Jack Pettersson's questions

So in AWS I created a Microsoft AD and managed to join a computer to the domain after changing the DHCP optionset. I then rebooted the machine and logged in as the admin account that was created with the domain, but soon realized that the admin account have very strict privileges. I can create new users and add computers to the AD, but that's about it... I can't add users to the domain admin group or even to the remote desktop users group.

Anyone know if there is any way to access the real administrator account when creating a windows active directory in AWS?

We have Office 365 hosted by an MSP. Included in this service is an ADFS server for SSO.

The SSO have never really worked properly, so i'm going to contact them and about it. But before I do so, I just wanted to make sure that it isn't working as intended.

When i go to portal.office.com and type in my username+upn and click in the password field I get redirected to another login screen (see image below, its in Swedish, but you should get the jist).

After I authenticate on that screen I get into the portal.

If I logout and then in again I get don't get that login screen, which is perfect. But if i close IE, open it again and go to portal.office.com again the login prompt comes up.

Isn't the point of ADFS for it to automatically log me in using my AD credentials? In my world that login-screen should never come up. In skype for business all i have to do is type my username+upn and i get logged in for instance.

So my question is: Is what i explained above correct behaviour for a properly set up ADFS SSO, or is there something amiss in the configuration?

I have just implemented WSUS in production for the first time. Everything is working fine, but the info reported by the Update Service Manager is a bit unintuitive.

When i check on a computers status it checks for "installed/not applicable", which in our case allways shows like 90+k updates as seen here:

So when i try to check how many % of updates are installed on a computer it allways says 99% (since 99.9 of them are not applicable) like so:

Is this normal? Is there any way to remove the "or not applicable" part of the criteria for compliance?

Running WSUS version 10.0.10514.4 on a server 2012 R2.

We currently use RAS on a server 2008 for VPN access to our network.

The problem is that the hosts connected to the network through that VPN can't resolve onsite names.

Ex: $remoteuser on $remotecomputer connects to corp VPN server. If $remoteuser tries to ping $onsiteserver using its hostname it fails. Pinging the servers IP works fine.

Clearly the client still uses its local DNS server (home router). So when $remotecomputer tries to resolve $onsiteserver the request gets to $remoteuser's home router, which just shrugs and sends the resolution request to the internet.

Is there any way to force the clients to use on-site DNS server for resolution (when they are connected to the VPN)

I'm trying to set up a site-to-site VPN connection between 2 of our offices. The VPN servers i'm using are 2 "Edgerouter lite" and the tunneling software i'm using is OpenVPN.

This is how the setup is at the moment:

-

R1:
LAN subnet: 192.168.2.0/24
LAN port: 192.168.2.1

WAN port: X.X.X.X

-

R2:
LAN subnet: 10.10.0.0/24
LAN port: 10.10.0.34

WAN port: Y.Y.Y.Y

-

R1 Open VPN config:
 openvpn vtun0 {
     local-address 192.168.2.1 {
     }
     local-port 1194
     mode site-to-site
     openvpn-option --comp-lzo
     openvpn-option --float
     openvpn-option "--ping 10"
     openvpn-option "--ping-restart 20"
     openvpn-option --ping-timer-rem
     openvpn-option --persist-tun
     openvpn-option --persist-key
     openvpn-option "--user nobody"
     openvpn-option "--group nogroup"
     remote-address 10.10.0.39
     remote-host X.X.X.X
     remote-port 1194
     shared-secret-key-file /config/auth/secret
 }

-

R2 Open VPN config:
 openvpn vtun0 {
     local-address 10.10.0.39 {
     }
     local-port 1194
     mode site-to-site
     openvpn-option --comp-lzo
     openvpn-option --float
     openvpn-option "--ping 10"
     openvpn-option "--ping-restart 20"
     openvpn-option --ping-timer-rem
     openvpn-option --persist-tun
     openvpn-option --persist-key
     openvpn-option "--user nobody"
     openvpn-option "--group nogroup"
     remote-address 192.168.2.1
     remote-host Y.Y.Y.Y
     remote-port 1194
     shared-secret-key-file /config/auth/secret
 }

-

show openvpn status site-to-site on R1

OpenVPN client status on vtun0 []

Remote CN       Remote IP       Tunnel IP       TX byte RX byte Connected Since
--------------- --------------- --------------- ------- ------- ------------------------
None (PSK)      Y.Y.Y.Y   10.10.0.39        51.6K   51.0K N/A

-

show openvpn status site-to-site on R2

OpenVPN client status on vtun0 []

Remote CN       Remote IP       Tunnel IP       TX byte RX byte Connected Since
--------------- --------------- --------------- ------- ------- ------------------------
None (PSK)      X.X.X.X   192.168.2.1       85.3K   84.5K N/A

-

Routing table R1:
IP              Next hop    INT     TYPE
0.0.0.0/0       X.X.X.XGW   eth1    static
127.0.0.0/8                 lo      connected
192.168.2.0/24              eth0    connected
X.X.X.X/X                   eth1    connected
10.10.0.0/24                vtun0   static
10.10.0.39/32               vtun0   connected

-

Routing table R2:
IP              Next hop    INT     TYPE
0.0.0.0/0       Y.Y.Y.YGW   eth0    static
127.0.0.0/8                 lo      connected
10.10.0.0/24                eth1    connected
Y.Y.Y.Y/Y                   eth0    connected   
192.168.2.0/24              vtun0   static
192.168.2.1/32              vtun0   connected   

From a host on the 192.168.2.0 LAN (On R1) i can ping 10.10.0.34 (LAN port IP on R2) but i can't ping 10.10.0.4 (a host on the R2 LAN).

Is there anything wrong in my configuration?

One of our windows servers has started acting up. All network services from roles on the server just stop working all of a sudden, untill the server is restarted. the issue occurs every other week or so. I can still access the server using VNC (remote desktop) and the server can reach network services on other servers in the network while the issue is active.

Symptoms:

• File shares don't show up when you browse for //server-name.
• Users are unable to print using the print service on the server.
• Users are unable to login via the server (gets logged in with temp profile).

I have tried troubleshooting this for a while, but with no success.

• It's not network related, our NMS can ping it at all times (and well, i can vnc to it when the issue is active, so there is that).
• It's not hardware related, NIC is fine and no HW resources are being used extensively.

Roles installed:

• AD/DC
• DHCP
• DNS
• File Services
• Print service
• Web Server (IIS)

No other applications are installed. The server is located internationally so i can't just replace it.

Any help/ideas are welcomed.