Reset an AD Users Password Expiry Date
KB ID 0001272 Problem I was setting up a Cisco ASA this week and needed to enable the ability for users to reset their domain passwords when they are about to expire. To actually test that, I needed a test user that had their password either about to expire, or actually expired. As I dint want to wait 42 days, or setup a password policy just for one user, I needed to find a ‘quick and dirty’ fix for one user. Solution You...
Managing IE Settings via GPO
KB ID 0001269 Problem There used to be a GPO called “Internet Explorer Maintenance” that you could set your Internet Explorer settings, i.e. Proxy server settings, home pages etc. This has now gone, and has been replaced with a group policy preference. Solution From the Group Policy Management Console > Locate the OU containing the USERS you want to link the policy to and create a new policy, then give it a sensible...
Windows 10 Create a WMI Filter for Group Policy
KB ID 0001267 Problem I was messing around with some GPO’s for client today to replace ‘Edge’ as the default browser, (with IE11). To make the whole process more efficient, I wanted to use a WMI filter toapply the policy only to Windows 10 machines. Before this used to be simple enough, you just set the Windows version in a WMI query. But because it searches for a string e.g. 6.1 (for Windows 8.1), that’s...
Move AD Group Members to an OU
KB ID 0001266 Problem I got asked to do this at work this week, PLEASE BE AWARE, moving users about within AD may drastically change the way your ‘User Group Policies’ are being applied. So do some Group Policy Modelling beforehand, to avoid any problems. Solution In the example above, I’ve got ten users in a security group called ‘Source-Group’. For simplicity, they are all in the same source OU as well,...
Windows Server – Locating, Transferring, and Seizing FSMO Roles
FSMO Roles KB ID 0001257 Problem I’ve written about transferring and sizing FSMO roles, (Flexible Single Master Operations) before, see the following article; Transferring Your FSMO Roles Now you have a PowerShell Commandlet to help ‘Move-ADDirectoryServerOperationMasterRole’. FSMO Roles : Solution As before you can view your FSMO role holders, by using the following command. netdom query fsmo To transfer them to...
Install and Configure Certificate Enrolment Policy Web Service
KB ID 0001250 Problem A client had moved a domain joined server into their DMZ, and while they had opened the correct ports for Domain Authentication on their firewall, no one had considered the certificates on the server which had expired, and could not be renewed. Some research, pointed me towards Certificate Enrolment Web Service. Its job is to let clients enrol and renew certificates, from either non domain joined machines, or...
URI Was Validated Successfully But there Was No Friendly Name Returned
KB ID 0001249 Problem When attempting to connect a host to a Certificate Enrolment Policy Server it worked but had the following complaint; WARNING: The URI “https://{Host-Name}ADPolicyPRovice_CEP_{Method}/service.svc/CEP” was validated sucessfully but there was no friendly name returned by the remote machine. Solution On your certificate enrolment policy server, open the Internet Information Servers (IIS) Management...
Certificate Enrolment – URI This ID conflicts with an Existing ID
KB ID 0001248 Problem When attempting to connect a host to a Certificate Enrolment Policy Server I got this error; The URI Entered above had ID : “{Random-GUID}”. This ID conflict with an existing ID Solution On your certificate enrolment policy server, open the Internet Information Servers (IIS) Management console. Expand {Server-Name} > Sites > Default Web Site > ADPolicyProvider_CEP_Kerberos, (yours may not end...
Upgrade Your Microsoft PKI Environment to SHA2 (SHA256)
KB ID 0001244 Problem This is pretty much PART TWO of two posts addressing the need to migrate away from SHA1 before February 2017. Back in PART ONE we looked at how to upgrade the ROOT CA. It does not matter if it’s an offline or online root CA the process is the same. In many organisations their PKI is multi tiered, they either have a RootCA <> SubCA, or a ROOTCA <> IntermediateCA <> IssuingCA. (which is...
Certificate Services – Migrate from SHA1 to SHA256
SHA1 to SHA256 KB ID 0001243 Problem It’s time to start planning! Microsoft will stop their browsers displaying the ‘lock’ icon for services that are secured with a certificate that uses SHA1. This is going to happen in February 2017 so now’s the time to start thinking about testing your PKI environment, and making sure all your applications support SHA2. Note: This includes code that has been signed using...