RE: [ActiveDir] Restore AD

2004-12-05 Thread Grillenmeier, Guido
it's important to note, that adding sIDHistory to a reanimated object via DsAddSidHistory won't work, if the original object to that SID is no longer available (e.g. from domain, which has been shutdown in the meantime). A good approach would be to add further attributes to keep in the tombstone

RE: [ActiveDir] Custom Password Filter DLL

2004-12-05 Thread joe
Do you feel there is a difference between a custom gina and hacked gina or do you consider a hacked gina the same as a custom gina? By hacked I mean a gina that is MS but has had pieces of the actual file binary tweaked and the peheader recalculated and tweaked to account for the changes so the fil

RE: [ActiveDir] Restore AD

2004-12-05 Thread Eric Fleischman
Yes Guido what you noted would work well. It has been done before. Someone who has good provisioning might not even care about this in fact. Most linked attributes tend to be provisioned by the nature of what they are used for (group memberships, manager, etc.) and therefore tend to be able to

RE: [ActiveDir] Custom Password Filter DLL

2004-12-05 Thread Ulf B. Simon-Weidner
Since they are just talking about resource hacking the regkey will not be affected and a hotfix might change the dll and the reg if necessary. The hotfix will not be able to determine that the dll was hacked. Just AFAIK Gruesse - Sincerely, Ulf B. Simon-Weidner MVP-Book "Windows XP - Die Ex

RE: [ActiveDir] Custom Password Filter DLL

2004-12-05 Thread Glenn Corbett
Eric, This was more in reference to the resource hacker link that was posted. I was presuming that rather than create a custom gina, people would simply hack the resources on the standard one, in which case my points were valid. You are correct of course, if the standard gina is replaced with a ne

RE: [ActiveDir] OT: Full vs Diff

2004-12-05 Thread Robert Rutherford
Ok... Yes it is out of the ordinary for backups to take longer on Diffs. I dont expect you should be running incrementals instead of Diffs, especially as you state that your fulls are only taking 4 hrs. What backup software are u using? Has it been working OK? Have you checked the backup jobs

RE: [ActiveDir] Restore AD

2004-12-05 Thread Grillenmeier, Guido
agreed on most of what you say, Eric. it's just that many companies don't have a full fledged provisioning service today, which takes care of all the group-links etc - especially when regarding groups used to manage file-systems. Ofcourse this could be extended, if the sytem itself is inplace. I'

RE: [ActiveDir] OT: Full vs Diff

2004-12-05 Thread Douglas M. Long
Well, it looks like there was something wrong with the media set the differentials were trying to use. Now all works just fine, but I have decided that the level of retention that we require is actually going to allow me to perform full backups every night with the amount of scratch media we hav

[ActiveDir] Joining to different AD Domains

2004-12-05 Thread Mike Hogenauer
Our company recently merged with another company. Both companies are running windows 2000 AD domains. I need to join these 2 domains ASAP to share resources and user groups, etc. I’ve never had to join two different AD domains into one domain so any first steps or good links would be appr

RE: [ActiveDir] Joining to different AD Domains

2004-12-05 Thread Brian Desmond
Hi Mike,   What you’re looking for is a two way trust between the domains. You can set this up using AD Domains and Trusts. A trust will enable cross domain resource sharing.   As far as DNS, I’d recommend creating a secondary zone for each organization on the other’s DNS servers.   E

RE: [ActiveDir] Joining to different AD Domains

2004-12-05 Thread Renouf, Phil
Also make sure to integrate your WINS environments. Establish a push pull replication between your two separate WINS environments to allow for full name resolution between both AD domains via DNS and WINS (assuming you are using WINS). Brian is on the right track I think. If sharing resources is y

[ActiveDir] Add Computer to Domain rights

2004-12-05 Thread Mike Celone
Where does the Add Computers to the domain right need to be specified?  Do you define it on the Default Domain Controllers Policy or on the Default domain policy?  I have to give a group this right and I wasn't sure which policy it needs to be defined on.   Mike

RE: [ActiveDir] Add Computer to Domain rights

2004-12-05 Thread Brian Desmond
Mike-   You need to delegate this right. Create group on your domain called Add Computer To Domain or something of that nature. Put the users you want to grant this right to in the group.   Right click the computers CN (or where ever users are going to be creating computer accounts if y