Home / user-508715

IshRaj's questions

Martin Hope
IshRaj
Asked: 2021-05-07 07:05:08 +0800 CST
  • 0

I am trying to export AD schema details for a trusted forest. I don't have access to a domain computer of the trusted forest. I don't have an account of a trusted forest.

I use the following command to extract attributes of my own forest.

$schema = Get-ADObject -SearchBase ((Get-ADRootDSE).schemaNamingContext) `
-SearchScope OneLevel -Filter * -Property objectClass, name, whenChanged,`
whenCreated,description,attributeID, isDefunct | Select-Object objectClass, name, whenCreated, whenChanged, isDefunct, `
@{name="event";expression={($_.whenCreated).Date.ToShortDateString()}} | `
Sort-Object whenCreated

However Get-ADObject is not working when I provide the schema partition context of the trusted domain. it gives an error like this.

Get-ADObject : The supplied distinguishedName must belong to one of the following partition(s)... listing the schema, configuration , domain partitions of my current forest.

I tried to use the directory services methods. But this doesn't provide us details like whenmodified which is required for us to understand the timeline of schema changes in the directory. Any one can provide us with a comprehensive way to query schema of a trusted forest ??

$Forest = new-object System.DirectoryServices.ActiveDirectory.DirectoryContext("Forest", $ForestFQDN)
$Schema = [System.DirectoryServices.ActiveDirectory.ActiveDirectorySchema]::GetSchema($Forest
$AllProperties = $Schema.FindAllProperties()
powershell active-directory
Martin Hope
IshRaj
Asked: 2020-10-13 09:55:00 +0800 CST
  • 0

OneDrive for business data retention post license deactivation My client doesn't want his users to use OneDrive for business.

They want to use Sharepoint on-premise. Unfortunately few of the users have enabled Onedrive as it was a part of Microsoft 365 Apps for Enterprise (formerly pro-plus) license bundle/pack.

As part of the remediation.

  1. The Officeonline and Onedriveforbusiness services have been disabled in the M365 license option and reassigned to the users.
  2. The existing personal sites lockstate is set to no access.

Q: Some of the users had data in the onedrive sites. How long the data will be retained ? Will OD4B data deletion get triggered in this case ?

sharepoint onedrive-for-business office365
Martin Hope
IshRaj
Asked: 2020-08-12 05:41:53 +0800 CST
  • 0

I have an on-premise deployment of Windows Hello for business [Certificate Trust] using ADFS 4.0 DRS. I also have an O365 Apps for Enterprise (Pro-plus) subscription. The identities (users only) are synced from on-premise to Azure AD. Only 8 attributes (Required for O365 Pro-plus is synced), [App Filtering in used]

accountEnabled cn displayName objectSID pwdLastSet samAccountName sourceAnchor usageLocation userPrincipalName

No device/group write-back is enabled, no other O365 applications are used.

I am seeing plenty of errors like ones mentioned in blog below (Q4) in Synchronization Service , where the service is trying to overwrite/remove the msds-keycredentialLink attribute [Populated to due WH4B provisoning] for insufficient permissions.

https://techcommunity.microsoft.com/t5/azure-active-directory-identity/azure-ad-mailbag-windows-hell...

They should be triggered by the synchronization rules listed below

IN from AAD - User NGCKey (to DeviceKey in mv) Out to AD – User NGCKey (from DeviceKey in mv to msds-keycredentialLink in AD)

My questions,

  1. Why does it need to writeback the NGCkey ?

  2. Why the errors still persists even if the below rules are disabled ?

azure-active-directory azureadconnect
Martin Hope
IshRaj
Asked: 2020-06-05 01:14:45 +0800 CST
  • 0
  • We are facing an issue with our WHFB enrollment process.
  • The ADFS server Windows Intergrated login process is throwing error: HTTP 400 - Bad Request (Request header too long).
  • The issue is limited to one user at this point of time
  • ADFS IDPinitiatedSignon page working on IE but not on Edge/Google Chrome with the above error when attempting kerberos authentication
  • The user is part of 56 groups.
  • SAM account name is of 20 characters (Migrated from a separate forest)
active-directory kerberos adfs
Martin Hope
IshRaj
Asked: 2019-04-10 06:24:28 +0800 CST
  • 1

We have a string valued attribute which is attached to user class. This attribute is created using schema extension. When i use this custom attribute to implement a inbound AADconnect attribute filtering (negative) it doesnt work.

However if i am using a extensionattribute to achieve the same filtering it works flawlessly.

Does azure attribute filtering work with customer (extended) attributes ?

active-directory