We have run into an issue with one of our machines which keeps the GPO settings after removal from the Domain. We must connect this machine to the domain to receive updates from our WSUS Server. After running the updates, we remove the machine from the domain and reboot. However, the GPO settings are sticking after removal which prevents the machine from functioning properly. This machine is located in a closed environment. Any ideas how to rid this machine of GPOs?
Running Windows 2008 R2
We setup very large systems which consist of many different types of servers, switches, and routers. These systems are then shipped out to different locations and are turned on ready to go upon arrival.
We script many different areas of the install to increase our efficiency but recently have decided to try an automate at least 90% of the process.
Currently, after the system arrives at its destination, users would follow a set of procedures that we have written to customize the applications or do any "restores" that would be required. These can be a long process - sometimes 500 steps. Often times the system is wiped and the process begins again which requires the on-staff IT to move through the procedures to set everything up again.
The process is a grueling one especially when the procedures must be checked and re-checked.
The options we have considered:
Scripting The scripts will not be specific to any one system which will allow us to make the proper changes depending on the location of the system.
Depending on the development of the scripts it may be difficult to make changes, time to develop scripts is substantial, if we move on (job wise) others may have a difficult time picking up the scripts, and execution time for the script.
Templates Create a template from a working base copy with all the installed components ready to go. For instance, if we a Jabber server all the proper settings would already be setup on the template and a script would be kicked off to create the proper tables and database settings on the DB server. Once the template is up it will be connected to the SQL server and ready to go.
Some of the foreseeable disadvantages here are the potential size of the templates, space required on storage, and transporting the image. Scripts would remain to do anything specific to that location if necessary.
In the vast experience of those on ServerFault, does anyone have any kind of experience with this? What is the most practical and efficient way?
Environment:
Problem:
We have a shared folder that resides on a NAS using a Windows 2008 AD for the authentication with the proper permissions setup. When the Windows 2000 machine tries to open the share residing on the Win2008 machine, it is prompted for a username and password. Upon entering the credentials it continuously re-asks for credentials.
Important Details:
The Windows 2000 machine can ping both the XP machines and the Windows 2008 Server
The Windows 2008 machine is mandated to only use NTLMv2
The Windows 2000 machine was originally set to NTLM but was recently switched to NTLMv2 if negotiated for the purpose of trying to connect to the share.
As I am sure it will come up, we are using Windows 2000 because of contractual obligations
Questions:
Why is password Authentication failing in this case?
After setting a GPO for the Win2000 machine for it to use NTLMv2, we used SECEDIT to update the GPOs without rebooting. Does anyone know if this is sufficient or will a reboot be required?
UPDATE
We checked both of the 2008 Domain Controllers to find an error code. We received:
Microsoft_Auth_Package_V1_0
0xc000006a
Event ID: 4776
I know this to be an authentication error via THIS article
"The value provided as the current password is not correct"
We know this password to be correct, but since these two domains (Win2000 & Win2008) do not have a trust setup what authentication account needs to be used? One that resides on the Win2000 hosted domain?
Update 2
I have done some research into NTLMv2 and the settings that are required as the whole if negotiated thing was getting to me. I stumbled upon the following information:from the following source:
So my question then is still the if negotiated and what the true meaning of session security when dealing with NTLMv2? My thinking is session security are the keywords here.
Our 2008 server is set to level 5 Our 2000 server is set to level 1
The 2000 server cannot under any circumstances be changed from level 1 as unfortunately it would break authentication to many legacy devices. So to me it sounds like the issue is at level 3 where the session is passing NTLM.
I feel like I am almost there but I am having a difficult time processing through it.
For security reasons, we need to "lock" some of the preferences in Mozilla Firefox. We are running Windows XP and the latest version of Mozilla version 14.0.1. In particular some of the security preferences such as Security.ask_for_password. If the user were to do about:config, we would like the particular options to be greyed out so they cannot click on them.
I have read that this can be done by adding the following in:
\Mozilla Firefox\defaults\pref\test.js
preflock("security.enable_ssl3", false);
However, this does nothing.
We have around 300 RHEL servers that are currently connecting to a Puppetmaster server. However, we have noticed some performance bottlenecks and it is the point of failure in our system. I am fairly new to puppet in general and I am considering creating a decentralized puppet architecture instead of having Puppet clients connect to the Puppetmaster server. Aside from what I would suspect to happen such as performance gain and lack of signing and exchanging SSL certs for new machines, what are other pros and cons to setting up a decentralized architecture?
Setting up a testing environment on a RHEL5 server to test out OTRS ticketing system. I installed XAMPP for the ease of use factor for testing but can't seem to get the ticketing system to start with XAMPP at all.
I am new to OTRS and learning on the fly. The documentation says to go to localhost/otrs/installer.pl. First, this file does not exist anywhere in the directory except in /opt/otrs/cgi-bin & fcgi-bin. And when I attempted to start OTRS in general I get
" --> Please start the web server first! (service httpd start) <--"
So do I need to edit the startup script to force it to use XAMPP? Or am I better off just installing HTTPD & MySQL myself?
We recently noticed our 10gE NIC was reporting as devXXXXX. Does anyone know why this would be given this name as opposed to ethX?
Our System: The issue occurred on two separate servers. We are running RHEL4.9 & RHEL 4.5 which are on separate networks.
I know that I can change the name using nameif but it has to be run before the interface is up or else it fails.
We are trying to determine the pros and cons of allotting different number of CPUs to VMs (VMware). We would like to see how the VMware kernel is dividing up the total number of cores/threads and determine the best architecture for our specific software configuration needs. Is anyone aware of how to look at IRQ interrupts within the ESXi kernel?
We recently lost one of our Windows 2K8 servers while switching from Static to DHCP after a DHCP release command was inadvertently called. The server was still active but we were no longer aware of the IP to access. The FQDN was also in the process of being updated leaving us helpless. We attempted to reboot the windows machine by using a private link from a RHEL box using the following command:
# net rpc shutdown -r XXX.XXX.X.X -U [USERNAME]
We received a WERR_ACCESS_DENIED error. After a visit to the datacenter, we were able to get the machine online. But has anyone come across the net rpc shutdown error before? It would be helpful to know we could rely on using a Private Link to fix future issues.
I have researched the above error and was only able to find information on "Simple File Sharing" which does not exist in any Windows Server loads that I am aware of.