Then we should be looking at user authentication by other means than just passwords. But that isn't a utopia either.
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rich Milburn Sent: 06 October 2005 15:35 To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] Active Directory wish list There seem to be several schools of thought on the password policy issue... - the execs and exec admins who should have the 4th most complex passwords (next to HR, accounting, and IT maybe) but lack the computer literacy to understand why and so unfortunately want no passwords or their dog's name as a password, and they have the political influence to be heard - the security people who want 5 way complex passwords (including ASCII characters) and understand the threats but not the user issues - developers who don't want the [continued] blame for leaving an open password policy, and who [might] now reasonably [from a technical and security perspective] ask "why would you want to allow some people to have a weak password policy if others require a strong one on the same network??" - AD admins who have to figure out how to make everyone happy but may get blamed if the network is compromised. - and others of course. Personally I tend to side with the developers on this, but then it probably should not be mandated by the program, only set as an initial default to protect the ignorant. IMHO. Rich --------------------------------------------------------------------------- Rich Milburn MCSE, Microsoft MVP - Directory Services Sr Network Analyst, Field Platform Development Applebee's International, Inc. 4551 W. 107th St Overland Park, KS 66207 913-967-2819 --------------------------------------------------------------------------- "I am always doing that which I can not do, in order that I may learn how to do it." - Pablo Picasso -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Wednesday, October 05, 2005 7:20 PM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] Active Directory wish list The way I can see different password policies for one domain being implemented is if you have a product/tool in front of your directory intercepting the passwords and enforcing different rules as the passwords go through. The underlying directory (AD) will have to have no policy, or have at least a very relaxed policy. This would be a sort of password servicing provisioning system. Sincerely, Dèjì Akómöláfé, MCSE+M MCSA+M MCP+I Microsoft MVP - Directory Services www.readymaids.com - we know IT www.akomolafe.com Do you now realize that Today is the Tomorrow you were worried about Yesterday? -anon ________________________________ From: [EMAIL PROTECTED] on behalf of Tyson Leslie Sent: Wed 10/5/2005 4:54 PM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] Active Directory wish list In our case (empty root, 4 child domains, 3500 users), it was primarily politics. We brought in two consultants (one from a VAR, one from Microsoft), and the decision was that the best way to go, based on politics, geographical location of the offices, and division of administration, was the empty root and 4 child domains. Password policies was a small factor, but not a driving force... That said, I personally would love to see the ability to have multiple password policies within a single domain. Tyson. ________________________________ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Phil Renouf Sent: Wednesday, October 05, 2005 1:37 PM To: ActiveDir@mail.activedir.org Subject: Re: [ActiveDir] Active Directory wish list My question would be: for a small directory of 5000 users, why do you have 3 domains? If it is for separate password policies, then perhaps a better wish list item would be the ability to have multiple password policies in one domain. Phil On 10/5/05, Rich Milburn <[EMAIL PROTECTED]> wrote: I think the biggest reason people want to be able to run multiple domains on one server is the same reason practically no one (except for SBS) installs just one DC, and the same reason we always install a minimum of 2 for a domain. We have a forest root and 2 child domains model, and it takes us 6 servers to run that - for basically 2 directories and fewer than 5000 users. That seems like a waste of hardware in some situations - especially if you have multiple orgs that you run. The parallel might be for a web hosting company to have 2 full web servers for each domain they host - in case 1 goes down, they still have a second. VS is an answer, yes, although you still need a full server license for each VM. The thing with domains is you don't want to only have 1 online copy of the directory. MS didn't seem too convinced there was a good reason to have an online second server - they cited backups as a good solution to the issue. In a big org the cost of an additional server to provide redundancy is negligible, but is having an online copy (second DC) really the BEST way to do this? And it doesn't help SBS users, since they can (correct me if I'm wrong) only have 1 DC. I realize it may be the best way we have with W2K3, but how could the issue of redundancy be addressed with AD differently than having 2 DCs minimum per domain? Anyone have any ideas? Rich -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of joe Sent: Tuesday, October 04, 2005 9:20 PM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] Active Directory wish list Yeah I can say that it isn't in Longhorn. As the dev guys put it, this is a tough one. It wouldn't just be a nobrainer if they had separate instances of AD, there are just tons of other things involved that make it extremely difficult. It was something that was brought up in the summit though, not sure how much I can say around it other than no, it won't be there. MS feels the focus of this is dramatically reduced now as well due to the fact that VS is available and can run DCs. Also the Server Core DCs helps here as well as the DCs will have a smaller footprint. If folks are NOT in agreement with that assessment, definitely speak up, it is too late for Longhorn but possibly the opportunity exists to convince them for BlackComb. joe -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Charlie Kaiser Sent: Tuesday, October 04, 2005 9:37 PM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] Active Directory wish list I'd also like to see the ability to run DCs for multiple domains on the same server. SMBs with limited resources balk at having to buy additional server hardware for redundancy on multiple domains, especially when the AD load on the DCs is minimal. This feature sounds like an offshoot of your list below. If you can run AD as a service, it might not be that hard to allow multiple domains similar to multiple websites/DBs on one server... I remember discussing this with Stuart Kwan at DEC a couple of years ago. I hope it makes it into the mix... ********************** Charlie Kaiser W2K3 MCSA/MCSE/Security, CCNA Systems Engineer Essex Credit / Brickwalk 510 595 5083 ********************** > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] ] On Behalf Of joe > Sent: Tuesday, October 04, 2005 4:25 PM > To: ActiveDir@mail.activedir.org > Subject: RE: [ActiveDir] Active Directory wish list > > Vista is the client OS. I don't believe they have named Longhorn > Server yet.I am voting for something like Windows Server 5.4.0 or > something like that. I realize that the marketing group would have > something to say about it but I figure the best thing from them is if > they pronounced their thoughts from the bottom of Lake Washington. > People don't install servers because they have cool names. > > The biggest non-NDA pieces that I have heard announced in conferences > or seen on the web already is the Read Only DC to limit security > exposure for WAN deployments, restartable AD that can be > stopped/started as necessary, DA/Admin separation so that you can have > an Admin on a DC that "can't" achieve Domain-wide DA level rights, and > DCs running on Server Foundation or now its called Server Core which > is a GUI-challenged Windows Server. > > I can also say that there are a myriad of GUI updates for the Admin > tools though I can't state specifics. BJ Whalen who was involved with > the GPMC project has been brought in to work on admin experience and > anyone who has worked with GPOs with and without GPMC know that he > really helped out. > > All in all, there is some very cool stuff and MS has really been > listening to the community on what they want and need. I know that > this list is watched for ideas and such and has been the source of > DCRs internally. So if you have ideas, spout them here, they will most > certainly be heard. They may not make Longhorn as it is getting a bit > late to add major changes but your ideas could make it into a later > rev. > > > joe > > > ________________________________ > > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Steven Wood > Sent: Monday, October 03, 2005 3:46 PM > To: ActiveDir@mail.activedir.org > Subject: [ActiveDir] Active Directory wish list > > > Hi, > > With Windows Vista on it's way what's on people's wish list as far as > Active Directory is concerned? Also are there any big enhancements > due? > > Thanks > Steven > List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ -------APPLEBEE'S INTERNATIONAL, INC. CONFIDENTIALITY NOTICE------- PRIVILEGED / CONFIDENTIAL INFORMATION may be contained in this message or any attachments. This information is strictly confidential and may be subject to attorney-client privilege. This message is intended only for the use of the named addressee. If you are not the intended recipient of this message, unauthorized forwarding, printing, copying, distribution, or using such information is strictly prohibited and may be unlawful. If you have received this in error, you should kindly notify the sender by reply e-mail and immediately destroy this message. Unauthorized interception of this e-mail is a violation of federal criminal law. Applebee's International, Inc. reserves the right to monitor and review the content of all messages sent to and from this e-mail address. Messages sent to or from this e-mail address may be stored on the Applebee's International, Inc. e-mail system. List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ -------APPLEBEE'S INTERNATIONAL, INC. CONFIDENTIALITY NOTICE------- PRIVILEGED / CONFIDENTIAL INFORMATION may be contained in this message or any attachments. This information is strictly confidential and may be subject to attorney-client privilege. This message is intended only for the use of the named addressee. If you are not the intended recipient of this message, unauthorized forwarding, printing, copying, distribution, or using such information is strictly prohibited and may be unlawful. If you have received this in error, you should kindly notify the sender by reply e-mail and immediately destroy this message. Unauthorized interception of this e-mail is a violation of federal criminal law. Applebee's International, Inc. reserves the right to monitor and review the content of all messages sent to and from this e-mail address. Messages sent to or from this e-mail address may be stored on the Applebee's International, Inc. e-mail system. List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
