RE: [ActiveDir] Anyone ever convert dnsRecord attribute?

Nah I think you missed what I was saying. When I said AD is a big bucket of nails, I was trying to say, it is an LDAP directory, its in the owners manual. Being an LDAP directory, the natural way of retrieving info out of it is with LDAP. You simply need to work out the format of the data

RE: [ActiveDir] Global Catalogs and the Infrastructure Master

Ok it sounds like you left a DC in each domain as a non-GC simply to hold the infrastructure master roles. If that is the case, yes, promote all DCs to GCs. - http://www.joeware.net http://www.joeware.net/(download joeware) http://www.cafeshops.com/joewarenet (wear joeware)

[ActiveDir] Windows 2003 and Windows 98 issue

Hi all and greetings from darkest South Africa. This is my first query to the gurus on the list. This is my scenario. I have a native mode Windows 2000 forest that Im upgrading to Windows 2003. Its a single domain forest and this is what Ive done so far. 1 ) Run adprep

RE: [ActiveDir] Windows 2003 and Windows 98 issue

I would say you should be running in mixed mode -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Peter JohnsonSent: Wednesday, March 31, 2004 9:21 AMTo: [EMAIL PROTECTED]Subject: [ActiveDir] Windows 2003 and Windows 98 issue Hi all

RE: [ActiveDir] Windows 2003 and Windows 98 issue

also disable the "Domain Member: Digitally encrypt or sign secure channel data (always)"security option in the Default Domain Controller policy however, don't forget to re-enable this after you've upgraded all your Win98 clients /Guido From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]

RE: [ActiveDir] Windows 2003 and Windows 98 issue

Title: Message Are you using the domain name when using your login name, i.e. domain\username? -Original Message-From: Peter Johnson [mailto:[EMAIL PROTECTED] Sent: 31 March 2004 15:21To: [EMAIL PROTECTED]Subject: [ActiveDir] Windows 2003 and Windows 98 issue Hi

RE: [ActiveDir] Windows 2003 and Windows 98 issue

Did something similiar to ourselves at my company and got the same results. What is going on is that you need to have the first 2003 domain controller tohave the PDC Emulator FSMO. The article http://support.microsoft.com/?kbid=325379"How to Upgrade Windows 2000 Domain Controllers to Windows

[ActiveDir] Cross forest policies - boxes in Win2k domain, users in win2k3 s ingle domain forest

Title: Cross forest policies - boxes in Win2k domain, users in win2k3 single domain forest Hello all, Having moved all of our users from an NT4 account domain to a Windows 2003 domain, we have a requirement to set policies on our citrix servers which sit in a separate windows 2000 forest,

[ActiveDir] windows 2003 domain

If i have a forest where one domain has upgraded to windows 2003 at the win2k functional forest and domain level, would this have an adverse effect on other domains which were running dc's with win2k sp2 or vice versa? do those dc's/gc's need to be at least sp3? thanks List info :

Re: [ActiveDir] Global Catalogs and the Infrastructure Master

Cody As others have indicated, you will have no issues with setting the IM role holder DCs as GCs. For a really good article that explains why, have a look at: http://www.mcpmag.com/columns/article.asp?EditorialsID=403 Here's another article which covers GC placement generally:

RE: [ActiveDir] windows 2003 domain

You really want to get to SP4. SP3 is minimum but in term of security fixes plan to get to SP4 soon for compatibility. Patching is very important. Take a look at SUS or SMS. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kern, Tom Sent: Wednesday, March

[ActiveDir] Testing other GPO's to DC's

Hi, I'm sure this has been covered in previous posts but how can I create a GPO object and link it to the Domain Controllers OU but only apply it to a couple of domain controllers for testing purposes? Is it removing the authenticated users group and adding the specific domain controllers to

RE: [ActiveDir] Unable to modify GPO Policy

Okay, here is everything that I have tried, applied and modified. I have a few problems on a DC on a sub-domain. If I open the mmc on either my desktop or on the sub-domain's DC, it gives me an access is denied. But, If I open up an mmc console on the parents DC, I have no problem. I am

RE: [ActiveDir] Testing other GPO's to DC's

Yes, that's exactly it. Grant those specific DCs the Read and Apply Group Policy rights on the GPO. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Devan Pala Sent: Wednesday, March 31, 2004 12:08 PM To: [EMAIL PROTECTED] Subject: [ActiveDir] Testing

RE: [ActiveDir] Cross forest policies - boxes in Win2k domain, u sers in win2k3 s ingle domain forest

Title: Cross forest policies - boxes in Win2k domain, users in win2k3 single domain forest Why do cross-forest trusts only work with W2K3? I may have missed some piece of information, but have you seen this? http://support.microsoft.com/?kbid=823862 From: Wilkinson, Stephen [mailto:[EMAIL

Re: [ActiveDir] Unable to modify GPO Policy

Did you try connecting to the share by UNC path fom theDC and from your workstation? Was that test successful? -- Tim Hines, MCSE, MCSA Windows 2000 Directory Services = When responding to posts, please Reply to Group via your newsreader so

[ActiveDir] Domains Separated by Firewall

Hi: We are doing an AD/E2K3 migration, and we have a scenario that I haven't found covered in the archives: Our AD forest presently consists of an empty forest root, with a single child domain. We have a division, however, with significantly higher security requirements than the rest of the

RE: [ActiveDir] Domains Separated by Firewall

Are you sure that the separate domain will meet the organization's requirements? Remember, the forest is the security boundary, not the domains. Hunter -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Wednesday, March 31, 2004 11:36 AM To: [EMAIL PROTECTED]

RE: [ActiveDir] Unable to modify GPO Policy

It was not successful. It prompted me for a username and password. S -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Tim Hines Sent: Wednesday, March 31, 2004 11:11 AM To: [EMAIL PROTECTED] Subject: Re: [ActiveDir] Unable to modify GPO Policy Did you

RE: [ActiveDir] Domains Separated by Firewall

I'm aware of that; that's still to be decided on, and I'm still gathering all the requirements. Meanwhile, I'm looking into whether this is technically feasible. Thanks, Andy Are you sure that the separate domain will meet the organization's requirements? Remember, the forest is the

RE: [ActiveDir] Domains Separated by Firewall

Hi Andy, Check out the following: * Active Directory in Networks Segmented by Firewalls - http://www.microsoft.com/downloads/details.aspx?FamilyID=c2ef3846-43f0-4caf- 9767-a9166368434eDisplayLang=en * Restricting Active Directory Replication Traffic to a Specific Port (MS-KBQ224196) -

RE: [ActiveDir] Domains Separated by Firewall

I've been reading these paper, but most of them assume resource sharing /or cross-domain authentications happening; the scenario I'm looking at (security boundaries/requirements being looked at separately) is simply having replication between the domains (and mail flow, but that's a separate

RE: [ActiveDir] Domains Separated by Firewall

Return Receipt Your RE: [ActiveDir] Domains Separated by Firewall document :

RE: [ActiveDir] Domains Separated by Firewall

Andy, a domain separated by a firewall in the same forest is feasible and it sounds like you're on the right track as far as concerns and architecture. Keep in mind that there are new features in the Exchange application as well that make it different than the 5.5 setup you currently have. You'll

[ActiveDir] Restore

I have a question for everyone, If I have a facility that is using the same back up and tape drive as me, could I take their tapes and access the backed up data on those tapes and restore that data to an alternate location? Justin A. Salandra, MCSE Senior Network Engineer Catholic Healthcare

RE: [ActiveDir] Restore

Yup... That's the idea. -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -Original Message- From: Salandra, Justin A. [mailto:[EMAIL PROTECTED] Sent: Wednesday, March 31, 2004 4:40 PM To:

RE: [ActiveDir] Restore

This is also why most backup software vendors offer the ability to password protect the information on the tapes. -Stuart Fuller -Original Message- From: Roger Seielstad [mailto:[EMAIL PROTECTED] Sent: Wednesday, March 31, 2004 2:53 PM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir]

RE: [ActiveDir] Domains Separated by Firewall

Thanks, I'll be looking at it from that side as well. I was originally under the impression that the AD architecture was done, and that I just had to do the engineering, but it appears that's not the case- I'll be convening meetings with them to get the architecture finalized before I go into the

RE: [ActiveDir] Domains Separated by Firewall

If that doesn't work, you may want to consider IPSec tunnels if the firewall can support. Simplifies the config and secures the transport. The overhead is on the server but you can buy NIC's that offload the processing. If you use the tunnel, it's two ports and a protocol to setup and works

[ActiveDir] AD Query

Does anyone know of a was that I can Pull a query of AD that lists each user, what ou they are in and what groups they belong too smime.p7s Description: S/MIME Cryptographic Signature

RE: [ActiveDir] Domains Separated by Firewall

IPSec is another option I'm considering, but I'd like to think the SMTP link approach would be more straightforward; once this project is completed, it's being turned over to an Operations shop, so I'd like to keep it simple for their sake. -Original Message- From: [EMAIL PROTECTED]

RE: [ActiveDir] AD Query

dsquery (come with 2k3, but also works fine on 2000) get OU from DN of user objects get groups from memberOf attribute (will not be complete in multi-domain forests, but maybe good enough for what you need) /Guido From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL

RE: [ActiveDir] Testing other GPO's to DC's

or create a sub-ou underneath the domain controllers OU which you link the GPO to. then put those DCs into the sub-OU. not only good for testing purposes... /Guido -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darren Mar-Elia Sent: Mittwoch, 31. März

[ActiveDir] Released! Windows Server 2003 Active Directory Branch Office Guide

Enjoy. Windows Server 2003 Active Directory Branch Office Guide http://www.microsoft.com/downloads/details.aspx?FamilyId=9353A4F6-A8A8-40BB- 9FA7-3A95C9540112displaylang=en List info : http://www.activedir.org/mail_list.htm List FAQ: http://www.activedir.org/list_faq.htm List archive:

RE: [ActiveDir] Domains Separated by Firewall

Actually, Guido you can also use SMTP to replicate PAS data. That facilitated GCs across the firewall. (you said just config and schema, which I assume was just an oversight, but wanted to be sure we were all clear) I've done this. What sorts of guidance are you looking for? It's typically fairly