Cisco AnyConnect With Server 2016 NPAS (RADIUS) Different Groups
Oct11

Cisco AnyConnect With Server 2016 NPAS (RADIUS) Different Groups

KB ID 0001474 Problem A few years ago I replaced a firewall that was setup like this, and while it took me a while to work out what was going on, I remember thinking it was an elegant solution. Fast forward to today, and I’m now working with the guy who set it up! (Kudos to Paul White). So when I had a client with a similar requirement, I sat down fired up the lab, and documented it. What was used; Windows 10 Remote Client...

Read More
Moving Certificate Services To Another Server
Oct08

Moving Certificate Services To Another Server

KB ID 0001473 Problem If you are retiring a CA Server, or there sa problem with the server and you want to move Microsoft Certificate eServices to another server, the procedure is pretty straight forward. BE AWARE: We are moving the CA Server, NOT the server name/FQDN, the two things are NOT the same, (you might have called them the same thing!) But a Certificate Authority has a name of its own, and that what we are going to move. So...

Read More
PowerShell: Bulk Enable / Disable Users
Sep11

PowerShell: Bulk Enable / Disable Users

KB ID 0001469 Problem I needed to work out how to bulk disable some domain users from a .CSV file this week, so I thought I’d write it up. Disable Domain Users in Bulk from CSV Well firstly, you need to have your users in a CSV file. For the live job I just exported all the SamAccountNames to a CSV, but here for testing I just loaded a few in manually; Then execute the following two commands; Import-Module ActiveDirectory ...

Read More
Exchange and the LegacyExchangeDN Problem
Sep07

Exchange and the LegacyExchangeDN Problem

KB ID 0001468 Problem Why do we have the Exchange LegacyDN? It’s a throwback, from a time when we had our users, and our mail users in different databases. Below you can see the ExchangeLegacyDN for this Exchange on-premise user; /O=First Organisation/OU=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn={something-user-specific} Who cares? Well they are still important, if you send an internal email (to someone in...

Read More
PDC Emulator: Cannot Sync Time From External NTP Server
Aug28

PDC Emulator: Cannot Sync Time From External NTP Server

KB ID 0001464 Problem I was involved in a question on Experts Exchange this week where the asker could not get their PDC to sync time from an external NTP server. He was seeing an Event ID 12 Error; Time Provider NtpClient: This machine is configured to use the domain hierarchy to determine its time source, but it is the PDC emulator for the domain at the root of the forest, so there is no machine above it in the domain hierarchy to...

Read More
Dcpromo Error: No Other Active Directory Controllers?
Aug04

Dcpromo Error: No Other Active Directory Controllers?

KB ID 0001453 Problem I was trying to demote a domain controller yesterday morning, it was a 2008 R2 Domain controller, (in fact it was SBS 2011). I’d already added a nice new Server 2016 Domain Controller to the domain, and transferred all the FSMO roles, so I was surprised when I tried to gracefully demote the old DC and got this; You did not indicate that this Active Directory domain controller is the last domain controller...

Read More