Group policy lock workstation

Tutorials Win: Microsoft Windows Forum

- Previous
 - 1
 - New server, old client(s) I'm working on a little project here in my home office. I want to move my existing clients to a new 2003 Server in a new domain. Presently, the 3 or 4 machines here are in the Windows 2000 Server based domain lair.org, aka LAIR. The existing AD structure has problems and I wish to abandon it. I want to MOVE the existing client machines into a new 2003 domain (home.lair.org aka "home"). The goal is to NOT lose the existing user profiles on the client machines. My desktop machine, for example, would take days to rebuild if I lost the profile data. So, I see two possible courses; I'm asking to have my assumed plans validated and clarified or to have them disputed and detailed alternatives offered. 1. Create new server with new AD domain in new forest. Move client machines with ADMT and or USMT. Would this work? Could/would I create some kind of trust or other temporary affiliation between the old forest/domain and the new one in order to use ADMT. If this is to be the plan, I'd REALLY appreciate a step-by-temp summary. I've never used any migration tools before and need a basic orientation. Something like; "create domain, create trust (treat it like foreign domain aka business-to-business link or something like that?) run ADMT, choose method option "Q", import client data, do after-move cleanup X, Y, Z, decommission old server". 2. Create new server with new AD domain in new forest. Log into new domain (to create new profile folders and registry links thereto). Use registry hack to change SID pointers for user data folder from newly created profile path (e.g., c:\documents and settings\user1.001\) to existing (the one I want to keep) profile path (e.g., c:\documents and settings\user1.000\) or thereabouts. What do you think? Bear -- Remove NOSPAM to email me Tag: Group policy lock workstation Tag: 27940
 - 2
 - AD Setup Checklist: Request for Comments Greetings, I am an Active Directory novice. I am planning to set up a very small test domain. One purpose is to start to learn something about Active Directory domain administration. The other purpose is to have a workstation/server environment which I can use to start learning .NET development. This post is a follow up to a previous post which included general questions regarding AD configuration. What follows is a draft of a step-by-step checklist I've created for setting up and configuring my first AD. The main purpose for the checklist is preparation. If the checklist is adequately complete, I should be able to just follow the steps without any surprises, and without having to stop in the middle of the process and say, "Hey, wait a minute, what about X?" I recognize that I could probably create a suitable learning environment solely for development, by merely installing IIS, SQL, and Studio.NET on the workstation, but I would prefer, if possible, to set up a genuine Active Directory workstation/server combination, so that I have the opportunity to learn something about AD administration as well. I also recognize that I could probably accomplish what I want by just bypassing AD altogether and creating a workgroup, but that would also not serve the secondary purpose of learning something about AD setup and administration, and being able to continue to learn more about it in the future. The following details may be relevant and helpful. I currently have two PCs connected together through a router. One PC is running Server2K3 and SQL Server2K, and the other is running XP Pro. Eventually this may grow to include two additional workstations. I have elected to not use DHCP on the server at this time because the router receives a dynamic IP from my ISP, and is configured to hand out static internal IPs to each of the two currently existing machines. I would prefer to keep it this way for the time being. My goal is to have the Server2K3/SQLServer2K machine running AD, IIS, and file services, acting as a domain controller/application server/database server/file server. Then, I would install Studio.NET on the XP Pro workstation. As I work my way through various tutorial books, I would be using the workstation to build applications, and then uploading the project files to the server for testing via various web browsers. Here is the first draft of my checklist. I will welcome constructive comments from experienced users regarding steps which are wrong, missing, or not ordered properly. -------------------------------- AD SETUP AND CONFIGURATION CHECKLIST I. PROMOTE THE WIN2K3 SERVER TO A DOMAIN CONTROLLER: 1.Have the Setup CD available 2.Select Start | Settings | Control Panel | Administrative Tools | Configure Your Server Wizard 3.Run the Active Directory Setup Wizard 4.Select Typical Configuration for a First Server 5.Select DNS but not DHCP (the router will hand out static internal IPs) 6.Enter the full DNS name of the Domain (i.e., mydomain.local) 7.Enable DNS query forwarding: supply the IP of the ISP's DNS server 8.Reboot 9.Finish II. CHECK THAT THE DEFAULT ADMIN ACCOUNT ON THE SERVER IS A MEMBER OF THE DOMAIN ADMINS GROUP: 1.Start | Settings | Control Panel | Administrative Tools | Active Directory Users and Groups 2.Expand the Domain Node | Select the Users folder 3.Right click on the default admin account and select Properties III. INSTALL IIS AND FILE SERVICES ON THE SERVER: 1.Have the Setup CD available 2.Start | Settings | Control Panel | Add or Remove Programs 3.Select Add/Remove Windows Components 4.Select Application Server 5.Next 6.Deselect FrontPage server extensions (we won't be using FrontPage to develop web pages; all apps will be developed in ASP.NET or VB.NET) 7.Enable ASP.NET, IIS, and file services 8.Insert the CD when prompted 9.Next 10.Finish IV. CHECK THE IIS SERVER'S MASTER WEB SITE SETTINGS: 1.Open the IIS Manager: Start | Settings | Control Panel | Administrative Tools | IIS Manager 2.Right click on the Web Sites folder and select Properties 3.Inspect all the tabs. It may not be necessary to change any of the defaults, at least for a test environment V. ENABLE WEB SERVICE EXTENSIONS FOR ASP WEB SITES: 1.In the IIS manager, select the Web Service extensions node 2.Select services from the list as appropriate VI. CREATE A DOMAIN USER ACCOUNT: 1.Start | Settings | Control Panel | Administrative Tools | Active Directory Users and Groups 2.Expand the Domain Node | Select Users folder 3.Current Container | Create a New User 4.Enter the First, Middle and Last Name of the user 5.Enter the username 6.Next 7.Enter the password for the account and select "User cannot change password" and "Password never expires" 8.Finish 9.Set properties for the account: right click on the account object 10.Check that the account is a member of the Domain Users 11.OK VII. ADD THE XP PRO WORKSTATION TO THE DOMAIN: 1.Start | Settings | Control Panel | Administrative Tools | Active Directory Users and Computers 2.Select the Computers node 3.In the Details pane, right click and select New | Computer... 4.Provide the DNS name of the workstation 5.Set the domain user or domain group that can log on to the computer VIII. CONFIGURE THE DOMAIN CLIENT ON THE XP PRO WORKSTATION: 1.Log on to the XP Pro workstation as a local Admin 2.Select Start | Settings | Control Panel | System 3.Select the Computer Name tab and select the Change button 4.Select Member of Domain and provide the domain name (i.e., 'mydomain.local') 5.Provide a username and password for a domain account that has permission to log onto this computer within the domain then click OK 6.Reboot 7.Log on again as a local Admin 8.Add a domain user account to the local machine so these users can log onto the domain from this machine, using the domain account: open Computer Management (shortcut is already placed on the desktop of the Admin account) 9.Right click in the Details pane and select New User... 10.Provide the username and domain name | Next 11.Select Standard User | Finish 12.Test the account by logging off and logging on using the domain user account IX. COPY THE WORKSTATION'S LOCAL USER ACCOUNT PROFILE TO THE DOMAIN ACCOUNT: 1.Log off the workstation's domain account and log on as a local Admin 2.Start | Control Panel | System | Advanced | User Profiles | Settings 3.Select the local user account with the desired profile, and select Copy To | Browse 4.Select the domain account on the local machine | OK | OK | OK 5.Test the account: log off as local Admin, log on as domain user Tag: Group policy lock workstation Tag: 27939
 - 3
 - Security account Manager Fail during boot up in server 2003 Hi everyone: I encounter a strange boot up issue that caused this message that I stumped on when I did a " sysprep -dc" on a domain controller in Standard server 2003, and the message is "Security account manager initialize fail because.... the value provide ID 0xc0000084....., please, go to recover console to do a repair..." and the only button is to click "OK" to continue and that the system reboot immediately after you click "OK" button Tag: Group policy lock workstation Tag: 27936
 - 4
 - Restore to Server2003 I Just upgraded a server new drives and the works. I backed up the 2000 server before I did all this. I restored My departments folders and all my user directories to the 2003 server,. I used Veritas BackupExec 9.1 also when I restored I kept the permissions and the tree structure. After restoring all the files they are all marked READ-ONLY , no users can save files if they work on them or anything and I cannot clear the read-only, I clear it and it comes right back. Anyone have any ideas how I can fix this. It would be like super appreciated...TYIA Tag: Group policy lock workstation Tag: 27935
 - 5
 - From manual site links back to auto Looking for advice as how we can switch from manual site links to auto generated site links. We currently have 53 sites connecting back to a datacentre (hub and spoke setup), where the HUB has 4 DC's of which 2 of them are bridge servers that hold all the site links connection. At the time back in the early days of Windows 2000 AD this was the best approach due to the limitation of AD replication. However now that we have upgraded to full native mode 2003 AD - we would like to switch to back to auto generated links and use all 4 DC's or 3 at least. Does anyone know of what the best approach to do this would be? Regards Alistair Tag: Group policy lock workstation Tag: 27918
 - 6
 - How does the netbootGUID attribute get populated? This attribute is not populated in my AD. It's listed as an 'optional' attribute for Computer Objects in the Schema. It was my assumption that this attribute would contain the System UUID for all the computers that are members of my Domain, but this does not seem to be happening automatically. Is there something that I need to do to enable this behavior? I don't want to use the System UUID to enable remote booting at the present time, however I do want to collect this information for future use... Thanks in advance, Tag: Group policy lock workstation Tag: 27915
 - 7
 - OU's "Computer Configuration" Settings Doesn't apply... Hi, I have problem Windows Server 2003 Active Directory. I created 2 organizational units. And their group policies. OU's group policy's "User Configuration" settings aplly all clients.But "Computer Configuration" settings doesn't apply. How can i do? Thanks for your interest... Tag: Group policy lock workstation Tag: 27914
 - 8
 - Multiple identical user accounts in same ADS Hi, I have some peculiar doubt about creation of user account in Active directory .The scenario is as follows :- I have a machine with Windows 2003 server configured with Acive Directory.This server actually a Web server we are hosting different sites for different customer. Hence we need to have a their own user accounts t be created.So, currently I have situation where I need to create Three user accounts with same login information but belongs to different OU. Ca anybody please suggest me that is there any possiblity to create multiple identical login accounts in same active directory under different OU's. Any help is highly appreciated. Thanks in advance Ravi Tag: Group policy lock workstation Tag: 27909
 - 9
 - help!! i use csvde export users from ad, but i discover not export user password. what do i do? i can export user password using csvde.exe or ldifde.exe? help!!!! Tag: Group policy lock workstation Tag: 27899
 - 10
 - Desperate: Windows XP SP2 intermittent slow logins to Windows 2K AD Domain I hope someone can help with this issue. I just started rolling out new Dell XP workstations to our 60 user domain. The XP logins sometimes take up to 5 minutes to login. It usually happens about every 5th login sometimes everytime. The workstations are getting 1053 userenv errors saying that Windows cannot determine the computer name. The RPC server is unavailable. All the machines are using DHCP and getting DNS from the server. I also installed WINS and enabled NetBios over TCP/IP on the workstations. I've tried every possible fix I've found on the internet. I'm attaching a netdiag because I'm getting a DNS error that may be the culprit. The server IP is 119.0.0.199 but the netdiag says it's 119.0.0.28 which is a RAS IP address. Here is the netdiag. Sorry for the length. Any help would be appreciated. I'm going nuts with this one. Per interface results: Adapter : Intel Pro 1000 MT Gigabit Ethernet Adapter - onboard Netcard queries test . . . : Passed Host Name. . . . . . . . . : ZOOM IP Address . . . . . . . . : 119.0.0.199 Subnet Mask. . . . . . . . : 255.255.255.0 Default Gateway. . . . . . : 119.0.0.2 Dns Servers. . . . . . . . : 119.0.0.199 AutoConfiguration results. . . . . . : Passed Default gateway test . . . : Passed NetBT name test. . . . . . : Passed No remote names have been found. WINS service test. . . . . : Skipped There are no WINS servers configured for this interface. Adapter : {6B7C85D3-4637-480F-B44F-D2D2D6B2DFA8} Netcard queries test . . . : Passed Host Name. . . . . . . . . : ZOOM IP Address . . . . . . . . : 119.0.0.28 Subnet Mask. . . . . . . . : 255.255.255.255 Default Gateway. . . . . . : Dns Servers. . . . . . . . : 127.0.0.1 AutoConfiguration results. . . . . . : Passed Default gateway test . . . : Skipped [WARNING] No gateways defined for this adapter. NetBT name test. . . . . . : Passed No remote names have been found. WINS service test. . . . . : Skipped There are no WINS servers configured for this interface. Global results: Domain membership test . . . . . . : Passed NetBT transports test. . . . . . . : Passed List of NetBt transports currently configured: NetBT_Tcpip_{B409B810-9359-4E71-B321-FF245AD1BA52} NetBT_Tcpip_{6B7C85D3-4637-480F-B44F-D2D2D6B2DFA8} 2 NetBt transports currently configured. Autonet address test . . . . . . . : Passed IP loopback ping test. . . . . . . : Passed Default gateway test . . . . . . . : Passed NetBT name test. . . . . . . . . . : Passed Winsock test . . . . . . . . . . . : Passed DNS test . . . . . . . . . . . . . : Passed [WARNING] Cannot find a primary authoritative DNS server for the n 'ZOOM.domain.com.'. [RCODE_SERVER_FAILURE] The name 'ZOOM.domain.com.' may not be registered in DNS. PASS - All the DNS entries for DC are registered on DNS server '119.0.0. . Redir and Browser test . . . . . . : Passed List of NetBt transports currently bound to the Redir NetBT_Tcpip_{B409B810-9359-4E71-B321-FF245AD1BA52} NetBT_Tcpip_{6B7C85D3-4637-480F-B44F-D2D2D6B2DFA8} The redir is bound to 2 NetBt transports. List of NetBt transports currently bound to the browser NetBT_Tcpip_{B409B810-9359-4E71-B321-FF245AD1BA52} NetBT_Tcpip_{6B7C85D3-4637-480F-B44F-D2D2D6B2DFA8} The browser is bound to 2 NetBt transports. DC discovery test. . . . . . . . . : Passed DC list test . . . . . . . . . . . : Passed Trust relationship test. . . . . . : Skipped Kerberos test. . . . . . . . . . . : Passed LDAP test. . . . . . . . . . . . . : Passed Bindings test. . . . . . . . . . . : Passed WAN configuration test . . . . . . : Skipped No active remote access connections. Modem diagnostics test . . . . . . : Passed IP Security test . . . . . . . . . : Passed IPSec policy service is active, but no policy is assigned. The command completed successfully Tag: Group policy lock workstation Tag: 27891
 - 11
 - publish shares I would like to publish shares to the AD but set the permissions in the way that only department folders and printers are visible to the user. In other words, if manufacturing user navigates to the My Network places, he can only see manufacturing department folder and printer. I would like to have this across the board for the whole company. Also, I would like to hide built-in and other sensitive data from non admin users. Please help. Thanks, George Tag: Group policy lock workstation Tag: 27887
 - 12
 - sharing out folders on their computers <-- Must Stop --> Can someone explain to me how I can go about keep a user from sharing out folders on their computers? Scenario: I have a "user / with admin rights over his machines" who seems to want to share info from folders on his desktop to some users within the company. I am looking for a way to stop this from happening. Tag: Group policy lock workstation Tag: 27878
 - 13
 - Active Directory 2003 working with Exchange 5.5 I'm looking for a newsgroup that I can talk with people on this subject. I need to be able to add my Exchange 5.5 server to AD 2003. Thank you in advance. Tag: Group policy lock workstation Tag: 27869
 - 14
 - Set Password with MD5 Hash At our university users change their passwords via a web portal. Then we can get the MD5 hash of that password via SQL. Is there any way to set users passwords based on that MD5 hash? Tag: Group policy lock workstation Tag: 27867
 - 15
 - Universal and global groups. Could anyone explain why you would use universal group for 3 but not for 2 as they are on different domains. I think im missing something very simple here but the more i read this and try to understand the more i get confused. Also why use universal for 3 when you can use global ? Any answers will be gratefully received. Scenario: You are an infrastructure planner on the Active Directory infrastructure design team for The Ski Haus, an international retailer of ski apparel. The Ski Haus uses two domains, one for resources at their Denver, Colorado, location and another for resources at their Geneva, Switzerland, location. The Product Design department at each location maintains a separate database of ski hat designs. Product Design users at each location must have full control of the ski hat design database in their own domain. Product Design users at both locations must have read permissions on both ski hat design databases. Product Design users at both locations must have change permissions on the ski sweater design database in the Geneva location. 1.. Explain how your design team will use security groups to allow the Product Design users in each domain full control of the ski hat design databases in their domains. Set up a Denver Product Design global group and add the Denver Product Designer users to the group. Set up a Geneva Product Design global group and add the Geneva Product Designer users to the group. Then add the Denver Product Design global group to a Denver Product Design domain local group and add the Geneva Product Design global group to a Geneva Product Design domain local group. Grant full control permissions for the ski hat design database to each domain local group. 2.. Explain how your design team will use security groups to allow the Product Design users in each domain read permission to the Denver and Geneva ski hat design databases. Set up a Denver domain local group that has read permission for the ski hat design database. Add the Geneva Product Design global group to the Denver domain local group. Set up a Geneva domain local group that has read permission for the ski hat design database. Then add the Denver Product Design global group to the Geneva domain local group. 3.. Explain how your design team will use security groups to allow all Product Design users in both domains change permission to the ski sweater design database in Geneva. Set up a universal group. Set up a domain local group in the Geneva domain that has change permission for the ski sweater design database. Add the Geneva Product Design global group and the Denver Product Design global group to the universal group. Add the universal group to a domain local group in Geneva. Tag: Group policy lock workstation Tag: 27866
 - 16
 - Time synch problems... We recently migrated to Active Directory... Everything is running smooth. Except, some of our servers are still looking to the old NT PDC for time synchronization. (even though they are on the AD domain.) I found this out with "w32tm -v" Is there an easy way I can correct them? (group policy or something) Aren't they supposed to get time from a DC on the domain they are a member of? TIA!!! Tag: Group policy lock workstation Tag: 27865
 - 17
 - Password Policy GPO and Sharpoint Users Here's my situation. My company needs to institude a password change policy in our Domain. I know that the only place to do this is at the root of the domain. I have an OU called Sharepoint. All the users in that group are external clients that we dont want the password change policy appliing to. How can I go about doing this? Is it as simple as checking the "password never expires" box in thier user account setting? Tag: Group policy lock workstation Tag: 27864
 - 18
 - Automation Error....Help!!! Hi all, I try to obtain a list of current users in a Domain Controller using VB 6.0 an ADO 2.8. I try this: Dim rootDSE As IADs Dim con As New Connection, rs As New Recordset Dim Com As New Command Dim oIADs As IADs Dim sObjectDN As String Dim sUserADsPath As String ' Bind to the Active Directory with the RootDSE object. Set rootDSE = GetObject("LDAP://RootDSE") sObjectDN = "LDAP://" & rootDSE.Get("defaultNamingContext") Set rootDSE = Nothing Set oIADs = GetObject(sObjectDN) The first time I execute my code, function well, but, if a try to search for a second user, I have an Automation Error in: Set oIADs=GetObject(sObjectDN)... If I Restart the server, the code back to function, once, only once... What happend? I try to get a list of users in a Ou...any help? thanks!!! Tag: Group policy lock workstation Tag: 27861
 - 19
 - Changing Operations Manager I am trying to change the operations manager from my current domain controller to another DC on the network in windows 2003 but I get the following message: The transfer of the operations master role cannot be performed because: The requested FSMO operation failed. The current FSMO holder could not be contacted. I am trying to change the operations manager on the current main DC which I assume is the FSMO holder. After spending all morning looking on Technet Plus CDs and Technet online I have found nothing. I also did a google search and have still found nothing. What am i missing? Tag: Group policy lock workstation Tag: 27856
 - 20
 - apply registry settings at logon through GroupPolicy? I have 2 terminal services servers windows 2003.. and each time a user logs on, i would like to apply a registry setting. (It's a setting I can't seem to find in GroupPolicy) The following should be applied when a user logs on: Hkey_current_user\software\microsoft\windows\currentversion\explorer\advanced Value: Hidden Type: Reg_Dword Value: 0 Value: HideFileExt Type: Reg_Dword Value: 0 Value: ShowSuperHidden Type: Reg_Dword Value: 0 Any thoughts on how i can do this since GroupPolicy doesn't seem to allow these specific settings. Does Group Policy allow to specify specific registry settings to be entered such as the above? Any help would be great appreciated! Chris Thunell IT Manager Pierce Associates, Inc. Tag: Group policy lock workstation Tag: 27852
 - 21
 - Help, logoff script and disconnected computer == problem Hi I have a script running every time our users log of the domain. Its controlled via a GPO in our AD, (think its in User Configuration -> System -> Logon/Logoff scripts or something like that), and I've copied the script over to the Logoff folder for that GPO. Everything works fine as long as the computers are connected to the network when the users logoff, but if the computer isn't connected (laptop users are still able to logon to their computers eventhough they are not connected to the domain), it prints and error about not being able to run the script, which it obviously cant since it doesnt have a local copy of it. Is there any way to got around this error, can I disable the script, so it doesnt run when computers are "offline", or can I have our AD replicate the script to the computers so they have a local copy? (PS. Running Win2K server with Win2K Pro/WinXP Pro clients). Best regards, Egil Hansen. Tag: Group policy lock workstation Tag: 27851
 - 22
 - Re-joining BDC to domain with invalid computer account Had 2 domains with AD. New domain was with 2 DC, DC1 and DC2. An older W2k server from old domain, also named DC2, had to be moved and renamed to new domain. The guy who did it (hopefully it isn't me !) plugged the W2k server DC2 into the new network, and ..... changed the computername to Server1 and joined it to the new domain, forgetting that the "DC2" name would only be changed to "Server1" after reboot ! Results : Duplicate name on the network, DC2 changed to Server1 in AD (DC container), and DC2 cannot log on to the network anymore (netlogon service doesn't start). I tried to demote DC2 (to re-promote it later), but it doesn't works. Even whithout network connection, with its own DNS service installed, and after deleting DC1 and Server1 in AD, it refuses to remove AD and DC role ...... because I only can log on locally and not to the domain. Any idea (other than reinstalling OS) ? Tag: Group policy lock workstation Tag: 27850
 - 23
 - ldifde:How to export user from one particular OU and export it bac Sorry for this newbie question: Looking for someone could help on ldifde syntax to be use to export Win2003 AD users from one particular OU. And the ldifde syntax to export it back to that OU. Tag: Group policy lock workstation Tag: 27848
 - 24
 - What is DNS hosting? Hello All, What is DNS hosting? Please reply me soon. Thanking you Gunjan Desai Tag: Group policy lock workstation Tag: 27842
 - 25
 - intrenet connection & Active directory i had 2 seperatenetworks. the1st network was old and it was hooked up to the internet. using a 24 port 10mbps switch and an internet netgear router the 2nd network i was builiding up fromthe scratch.. it had a server, .. xeon 3.2, 1.5 gb, 140gbscsi, 1gbps nework.. i installed win2k03.. everything was fine .. then i installed active directory, which made me install a file server and a dhcp server along w. it, when i hooked it up to the old network, .. and joined some computers to the domain i alredy hooked up.. all the computer that we 're not connected to the domain lost internet connection but not network connection .. all but the server and another computer that i hooked up to domain were connected to the internet, the others just shut down,.. when i unhooked the server,.. and restarted the whole network system .. and seperated the domain .. everything on the old system went back to somewhat normal standard (ie slowness, hehe) .. so what is the solution ? why does the internet go away ? best regards,, Tag: Group policy lock workstation Tag: 27841
- Next
 - 1
 - How to retain userid & password when deploying ADS from "Standalone" Server for Windows 2000 Server. I tried to deploy ADS on the existing standalone Windows 2000 Server, but the user id need to recreate all over again. I found that is ADMT version 2.0 but all the article is discuss about DOMAIN environment. My question is; can ADMT help to migrate the userid & password from the existing "Standalone" Windows 2000 server to Active Directory Windows 2000 Server? Thanks. ttm Tag: Group policy lock workstation Tag: 27840
 - 2
 - unique x500 object id generation Hi, In my test lab, on a win2k3 system, I am in the process of modifying the schema. I'm doing this using mmc snap-in. When I try to add a new Class, I'm prompted to enter a 'unique x500 object id' ? I have read up a little bit on it, am still stuck. Could anyone help me know how to generate this? Some sites have suggested oidgen.exe, but that's for win2k system, plus I donot have the win2k resource CD. Is there a way to see the oid's stored or used in the active directory? Also, can i just use ldife.exe instead of using the snap-in? Thanks in advance. Tag: Group policy lock workstation Tag: 27831
 - 3
 - Simple question about child domains... Hi, all! Hopefully this is a quick question, with a follow-up... Is there an easy way to determine if an AD box is running as a child domain of another domain? Here's the deal: we have several different sites, all under the "mycompany.com" domain. However, as configured, one domain at a site is SiteA.mycompany.com, and another is SiteB.mycompany.com. At this point, the guy who config'd this setup is no longer here, and I'm trying to determine whether this whole thing was set up as SiteA.mycompany.com as it's own forest, and SiteB.mycompany.com as it's own forest (which I suspect is the case). Is there a quick way to determine? Neither AD boxes are replicating the other, and attempts at dynamic DNS updates fail (entries in SiteB Event Viewer indicate that). Quick way to determine? Follow-up question: Assuming both are their own forest, can we a) create an AD box to act as "mycompany.com", and somehow convert these two boxes that are their own forests/domains to be child domains of the domain (single forest, multiple domains) without completely rebuilding the two DCs? We know that our end result needs to be a single forest, single domain (mycompany.com) with child domains (different policies, different user bases, different OUs, etc). I've set up several single forest, single domain boxes before, but I need to be sure what I'm looking at in this particular setup before I start changing things or recommending changes. Thanks for any suggestions! Jack Tag: Group policy lock workstation Tag: 27829
 - 4
 - network drive and permission My company network is under domain, and I have a network drive in file server. What I want to do is to allow people to access the file BUT not copy the whole folder and paste it under users' computer. Is there any method allow me to do that under active directory? We are using Windows Server 2003. Thanks. Tag: Group policy lock workstation Tag: 27824
 - 5
 - Doesn't redirect to My Documents folder Hello friends, I have a DC where the "My Documents" folder of each users is redirected to \\FILERSERVER\MyDocuments\Pedro.Perez but SOMETIMES this doesn't work. Instead of redirect to FILESERVER the "My Documents" folder is redirected to Local Profile: C:\Documents and Settings\Pedro.Perez\My Documents. Why would this occur? Any help is appreciated. Heriberto Tag: Group policy lock workstation Tag: 27822
 - 6
 - SYSVOL FRS Member Object how to remove older duplicates Hi All, After running DCDIAG in my mixed Windows 2000 / Server 2003 env. I get the following error: ......................... DC12 passed test systemlog Starting test: VerifyReferences Some objects relating to the DC DC12 have problems: [1] Problem: Conflict Mangled Value Base Object: CN=DC12,OU=Domain Controllers,DC=officenet,DC=partner,DC=nl Base Object Description: "DC Account Object" Value Object Attribute: frsComputerReferenceBL Value Object Description: "SYSVOL FRS Member Object" Mangled Value: CN={acec90af-41a6-45b7-8662-87dff85c5e25},CN=DFSRoot,CN=DFSRoot,CN=DFS Volumes,CN=File Replication Service,C N=System,DC=officenet,DC=partner,DC=nl Recommended Action: Check that there is not more than one SYSVOL FRS Member Object for this DC, and if so clean up the older duplicates. When I check the frsComputerReferenceBL object whit adsiedit it returns multiple values, but I cannot delecte them because they are owned by the system? What to do next? Call MS? Regards Remy Tag: Group policy lock workstation Tag: 27817
 - 7
 - Only allow local user profiles We are moving away from roaming profiles. We have enabled the only allow local user profiles in group policy. This setting says that it is at least Windows XP Pro and Windows 2003 setting. I have found out different. I cannot get roaming profiles to work when roaming users log into 2000 machines. I tested it by deleting the files in the roaming folder and the local profile for a test user. With the setting not configured the profile files are created after the user logs in and out. I enable the setting that should be win xp and above and remove the roaming prifile files and the local profile and it won't copy the files out to the roaming folder. Anyone run into this? Tag: Group policy lock workstation Tag: 27804
 - 8
 - Only allow local user profiles We are moving away from roaming profiles. We have enabled the only allow local user profiles in group policy. This setting says that it is at least Windows XP Pro and Windows 2003 setting. I have found out different. I cannot get roaming profiles to work when roaming users log into 2000 machines. I tested it by deleting the files in the roaming folder and the local profile for a test user. With the setting not configured the profile files are created after the user logs in and out. I enable the setting that should be win xp and above and remove the roaming prifile files and the local profile and it won't copy the files out to the roaming folder. Anyone run into this? Tag: Group policy lock workstation Tag: 27803
 - 9
 - WLAN Security Is there a policy in AD that can prevent WLAN clients from connecting to network resources or even getting a DHCP lease? Thanks, Jody Tag: Group policy lock workstation Tag: 27802
 - 10
 - Cross Forest Trusts I have two different Windows 2003 forests. In each forest, there is only one domain with one DC in each domain). I am trying setup a cross-forest transitive trust for these two forests. My problem is that on one side of the trust (the forest with the incoming trust relationship) I can setup the trust just fine. The forest sees the other forest as a Windows 2003 forest and all is fine. On the other side of the trust relationship (the forest with the outgoing trust relationship), when I put in the DNS name of the forest I want to establish the trust relationship with, the Create New Trust Wizard does not recognize it as a Windows 2003 forest. It simply asks me if it is an external realm or a domain. I figure that the issue is simply a DNS issue. However, I have checked the each DC and made sure that they had a primary copy of its own DNS zone and a secondary copy of the zone associated with the domain I want to establish the trust with. Can anyone give me any ideas as to what might be going on or what we are doing wrong? I figure it is probably an error occurring between the chair and keyboard, but I want to check first. Thanks! Ward D. Cook Tag: Group policy lock workstation Tag: 27790
 - 11
 - HELP: DNS and DHCP not working anymore?? Hi, I've got the following urgent problem: After having installed a Windows 2003 Server and integrated (or so I thought ...) into our existing mixed legacy NT/Windows 2000 domain, the DHCP and/or DNS doesn't work correctly anymore?? I just wanted to add that new server as a stand-alone fileserver! The DHCP clients don't get any valid IP addresses anymore and there's the following error message on my DNS server: "Registration of the DNS record ... failed for the following reason: DNS operation refused" ??? It seems like the Windows 2003 server has messed everything up? How do I remedy this? I've shutdwon the new server and restarted the old ones, but it stil isn't working. What can I do? The clients need the DHCP working tomorrow ..... Thanks alot!! John Tag: Group policy lock workstation Tag: 27783
 - 12
 - Searching AD Attributes I am looking for a script to search the entire AD and return UserNames based on the value of certain attributes. Can someone help? Paul Glickenhaus Tag: Group policy lock workstation Tag: 27782
 - 13
 - Cracking passwords in Active Directory From my understanding there is NOT a utility like LOphtCrack for cracking passwords in Active Directory (2K3). If I am incorrect please let me know. I'm wondering if there's a utility a network administrator can use on a GC to test user's password for policy compliance (not using dictionary words, etc.) TIA Jon Tag: Group policy lock workstation Tag: 27780
 - 14
 - searchable database for GPO's???? This is a multi-part message in MIME format. ------=_NextPart_000_0002_01C52AD0.3C96FF20 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Where, or where, can I find a comprehensive - online (or downloadable, or on Server 2000/2003 somewhere in it's many tools) - can I search for keywords to find out just where the heck a specific Policy exists. I often change something, then cannot for the life of me find it afterwards. And sometimes, I'd like to search for a keyword/topic to find out ALL policies relating to it. Thanks! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! ------=_NextPart_000_0002_01C52AD0.3C96FF20 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html xmlns:o=3D"urn:schemas-microsoft-com:office:office" = xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns=3D"http://www.w3.org/TR/REC-html40"> <head> <META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; = charset=3Dus-ascii"> <meta name=3DGenerator content=3D"Microsoft Word 11 (filtered medium)"> <style>  </style> </head> <body lang=3DEN-US link=3Dblue vlink=3Dpurple> <div class=3DSection1> Where, or where, can I find a comprehensive - online = (or downloadable, or on Server 2000/2003 somewhere in it’s many tools) = - can I search for keywords to find out just where the heck a specific Policy exists.  I often change something, then cannot for the life of me = find it afterwards.<o:p></o:p> And sometimes, I’d like to search for a keyword/topic to find out = ALL policies relating to it.<o:p></o:p> <o:p> </o:p> Thanks! = !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!<o:p></o:p> <o:p> </o:p> <o:p> </o:p> </div> </body> </html> ------=_NextPart_000_0002_01C52AD0.3C96FF20-- Tag: Group policy lock workstation Tag: 27776
 - 15
 - Domain Admins and LDAP search We are using Active Directory as our corporate address book and I am running into the problem of any normal user that is put into the Domain Admin group no longer shows up in the address book (ldap query). If I add a new user, and do not put them in Domain Admin group they show up fine - adding a user, and putting them in this group they do not show up at all. I have been looking at the rights (specifically Domain Admin group) read phone and mail options for the group and it is allowed. Any thoughts appreciated. Edward ebroo@phillips.com Tag: Group policy lock workstation Tag: 27772
 - 16
 - Domain Policy vs Domain Controller Policy. Can anybody explain the difference between these 2? Which takes precedence over which? Thanks, Dave Tag: Group policy lock workstation Tag: 27766
 - 17
 - DC problems We currently have 4 sites. I am currently tryinging to bring down a DC that is local (all services and roles have been moved to other local servers). There is another local DC. My problem is when I down the DC it takes a long time to logon and when I check the logonserver it is from another site and not our local site. I know that it should logon to the closest DC which it is not doing. What should I check and is there a way to set a prefered logon server? Tag: Group policy lock workstation Tag: 27762
 - 18
 - ADAM - restrictive predefined attributes cause app problems I found some glitches trying to get predefined ADAM attributes to cooperate: - "countrycode" is predefined als integer, but applications expect it to be of type OID=1.3.6.1.4.1.1466.115.121.1.11, which is a 2char-IA5-String - "l", "telephonenumber" and "facsimileTelephoneNumber" (and maybe some other attributes, too) are predefined as single-value, but some application expect these attributes to be multi-valued. This might be due to rfc 2256. Unfortunately systemflags=16 blocks these predefined attributes from being modified to a less restrictive definition. Is there a workaround for this? Tag: Group policy lock workstation Tag: 27755
 - 19
 - Account Migration Isn't there an easy way to copy all the user accounts from one group in one NT domain to another group in another 2000 active directory? Tag: Group policy lock workstation Tag: 27754
 - 20
 - sysvol replication problems I have 3 win 2003 domain controllers in 3 different sites. One site was continually giving me this error "FRS has failed to add computer %1 to the replica set c:\windows\sysvol \domain ...etc, while the replica DC %2 was giving me Event ID. 13508. I decided to demote DC %1 and then promoted it again. Now I am getting Event ID 13565 on DC %1 and still same Event ID 13508 on DC %2. All other replication is working fine. Some one please help, am getting desperate -- El diri diri kalafala Tag: Group policy lock workstation Tag: 27749
 - 21
 - Cannot create user Hi All, I have a problem with creating user in my AD. when i create the user with username service, it give me the user already exist, please use another user name. But when I search my whole AD, there is no user with the user name service. Can anyone tell me what is happening? thank you. Eng Tag: Group policy lock workstation Tag: 27740
 - 22
 - AD not working, LDAP problem? I have a small domain with a single DC that was recently ugraded from NT4 to win2003 (functional level 2000 native). When I try to join a computer the full DNS domain name I get the following error: /quote/ DNS was successfully queried for the service location (SRV) resource record used to locate a domain controller for domain lnm.bp.sissa.it: The query was for the SRV record for _ldap._tcp.dc._msdcs.full.DNS.name The following domain controllers were identified by the query: myserver.full.DNS.name Common causes of this error include: - Host (A) records that map the name of the domain controller to its IP addresses are missing or contain incorrect addresses. - Domain controllers registered in DNS are not connected to the network or are not running. For information about correcting this problem, click Help. /unquote/ The DC is also the DNS server, it registers AD-specific records (as the error itself hints), himself and clients correctly. I can nslookup myserver without problems. It is certainly online and functional: I can add computers to the domain if I use the netbios name of the domain. IOW the most common causes of this error are not my case. To me it looks like LDAP queries do not work, I can search AD from the DC but not from clients; furthermore, client PCs will show some other problems that IMNSHO can all be explained with LDAP failures. Any idea to fix it up? Thanks, ----------------------- Sergio Graziosi Neurobiology Sector SISSA/ISAS Trieste Tel: +39/040/3787256 www.sissa.it/~graziosi ----------------------- Tag: Group policy lock workstation Tag: 27737
 - 23
 - Restore a 2003 server with AD Hi! We had a disk crash on our single 2003 server with AD. How do I restore it from tape? We have fullbackup with systemstate (ntbackup). Do I first install a standard 2003 without AD and then restore from tape? Please help! Tomppa Tag: Group policy lock workstation Tag: 27736
 - 24
 - Backup users in AD I want to back up only the users and policies for my domain without a system state backup or any other information. I want to be able to rebuild the machine from scratch and import the users and policies but nothing else so that i know all the settings are at their defaults other then what i changed during isntall/config. Can this be done? -Nathan Stansell Tag: Group policy lock workstation Tag: 27728
 - 25
 - AD membership Documentation dilemma Our office has a close to 1000 users in AD and often we need to change their network and printer group mappings, which once we do we update the data into a spreadsheet. We have found this very troublesome b/c its a pain constantly trying to keep the Spreadsheet syncrhonised with AD, it can also be a bit of a pain adding alot of users to AD groups since you have to type each one in........or at least have a source from where we can copy. Is anyone in the same boat where they are having problems keeping their AD and documentation in sync. We were thinking of where we can 1. have an export of all AD groups and members regularly, and 2. in one of the spreadsheets have an interface where we can type the AD group name, input the members and it'll automatically update the data into AD..... but were not sure where to start from..... anyone have any pointers or any best practice solutions for keeping their AD and group membership doco up to date!!! Any help appreicated.......... Zeno Tag: Group policy lock workstation Tag: 27722

I would like to make a group policy to lock the workstation if it is in
active for 15 minutes. I don't want to want the user to lose any work they
are working on, just want to lock the workstation and then they will have to
log back in.

Top

Re: Group policy lock workstation by Lanwench

Lanwench
Sat Mar 19 23:43:51 CST 2005

Network Jeff wrote:
> I would like to make a group policy to lock the workstation if it is
> in active for 15 minutes. I don't want to want the user to lose any
> work they are working on, just want to lock the workstation and then
> they will have to log back in.

Set a password protected screensaver.

Top

Re: Group policy lock workstation by Chriss3

Chriss3
Sun Mar 20 10:24:19 CST 2005

Hello,
Configure the follow Group Policy Settings.

User Configuration\Administrative Templates\Control Panel\Display\Screen
Saver [Enable]

User Configuration\Administrative Templates\Control Panel\Display\Password
protect the screen saver

User Configuration\Administrative Templates\Control Panel\Display\Screen
Saver timeout

--
Regards
Christoffer Andersson
Microsoft MVP - Directory Services

No email replies please - reply in the newsgroup
------------------------------------------------
http://www.chrisse.se - Active Directory Tips

"Lanwench [MVP - Exchange]"
<lanwench@heybuddy.donotsendme.unsolicitedmail.atyahoo.com> skrev i
meddelandet news:%23Wtf8$QLFHA.1308@TK2MSFTNGP15.phx.gbl...
> Network Jeff wrote:
>> I would like to make a group policy to lock the workstation if it is
>> in active for 15 minutes. I don't want to want the user to lose any
>> work they are working on, just want to lock the workstation and then
>> they will have to log back in.
>
> Set a password protected screensaver.
>
>

Top

Re: Group policy lock workstation by Allen

Allen
Mon Mar 21 02:15:15 CST 2005

good ,thaks for reply. i should be study it again. i think i will remember
it.
"Lanwench [MVP - Exchange]"
<lanwench@heybuddy.donotsendme.unsolicitedmail.atyahoo.com> wrote in message
news:%23Wtf8$QLFHA.1308@TK2MSFTNGP15.phx.gbl...
> Network Jeff wrote:
>> I would like to make a group policy to lock the workstation if it is
>> in active for 15 minutes. I don't want to want the user to lose any
>> work they are working on, just want to lock the workstation and then
>> they will have to log back in.
>
> Set a password protected screensaver.
>
>

Top