was good, repadmin, replmon was good. After demotion of old DC (DC01) it became a member server and went to the Computers-OU. No errors on demotion. So everything good. Because it was the "main dc" I wanted to re-use the ip-address. Since it was a member server now I renamed the host (from DC01 to TEMP01) and gave it another ip-address.

Then I went on to DC001 (the new one long running 2012r2 dc) and gave it the original ip address of the old 2003 dc. I didn't rename the dc, just changed the ip.

two "problems":

I can ping now both names, they both resolve on the original ip (so DC01 answers and DC001 answers). I don't understand why. Of course the ip-adress answers, because it's active again. But the name DC01 shouldn't resolve anything. I cleaned up every zone, folder and whatever on all dns servers and restarted every dns server. I cleaned the caches, flushdns etc. It's pingable from the whole network so it must be a central thing.

Any suggestions? Interesting: If I open a share through \\new name it works if I open it through \\old name (which is pingable) I get the famous error "dublicate name exists on the network" -> loopback check and disablestrictnamechecking. This lets me think, that the target machine (new dc) really thinks it is or was named DC01 (old name). But it never was, just got now the same ip-adress as the old one earlier...

Second problem is that I'm not able to replicate with a secondary zone from another dns in another country but I don't think that it's related to the things I already wrote about.

thanks!

Thanks, regards, tim

↧

Active direcyory

June 9, 2016, 1:31 am

≫ Next: Reset password with History resulting in - "The server does not support the control. The control is critical."

≪ Previous: "Old" name of domain controller still shows up and is pingable after demotion and shutdown

dear team,

i want to change my compange all users password how we able to change or reset all users login ID password in AD

please share any good way or command step by step windows 2008 r2 standard AD Server

Contain a combination of at least three of the following characters: uppercase letters, lowercase letters, numbers, symbols (punctuation marks)

↧

Reset password with History resulting in - "The server does not support the control. The control is critical."

June 9, 2016, 7:59 am

≫ Next: Event ID's

≪ Previous: Active direcyory

I've followed what I believe to be the right steps from this article (only in powershell). I can't however get it to work. I've tried both controls and verified through adsiedit and ldp that I have both controls that I need. I'm sure I'm missing something quit simple here but would appreciate some help.

supportedControl (35):
  1.2.840.113556.1.4.2239 = ( POLICY_HINTS );
  1.2.840.113556.1.4.2066 = ( POLICY_HINTS_DEPRECATED );

When I set isCritical ("1.2.840.113556.1.4.2239", $byte, $true, $true) to true I get a failure of ...

Exception: System.Management.Automation.MethodInvocationException: Exception calling "SendRequest" with "1" argument(s): "The server does not support the control. The control is critical." --->
	System.DirectoryServices.Protocols.DirectoryOperationException: The server does not support the control. The control is critical.
	   at System.DirectoryServices.Protocols.LdapConnection.ConstructResponse(Int32 messageId, LdapOperation operation, ResultAll resultType, TimeSpan requestTimeOut, Boolean exceptionOnTimeOut)
	   at System.DirectoryServices.Protocols.LdapConnection.SendRequest(DirectoryRequest request, TimeSpan requestTimeout)
	   at CallSite.Target(Closure , CallSite , Object , Object )
	   --- End of inner exception stack trace ---
	   at System.Management.Automation.ExceptionHandlingOps.ConvertToMethodInvocationException(Exception exception, Type typeToThrow, String methodName, Int32 numArgs, MemberInfo memberInfo)
	   at CallSite.Target(Closure , CallSite , Object , Object )
	   at System.Dynamic.UpdateDelegates.UpdateAndExecute2[T0,T1,TRet](CallSite site, T0 arg0, T1 arg1)
	   at System.Management.Automation.Interpreter.DynamicInstruction`3.Run(InterpretedFrame frame)
	   at System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame)

When I don't set isCritical ("1.2.840.113556.1.4.2239", $byte, $false, $true) I get a Success returned but the password hasn't been changed.

RequestId    :
MatchedDN    :
Controls     : {}
ResultCode   : Success
ErrorMessage :
Referral     : {}

This is what I'm doing

[System.Reflection.Assembly]::LoadWithPartialName("System.DirectoryServices.Protocols") | Out-Null
[System.Reflection.Assembly]::LoadWithPartialName("System.Net") | Out-Null

$SDPServer = $srv
$SDPPort = 636

$SDPConnection = New-Object System.DirectoryServices.Protocols.LdapConnection -ArgumentList "$($SDPServer):$($SDPPort)"

#Set session options

$SDPConnection.SessionOptions.SecureSocketLayer = $true;
$SDPConnection.SessionOptions.VerifyServerCertificate = { return $true;} #needed for self-signed certificates
$SDPConnection.SessionOptions.ProtocolVersion = 3;

$SDPConnection.AuthType = [System.DirectoryServices.Protocols.AuthType]::Basic
#$SDPConnection.AuthType = [System.DirectoryServices.Protocols.AuthType]::Ntlm

$netcred = new-object "System.Net.NetworkCredential" -ArgumentList $adsvc, $adpwd, $domain

$SDPConnection.Bind($netcred)

[byte]$byte = "0x1"

#$control = new-object "System.DirectoryServices.Protocols.DirectoryControl" -ArgumentList "1.2.840.113556.1.4.2066", $byte, $true, $true
$control = new-object "System.DirectoryServices.Protocols.DirectoryControl" -ArgumentList "1.2.840.113556.1.4.2239", $byte, $true, $true

$request = new-object "System.DirectoryServices.Protocols.ModifyRequest" -ArgumentList $userDN
$request.Controls.Add($control) | Out-Null

$modification = New-Object "System.DirectoryServices.Protocols.DirectoryAttributeModification"
$modification.Name = "userPassword"
$modification.Operation = [System.DirectoryServices.Protocols.DirectoryAttributeOperation]::Replace
$modification.Add($usrpwd) | Out-Null

$request.Modifications.Add($modification) | Out-Null

$result = $SDPConnection.SendRequest($request);

$result

↧

Event ID's

June 9, 2016, 11:08 am

≫ Next: Error "an attempt to resolve the DNS name of a domain controller in the domain.."

≪ Previous: Reset password with History resulting in - "The server does not support the control. The control is critical."

I am currently trying to set up some monitors through an RMM for Active Directory. I would like to be able to monitor the event logs for any issues that arise. Is there a list of all the AD related Event ID's anywhere?

↧

Error "an attempt to resolve the DNS name of a domain controller in the domain.."

June 9, 2016, 11:42 am

≫ Next: DNSCMD Option /statictis

≪ Previous: Event ID's

I'll start by saying that I'm still learning a lot so please go easy. I recently setup a server 2012r2 from stock with AD,DNS,DHCP. I'm trying to connect a client windows 7 laptop to the server for the first time and I get the error. I can ping the server from the laptop by FQDN and it works fine. When I try to nslookup the server it can't be found.

Windows IP Configuration

   Host Name . . . . . . . . . . . . : nminew
   Primary Dns Suffix  . . . . . . . : nano.local
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : nano.local

Ethernet adapter NIC1:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Broadcom NetXtreme Gigabit Ethernet
   Physical Address. . . . . . . . . : 34-17-EB-EF-38-37
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 192.168.1.2(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.1.1
   DNS Servers . . . . . . . . . . . : 192.168.1.2
   NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter isatap.{4702681F-AB2B-4FB7-8BD0-BF5C0A326D37}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Current dcdiag didn't throw any flags but previous ones have

Directory Server Diagnosis


Performing initial setup:

   Trying to find home server...

   Home Server = nminew

   * Identified AD Forest.
   Done gathering initial info.


Doing initial required tests


   Testing server: Default-First-Site-Name\NMINEW

      Starting test: Connectivity

         ......................... NMINEW passed test Connectivity



Doing primary tests


   Testing server: Default-First-Site-Name\NMINEW

      Starting test: Advertising

         ......................... NMINEW passed test Advertising

      Starting test: FrsEvent

         ......................... NMINEW passed test FrsEvent

      Starting test: DFSREvent

         ......................... NMINEW passed test DFSREvent

      Starting test: SysVolCheck

         ......................... NMINEW passed test SysVolCheck

      Starting test: KccEvent

         ......................... NMINEW passed test KccEvent

      Starting test: KnowsOfRoleHolders

         ......................... NMINEW passed test KnowsOfRoleHolders

      Starting test: MachineAccount

         ......................... NMINEW passed test MachineAccount

      Starting test: NCSecDesc

         ......................... NMINEW passed test NCSecDesc

      Starting test: NetLogons

         ......................... NMINEW passed test NetLogons

      Starting test: ObjectsReplicated

         ......................... NMINEW passed test ObjectsReplicated

      Starting test: Replications

         ......................... NMINEW passed test Replications

      Starting test: RidManager

         ......................... NMINEW passed test RidManager

      Starting test: Services

         ......................... NMINEW passed test Services

      Starting test: SystemLog

         ......................... NMINEW passed test SystemLog

      Starting test: VerifyReferences

         ......................... NMINEW passed test VerifyReferences



   Running partition tests on : ForestDnsZones

      Starting test: CheckSDRefDom

         ......................... ForestDnsZones passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... ForestDnsZones passed test

         CrossRefValidation


   Running partition tests on : DomainDnsZones

      Starting test: CheckSDRefDom

         ......................... DomainDnsZones passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... DomainDnsZones passed test

         CrossRefValidation


   Running partition tests on : Schema

      Starting test: CheckSDRefDom

         ......................... Schema passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... Schema passed test CrossRefValidation


   Running partition tests on : Configuration

      Starting test: CheckSDRefDom

         ......................... Configuration passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... Configuration passed test CrossRefValidation


   Running partition tests on : nano

      Starting test: CheckSDRefDom

         ......................... nano passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... nano passed test CrossRefValidation


   Running enterprise tests on : nano.local

      Starting test: LocatorCheck

         ......................... nano.local passed test LocatorCheck

      Starting test: Intersite

         ......................... nano.local passed test Intersite

Previous dcdiag:

Directory Server Diagnosis

Performing initial setup:

Trying to find home server...

Home Server = nminew

* Identified AD Forest.
Done gathering initial info.

Doing initial required tests

Testing server: Default-First-Site-Name\NMINEW

Starting test: Connectivity

......................... NMINEW passed test Connectivity

Doing primary tests

Testing server: Default-First-Site-Name\NMINEW

Starting test: Advertising

......................... NMINEW passed test Advertising

Starting test: FrsEvent

......................... NMINEW passed test FrsEvent

Starting test: DFSREvent

......................... NMINEW passed test DFSREvent

Starting test: SysVolCheck

......................... NMINEW passed test SysVolCheck

Starting test: KccEvent

A warning event occurred. EventID: 0x80000B46

Time Generated: 06/06/2016 11:27:04

Event String:

The security of this directory server can be significantly enhanced by configuring the server to reject SASL (Negotiate, Kerberos, NTLM, or Digest) LDAP binds that do not request signing (integrity verification) and LDAP simple binds that are performed on a clear text (non-SSL/TLS-encrypted) connection. Even if no clients are using such binds, configuring the server to reject them will improve the security of this server.

......................... NMINEW passed test KccEvent

Starting test: KnowsOfRoleHolders

......................... NMINEW passed test KnowsOfRoleHolders

Starting test: MachineAccount

......................... NMINEW passed test MachineAccount

Starting test: NCSecDesc

......................... NMINEW passed test NCSecDesc

Starting test: NetLogons

......................... NMINEW passed test NetLogons

Starting test: ObjectsReplicated

......................... NMINEW passed test ObjectsReplicated

Starting test: Replications

......................... NMINEW passed test Replications

Starting test: RidManager

......................... NMINEW passed test RidManager

Starting test: Services

......................... NMINEW passed test Services

Starting test: SystemLog

A warning event occurred. EventID: 0x000727A5

Time Generated: 06/06/2016 11:25:10

Event String:

The WinRM service is not listening for WS-Management requests.

A warning event occurred. EventID: 0x000003F6

Time Generated: 06/06/2016 11:26:57

Event String:

Name resolution for the name _ldap._tcp.dc._msdcs.nano.local. timed out after none of the configured DNS servers responded.

A warning event occurred. EventID: 0x000727AA

Time Generated: 06/06/2016 11:27:27

Event String:

The WinRM service failed to create the following SPNs: WSMAN/nminew.nano.local; WSMAN/nminew.

A warning event occurred. EventID: 0x0000000C

Time Generated: 06/06/2016 11:27:26

Event String:

Time Provider NtpClient: This machine is configured to use the domain hierarchy to determine its time source, but it is the AD PDC emulator for the domain at the root of the forest, so there is no machine above it in the domain hierarchy to use as a time source. It is recommended that you either configure a reliable time service in the root domain, or manually configure the AD PDC to synchronize with an external time source. Otherwise, this machine will function as the authoritative time source in the domain hierarchy. If an external time source is not configured or used for this computer, you may choose to disable the NtpClient.

A warning event occurred. EventID: 0x00002724

Time Generated: 06/06/2016 11:27:31

Event String:

This computer has at least one dynamically assigned IPv6 address.For reliable DHCPv6 server operation, you should use only static IPv6 addresses.

A warning event occurred. EventID: 0x000003F6

Time Generated: 06/06/2016 11:27:35

Event String:

Name resolution for the name nano.local timed out after none of the configured DNS servers responded.

A warning event occurred. EventID: 0x000003F6

Time Generated: 06/06/2016 11:27:37

Event String:

Name resolution for the name wpad timed out after none of the configured DNS servers responded.

......................... NMINEW passed test SystemLog

Starting test: VerifyReferences

......................... NMINEW passed test VerifyReferences

Running partition tests on : ForestDnsZones

Starting test: CheckSDRefDom

......................... ForestDnsZones passed test CheckSDRefDom