In my Azure AD tenant that has an active Azure AD Premium 2 license, I have enabled Self-Service Group Management.

Users are able to create security groups and then configure the membership policy with one of the available options:

• This group requires owner approval
• This group is open to join for all users
• Only the owner of this group can add members

Can this also be configured in the Azure AD portal? If so, where?

I have a standalone root CA base on Windows Server 2019 Core.

I know that with certutil.exe -dump certificate.req I can inspect the CSR, but the root CA's policies may override the requested extension attributes.

On the Desktop edition, after importing the CSR into the root CA, I can inspect the pending request and see where root CA policies may override requested extension attributes, add additional extensions or remove them.

For example, the CSR requests the Key Usage extension to be critical, but the root CA policy overrides the Key Usage requests and removes the critical flag, as you can see in the picture below.

My questions are:

1. How do I import a CSR file to the Pending Requests queue on the command line or in PowerShell?
2. How can I see how the CA would actually issue the certificate, on the command line or in PowerShell?

I have a standalone root CA (RootCA) and an enterprise subordinate CA (SubCA). Both Windows Server 2019.

The RootCA seems to ignore the CAPolicy.inf file configuration settings, when attempting to sign the SubCA's CSR, as shown in the pending request properties view:

The CAPolicy.inf on the RootCA (%SystemRoot%\CAPolicy.inf) is this:

[Version]
Signature= "$Windows NT$"

[Strings]
szOID_KEY_USAGE = "2.5.29.15"

[Extensions]
%szOID_KEY_USAGE% = AwIBhg==
Critical = %szOID_KEY_USAGE%

During RootCA installation, the CAPolicy.inf was used to make the KeyUsage extension of the root certificate critical. This can be seen in the root certificate properties as well as in the certocm.log: Opened Policy inf: C:\Windows\CAPolicy.inf

The documentation states

The CAPolicy.inf is a configuration file that defines the extensions, constraints, and other configuration settings that are applied to a root CA certificate and all certificates issued by the root CA.

So, why does the RootCA ignore the CAPolicy.inf when issuing a (SubCA) certificate, despite the docs stating otherwise?

I need to deactivate the 'More Information Required' screen for my break-glass administrator account.

As per documentation I did disable the Azure Security Defaults last week.

Then I created one Conditional Access Policy that requires all users to sign in with MFA, except the break-glass administrator account.

This did not disabled the 'More Information Required', but at least now I am able to click on the Next button and then to skip the setup of MFA.

However, I need this screen to not appear in the first place. How do I achieve that?

Our three Active Directory domain controllers are collectively reporting thousands of 'Kerberos pre-authentication failed' events a week, where the IpAddress field is of a domain controller (but always a different one) and the TargetSid field is the domain Administrator account. Looking at all those particular events I also noticed that -- with the exception if the EventData/Ipport field which is random, and the EventData/Ipaddress field which is always a domain controller -- all other EventData fields always have the same value.

The domain controllers are brand new and the Administrator is not used on those machines. Not to start a service, not to run tasks, not for anything else. I'm 99.99% certain that it's not a compromised domain controller. Our domain controllers are healthy, dcdiag /q isn't reporting any issues.

I do not understand what is going on and need help understanding those particular events and why they are reported. Here is one of the events:

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
    <System>
        <Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/>
        <EventID>4771</EventID>
        <Version>0</Version>
        <Level>0</Level>
        <Task>14339</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8010000000000000</Keywords>
        <TimeCreated SystemTime='2020-11-23T14:52:18.851767600Z'/>
        <EventRecordID>49462065</EventRecordID>
        <Correlation/>
        <Execution ProcessID='652' ThreadID='2348'/>
        <Channel>Security</Channel>
        <Computer>dc01.company.local</Computer>
        <Security/>
    </System>
    <EventData>
        <Data Name='TargetUserName'>Administrator</Data>
        <Data Name='TargetSid'>S-1-5-21-xxxxxxxxx-xxxxxxxxx-xxxxxxxxx-500</Data>
        <Data Name='ServiceName'>krbtgt/COMPANY.LOCAL</Data>
        <Data Name='TicketOptions'>0x40810010</Data>
        <Data Name='Status'>0x18</Data>
        <Data Name='PreAuthType'>2</Data>
        <Data Name='IpAddress'>::ffff:10.12.22.11</Data>
        <Data Name='IpPort'>53321</Data>
        <Data Name='CertIssuerName'></Data>
        <Data Name='CertSerialNumber'></Data>
        <Data Name='CertThumbprint'></Data>
    </EventData>
</Event>

I need to remove a couple of old Group Policies that applied security settings to our servers.
(Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment).

I always thought they were tattooed on the system, like the ones in Audit Policy or Security Options, but noticed out that this is not so. My test server did in fact revert to a previous setting or default setting.

Upon investigating this, I found a documentation on that.

Persistence of security settings policy

Security settings can persist even if a setting is no longer defined in the policy that originally applied it.

Security settings might persist in the following cases:

• The setting has not been previously defined for the device.
• The setting is for a registry security object.
• The settings are for a file system security object.

All settings applied through local policy or through a Group Policy Object are stored in a local database on your computer. Whenever a security setting is modified, the computer saves the security setting value to the local database, which retains a history of all the settings that have been applied to the computer. If a policy first defines a security setting and then no longer defines that setting, then the setting takes on the previous value in the database. If a previous value does not exist in the database then the setting does not revert to anything and remains defined as is. This behavior is sometimes referred to as "tattooing".

Registry and file security settings will maintain the values applied through Group Policy until that setting is set to other values.

https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/security-policy-settings

Now, before I clean up those GPOs, I need to know

1. which systems have been tatooed by the obsolete policy settings, so I can manually revert the settings,
2. and what was the value that the security setting is going to revert to, when I remove the GPO.

How can I do that?

I am trying to join a Ubuntu/Linux computer to the Active Directory domain as a normal user-account who is not a member of the domain-admins group.

I can join Windows computers just fine. You do not have to be admin, but have a quota of computers that you can join without being an administrator.

But when I try to bring a Ubuntu Linux computer into the domain, it fails with the error message below. I would appreciate any help on this.

daniel@linux01:~$ sudo realm join -v -U '[email protected]' AD.example.com
[sudo] password for daniel:
 * Resolving: _ldap._tcp.ad.example.com
 * Performing LDAP DSE lookup on: 10.0.0.10
 * Successfully discovered: ad.example.com
Password for [email protected]:
 * Unconditionally checking packages
 * Resolving required packages
 * LANG=C /usr/sbin/adcli join --verbose --domain ad.example.com --domain-realm AD.example.com --domain-controller 10.0.0.10 --login-type user --login-user [email protected] --stdin-password
 * Using domain name: ad.example.com
 * Calculated computer account name from fqdn: LINUX01
 * Using domain realm: ad.example.com
 * Sending NetLogon ping to domain controller: 10.0.0.10
 * Received NetLogon info from: dc1.ad.example.com
 * Wrote out krb5.conf snippet to /var/cache/realmd/adcli-krb5-iIuXdP/krb5.d/adcli-krb5-conf-eeT5bO
 * Authenticated as user: [email protected]
 * Looked up short domain name: AD
 * Looked up domain SID: S-1-5-21-13313029-848207003-2406435418
 * Using fully qualified name: linux01.ad.example.com
 * Using domain name: ad.example.com
 * Using computer account name: LINUX01
 * Using domain realm: ad.example.com
 * Calculated computer account name from fqdn: LINUX01
 * Generated 120 character computer password
 * Using keytab: FILE:/etc/krb5.keytab
 * Computer account for LINUX01$ does not exist
 * Found well known computer container at: CN=Computers,DC=ad,DC=example,DC=com
 * Calculated computer account: CN=LINUX01,CN=Computers,DC=ad,DC=example,DC=com
 * Encryption type [3] not permitted.
 * Encryption type [1] not permitted.
 ! Insufficient permissions to modify computer account: CN=LINUX01,CN=Computers,DC=ad,DC=example,DC=com: 000020E7: AtrErr: DSID-03153402, #1:
        0: 000020E7: DSID-03153402, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 90008 (userAccountControl):len 4

adcli: joining domain ad.example.com failed: Insufficient permissions to modify computer account: CN=LINUX01,CN=Computers,DC=ad,DC=example,DC=com: 000020E7: AtrErr: DSID-03153402, #1:
        0: 000020E7: DSID-03153402, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 90008 (userAccountControl):len 4

 ! Insufficient permissions to join the domain
realm: Couldn't join realm: Insufficient permissions to join the domain

I have an nginx server with exactly one site configuration (the default site).

I keep seeing the following lines in my access.log

xxx.xxx.xxx.xxx - - [10/Jul/2018:16:32:14 +0200] "GET / HTTP/1.1" 400 37 "-" "-"

I know for a fact that this happens if the request doesn't send a Host:header, as in curl -v -H "Host:" https://{{ server_ip }}

root@mypc:~# curl -v -H "Host:" http://{{ server_ip }}
* Rebuilt URL to: http://{{ server_ip }}/
*   Trying {{ server_ip }}...
* Connected to {{ server_ip }} ({{ server_ip }}) port 80 (#0)
> GET / HTTP/1.1
> User-Agent: curl/7.47.0
> Accept: */*
>
< HTTP/1.1 400 Bad Request
< Server: nginx/1.14.0 (Ubuntu)
< Date: Wed, 11 Jul 2018 08:14:07 GMT
< Content-Type: text/html
< Content-Length: 182
< Connection: close
<
<html>
<head><title>400 Bad Request</title></head>
<body bgcolor="white">
<center><h1>400 Bad Request</h1></center>
<hr><center>nginx/1.14.0 (Ubuntu)</center>
</body>
</html>
* Closing connection 0

I did configure my site to respond to requests with no Host: header with an 444 error code. Obviously, this doesn't work. I assume I did misunderstand the docs and my config is incorrect. I would be glad if someone could point out what's missing:

ssl_certificate /etc/letsencrypt/live/{{ hostname_fqdn }}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/{{ hostname_fqdn }}/privkey.pem;

# Respond to requests without a host header with HTTP status 444
server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name "";
    return 444;
}

server {
    listen 80;
    listen [::]:80;

    server_name {{ hostname_fqdn }};

    if ($allowed_country = no) {
        return 444;
    }

    return 301 https://{{ hostname_fqdn }}$request_uri;
}

server {
    listen 443 ssl;
    #listen [::]:443 ssl;

    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    server_name {{ hostname_fqdn }};

    if ($allowed_country = no) {
        return 444;
    }

    location / {
        include uwsgi_params;
        uwsgi_pass unix:/run/uwsgi/app/{{ django_project_name }}/socket;
    }

    location /static/ {
        root {{ django_static_root }};
    }
}

server {
    listen 80;
    listen [::]:80;

    listen 443 ssl;
    #listen [::]:443 ssl;

    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    server_name api.zeitschrift.hausbesitzerverlag.de;

    if ($allowed_country = no) {
        return 444;
    }

    location / {
        include uwsgi_params;
        uwsgi_pass unix:/run/uwsgi/app/{{ django_project_name }}/socket;
    }

    location /pmx-api/ {
        auth_basic "Restricted Content";
        auth_basic_user_file /etc/nginx/htpasswd;

        limit_req zone=api burst=5;

        include uwsgi_params;
        uwsgi_pass unix:/run/uwsgi/app/{{ django_project_name }}/socket;
    }

    location /komtrigon-api/ {
        limit_req zone=api burst=5;

        include uwsgi_params;
        uwsgi_pass unix:/run/uwsgi/app/{{ django_project_name }}/socket;
    }

    location /static/ {
        root {{ django_static_root }};
    }
}

I installed Windows Deployment Services (WDS) on a new Server 2012 R2 machine. My Hyper-V (Gen2, UEFI, Secure Boot) clients fail at requesting 'boot\x64\wdsmgfw.efi' via TFTP. The server responds that the file was not found.

I can confirm that 'C:\RemoteInstall\Boot\x64\wdsmgfw.efi' is indeed missing. Everything else is there.

I tried installing a Server 2016 and configuring WDS, but the file is missing there, too.

Why is that file missing and what must I do to get PXE running?

I have just found out that 192.112.36.4 (g.root-servers.net.) neither responds to requests, nor responds to pings.

.                        3600000      NS    G.ROOT-SERVERS.NET.
G.ROOT-SERVERS.NET.      3600000      A     192.112.36.4

I checked http://www.internic.net/domain/named.root, which is an up2date list of root servers and the IP address is correct. I always was under the impression that those root servers are redundant to the point where it is impossible that there is downtime. According to http://root-servers.org there are worldwide six locations where servers are located, so I would assume I am correct with that assumption.

My question is if g.root-servers.net. is in any way different from all the others, or special,
and if I am supposed to not get a DNS response from it for any reason?

It took me several hours to fix the issue because the local component store was corrupted and the computers are accessing a local WSUS server instead of the public update server by Microsoft (and because I use Dism very rarely). For reference and to help other people with the same issue, I will write down a problem description and provide a solution.

Since upgrading to Windows 10 Pro Version 1511 (Build 10586) I have a problem with a corrupted filed opencl.dll in several locations.

I tried sfc.exe /scannow, but it failed to fix the issue. The error messages are, among others:

2015-12-08 08:50:43, Info                  CSI    00003c3a Hashes for file member \SystemRoot\WinSxS\wow64_microsoft-windows-r..xwddmdriver-wow64-c_31bf3856ad364e35_10.0.10586.0_none_3dae054b56911c22\opencl.dll do not match actual file [l:10]"opencl.dll" :
  Found: {l:32 g2VAunZ6/2J1G3oL7kf9fjInPUA9VYeiJcl9VKgizaY=} Expected: {l:32 9rnAnuwzPjMQA7sW63oNAVhckspIngsqJXKYSUeQ5Do=}
2015-12-08 08:50:43, Info                  CSI    00003c3b [SR] Cannot repair member file [l:10]"opencl.dll" of microsoft-windows-RemoteFX-clientVM-RemoteFXWDDMDriver-WOW64-C, version 10.0.10586.0, arch Host= amd64 Guest= x86, nonSxS, pkt {l:8 b:31bf3856ad364e35} in the store, hash mismatch
2015-12-08 08:50:43, Info                  CSI    00003c3c [SR] This component was referenced by [l:125]"Microsoft-Windows-RemoteFX-VM-Setup-Package~31bf3856ad364e35~amd64~~10.0.10586.0.RemoteFX clientVM and UMTS files and regkeys"
2015-12-08 08:50:43, Info                  CSI    00003c3d Hashes for file member \??\C:\WINDOWS\SysWOW64\opencl.dll do not match actual file [l:10]"opencl.dll" :
  Found: {l:32 g2VAunZ6/2J1G3oL7kf9fjInPUA9VYeiJcl9VKgizaY=} Expected: {l:32 9rnAnuwzPjMQA7sW63oNAVhckspIngsqJXKYSUeQ5Do=}
2015-12-08 08:50:43, Info                  CSI    00003c3e Hashes for file member \SystemRoot\WinSxS\wow64_microsoft-windows-r..xwddmdriver-wow64-c_31bf3856ad364e35_10.0.10586.0_none_3dae054b56911c22\opencl.dll do not match actual file [l:10]"opencl.dll" :
  Found: {l:32 g2VAunZ6/2J1G3oL7kf9fjInPUA9VYeiJcl9VKgizaY=} Expected: {l:32 9rnAnuwzPjMQA7sW63oNAVhckspIngsqJXKYSUeQ5Do=}
2015-12-08 08:50:43, Info                  CSI    00003c3f [SR] Could not reproject corrupted file [l:23 ml:24]"\??\C:\WINDOWS\SysWOW64"\[l:10]"opencl.dll"; source file in store is also corrupted

Okay, so the issue is clear now. Unfortunately, SFC is unable to resolve the corruption because the local component store also got corrupted. Unfortunately, I lost the error messages indicating the component store corruptions.

So I tried Dism /Online /Cleanup-Image /RestoreHealth to no avail. It fails with error 0x800f081f, indicating another problem with the source files.

2015-12-08 08:57:35, Info                  CBS    Exec: Download qualification evaluation, business scenario: Manual Corruption Repair
2015-12-08 08:57:35, Info                  CBS    Exec: Clients specified using Windows Update.
2015-12-08 08:57:35, Info                  CBS    WU: Update service is not default AU service, skip. URL: https://fe2.update.microsoft.com/v6/, Name: Microsoft Update
2015-12-08 08:57:35, Info                  CBS    WU: Update service is not default AU service, skip. URL: https://fe2.ws.microsoft.com/v6/, Name: Windows Store
2015-12-08 08:57:35, Info                  CBS    WU: Update service is not default AU service, skip. URL: https://fe3.delivery.mp.microsoft.com/, Name: Windows Store (DCat Prod)
2015-12-08 08:57:35, Info                  CBS    WU: WSUS service is the default, URL: (null), Name: Windows Server Update Service
2015-12-08 08:57:35, Info                  CBS    DWLD:Search is done, set download progress to 20 percent.
2015-12-08 08:57:35, Info                  CBS    Nothing to download, unexpected
2015-12-08 08:57:35, Info                  CBS    Failed to collect payload and there is nothing to repair. [HRESULT = 0x800f081f - CBS_E_SOURCE_MISSING]
2015-12-08 08:57:35, Info                  CBS    Failed to repair store. [HRESULT = 0x800f081f - CBS_E_SOURCE_MISSING]

Looking at the error messages, it becomes clear that Windows is set to use our local WSUS server and therefore Dism is unable to retrieve the valid file from the repositories. While I am sure that I could somehow configure WSUS to provide the necessary files, I don't know how and I need a quick fix. (If someone knows how to configure WSUS accordingly, please provide information).

Limiting access to the local storage by adding the paramter /LimitAccess would be useless as the local component store is also corrupted, as mentioned earlier.

I experienced this issue on two machines. A refresh of Windows 10 did not fix the issue.

I could not find anything useful on that topic, so I am once again turning to you.

I want to be able to search files on a shared folder using Windows 10. The shared folder is on a file server running Server 2012 R2.

1. The shared folder should be indexed.
2. The search must use an index (fast, cheap) and not search the file system (slow, expensive).
3. The index must be made available by the server and not be created by the client (expensive if having many clients).
4. Must work out-of-the-box or with Microsoft-Tools. No 3rd-Party applications.

I found information that I could add mapped drives to the indexed paths list, but mapped drives do not show up in the selection. Besides, it would violate #3.

I know about the Windows Search feature in Server 2012. I haven't found information on how to use it in cooperation with the clients.

How would I achieve that?

What is the difference between New-DfsnFolder and New-DfsnFolderTarget?

Both commands require both parameters, -Path and -TargetPath. They create the same thing. A DFS folder with a target.

So what is different?

I need to give a couple of users ReadPermissions to some mailboxes. And I need the read-only mailboxes to appear in the users' Outlook via auto-mapping.

I know that you can achieve this via the mxExchDelegateListLink attribute in the Active Directory. However, this is not working with Office 365 and DirSync.

I figured out, that you can view the property in PowerShell using the following command:

(Get-MailboxPermission <mailbox> -ReadFromDomainController)[0].DelegateListLink

It lists all the users whose Outlook will automatically map the queried mailbox.

How can I add users to that attribute via PowerShell? This Property is the same for each MailboxPermission object, so you probably cannot just edit the Property by itself.

Reading the Network Recommendations for a Hyper-V Cluster in Windows Server 2012, I am left with some unanswered questions.

It's recommended to have a management network and a cluster network.
The management network is set to """Allow cluster network communication and client connectivity",
and the cluster network is set to "Allow cluster network communication only". But there is no other difference or classification.

How does the failover cluster actually know what of those two networks to use for "inter-node cluster communication such as the cluster heartbeat and Cluster Shared Volumes (CSV) redirection"?

We are using IPv4 in our company. Our ISP does not provide IPv6 and this won't change in the next years.

The Best Practices Analyzer (BPA) of our Server 2012 R2 DNS server warns about the IPv6 DNS root hints not responding to the DNS server’s queries. Of course, as we do not have an IPv6 internet access.

I see two solutions:

1. Ignore the warnings. As long as this does not have an impact on the speed of DNS resolutions. (Something like clients trying IPv6 first, waiting for a timeout and then trying an IPv4 name resolution.)

2. Remove the IPv6 addressse from the root hints and add them back if we get IPv6 in the future.

Any other solutions? What should I prefer?

I am currently planning a high available Windows Server 2012 R2 environment within a Hyper-V-Cluster with two nodes. I am not sure about how to deploy the virtual domain controller for the work domain, to keep the forest available when a node goes down.

I see two options:

1. Create one virtual machine with the domain services and configure the vm as a cluster resource in the failover cluster. Let the cluster worry about the availability of the virtual machine (domain controller).

2. Create one VM on Hyper-V-Node 1. Create a second VM on Hyper-V-Node 2. VMs are not configured as a cluster resource (no redundancy per VM). Install domain services on both VMs. Let the domain controllers worry about offering the domain services, if a node and therefore one VM goes down.

My Questions are:

• Is there a preferred method?
• What advantages and disadvantages do both methods have?

I appreciate high quality answers, please back up your responses with sources.

I am having trouble accessing the location property of my Active-Directory's Site via Powershell. (Windows Server 2012 R2)

The following command returns no value:
> (Get-ADReplicationSite "Default-First-Site-Name" | Get-ADObject).location

This command returns an identifier:
> (Get-ADReplicationSite "Default-First-Site-Name" | Get-ADObject).objectGUID

When I am looking into the graphical Attribute Editor of the object in the Active Directory Sites and Services Snap-In, I can verify by the objectGUID-propterty, that I do query the correct AD object and that the location-property is filled.

So why does Powershell return no value and how do I query and edit the location attribute?

We are currently in the situation that we receive some E-Mails from our business partners containing inline attachments of the file types .doc(x) and .pdf with our Exchange Server.

Outlook does not show those files by default. I know there is a Exchange setting that tells Outlook to display inline attachments.
For those curious, it is Set-OrganizationConfig -ShowInlineAttachments:$true.

Before I apply that setting, I am curious to know whether I should even consider it. I do not want to implement a bad practice and I have the feeling that there is a reason this is $false by default. I rather educate our business partner.

Is showing E-Mail Inline Attachments in Exchange/Outlook a bad practice?

Edit

For clarification: Inline attachments ≠ automatic attachment preview.

In the following picture you see the difference between inline attachments and regular attachments. The first is disabled for Outlook clients in a domain environment by before stated Exchange setting.

(Source: http://blogs.mccombs.utexas.edu/the-most/2011/01/28/email-attachments-in-the-body-of-outlook-messages/)

I set up a DFS to centralise my shares. After doing so, I noticed, that I can access the shares via the domain path (\\SNAKEOIL.LOCAL\Research), but the folders is shown as empty.

The intended namespace \\SNAKEOIL.LOCAL\Public is working as expected.

Why is that and how can I avoid this strange behaviour?

Servers are running Windows Server 2012 R2. Howevery, I have the same problem with 2008 R2, too. Here is my setup:

SOIL-DC1 (domain controller, DFS)

• D:\Shares\Research (shared as \\SOIL-DC1\Research)
• D:\Shares\Laboratory (shared as \\SOIL-DC1\Laboratory)

SOIL-DC2 (domain controller, DFS)

• D:\Shares\Development (shared as \\SOIL-DC2\Development)

\\SNAKEOIL.LOCAL\Public (DFS-Namespace)

• Research (targets to \\SOIL-DC1\Research)
• Laboratory (targets to \\SOIL-DC1\Laboratory)
• Development (targets to \\SOIL-DC1\Development)