Marcus Hall

User Tools

Site Tools

Trace:
software:microsoft:windows:activedirectory

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
software:microsoft:windows:activedirectory [2015/08/02 02:59] – superwizardsoftware:microsoft:windows:activedirectory [2026/08/13 18:59] (current) – [Active Directory] superwizard
Line 1: Line 1:
 +====== Active Directory ======
 +
 +-------------------------------------------------------------------------------------------------------------------------------------------------\\
 +
 +====== Active Directory Group policy ======
 +Active Directory Group policy, we created a group policy for the entire domain. We defined: Computer Configuration, Policies, Windows Settings, Security Settings, Local Policies, Security Options, interactive logon: Message Text for users attempting to log on and interactive logon: Message title for users attempting to log on
 +
 +The message should appear **before the user enters Windows credentials**, not after reaching the desktop. On a typical Windows 10/11 console:
 +
 +  - Start or restart the computer.
 +  - Dismiss the initial lock screen or press Ctrl+Alt+Delete, if required.
 +  - The legal-notice dialog appears.
 +  - The user must click **OK**.
 +  - Windows then presents the normal username/password/PIN sign-in screen.
 +
 +It generally does **not** appear when merely unlocking an already signed-in session. Test using a full restart or sign-out, preferably from the computer’s physical console. Microsoft describes it as a dialog displayed before users can sign in. ([[https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on|Microsoft policy documentation]])
 +
 +===== Test it on one affected computer =====
 +
 +Open **Command Prompt as Administrator** and run:
 +
 +<code cmd>
 +gpupdate /target:computer /force
 +</code>
 +
 +Confirm that it reports:
 +
 +<code>
 +Computer Policy update has completed successfully.
 +</code>
 +
 +Then restart—not merely lock—the computer:
 +
 +<code cmd>
 +shutdown /r /t 0
 +</code>
 +
 +Test the next sign-in from the local console.
 +
 +===== Verify the resulting registry values =====
 +
 +After the policy refresh, run this in an elevated Command Prompt:
 +
 +<code cmd>
 +reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v LegalNoticeCaption
 +reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v LegalNoticeText
 +</code>
 +
 +You should see your configured title and message. These are the effective Windows settings:
 +
 +^ Policy        ^ Registry value       ^
 +| Message title | ''LegalNoticeCaption'' |
 +| Message text  | ''LegalNoticeText''    |
 +
 +If both values contain the expected text, Windows has received the setting. Restart and test at the console.
 +
 +If they are missing, empty, or contain different text, the GPO is not applying as intended or another policy is overriding it.
 +
 +===== Confirm that the GPO applies to the computer =====
 +
 +Because these settings are under **Computer Configuration**, they apply according to the location and permissions of the **computer account**, not the user account.
 +
 +Create a Group Policy Results report:
 +
 +<code cmd>
 +mkdir C:\Temp
 +gpresult /scope computer /h C:\Temp\ComputerPolicy.html
 +start C:\Temp\ComputerPolicy.html
 +</code>
 +
 +In the report, examine:
 +
 +  * **Applied Group Policy Objects** — your legal-notice GPO should be listed.
 +  * **Denied Group Policy Objects** — look for security filtering, WMI filtering, or other denial reasons.
 +  * The resulting settings under:
 +  ''Computer Configuration → Windows Settings → Security Settings → Local Policies → Security Options''
 +
 +Microsoft recommends ''gpresult'' for viewing the full resulting policy set because ''rsop.msc'' does not necessarily display every setting. ([[https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/gpresult|Microsoft gpresult documentation]], [[https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/use-resultant-set-of-policy-logging|Microsoft RSoP guidance]])
 +
 +For a quick text-only check:
 +
 +<code cmd>
 +gpresult /r /scope computer
 +</code>
 +
 +===== Check the GPO itself =====
 +
 +In **Group Policy Management**, verify all of the following:
 +
 +  - The GPO is actually **linked** to the domain or an OU containing the affected computer accounts.
 +  - The link is enabled.
 +  - **Computer Configuration Settings** are not disabled.
 +  - Security filtering permits the computer to **Read** and **Apply Group Policy**.
 +  - A WMI filter is not excluding the computer.
 +  - The computer’s OU does not have **Block Inheritance** enabled.
 +  - Another GPO linked closer to the computer’s OU is not replacing the title or message with blank values.
 +
 +A common source of confusion is **GPO Status: Enabled**. That status only means the GPO’s Computer and User sections are available for processing. It does **not** prove that the GPO is linked, within scope, permitted by security filtering, or applied to a particular computer.
 +
 +===== If it still does not apply =====
 +
 +Check the client’s Group Policy operational log:
 +
 +<code>
 +Event Viewer
 +  Applications and Services Logs
 +    Microsoft
 +      Windows
 +        GroupPolicy
 +          Operational
 +</code>
 +
 +Look for errors at the time you ran ''gpupdate''.
 +
 +Since three weeks have passed, this is not an ordinary refresh-delay problem. Computer policy normally refreshes approximately every 90 minutes plus a randomized interval and is also processed at startup. The most likely causes are an incorrect link/scope, security filtering, blocked inheritance, or another higher-precedence GPO overriding the values. ([[https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-processing|Microsoft Group Policy processing documentation]])
 +
 +====== Configure Microsoft Entra hybrid join ======
 +
 +<WRAP center round box >
 +Bringing your devices to Microsoft Entra ID maximizes user productivity through single sign-on (SSO) across your cloud and on-premises resources. You can secure access to your resources with Conditional Access at the same time.
 +
 +https://learn.microsoft.com/en-us/entra/identity/devices/how-to-hybrid-join
 +
 +</WRAP>
 +
 +
 +====== Viewing the active Directory with ADSIEDIT.MSC ======
 +
 +http://forums.msexchange.org/m_1800466536/mpage_1/key_/tm.htm#1800466536
 +
 +Active Directory Search Expression = http://msdn.microsoft.com/en-us/library/ms675768%28v=vs.85%29.aspx
 +
 +Also: http://technet.microsoft.com/en-us/library/ee198834.aspx
 +
 +====== List Active Directory Email Addresses ======
 +
 +dsquery user -limit 0 | dsget user -ln -fn -email >employee-list.txt
 +
 +ADSIEdit:
 +
 +http://exchangeinbox.com/article.aspx?i=73
 +
 +File: ListEmailAddresses.zip
 +
 +http://exchangepedia.com/2005/09/how-to-export-all-email-addresses-from-a-domain.html
 +
 +Control Panel's Administrator Tool called Active Directory Users and Computers
 +
 +http://www.cmsconnect.com/praetor/webhelpg2/chapter_7_-_log_viewer/ad_export_users.htm
 +
 +If all you want is the primary SMTP address then the following will do the trick:
 +
 +http://www.petri.co.il/forums/showthread.php?t=7690
 +
 +Another Script
 +
 +http://forums.techarena.in/active-directory/64389.htm
 +
 +
 +
 +http://www.msexchange.org/articles_tutorials/exchange-server-2007/management-administration/uncovering-new-export-list-feature-exchange-server-2007-service-pack1.html
 +
 +
 +
 +
 +====== Server4 Aphelian Connection to Active Directory ======
 +
 +  Host info
 +  Name: activedirectory
 +  Host: etspowergroup.local
 +  Port: 389
 +  Version: 3
 +  Base DN: DC=ETSPowerGroup,DC=local
 +  
 +  User Info
 +  User DN: Matthew Jados,CN=Users,DC=ETSPowerGroup,DC=local
 +  Password: 
 +
 +====== Mac OS/Linux/Windows Single Sign-On ======
 +
 +http://weblog.bignerdranch.com/?p=6
 +
 +====== Well Known Security Identifiers ======
 +
 +From: https://support.microsoft.com/en-us/help/243330/well-known-security-identifiers-in-windows-operating-systems
 +
 +<code>
 +SID: S-1-5-11
 +Name: Authenticated Users
 +Description: A group that includes all users whose identities were authenticated when they logged on. 
 +Membership is controlled by the operating system.
 +</code>
 +
 +====== Computer login ======
 +<WRAP center round box >
 +
 +2022-04-05
 +
 +Deny User or Group to Sign in Locally in Windows 10
 +
 +From <https://winaero.com/deny-user-group-sign-in-locally-windows-10/> 
 +
 +
 +From: https://community.spiceworks.com/topic/216823-implications-of-removing-nt-authority-authenticated-users-user-from-users-list
 +
 +Andre Canis
 +Jalapeno
 +Best Answer
 +Andre Canis Apr 17, 2012 at 6:08 AM 
 +A better way would be to do it in the security policy (secpol.msc)
 +
 +Security Settings > Local Policies > User Rights Assignments > **Allow log on locally**.\\ 
 +Remove the "Users" group from this policy and\\ 
 +add those users you want to allow to log on.
 +
 +From: https://community.spiceworks.com/topic/199167-active-directory-2008-r2-control-user-login-to-computer
 +
 +ChristopherO
 +Mace
 +ChristopherO Feb 15, 2012 at 6:54 AM \\ 
 +You could certainly do this in 2003.\\ 
 +If you want to be granular, you will need to update the Users group on each computer\\ 
 +- remove Domain Users and add in the specific accounts/groups that can log into that computer.\\ 
 +If it's going to be the same for a large number of computers (ie, users in the Sales group can log into any computer in the Sales department) you can use Restricted Groups in Group Policy - just remember, with Restricted Groups it will remove ALL other users/groups from that local computer group and ONLY allow in what you set in the policy.
 +
 +From: https://community.spiceworks.com/topic/338040-how-to-stop-domain-users-from-logging-into-my-pc
 +
 +From: https://community.spiceworks.com/topic/126427-restrict-certain-users-from-login-on-certain-computers
 +
 +From: http://windowsitpro.com/security/restricting-interactive-user-logons
 +
 +</WRAP>
 +
 +====== Remote Login Active Directory ======
 +
 +Local Secpol.msc security "Allow login Through Terminal Services"
 +
 +
 +====== PowerBroker Identity Services ======
 +
 +From: http://www.powerbrokeropen.org/
 +Download: http://download1.beyondtrust.com/Technical-Support/Downloads/PowerBroker-Identity-Services-Open-Edition/?Pass=True
 +
 +linux login active directory
 +
 +<code>
 +RE:[linuxadmin-l] Centralized Login Solution For All The Linux And AIX
 +Inbox
 +JJ_AIX
 +Reply from JJ_AIX on Sep 14 at 4:03 PM Thanks guys , I appreciate it , I saw ...
 +2:34 PM (22 hours ago)
 +nawzs-se
 +12:55 AM (12 hours ago)
 +
 +Reply from nawzs-se on Sep 15 at 12:49 AM
 +Well, Powerbroker Open is free, if you can manage without a support agreement. .. 
 +It'll take care of the unified logon, the paid version can also handle GPOs for your linux and unix systems. 
 +On the other hand, we use sssd and that one works well too. 
 +One small but important difference between the two setups is that with sssd (or nslcd) you need to set the unix attributes in your ldap directory ( such as uid,gid,unixhome and loginshell). If you go with Powerbroker it'll take care of that for you by hashing the SIDs for uid, gid and assigning defaults for the rest. Defaults are customizable.
 +</code>
 +
 +
 +
 +
 +====== rd-gateway-ports-and-certificates ======
 +
 +From: https://social.technet.microsoft.com/Forums/windowsserver/en-US/a241a5be-e39d-4dfc-a513-e4f83c4dc906/rd-gateway-ports-and-certificates?forum=winserverTS
 +
 +<code>
 +In this deployment, RD Gateway needs the ports to be opened on the internal firewall for the following purposes:
 +To authenticate users
 +To authorize users
 +To resolve the DSN names of internal resources
 +To forward RDP packets from the client
 +To get the Certificate Revocation List
 +To send RADIUS requests (in a central NPS server scenario)
 +</code>
 +
 +
 ====== ADSI Edit ====== ====== ADSI Edit ======
  
software/microsoft/windows/activedirectory.1438484344.txt.gz · Last modified: by superwizard