RE: [ActiveDir] DEC Chatter - Was something else...

2004-03-28 Thread joe
Longhorn Server is the interim version of Blackcomb Server. We didn't discuss any interim versions of the workstation OS Pre-Longhorn (aka Shorthorn, Shoehorn, etc). I think it is has only been since last November or so that the idea that we were going to have Longhorn server came about.

RE: [ActiveDir] Linking other GPO objects to Domain Controllers

2004-03-28 Thread joe
Ah. Interesting... His app must be doing something with older API calls as LDAP should have been unaffected by that change. I guess if he were falling back to NTLM authentication on the bind that might be involved. I think this one falls into the category of prod the vendor to make them figure

RE: [ActiveDir] DEC Chatter - Was something else...

2004-03-28 Thread joe
1. I don't think so... Not if it were a TRUE caching mechanism... I.E. You don't drag all of the account info for all objects in a single domain to the caching device, you only drag the ones used at that site... This should actually allow you to use a smaller machine especially with the domain

RE: [ActiveDir] permissions to only disable an AD user account

2004-03-28 Thread Eric Fleischman
So long as we can agree that you'll either have an inconsistent admin experience or a functional level dependency, that'll work, although I wouldn't like it as much as some other options. ;) Here's an option I like: tie it to functional level, but in the same way we do LVR now. So what do we do

RE: [ActiveDir] Linking other GPO objects to Domain Controllers

2004-03-28 Thread Darren Mar-Elia
Ouch. Joe, I feel that pain. Talk about denial of service. I think this brings up a few good points about a few things near and dear to my heart. First off, I always council to link GPOs as close to the target audience as possible. In your example below where Everyone gets added to some sec.

RE: [ActiveDir] DEC Chatter - Was something else...

2004-03-28 Thread Darren Mar-Elia
That would be cool. If I'm not mistaken, I think NDS has allowed a similar capability for years in that you can cleave off parts of a tree and replicate it to those servers that need it most. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of joe Sent:

RE: [ActiveDir] AD and ports

2004-03-28 Thread joe
The WinNT stuff is usually all RPC based which generally means RPC Range (1024+) unless you specifically force machines to only talk RPC on certain ports. There is details about this sort of stuff on the MS site. Do searches on firewalls and RPC. joe - http://www.joeware.net

RE: [ActiveDir] Server up/downtime

2004-03-28 Thread deji Agba
So say an Exchange Server that is responding to pings but isn't handling mail at all or not very well is considered UP for availability numbers. This you handle by using the Built-in Exchange monitoring tool. You can roll your own sink to monitor queue and send you an alert IF it reaches a

RE: [ActiveDir] Linking other GPO objects to Domain Controllers

2004-03-28 Thread Thommes, Michael M.
Actually, this contractor was testing to get to the higher level of secure authentication. Our domain was set back a notch on this value when we went to Server 2003 on some of our DCs since the default value (always) broke some older apps (like non-current SNAP servers). We wanted to set the

RE: [ActiveDir] DEC Chatter - Was something else...

2004-03-28 Thread joe
Yep, they do have that but I think this is better. Here's why Almost zero administration overhead if done right. When you do this with NDS, you have to make logical choices of what partitions people go into and when they move around (say short term visit to some site for the summer or the

RE: [ActiveDir] Linking other GPO objects to Domain Controllers

2004-03-28 Thread joe
Ah understood. Me and my assumptions... Cool. Go security! I would like to say that we will fix that value in our environment when we finally dump all NT4 and Win9x however it will also break our EMC Celerra's, our Linux Samba, our Unix Samba, our you name the OS/RTS Samba, and other things. It

RE: [ActiveDir] permissions to only disable an AD user account

2004-03-28 Thread GRILLENMEIER,GUIDO (HP-Germany,ex1)
and once you've got the method for updating that attribute in place, you'd still need to add a way to grant permissions in AD to allow to use the method - right? I could imagine, that this would happen via additional Extended Rights, similar to other new Rights that have already been added in

RE: [ActiveDir] Remote Desktop Issue

2004-03-28 Thread Michael B. Smith
Doesn't local "Administrators" by default include "Domain Admins" but not "Enterprise Admins"? -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Daniel GilbertSent: Saturday, March 27, 2004 11:39 PMTo: [EMAIL PROTECTED]Subject: RE:

RE: [ActiveDir] Server up/downtime

2004-03-28 Thread joe
Yes and no. This is still internal to Exchange, it is just as bad as say a MOM agent that is running tests on a local box. Doesn't tell you anything about whether clients can access you or not. Do you for instance warn if the queue doesn't grow at all for a while? That would be an aside

RE: [ActiveDir] Quick question on ADMT

2004-03-28 Thread Eric Fleischman
Title: Message Hi Steve, Can you clarify a bit? Do you mean during a migration? If so, how large is the migration were talking about (how many users/computers/groups/etc.)? With that I can probably scrounge up some anecdotal numbers, but official is tough. Ill see what I can do.

RE: [ActiveDir] Exchange 2003 DL

2004-03-28 Thread GRILLENMEIER,GUIDO (HP-Germany,ex1)
if you're running E2k3 in a Win2003 AD, you might want to use the ManagedBy attribute of the group afterall: 2003 has a new function in ADUC, which simplifies setting the permissions for managing group-memberships for the user defined as the manager of a group. You just have to select the new

RE: [ActiveDir] Linking other GPO objects to Domain Controllers

2004-03-28 Thread joe
Absolutely on many of your points. This design was out of the client group as they own the entire GPO process since we only do GPO's for clients (well and domain controllers obviously). Everyone looked at it though and no one thought up the possible issues/consequences. It seemed linking at the

RE: [ActiveDir] Server up/downtime

2004-03-28 Thread Depp, Dennis M.
We have serveral tests for determining if a system is functioning. The first is a simple ping test. The second level is to determine if necessary services are running on the server. The services we monitor depend on the functionality of the server. IE, Exchange servers are checked to verify

RE: [ActiveDir] Exchange 2003 DL

2004-03-28 Thread GRILLENMEIER,GUIDO (HP-Germany,ex1)
Joe, I do basically agree with you on this, however it is not so uncommon for medium sized companies (of which there simply are more of than really large ones), to allow just the owner of a group to change membership. For these companies this feature is rather handy, as you don't need to take

[ActiveDir] monitoring display

2004-03-28 Thread cyrus1
greetings, is there any way that it would display current users logon that will display info such as, 1. time user login and log out 2. current files being accessed/read 3. current printer being used. thanks cyrus List info

RE: [ActiveDir] monitoring display

2004-03-28 Thread mathif
Title: RE: [ActiveDir] monitoring display Hi Cyrus, Yep! you can do that from Computer Management. It gives you all the details.. Cheers, Athif -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Monday, March 29, 2004 8:35 AM To: [EMAIL PROTECTED] Subject:

[ActiveDir] Unable to modify Administrator's object class

2004-03-28 Thread Manoj Sp
Hi all, I want to modify administrator's object class to include an auxiliary object class with the following characteristics: governsID - 2.16.840.1.114008.1.6000.2.42 lDAPDisplayName - pbwPerson objectClassCategory - 3 subClassOf - top possSuperiors - top rDNAttID - cn mustContain