http://microsoft.com/mps -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Roger Seielstad Sent: Wednesday, January 28, 2004 7:58 AM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir] Change in A/D security between 2k and 2k3
Have a link to the MPS? -------------------------------------------------------------- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. > -----Original Message----- > From: Michael B. Smith [mailto:[EMAIL PROTECTED] > Sent: Wednesday, January 28, 2004 1:24 AM > To: [EMAIL PROTECTED] > Subject: RE: [ActiveDir] Change in A/D security between 2k and 2k3 > > > Doing non-GUI provisioning for Exchange is a PITA, at best. > Not to mention poorly documented. I've got way too many lines of > vbscript for my environment, and even so, I couldn't figure out how to > do some of it in script (primarily address list ACEs). > > Microsoft's MPS for Exchange 2003 is _slick_. But I haven't had a > chance to spend any time looking under the hood yet. > > While you're here -- some info/questions about a tool near/dear to > your heart -- adfind: > > It appears to have an off-by-one error (or something) -- it doesn't > seem to display the primary group for a user in the memberOf attribute > (does that mean it isn't there?) > > Prolly somewhat related to the above, it doesn't decode primaryGroupID > into a name. > > msExchMailboxSecurityDescriptor: â <-- displays a non-printable > character here > > It would be nice to be able to suppress the display of blobs (like > msExchRecordedName and mSMQSignCertificates). > > Thanks again, > Michael > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of joe > Sent: Wednesday, January 28, 2004 1:07 AM > To: [EMAIL PROTECTED] > Subject: RE: [ActiveDir] Change in A/D security between 2k and 2k3 > > > LOL no problem... Joe's late night troubleshooting service at your... > Well service. > > Now we have found we actually have a bunch of garbage in many of our > proxyaddresses attributes... Trying to pull all that out... Another > perl script of course. Going to have to chat with the people who do > the data provisioning in the morning.... > > > joe > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Michael B. > Smith > Sent: Wednesday, January 28, 2004 12:52 AM > To: [EMAIL PROTECTED] > Subject: RE: [ActiveDir] Change in A/D security between 2k and 2k3 > > Word. > > Word. Word. Word. > > Note: those are all four-letter words. > > Those other combinations WORK on both Windows 2000 and Windows 2003. > To date, I'd used what the manual and the vendor support staff said to > use. (And no, I don't know why it failed otherwise, and I find myself > not horribly concerned, now that I have something that works.) > > Thanks for talking me through this. > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of joe > Sent: Wednesday, January 28, 2004 12:07 AM > To: [EMAIL PROTECTED] > Subject: RE: [ActiveDir] Change in A/D security between 2k and 2k3 > > > Actually with AD you can specify the bind principal as > > NetBIOS name: domain\username > UPN : [EMAIL PROTECTED] (Assuming that > is the UPN) > DN : cn=user,ou=blah,dc=blah,dc=com > > Should be able to do the same with your program as well unless they do > a sanity check on the input and defines sane as DN format only... > > You can use the same DN for adfind if you would like as well to test > it. I just usually tell people the netbios form because they are more > familiar with it. > > On the PS... We are working it out and yes it does seem to not like > it... > > > joe > > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Michael B. > Smith > Sent: Tuesday, January 27, 2004 11:43 PM > To: [EMAIL PROTECTED] > Subject: RE: [ActiveDir] Change in A/D security between 2k and 2k3 > > Adfind works just dandy on w2k3. I tested it too, with -simple. > > Another question on ldap_simple_bind_s().... > > What is the format of the DN parameter? > > This application has me specify the user as > CN=username,CN=Users,DC=domain,DC=com along with a base DN for the > search (DC=domain,DC=com) whereas adfind needs the base in the same > format, but requires the username parameter in the > netbiosdomainname\username format. > > Does adfind rewrite the username or could this be where the change is? > > Thanks! > > Michael > > PS: Exchange hates duplicate proxyAddresses. Whose code let THAT slip > by? :-) > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of joe > Sent: Tuesday, January 27, 2004 11:07 PM > To: [EMAIL PROTECTED] > Subject: RE: [ActiveDir] Change in A/D security between 2k and 2k3 > > > Heh, I was done with work faster than I expected. You have got to love > perl... :op We seem to have a small issue with multiple user/contact > objects having the same proxy addresses and it is throwing errors on > the E2K servers and I had to go find all the dupes out of some 220k > objects with the proxyaddresses attribute... There were 64... > > > Ok back to the problem at hand; I tested this against one of my W2K3 > Test DCs running in a VPC session... As expected it worked fine. > > You might want to get a network trace of the traffic between the DC > and the server trying to talk to the DC, I am curious. > If they are indeed using just simple LDAP calls ala ldap_simple_bind_s > you will totally see that traffic nearly in clear text in NetMon > including the password being sent. > You will see right where it is failing. > > Actually let me get on the podium for a minute on the benefits of > network tracing and your friendly neighborhood LDAP apps... It is good > to do to understand what calls the LDAP is making to see how bad or > how good it is. You will find a lot of LDAP apps make a lot of > unnecessary calls (<cough>e2k<cough>)and do a lot of unnecessary > authentications. I would say one of my favorite "screwups" is an app > that authenticates people and the way it does it is it binds with an > app ID to do a search of the user's dn and then unbinds and rebinds > with the user's dn... This is great, 2 authentications for every one > needed. Anyway, if you can find the time, it is always good to look at > the apps and profile the traffic they generate and the queries they > use so you can catch those stupid objectclass=something queries > (<cough>e2k<cough>) and other inefficient things (<cough>e2k<cough>). > You can also do this by cranking up various debugging on your DC but > you usually don't want to do that with a prod box. NetMON is much > lighter... > > Just so I don't go away without insulting at least one person.... If > you call yourself an admin and DO NOT know how to use some sort of > network analysis/sniffer tool, you really need to do your job and go > learn one. This is invaluable for solving problems around AD and > computers in general. > Otherwise when you get that weird issue where some network switch or > router is throwing away UDP packets from the Kerberos authentication > process you will have to have someone who knows how to do the job come > in and do it. It is also very handy for DNS issues. > > > > [Tue 01/27/2004 22:54:00.81] > F:\DEV\cpp\OldCmp>Adfind -h vw2k3a -default -f name=administrator > -simple -u vtest\testuser -up Password1 > > AdFind V01.12.00cpp Joe Richards ([EMAIL PROTECTED]) May 2003 > > Using server: VW2K3a.vtest.local > Base DN: DC=vtest,DC=local > > dn:CN=Administrator,CN=Users,DC=vtest,DC=local > >objectClass: top > >objectClass: person > >objectClass: organizationalPerson > >objectClass: user > >cn: Administrator > >description: Built-in account for administering the computer/domain > >distinguishedName: CN=Administrator,CN=Users,DC=vtest,DC=local > >instanceType: 4 > >whenCreated: 20031026153618.0Z > >whenChanged: 20031230164947.0Z > >uSNCreated: 8194 > >memberOf: CN=TestUni,CN=Users,DC=vtest,DC=local > >memberOf: CN=Group Policy Creator Owners,CN=Users,DC=vtest,DC=local > >memberOf: CN=Domain Admins,CN=Users,DC=vtest,DC=local > >memberOf: CN=Enterprise Admins,CN=Users,DC=vtest,DC=local > >memberOf: CN=Schema Admins,CN=Users,DC=vtest,DC=local > >memberOf: CN=Administrators,CN=Builtin,DC=vtest,DC=local > >uSNChanged: 28711 > >name: Administrator > >objectGUID: {AE5284F2-257D-479D-8776-F46BDAE17028} > >userAccountControl: 66048 > >badPwdCount: 0 > >codePage: 0 > >countryCode: 0 > >badPasswordTime: 127122886467739888 > >lastLogoff: 0 > >lastLogon: 127172765879264320 > >pwdLastSet: 127115734585121920 > >primaryGroupID: 513 > >objectSid: S-1-5-21-1851711904-3339057820-1962739558-500 > >adminCount: 1 > >accountExpires: 9223372036854775807 > >logonCount: 32 > >sAMAccountName: Administrator > >sAMAccountType: 805306368 > >objectCategory: > CN=Person,CN=Schema,CN=Configuration,DC=vtest,DC=local > >isCriticalSystemObject: TRUE > >lastLogonTimestamp: 127172765879264320 > > > 1 Objects returned > > [Tue 01/27/2004 22:55:04.82] > F:\DEV\cpp\OldCmp> > > > > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of joe > Sent: Tuesday, January 27, 2004 10:44 PM > To: [EMAIL PROTECTED] > Subject: RE: [ActiveDir] Change in A/D security between 2k and 2k3 > > I would have to say no, ldap_bind_s is still fine and dandy. > Taking that away would break nearly every UNIX LDAP app written it > would appear as they all like it because it is simple. It would also > break many Windows Apps that were ported from UNIX because they didn't > know better. > > If you want to do a simple test, grab adfind and do this > > Adfind -h domaincontroller -default -f name=someobjectname -simple -u > domain\user -up userpassword > > Ex: > > [Tue 01/27/2004 22:41:29.41] > F:\DEV\cpp\OldCmp>Adfind -h w2kasdc1 -default -f name=joe -simple -u > joehome\joebob -up test > > AdFind V01.12.00cpp Joe Richards ([EMAIL PROTECTED]) May 2003 > > Using server: w2kasdc1.joehome.com > Base DN: DC=joehome,DC=com > > dn:CN=joe,CN=Users,DC=joehome,DC=com > >directReports: CN=$$jricha34,CN=Users,DC=joehome,DC=com > >managedObjects: CN=_DIST_TestGroup,OU=Test,DC=joehome,DC=com > >accountExpires: 127193976000000000 > >badPasswordTime: 127182179962809320 > >badPwdCount: 0 > >codePage: 0 > >cn: joe > >countryCode: 0 > >instanceType: 4 > >lastLogoff: 0 > >lastLogon: 127193024241243522 > >lockoutTime: 0 > >logonCount: 91 > >logonHours: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FF > >msNPAllowDialin: TRUE > >distinguishedName: CN=joe,CN=Users,DC=joehome,DC=com > >objectCategory: > CN=Person,CN=Schema,CN=Configuration,DC=joehome,DC=com > >objectClass: top > >objectClass: person > >objectClass: organizationalPerson > >objectClass: user > >objectGUID: {DF6AC5DC-3EBA-41FD-8893-E1ED7FAA5929} > >objectSid: S-1-5-21-1275210071-789336058-1957994488-218285 > >primaryGroupID: 513 > >pwdLastSet: 127189408129723189 > >name: joe > >sAMAccountName: joe > >sAMAccountType: 805306368 > >telephoneNumber: 555 > >userAccountControl: 512 > >userParameters: m: d > >uSNChanged: 1257854 > >uSNCreated: 1163453 > >whenChanged: 20040123043244.0Z > >whenCreated: 20021022040334.0Z > > > 1 Objects returned > > [Tue 01/27/2004 22:42:19.51] > F:\DEV\cpp\OldCmp> > > > > I am looking at a work issue right now, if I get done soon I will spin > up my W2K3 test environment and test it, but again I would be shocked > to death if it didn't work. > > joe > > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Michael B. > Smith > Sent: Tuesday, January 27, 2004 10:36 PM > To: [EMAIL PROTECTED] > Subject: RE: [ActiveDir] Change in A/D security between 2k and 2k3 > > The application does indeed use LDAP. > > It _appears_ that the issue is the API ldap_simple_bind_s. > > MSDN documentation says that nothing Microsoft supplies uses that API > in Windows XP. One may reasonably extrapolate that to include Windows > 2003. But I can't find anything that states that the API was > deprecated between Windows 2000 and Windows 2003. Or between windows > 2000 sp3 to sp4 (although there are minor hints). > > I've turned on auditing (hours ago) and almost nothing shows > -- either success or failure. I don't know what it takes to trigger an > audit event, but a simple ldap query doesn't seem to do it, or a > failed ldap_simple_bind_s. > > I've suggested (requested) a change to ldap_bind_s but is there > documentation somewhere that I am missing that says ldap_simple_bind_s > will no longer work properly? > > Thanks for your hint, it got me headed down the proper path. > > Michael > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of > GRILLENMEIER,GUIDO (HP-Germany,ex1) > Sent: Tuesday, January 27, 2004 2:48 PM > To: [EMAIL PROTECTED] > Subject: RE: [ActiveDir] Change in A/D security between 2k and 2k3 > > yes, there are various security changes in Win2k3, incl. > different default ACLs on various objects. > > But as you've created a special account for the app, you shouldn't > need to enable anonymous LDAP operations on your > Win2k3 DCs => however, the app needs to leverage the credentials > correctly to bind to the LDAP server (the DC). > > The real question is: what does the app really do? Do they even > perform LDAP queries or do they use some NT4 APIs to read data from AD > (I've seen this too many times, although the vendor swore they were > not). > You need to understand what the App does, before you can apply the > correct security - as you've mentioned, often you don't require to > change anything if all the app requires is to list user accounts or > groups etc. > > A good place to start to help figure out this issue is > AUDITING: go to your Default DC policy and enable "Audit directory > service access" for success and failure (preferrably in a lab, > ofcourse). Then start up your mis-behaving Application, wait for it to > fail and take some time to wade through the security Eventlogs => > often you can find a particular AD object (incl. the DN) which an app > tries to access when it fails. This gives you new options to check > out the permissions really required by the app (or to tell the vendor > how to correct a problem in their application). > > /Guido > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Michael B. > Smith > Sent: Dienstag, 27. Januar 2004 16:51 > To: [EMAIL PROTECTED] > Subject: [ActiveDir] Change in A/D security between 2k and 2k3 > > I run an application (ModusGate by Vircom, if anyone cares) that > requires "read access" (their phrasing) to A/D for LDAP queries. > > In Windows 2000, this was easily done in ADU&C -- create a user, > View->Advanced, properties on the domain, Security tab, add > the user and > grant "READ". > > I can do exactly the same thing in Windows 2003, but it doesn't work > anymore (and, in fact, the way I read the permissions I shouldn't even > need to do it with the change in the default permissions). The ONLY > account that works is the Administrator account. I can create an > account, add it to domain admins, enterprise admins, blah blah blah -- > so it looks just like Administrator and it still fails. So, I presumed > it was User Rights -- so I add this account and give it the same > everything there too (in Domain Controller Policy and Domain Policy). > Still no joy. > > Applied change suggested in KB 326690. Still no joy. > > Vircom is baffled as well, they say. > > Any hints or suggestions for me? > > Thanks. > > .+-wÈi0g-í+YbémPiæ0æ-í+bíÚf.+-j!ç > 0j!åoræyØIíV+v* > List info : http://www.activedir.org/mail_list.htm > List FAQ : http://www.activedir.org/list_faq.htm > List archive: > http://www.mail-archive.com/activedir%> 40mail.activedir.org/ > > > . .+-j! > 0j! or yïíIãV+v* > > List > info : http://www.activedir.org/mail_list.htm > List FAQ : http://www.activedir.org/list_faq.htm > List archive: > http://www.mail-archive.com/activedir%> 40mail.activedir.org/ > > > List info : > http://www.activedir.org/mail_list.htm > List FAQ : http://www.activedir.org/list_faq.htm > List archive: > http://www.mail-archive.com/activedir%> 40mail.activedir.org/ . .+-j! > 0j! or yïíIãV+v* > > List info > : http://www.activedir.org/mail_list.htm > List FAQ : http://www.activedir.org/list_faq.htm > List archive: > http://www.mail-archive.com/activedir%> 40mail.activedir.org/ > > .+w ííY P íí .+-j! > 0j! or > yïíIãV+v* > > List info : http://www.activedir.org/mail_list.htm > List FAQ : http://www.activedir.org/list_faq.htm > List archive: > http://www.mail-archive.com/activedir%> 40mail.activedir.org/ > > .+-wi0-+YbmPi0-+bÚf.+-j! > 0j!orØyØIV+v* > List info : http://www.activedir.org/mail_list.htm List FAQ : http://www.activedir.org/list_faq.htm List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ â²Ø~ˆm¶Ÿÿà rØyØ¢¸?™¨¥–+-†ÙŠËEm¶Ÿÿà rØyØ¢¸?–+-}ª¡¶bâ²Ör¯zm§ÿðà šŠV«r¯yÊ&ý§-Š÷4™¨¥iËb½çb®Šà
