RE: [ActiveDir] ADUC Extremely Slow

2005-07-13 Thread Frost, David: #CIO-BPI
First thing to suspect is the size of the OU it is focused on when opening, which is typically the last OU it was focused on when it closes. We have 2 Ous here which are huge and this usually causes the problem. Check the View / Filter Options / Maximum Number of Items to display, set it to 1000

RE: [ActiveDir] OT: Scripting changing of Exchange Admin Group for Contacts

2005-06-28 Thread Frost, David: #CIO-BPI
red.   HTH /Alain From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Frost, David: #CIO-BPISent: Friday, June 24, 2005 7:30 AMTo: ActiveDir@mail.activedir.orgSubject: [ActiveDir] OT: Scripting changing of Exchange Admin Group for Contacts Can anyone offer some guidance on whether

[ActiveDir] OT: Scripting changing of Exchange Admin Group for Contacts

2005-06-24 Thread Frost, David: #CIO-BPI
Can anyone offer some guidance on whether it is possible to script the change of the associated Exchange Admin Group for mail enabled contacts? I have a large number of mail enabled contacts that I would like to move from one Exchange Admin Group to another without deleting and recreating them.

RE: [ActiveDir] Renaming user and group object CNs

2005-06-09 Thread Frost, David: #CIO-BPI
and group object CNs You can script this using a tool like dsmod if you can come up with a list of the CNsthat you want to change to. There are other scripting options too, and if you want to change the CN to something like Lastname, Firstname you could even use ADModify. Phil On 6/8/05, Frost, David

[ActiveDir] Renaming user and group object CNs

2005-06-08 Thread Frost, David: #CIO-BPI
I have been researching the implication of modifying object CNs for users and groups in order to provide a) a more consistent cn format for objects in our directory, b) remove "special" characters such as /, #, and : that make dealing with objects via scripting difficult.   Courtesy of the A

RE: [ActiveDir] Least Privilege User Account Provisioning for AD AND Exchange

2005-05-18 Thread Frost, David: #CIO-BPI
it.   If you fill out those two attributes, the RUS should "kick in" and mailbox enable the object.        joe   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Frost, David: #CIO-BPISent: Wednesday, May 18, 2005 10:09 AMTo: ActiveDir@mail.activedir.orgSubject:

[ActiveDir] Least Privilege User Account Provisioning for AD AND Exchange

2005-05-18 Thread Frost, David: #CIO-BPI
I have a scenario I need to explore where the ability to create and modify the AD user account and associated Exchange (2003)mailbox creation is delegated out to 1st and 2nd line service desk personnel.  It is not desirable t have 1 and 2 LS staff using native tools such as ADUC or Exchange

[ActiveDir] Viewing Event Log Files recovered from backup

2004-10-08 Thread Frost . David
Does any one have any tools or utilities to suggest that would allow you to look at an event log file (security lets say)  that was recovered from a system backup as the active log file at the time the backup was taken,  It appears that any of the event log viewer utilities from Microsoft (E

RE: [ActiveDir] ADMT v2 PES question

2004-09-17 Thread Frost . David
Tony, That situation was a first hand experience for me. Once I reset (loosened) the password policy on 2K3, the export went. In my case, it was not complexity that was stopping it, but minimum password length. Jordan, I just remembered another gotcha. If you reinstalled the pes dll on the N

RE: [ActiveDir] ADMT v2 PES question

2004-09-15 Thread Frost . David
Check you default domain password policy. Likely your source domain has a weaker policy than the target (2K3) so it generates a random Password that meets the policy and places it in a file in the ADMT\logs directory. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] O

RE: [ActiveDir] Kinda OT: DNS entry

2004-08-11 Thread Frost . David
For a few months I have been trying to find out why these records are required and which application uses them. Currently I do not have them registered in my DNS and have yet to see a problem. The only references I have found refer to "legacy" clients or applications, but never are any specifics

RE: [ActiveDir] AD replication from 5.5 using ADC

2004-07-30 Thread Frost . David
The process for modifying the CAs is the same for E2k3. In our 5.5 to 2K3 migration we had a bunch of undesirable special characters and group identifiers in the 5.5 display that the ADC would replicate to the AD cn and name fields. Following MSKB 269834 stopped the 5.5 display name from overwrit

RE: [ActiveDir] Display specifier dsa.msc

2004-07-22 Thread Frost . David
If all you want to do is View the attribute in ADUC's Right pane as a column, you can with display specifies. Start with this link to add the column http://msdn.microsoft.com/library/en-us/ad/ad/modifying_existing_user_interf aces.asp?frame=true If you need to be able to modify it, you can crea

RE: [ActiveDir] Debate over 'split horizon' DNS

2004-06-10 Thread Frost . David
Having Successfully Integrated W2K3 AD with BIND DNS at our public Internet DNS Name, I can say I can be done without much pain. I choose to go with Bind for all the DNS work rather on the internal network than delegate the _srv record zones to Win/AD DNS. Our environment does not use dynamic add

[ActiveDir] Wierdness with IE Proxy GPO settings

2004-06-09 Thread Frost . David
I am having trouble making sense of IE proxy GPO settings.  Any Thoughts much appreciated.   I have defined the IE proxies in the Default Domain Policy for all Domain Users.  Everything (IE and other apps that use IE proxy config) works fine for normal logins.  The Weird things start happen

RE: [ActiveDir] OT: Compaq Servers

2004-06-08 Thread Frost . David
Title: Message I used Ghost to distribute Sysprep'd  images either by Multicast or IP connections on DL380's.  After the first build, each server was up and ready to run DCPromo within 10-15 minutes including the time to load the image over 100BaseT.  You can save a lot of time with the Syspr

RE: [ActiveDir] adding PCs

2004-06-03 Thread Frost . David
We removed it completely as well and created a role based on a group that could do it.  The right to add computers is by default granted to authenticated users, not just Domain users.  The surprise we got that lead to us to this was a user from a Trusted NT4 domain used their NT4 account to

RE: [ActiveDir] DNS settings

2004-05-10 Thread Frost . David
Title: Message What kind of Havoc is is causing? How are the users connecting to your network over their ISP's? Is there a like a VPN client of some sort by chance?    I have seen similar behaviour where VPN clients take all the IP settings except DNS from the ISP and default to the corporate

RE: [ActiveDir] Internet Explorer Connection Proxy Settings GPO I ssue

2004-03-26 Thread Frost . David
Enforced (GPMC) set to no for the domain level GPO, and other settings in that same domain level GPO get overridden by the OU policy.. From: Celone, Mike [mailto:[EMAIL PROTECTED] Sent: Friday, March 26, 2004 9:51 AMTo: '[EMAIL PROTECTED]'Subject: RE: [ActiveDir] Internet Explorer Connect

RE: [ActiveDir] Search filter for createTimestamp search with LDP

2003-12-19 Thread Frost . David
Thanks Jerry, I was missing the proper date format, specifically the final .0Z. I guess the *(any) does not work there. This time format works in both the whencreated/whenmodified attributes and the createtimestamp/modifytimestamp. According to something I stumbled over in my search for this an

[ActiveDir] Search filter for createTimestamp search with LDP

2003-12-19 Thread Frost . David
I need to search for user objects created or modified after a specific date. The createTimeStamp and modifyTimeStamp Attributes appear hold this information for each object. The problem I have is that I cannot get the correct LADP search filter to return any matches. Assuming BASE DN is correct