Microsoft PKI Planning and Deploying Certificate Services Part 2
KB ID 0001310 Problem In Part One we deployed our offline Root CA Server, now we are going to deploy a ‘Certificate Revocation Location’ server. Solution Before you start: Create a DNS record for ‘pki’ that points to the IP address, that you will have the CRL web server hosted on. I’m installing my CRL server on a separate web server because thats good practice. Starting with a domain joined member...
ADMT (Active Directory Migration Tool) Domain Migration – Part 4
KB ID 0001308 Problem On the homeward stretch now, back in Part Three, we migrated service accounts, groups, and users. Now we turn our attention to our machines. Note ADMT 3.2 Only support the migration of Operating Systems up to Windows 7, (that doesn’t mean Windows 8 and Windows 10 wont work, it just means they are not supported). Migrating Windows 8 and 10 throws a lot of security translation errors, because of the way it...
Microsoft PKI Planning and Deploying Certificate Services
KB ID 0001309 Problem “I don’t know what it is about Certificates, I just don’t like them, I don’t understand them, and I don’t like working with them” I hear this a lot, In fact I heard it this week, and as I’m usually the ‘go-to-guy’ for certificates and PKI, it winds me up! IT pros take the time to learn concepts like DNS, DHCP, Kerberos etc. But mention Certificate Services and...
ADMT (Active Directory Migration Tool) Domain Migration – Part 3
KB ID 0001307 Problem Seems like ages since I wrote Part Two, now we are ready to actually start moving objects from one domain to another. Solution ADMT: Service Account Migration Why would you want to do this first? Well this replaces any service accounts on the OLD domain machines with migrated service accounts form the NEW domain, so when the client machines, (or servers,) are migrated they’re already using the new service...
ADMT (Active Directory Migration Tool) Domain Migration – Part 2
KB ID 0001306 Problem Back in Part One we setup our migration admin account, and installed ADMT. Now, as I’m going to migrate the users passwords I need a ‘Password Export Server’, but first I need to tackle the subject of user SIDs Solution Domain Migrations and SID Filtering Every user has a SID (Security Identifier) it’s the thing AD uses to refer to and apply security to users, (and other objects). This...
Can A Domain Trust Another Domain With The Same ‘Root Domain’ Name?
KB ID 0001288 Problem About a month ago I was with a client to do some investigation/consultancy, they were a large company with their head office in the UK and a number of other offices around the world. They had a number of domains and sub domains and wanted to consolidate them all into a new domain. Well that’s all OK, but the UK company has been purchased by a large American company, who were putting a lot of pressure on...
Windows – A Delegation For This DNS Server Cannot Be Created
KB ID 0001287 Problem When promoting a server to be a domain controller, you might see the following error, “A delegation for this DNS server cannont be created because the authoritative parent zone cannot be found or it does not run Windows DNS server. If you are intergrating with an existing DNS infrastructure, you should manually create a delegation to this DNS server in the parent zone to ensure reliable name resolution from...
Changing the Windows 10 Browser, So It Isn’t Edge
KB ID 0001284 Problem I’ve seen one person use Edge as their browser in a business environment. I’ve got nothing against it, (I use a macOSX anyway). But I had a client that asked me how to make sure his machines are set to NOT use Edge as the default browser. I’m going to use Internet Explorer instead, but you can do the same with Chrome or Firefox depending on your browser of choice. Solution What I’m going...
Stop Windows Servers ‘Locking’ with Group Policy
KB ID 0001283 Problem Servers locking themselves after a period of inactivity is, (in most cases) a good thing. But on my test network that only I use it gets a bit annoying switching between machines and constantly having to unlock Windows all the time! Note: For obvious security reasons don’t do this on a production network! Solution Create a new GPO linked to your computer OU, (or edit an existing one). Edit the policy....
Windows – Forcing Domain Group Policy
KB ID 0001282 Problem I’ve written hundreds of posts about doing things with group policies. Every time I finish one, I write a couple of paragraphs on how long to wait, or how to force the policy etc. So I’ve finally got round to writing a post I can simply reference! How Long Before Group Policy Changes Are Applied? This is something that hasn’t changed since I was doing Windows 2000 exams 🙂 The default interval...