I have some User objects with "ExchangeActiveSyncDevices" object within. I also have some Computer objects with published printers inside.
So how can I look (with PowerShell) for such objects using some kind of unified approach? I mean without specific Exchange commandlets for AS devices and such. There must be a way to find objects with another object inside using some [ADSI] magic or such, right?
Here is the thing: I've composed a template for Active Directory Users and Computers so our branches could add/delete/rename computers in their respective OUs on their own (without granting them Full Control over Computer objects).
So it's kinda restircted "Not So Full Contol". It works correctly, most of the time. But there are some computers which has subobjects in them. Like AD published printers or sometimes some other stuff like "RouterIdentity" container.
How can I grant permissions to local admins groups over their respective OUs so they could delete Computer objects along with any object within those computer objects?
Currently (in terms of delegwiz.inf file) I grant those groups permissions to create and delete computer objects but it is not enough to delete any subobject.
[TemplateXX.SCOPE] computer=CC,DC
I've decided to review delegated permissions our branches have over Active Directory computer objects and reorganize things a bit.
One thing which stunned me is the fact that I need (according to lore all over the Internet) to grant Write All Properties to a security group in question over UO in which my computers are to rename the computer.
So I need to assign 1 permission to enable/disable computer account, 5 permissions to move computers between OUs and... to permit to write virtually every property of computer to simply rename a thing? WTF?
Is the Internet wrong? Are Microsoft nuts? What are you doing to restrict people simply to the renaming of computers?
There is no explanation on the web why such a mundane task as renaming computer should require such privileges which allows user to do pretty much anything with computer account beside renaming.
That's a weird one.
We have 3 servers (Windows Server 2012 R2) with DFS-N and DFS-R sharing and syncing same folders between themselves. We have those folders mapped on clients as network drives like x: ("\\contoso.com\Shared") or y: ("\\contoso.com\Departments"). Today one of them users (Windows 10 Pro OS) asked me to have a look at a problem: she was placing files into one of subfolders on those drives (and they were there when I was looking it on her PC), but no one else could see them.
So I thought perhaps she was using different DFS server and those are simply not synced between other servers, so I checked every server for contents of mentioned subfolder but none of them had those files.
Next I thought maybe that subfolder was made autonomous by user but when I checked out that feature in Control Panel was actually disabled all the time.
Some more notes:
So I'm eager to find out what happened there? How could it be possible that user was working with copy of network drive not present anywhere else with disabled caching?
Few days ago I witnessed a strange problem within my domain:
During RDP connection I see warnings about certificate being not trusted (and I see self-signed certificate, not issued by domain CA)
I can no longer connect by RDP to servers with enabled NLA (Network Layer Authentication).
This problem is omnipresent - I experience it on different workstations and on different servers, including Windows Server 2012R2|2008R2, Windows 7 and Windows 10.
About CA infrastructure: one offline Root CA and one Domain Level Issuing CA. pkiview.msc says everything is OK: both Root and Issuer have valid Certificates, CDP's, IAI's and DeltaCRL's (issuer only). I've updated Root CRLs and republished them in AD because I thought that might be the case but no luck.
Custom Certificate Template with Client|Server|RDP Auth still exists and I can confirm that servers in question have such certificates in Personal folder in MMC Certificates Applet (and can request new ones from there), although only self-signed certificate is present in RDP folder.
Using MMC Certificates applet I also see that both Root and Issuer certificates are trusted.
So.. I don't really know what to do and how fix it, and why it's broken in first place. Any help is appreciated.
PS. Also some time ago I modified Default Domain GPO enforcing private network IP ranges. Can it be the reason? Anyway, I turned those back to default and no luck either.
UPDATE Some pics to clarify a bit:
1) Security Warning
2) ...because servers presents Self-Signed Certificate
3) However we can see proper CA-certificate in Personal storage on server in question
4) In Remote Desktop certificate storage I can see just Self-Signed Cert. I copied proper one there as well, but no effect. And if I delete Self-Signed Cert from there I won't be able to connect to server over RDP at all.
5) Also you can see that my local CAs are trusted by server:
6) And that is the error I get when I try to RDP to NLA-enabled server. So client for some reason can't or won't willingly use CredSSP. It worked a week before so I think it's connected to cert problem.
7) Finally some screens from Issuing CA. It seems to be OK.
We are using Exchange 2016 with Outlook 2010/2013. In Outlook connection status window I've noticed that it has failed connections to our intranet Exchange 2016 server using it's External URL address.
Server is reachable through it's Internal URL and connects OK, it's subnet within same site with clients so I have no clue why would it try to go through External address in a first place.
So any help is appreciated.
We've been using Exchange 2010 for all possible roles for a long time. Now we've got ourselves new Exchange 2016 installation within same site, same domain, in order to migrate mailboxes there and get rid of old Exchange 2010.
One of few problems I've run into is that there was no mail flow between two servers. I can move mailboxes between two as much as I want, but when I send email to mailbox on other server - no success.
I've managed to half-solve the issue by adding receive connector on 2010. Now I was able to send mail from 2016 to 2010. Connector is like that:
listen on port 25 on primary interface
accept mail from 2016 ip
authentication with TLS and Exchange Server
Exchange Server permission group
But I don't know how to configure Exchange 2016 to be able to receive mail from 2010. I've messed around with it's default Frontend connector for a bit (tried to make it look basically the same) but no success. In fact I'm not even sure if receive connector is what I need. That's the reply I've got for messages I send from 2010 to 2016:
Diagnostic information for administrators:
Generating server: oldserver.contoso.com
[email protected]
#550 4.4.7 QUEUE.Expired; message expired ##
Original message headers:
Received: from oldserver.contoso.com ([172.22.223.2]) by oldserver.contoso.com
([172.22.223.2]) with mapi id 14.03.0123.003; Thu, 28 Jul 2016 17:20:32 +0600
Content-Type: application/ms-tnef; name="winmail.dat"
Content-Transfer-Encoding: binary
From: Old Server Mailbox <[email protected]>
To: New Server Mailbox <[email protected]>
Subject: Test08
Thread-Topic: Test08
Thread-Index: AdHowgsxCxzf+vHaQi2Wb9IRsLMA1A==
Date: Thu, 28 Jul 2016 17:20:31 +0600
Message-ID: <[email protected]>
Accept-Language: en-US, kk-KZ
Content-Language: ru-RU
X-MS-Has-Attach:
X-MS-TNEF-Correlator: <[email protected]>
MIME-Version: 1.0
X-Originating-IP: [172.22.232.48]
So any wisdom about how to make them work together is welcome.
We've got Windows Server 2008 R2 which servers as DC, Exchange mail server and file share (Let's call in Server-1). We also have fiber channel network storage, connected to this server. Putting there backups with Symantec Backup Exec 2010 (hosed on different server) over network regularly (it will be Server-SBE).
The problem is that over time (couple weeks usually) it's network receive speed on Server-1 goes down. It remains 1 Gbps in network adapter info but practically I see 300-400 kbps when I try to copy file to this server from some other servers, including Server-SBE.
It's not network storage problem, since copying to local disk C slow as well. It is not disk subsystem problem either, since copying files locally goes OK.
And it's also kinda selective: for example I can copy file from my workstation to this server with healthy speed of 10 MB/s (since there is 100M connection between), but I cannot do the same from my SBE server (2008R2 as well) despite 1G connection between them. After reboot of Server-1 everything gets back to normal. But it's really bad, since backups are not finished over weekend.
Any thoughts how do deal with it or what could the reason?
Other info:
We have Windows Server 2008R2 as domain controller with DHCP Server functionality. Task was to make reserve server on remote site in case of failure of main one. The reserve one will be running Windows Server 2012R2. The question was how to keep remote server DHCP records up-to-date. Since there is no DHCP replication possible between 2008R2 and 2012R2, and DHCP cluster is not an option, I've tried using netsh dhcp import/export approach to run every hour on schedule.
Export BAT-file on local site:
@echo off
c:
cd c:\DHCP-Export
echo DHCP Server configuration export started at %date% %time%
netsh dhcp server export \\192.168.2.10\DHCP-Import\dhcpcfg.exp all
echo DHCP Server configuration export finished at %date% %time%
@echo on
Import BAT-file on remote site:
echo DHCP Server configuration import started at %date% %time%
netsh dhcp server import c:\DHCP-Import\dhcpcfg.exp all
echo DHCP Server configuration import finished at %date% %time%
This tasks were put on schedule with administrative account. First import was made from auxiliary DC to remote server and was OK, remote server got scopes from file. But then, when I've made export from primary DC (with different scopes) and imported it into remote I was still seeing old scopes in DHCP console of remote server and no new ones, while I was expecting to see scopes from primary server.
What am I doing wrong? Should I drop remote's DHCP configuration somehow before import?
We have Dell MD3600f SAN storage array and two HP servers for VM failover clustering solution.
MD3600f is set, disks are mapped and connected to Hyper-V servers. On Hyper-V's I have partitioned and formatted these disks (NTFS) and assigned drive letters (N, Q, S) on both servers using DISKPART.
Now I can create folders or files on this disks using CMD with no problem. But if I delete folder ("rd s:\test" for example) on Server One and then list folders on Server Two ("dir s:\") it shows me the very "test" folder I deleted from Server One, i.e. Server Two is unaware of changes I made on using Server One and vice versa.
How can I tell Hyper-V treat this disks differently? Or what should I do to make these disks (N, Q, S) valid shared disk for Failover Cluster?
We've got Cisco SG300 switch (in L2 mode) which we use to extend our network.
It's ge10 port is connected to main switch (upper level, connected to different PC and Servers with no issues) and has trunk on it for 3 VLANs coming in from main: Data (112T), VoIP (111T) and DeviceMang (150T).
Other SG300 ports has setup like this: Data (112UP - for Windows PC who cannot tag traffic) and VoIP (111T - for IP phone who has no issue with VLANs).
Port Mode AdmVLAN OpVLAN
GE1 Trunk 111T, 112UP 111T, 112UP
GE2 Trunk 111T, 112UP 111T, 112UP
GE3 Trunk 111T, 112UP 111T, 112UP
GE4 Trunk 111T, 112UP 111T, 112UP
GE5 Trunk 111T, 112UP 111T, 112UP
GE6 Trunk 111T, 112UP 111T, 112UP
GE7 Trunk 111T, 112UP 111T, 112UP
GE8 Trunk 111T, 112UP 111T, 112UP
GE9 Trunk 1UP 1UP
GE10 Trunk 1UP, 111T, 112T, 150T 1UP, 111T, 112T, 150T
We usually connect both PC and IP Phone to the same port (PC through IP Phone). When I do it this way, my PC sees the network with no trouble.
But when I connect my PC directly to switch - PC becomes blind. It can no longer ping anything connected to upper level switch.
The switch itself (SG300) pings upper level devices with no trouble (through web or telnet interface). Also two servers within SG300 section of network sees each other but cannot see anything upper level.
So how to make Windows PCs directly attached to SG300 see devices on upper level switch?
There is an image, hope it helps.
I'm trying to get Cisco 7942G IP phone working on FreeBPX setup. It has issues with getting things over tftp. I tried hard reset thing and I'm getting this in tftpd log:
[root@localhost ~]# tail -f /var/log/messages | grep in.tftpd
Jul 29 11:18:02 localhost in.tftpd[4487]: RRQ from 172.22.225.60 filename SoftKeyDPN.xml
Jul 29 11:26:20 localhost in.tftpd[4664]: RRQ from 172.22.225.94 filename term42.default.loads
Jul 29 11:26:24 localhost in.tftpd[4665]: RRQ from 172.22.225.94 filename term42.default.loads
Jul 29 11:26:28 localhost in.tftpd[4666]: RRQ from 172.22.225.94 filename term42.default.loads
Jul 29 11:26:35 localhost in.tftpd[4671]: RRQ from 172.22.225.94 filename term42.default.loads
Jul 29 11:26:39 localhost in.tftpd[4672]: RRQ from 172.22.225.94 filename term42.default.loads
Jul 29 11:26:43 localhost in.tftpd[4674]: RRQ from 172.22.225.94 filename term42.default.loads
Jul 29 11:26:47 localhost in.tftpd[4679]: RRQ from 172.22.225.94 filename term42.default.loads
It's number 94.
Still it keeps rebooting and trying to get firmware. Before reset picture was pretty much the same, except it was after SEP*.cnf.xml, SoftKeyDPN.xml and dialplan.xml.
The phone log was telling about TFTP Error and TFTP timeout.
All this files are present anyway, I could get them by very tftp from another linux-based system (although it took much time - SEP config file 8Kb size was downloaded after 6 seconds! That's a quite delay, no?). Other IP phones had no troubles receiving their config, by the way. On this very line, also.
DHCP is on, option 150 is specified. It's elastix btw, CentOS based I belive. TFTP config below:
[root@localhost xinetd.d]# cat tftp
# default: off
# description: The tftp server serves files using the trivial file transfer \
# protocol. The tftp protocol is often used to boot diskless \
# workstations, download configuration files to network-aware printers, \
# and to start the installation process for some operating systems.
service tftp
{
socket_type = dgram
protocol = udp
wait = yes
user = root
server = /usr/sbin/in.tftpd
server_args = -s -vv /tftpboot --verbose
disable = no
per_source = 11
cps = 100 2
flags = IPv4
}
[root@localhost xinetd.d]#
I've no idea where to start digging. Any advice would help.
We've got PBX to configure. It's based on Elastix 2.4.0, freePBX 2.8.1 and Asterisk 1.8.20.0.
Currently we have a setup for inbound calls like that:
Inbound call > Announcement (30 sec) > IVR (no sound, for extension dial only, 5 sec) > Queue (for timeout on IVR, aka Callcenter)
Boss wants me to do some tuning: disallow external caller to dial certain extensions directly (like 141, 142, etc.) so the only way they (callers) could get to these numbers if someone (like 140) will patch them through first.
Could you suggest me what needs to be done? I've been configuring through Elastix until now, so if it should be done other way, extensive directions would help me a lot.