Move AD Group Members to an OU
KB ID 0001266 Problem I got asked to do this at work this week, PLEASE BE AWARE, moving users about within AD may drastically change the way your ‘User Group Policies’ are being applied. So do some Group Policy Modelling beforehand, to avoid any problems. Solution In the example above, I’ve got ten users in a security group called ‘Source-Group’. For simplicity, they are all in the same source OU as well,...
Windows Server – Locating, Transferring, and Seizing FSMO Roles
FSMO Roles KB ID 0001257 Problem I’ve written about transferring and sizing FSMO roles, (Flexible Single Master Operations) before, see the following article; Transferring Your FSMO Roles Now you have a PowerShell Commandlet to help ‘Move-ADDirectoryServerOperationMasterRole’. FSMO Roles : Solution As before you can view your FSMO role holders, by using the following command. netdom query fsmo To transfer them to...
Install and Configure Certificate Enrolment Policy Web Service
KB ID 0001250 Problem A client had moved a domain joined server into their DMZ, and while they had opened the correct ports for Domain Authentication on their firewall, no one had considered the certificates on the server which had expired, and could not be renewed. Some research, pointed me towards Certificate Enrolment Web Service. Its job is to let clients enrol and renew certificates, from either non domain joined machines, or...
URI Was Validated Successfully But there Was No Friendly Name Returned
KB ID 0001249 Problem When attempting to connect a host to a Certificate Enrolment Policy Server it worked but had the following complaint; WARNING: The URI “https://{Host-Name}ADPolicyPRovice_CEP_{Method}/service.svc/CEP” was validated sucessfully but there was no friendly name returned by the remote machine. Solution On your certificate enrolment policy server, open the Internet Information Servers (IIS) Management...
Certificate Enrolment – URI This ID conflicts with an Existing ID
KB ID 0001248 Problem When attempting to connect a host to a Certificate Enrolment Policy Server I got this error; The URI Entered above had ID : “{Random-GUID}”. This ID conflict with an existing ID Solution On your certificate enrolment policy server, open the Internet Information Servers (IIS) Management console. Expand {Server-Name} > Sites > Default Web Site > ADPolicyProvider_CEP_Kerberos, (yours may not end...
Upgrade Your Microsoft PKI Environment to SHA2 (SHA256)
KB ID 0001244 Problem This is pretty much PART TWO of two posts addressing the need to migrate away from SHA1 before February 2017. Back in PART ONE we looked at how to upgrade the ROOT CA. It does not matter if it’s an offline or online root CA the process is the same. In many organisations their PKI is multi tiered, they either have a RootCA <> SubCA, or a ROOTCA <> IntermediateCA <> IssuingCA. (which is...
Certificate Services – Migrate from SHA1 to SHA256
SHA1 to SHA256 KB ID 0001243 Problem It’s time to start planning! Microsoft will stop their browsers displaying the ‘lock’ icon for services that are secured with a certificate that uses SHA1. This is going to happen in February 2017 so now’s the time to start thinking about testing your PKI environment, and making sure all your applications support SHA2. Note: This includes code that has been signed using...
ADCS – Login Failure: The user has not been granted the logon type at this computer
KB ID 0001242 Problem Post By: Daniel Newton I was configuring a ADCS (Active Directory Certificate Services) on a DC (Domain Controller) for a client today and wanted to setup web-enrolment. I gave the Certificate Service User permissions to the IIS_USRS Group and everything was going well. Then, this error popped up when assigning the service account in setup. Solution This can be easily fixed, just follow these instructions and...
Error – The Computer You Are Signing Into Is Protected By An Authentication Firewall
KB ID 0001241 Problem I put a ‘net use’ command in a logon script for a client today, and the drive refused to appear. So I executed the offending line and saw the following error; System error 1935 has occurred The computer you are signing into is protected by an authentication firewall. The specified account is not allowed to authenticate the computer. Solution This error is seen because the user, (or group the user is a...
Changing Domain Users’ ‘User Logon Names’ and UPN’s
KB ID 0001238 Problem Changing a users UPN suffix is easy (as long as it’s been added – see below). There is some confusion about the User Login Name though. A few weeks ago I had a client that needed this done, (for an office 365 migration). But they had the added problem that some of their User Logon Names had spaces in them, they were in first-name{space}last-name format. What would happen if I changed their user...