So what if your DHCP is running on a DC? Should I move them into the group
or not. If not what problems could this cause.
I also use a RIS to do my 2000 and XP installs. This machine is not a DC.
Should I put the RIS into the group?
Thanks,jb
-Original Message-
From: Todd Povilaitis [mai
You don't have scavenging set up for your reverse DNS zones. Set the
scavenging up (I think its called Delete Stale Records) to match your DHCP
lease duration.
--
Roger D. Seielstad - MCSE
Sr. Systems Administrator
Inovis - Formerly Harbinger and
And it conveniently leaves out the part about how the DHCP client on Win2k
and later machines automagically handles it without that setting.
--
Roger D. Seielstad - MCSE
Sr. Systems Administrator
Inovis - Formerly Harbinger and Extricity
Atlanta,
Your second statement, about the DNS proxy group, is only true for
supporting downlevel clients. In addition, it opens up some new and
interesting security issues, because now your DHCP servers can injecy ANY
record they want into DNS, including bogus DC and GC records.
---
Which isn't strictly necessary, unless you plan on disabling all client
based updates.
Personally, we don't use that setting here, with a mix of Win9x on through
XP and have no issues with the DNS updates happening correctly.
--
Roger D. Seielst
Then you have zero reason to have any members of that group, and a few
security reasons not to.
--
Roger D. Seielstad - MCSE
Sr. Systems Administrator
Inovis - Formerly Harbinger and Extricity
Atlanta, GA
> -Original Message-
> From: To
Is this also true where only secure updates are allowed for the server or zone? One
of the immediate effects of allowing only secure updates (in addition to scavenging)
was the removal of all non-member (9x, NT) machine's A records from the zone. This is
what we wanted.
-Original Message-
Dear All, have picked up many useful pointers towards a version of ADMT v2.0
that is shipped with .NET RC1 (i think).
keen to research the use of "password export server" and the processes of
password migration which is new to v2.0
on the basis of planned migration from a source NT4 domain to Win
DNS scavaging was just mentioned. Anyone have a best practices for this? We're
currently not using it, but I'd like to keep things "clean" and current.
Dave
-Original Message-
From: Roger Seielstad [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, February 18, 2003 12:04 PM
To: '[EMAIL PROTE
I have a policy set for passwords; the passwords are set to expire every
90 days. When the passwords are about to expire, users are told that
"Your password will expire in 5 days. Do you want to change your
password now?" (The number changes, it does a countdown). However, if
the user says yes to
Do you have a minimum password age set? Or do you check the "User
cannot change password" box checked?
-Original Message-
From: John Balos [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, February 18, 2003 12:42 PM
To: [EMAIL PROTECTED]
Subject: [ActiveDir] Policy on password
I have a polic
Open the default DC policy, and view the right for "access this computer
from the network". Verify that authenticated users has this right. If
authenticated users does not have that right, you will experience that
error.
Tim Hines, MCSA, MCSE (2000 & NT4)
MVP - Active Directory
"If you catch a m
Answer:
The
NT Domain had the 'user must log in to change
password'
policy set. Since the user wasn't really
logging
in to access the web page, it was being
denied.
Best
thing to do is impersonate the user , is annon
acces
for that folder switched off?
Are
you using a asp.net
We run with Secure Updates only on all our zones. If you either don't want
Win9x and NT clients listed, or if you don't have any of those clients, then
you're all set.
Altnerately, you can set the DHCP server to register on behalf of the
downlevel clients, which also doesn't cause any issues. In e
very keen to leverage the templates for baselining DC security and
configuration distributed with the MS security operations guide,
it would seem that these would have been developed certainly before SP3 (w2k
by the way) which seems to have introduced a number of additional services
eg
Automatic
Probaly the everyone group dont have permission on all users to change
password. See http://support.microsoft.com/?kbid=242795.
regards, Marcio Schneider
> -Mensagem original-
> De: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]]Em nome de John Balos
> Enviada em: terca-feira, 18 de feve
The everyone group had access to this however, the authenticated users
didn't. I went ahead and added this group. What's the difference between
authenticated and everyone? Shouldn't it of worked even if you have the
everyone group on there? Thank you.
John
-Original Message-
From: Tim Hi
Graham:
The password export server is only required for migration of accounts from Win2K to
Win2K. It is not required for NT 4.0 to Win2K migrations.
Diane
-Original Message-
From: Graham Turner [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, February 18, 2003 10:40 AM
To: [EMAIL PROTECTED
Graham,
Though I don't have a link to them in front of me at the moment, as you
might recall, Microsoft submitted for and passed the Common Criteria.
Microsoft (via SAIC) published a configuration and an administration
guide that is a bit more current with templates, et. al. Look into
those for y
Funny, I was just looking at those :-]
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/issues/W2kCCSCG/W2kSCGcf.asp
-Original Message-
From: Rick Kingslan [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, February 18, 2003 3:22 PM
To: [EMAIL PROTECTED]
Subject: RE: [Ac
Thanks, Bob! ;-)
Rick Kingslan MCSE, MCSA, MCT
Microsoft MVP - Active Directory
Associate Expert
Expert Zone - www.microsoft.com/windowsxp/expertzone
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]] On Behalf Of Free, Bob
> Sent: Tuesday, February 18, 200
Hello Everyone,
The simplest domain model is the Single Forest / Single Domain. I
was thinking of using this model with an "empty" root domain? Does anyone
have any experience with "empty" root domain? Is it really beneficial? We
are only a small company with a few hundred users and have 4
Hi Cliff,
There are two pros that I am aware of...
1. In the case of radical naming hierarchy surgery, e.g., acquisition of
another company, it provides a convenient place to merge in the new domains.
2. "Enhanced security" for the Enterprise Admins and Schema Admins groups is
often claimed, but
In my opinion, the benefit to going with a dedicated forest root is
recoverability. You will have a domain that you are doing most of your
management. All of your user accounts, groups, computers and everything will
be in that domain. If something goes wrong, you don't have to worry about
blowing t
24 matches
Mail list logo