ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login
    1. Topics
    2. Tags
    3. active directory
    Log in to post
    • All categories
    • EddieJenningsE

      Logging Domain user authentication failures

      IT Discussion
      • audit policy windows domain server 2012 active directory active directory domain group policy • • EddieJennings
      5
      0
      Votes
      5
      Posts
      1.5k
      Views

      travisdh1T

      @eddiejennings said in Logging Domain user authentication failures:

      @travisdh1 said in Logging Domain user authentication failures:

      @eddiejennings No OSSEC, Wazuh, or some other security monitoring available? All of them monitor logins by default that I've looked at. Should be easy to customize a report for whatever you need.

      I haven't had to set this up in a Windows environment yet, so I'm also curious as to what you end up doing.

      We do have ExtraHop; however, it's not capturing all the traffic it should (and another team is in charge of its configuration), so using auditing on the domain controllers is a bit of a stop-gap measure.

      Ah. What an ..... effective use of resources.

      Good luck, ExtraHop is very nice, but like every other tool, it's useless untill deployed properly.

    • scottalanmillerS

      Easy PowerShell AD Commands

      IT Discussion
      • windows powershell active directory • • scottalanmiller
      4
      5
      Votes
      4
      Posts
      686
      Views

      EddieJenningsE

      One that I love

      Get-ADPrincipalGroupMembership -Identity SOMEUSERNAME | Select name

      List all of the groups in which the user is a member.

    • dbeatoD

      Microsoft Active Directory Auditing Tool

      IT Discussion
      • active directory audit pingcastle microsoft • • dbeato
      1
      0
      Votes
      1
      Posts
      664
      Views

      No one has replied

    • gjacobseG

      ADUC: Use Powershell to Export list of User/Groups

      IT Discussion
      • aduc server 2012 active directory activedirectory powershell users export report • • gjacobse
      2
      0
      Votes
      2
      Posts
      981
      Views

      DustinB3403D

      I got you

      # This script will export all users of the specified domain, and their group memberships to a CSV file. The usefulness of this tool is expressed when # setting up new hire employees or reviewing domain membership permissions. # It's not advisable to store the user credentials required to run this script as they can be decrypted. This script is not designed to save these credentials but could be modified to do so. # Use of this script implies that you understand what it does, and will do to with regards to your Active Directory installation members and group memberships. # As designed there are no changes made to your installation, the script simply generates a report of members, and their group memberships. # Any changes to this script are the responsibility of the person/organization which made said changes. # We cannot be held responsible for your misuse or misunderstanding of this script as it was designed. # # # # # Imports Active Directory information Import-Module Activedirectory $credentials = Get-Credential # Prompts for user credentials default user is “ ”, enter an administrator account in the form of “domain-name\administrator-account” Get-ADUser -Credential $credentials -Filter * -Properties DisplayName,EmailAddress,memberof,DistinguishedName,Enabled | % { New-Object PSObject -Property @{ UserName = $_.DisplayName EmailAddress = $_.EmailAddress DistinguishedName = $_.DistinguishedName Enabled = $_.Enabled # Deliminates the document for easy copy and paste using ";" as the delimiter. Incredibly useful for Copy & Paste of group memberships to new hire employees. Groups = ($_.memberof | Get-ADGroup | Select -ExpandProperty Name) -join ";" } # The export path is variable change to desired location on domain controller or end user computer. } | Select UserName,EmailAddress,@{l='OU';e={$_.DistinguishedName.split(',')[1].split('=')[1]}},Groups,Enabled | Sort-Object Username | Export-Csv $ENV:UserProfile\Documents\User-Permissions.csv –NTI #Function Get-SaveFile($initialDirectory) #{ #[System.Reflection.Assembly]::LoadWithPartialName("System.windows.forms") | #Out-Null # #$SaveFileDialog = New-Object System.Windows.Forms.SaveFileDialog #$SaveFileDialog.initialDirectory = $initialDirectory #$SaveFileDialog.filter = "All files (*.*)| *.*" #$SaveFileDialog.ShowDialog() | Out-Null #$SaveFileDialog.filename #} # # # open dialog box to select the .nessuss file. #$InputFile = Get-OpenFile #$OutputFile = Get-SaveFile # # #$Contents = [io.file]::ReadAllText($inputfile) #$Contents = [io.file]::ReadAllText('C:\tools\wd\nessus\data\data.xml') #$Global:OutFile = [System.IO.StreamWriter] "c:\tools\wd\nessus\outfile.csv" # ##$InputFile #$OutputFile #
    • OksanaO

      Microsoft Certificate Server, the relief from the self-signed certificates

      Starwind
      • microsoft active directory ad adcs • • Oksana
      1
      4
      Votes
      1
      Posts
      574
      Views

      No one has replied

    • OksanaO

      Instead of creating users manually, just join VMware vCenter to Microsoft AD

      Starwind
      • vmware vcenter vcenter vmware active directory ad vcsa microsoft • • Oksana
      1
      2
      Votes
      1
      Posts
      690
      Views

      No one has replied

    • DustinB3403D

      Is It Possible to Mount SMB Share Using Kerberos Token of Current User on MacOS

      IT Discussion
      • apple unix smb macos kerberos active directory • • DustinB3403
      48
      0
      Votes
      48
      Posts
      6.3k
      Views

      D

      See the following for ideas as to how you can accomplish what you're seeking to do:

      https://macmule.com/2011/09/08/how-to-map-drives-printers-based-on-ad-group-membership-on-osx/

    • JaredBuschJ

      Removed computer form AD need user profile

      IT Discussion
      • windows active directory windows vista windows 10 windows 7 migration profiles • • JaredBusch
      23
      1
      Votes
      23
      Posts
      2.5k
      Views

      CloudKnightC

      I've have used that ProfileWiz before by ForensiT, works really well.

    • LakshmanaL

      Verify the Logid status

      IT Discussion
      • active directory windows powershell search-adaccount • • Lakshmana
      35
      0
      Votes
      35
      Posts
      2.4k
      Views

      LakshmanaL

      @lakshmana The above helps me and its working but i need the output of that file to be append at the same .csv file which is not working.How to do that ?

    • scottalanmillerS

      Small Restaurant Network Redesign

      IT Discussion
      • network design active directory cisco vpn • • scottalanmiller
      34
      4
      Votes
      34
      Posts
      3.0k
      Views

      thwrT

      @jaredbusch said in Small Restaurant Network Redesign:

      @scottalanmiller said in Small Restaurant Network Redesign:

      Also worth noting, there are some problematic switches at each site. Again, because the VAR was clearly trying to add complexity to up the support bill, and I'm having them put in simple, low cost, unmanaged Netgears to make this really simple and reliable.

      I detest NetGear switches. They generally work, but everytime I try to use one for something even half specific, they puke.

      Sites this small can use the EdgeSwitch 8
      https://www.ubnt.com/edgemax/edgeswitch-8-150w/

      And it will report into UNMS along with the routers.

      Plus it's actually a switch, hardware- and software-wise. Not a breadbox which jumps over the table because you "accidentally" attached a cable to it. (yeah, I know, some NetGears also feature a metal case but it's not the same).

    • zachary715Z

      Least Privilege Accounts Setup

      IT Discussion
      • security active directory • • zachary715
      18
      0
      Votes
      18
      Posts
      1.7k
      Views

      DashrenderD

      @black3dynamite said in Least Privilege Accounts Setup:

      @zachary715 said in Least Privilege Accounts Setup:

      @jaredbusch said in Least Privilege Accounts Setup:

      @jaredbusch said in Least Privilege Accounts Setup:

      @zachary715 said in Least Privilege Accounts Setup:

      @jaredbusch said in Least Privilege Accounts Setup:

      I create an AD account specifically for local admin rights.

      This account information is ususally given to department managers.
      So if software or something needs installed, and they choose not to contact me, they can.

      They are also warned that fixing something will be billed...

      So you have one AD account setup that multiple department managers use when they need something that requires admin privileges? And then what you give that account local admin rights on each machine, or give it some sort of admin authority within the domain itself?

      That account gets local admin rights only. No other access.

      If I was an on site IT department, I woudl probably do it a bit different. I would have time to experiment and setup better methods.

      Yeah this is what I'm going through now and why I'm coming to the community to get input. Trying to think through this carefully and make sure I do it right and the way I want it done the first time.

      With the help of GPO Preferences, you could take advantage of using Item-level targeting for Local Users and Groups to fine tune who should have local admin privileges depending on the user, groups and/or computers.

      This is what I do. Works like a champ.

    • jrcJ

      AD Emulation on *Nix

      IT Discussion
      • active directory samba samba 4 • • jrc
      32
      0
      Votes
      32
      Posts
      3.9k
      Views

      EddieJenningsE

      @scottalanmiller said in AD Emulation on *Nix:

      @jrc said in AD Emulation on *Nix:

      However the company that makes the software could care less about Windows client licensing, and as a franchisee they have zero options on using this software.

      Of course they don't care, the responsibility for that falls 100% onto the end client to ensure that they have properly licensed their environment. The vendor has zero responsibility here.

      Reminds me of a PBX appliance vendor that shipped their "server" with Windows XP Pro as the OS. 😉

    • NerdyDadN

      Raising Domain/Forest from 2008 to 2016: What do I need to know?

      IT Discussion
      • active directory • • NerdyDad
      47
      1
      Votes
      47
      Posts
      3.1k
      Views

      DashrenderD

      @dbeato said in Raising Domain/Forest from 2008 to 2016: What do I need to know?:

      @dashrender said in Raising Domain/Forest from 2008 to 2016: What do I need to know?:

      @scottalanmiller said in Raising Domain/Forest from 2008 to 2016: What do I need to know?:

      @tim_g said in Raising Domain/Forest from 2008 to 2016: What do I need to know?:

      Does Samba / Azure AD Sync allow you to Sync back passwords (and/or accounts) from O365 (to Samba)? I've never looked into that.

      Never tried, but should, as it is just AD. It shouldn't be able to tell that it isn't Windows.

      Well - that depends, does the sync client have to run on a Windows AD server? If not, then you probably can sync a Samba solution to Azure AD.

      You can run it on any Windows server, but the problem with Samba is the password hash doesn't get sync to Azure.
      https://lists.samba.org/archive/samba/2016-November/204564.html

      That thread is kinda old - I wonder if 4.5 fixed that?

    • FATeknollogeeF

      Server 2008 w Hyper-V infrastructure: needs upgrades!!

      IT Discussion
      • server 2003 server 2008 active directory legacy old upgrade kvm fedora server • • FATeknollogee
      87
      2
      Votes
      87
      Posts
      7.7k
      Views

      ObsolesceO

      @fateknollogee said in Server 2008 w Hyper-V infrastructure: needs upgrades!!:

      @tim_g said in Server 2008 w Hyper-V infrastructure: needs upgrades!!:

      This was on a MD1000, very old.

      MD1000...old school! I know those units. I've got 2 of them in storage gathering dust!

      I have 2x LSI 620J. I might just connect it with LSI 9207E HBA

      If you don't mind the 3 gbps bus, the MD1000s are amazing.

    • KellyK

      Setting up Linux to use Active Directory Certificate Services

      IT Discussion
      • active directory centos 7.2 certificate authority • • Kelly
      10
      2
      Votes
      10
      Posts
      7.4k
      Views

      KellyK

      @kelly said in Setting up Linux to use Active Directory Certificate Services:

      @momurda said in Setting up Linux to use Active Directory Certificate Services:

      Have you gone to
      http://yourCA.domain.com/certsrv/mscep_admin
      If so is it showing a page like in the walkthrough?
      Have you tried without enrollment challenge password requirement?

      Yes to the first. I used the information there to run the mkrequest.

      I haven't tried without a password.

      Same error when no password is used in the mkrequest command.

    • scottalanmillerS

      SAMIT: Do You Need Two AD Domain Controllers?

      IT Discussion
      • samit scott alan miller active directory high availability best practices youtube ad dc domain controller • • scottalanmiller
      72
      5
      Votes
      72
      Posts
      8.5k
      Views

      dave247D

      @scottalanmiller said in Do You Need Two AD Domain Controllers? SAMIT Video:

      @dave247 said in Do You Need Two AD Domain Controllers? SAMIT Video:

      .... haven't had the chance to dig in as I am a freaking "IT generalist" where I work.

      Youtube Video

      I have a video for everything these days.

      yep I just watched that one.. guess I can't call myself a Systems Administrator anymore 😢 (jk I totally am)

    • OksanaO

      Deploy SQL Server 2016 Basic Availability Groups without Active Directory

      Starwind
      • database mirroring sql server starwind blog sql server 2016 availability groups basic availability groups ag bag failover cluster wsfc database mirroring active directory ad • • Oksana
      1
      1
      Votes
      1
      Posts
      1.2k
      Views

      No one has replied

    • gjacobseG

      ADUC: Clear 'dead' computers

      IT Discussion
      • ad active directory aduc computers powershell • • gjacobse
      13
      2
      Votes
      13
      Posts
      2.2k
      Views

      dbeatoD

      Another example taken from another script:

      import-module activedirectory $domain = "domain.mydom.com" $DaysInactive = 90 $time = (Get-Date).Adddays(-($DaysInactive)) # Get all AD computers with lastLogonTimestamp less than our time Get-ADComputer -Filter {LastLogonTimeStamp -lt $time} -Properties LastLogonTimeStamp | # Output hostname and lastLogonTimestamp into CSV select-object Name,@{Name="Stamp"; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp)}} | export-csv OLD_Computer.csv -notypeinformation
    • wirestyle22W

      Active Directory Migration Questions

      IT Discussion
      • active directory admt • • wirestyle22
      16
      0
      Votes
      16
      Posts
      2.2k
      Views

      wirestyle22W

      @dashrender From what I've seen, yeah.

    • GreyG

      Powershell: Get-OldComputers (and disable them)

      Developer Discussion
      • powershell active directory pruning • • Grey
      2
      3
      Votes
      2
      Posts
      882
      Views

      GreyG

      Import-Module activedirectory $target = Get-ADOrganizationalUnit -Identity "OU=Disabled Computer Accounts,OU=Space,DC=Domain,DC=com" $computers = Get-ADComputer -filter {(enabled -eq "false")} foreach ($name in $computers) { Move-ADObject $name -TargetPath $target -verbose }

      Followup to above... this section would move the disabled computers to a 'disabled' OU.

    • 1
    • 2
    • 3
    • 4
    • 5
    • 6
    • 7
    • 8
    • 4 / 8