Differences

This shows you the differences between two versions of the page.

--- software:microsoft:windows:activedirectory [2015/09/15 17:14] – superwizard
+++ software:microsoft:windows:activedirectory [2026/08/13 18:59] (current) – [Active Directory] superwizard
@@ Line 1: / Line 1: @@
+====== Active Directory ======
+-------------------------------------------------------------------------------------------------------------------------------------------------\\
+====== Active Directory Group policy ======
+Active Directory Group policy, we created a group policy for the entire domain. We defined: Computer Configuration, Policies, Windows Settings, Security Settings, Local Policies, Security Options, interactive logon: Message Text for users attempting to log on and interactive logon: Message title for users attempting to log on
+The message should appear **before the user enters Windows credentials**, not after reaching the desktop. On a typical Windows 10/11 console:
+  - Start or restart the computer.
+  - Dismiss the initial lock screen or press Ctrl+Alt+Delete, if required.
+  - The legal-notice dialog appears.
+  - The user must click **OK**.
+  - Windows then presents the normal username/password/PIN sign-in screen.
+It generally does **not** appear when merely unlocking an already signed-in session. Test using a full restart or sign-out, preferably from the computer’s physical console. Microsoft describes it as a dialog displayed before users can sign in. ([[https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on|Microsoft policy documentation]])
+===== Test it on one affected computer =====
+Open **Command Prompt as Administrator** and run:
+<code cmd>
+gpupdate /target:computer /force
+</code>
+Confirm that it reports:
+<code>
+Computer Policy update has completed successfully.
+</code>
+Then restart—not merely lock—the computer:
+<code cmd>
+shutdown /r /t 0
+</code>
+Test the next sign-in from the local console.
+===== Verify the resulting registry values =====
+After the policy refresh, run this in an elevated Command Prompt:
+<code cmd>
+reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v LegalNoticeCaption
+reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v LegalNoticeText
+</code>
+You should see your configured title and message. These are the effective Windows settings:
+^ Policy        ^ Registry value       ^
+| Message title | ''LegalNoticeCaption'' |
+| Message text  | ''LegalNoticeText''    |
+If both values contain the expected text, Windows has received the setting. Restart and test at the console.
+If they are missing, empty, or contain different text, the GPO is not applying as intended or another policy is overriding it.
+===== Confirm that the GPO applies to the computer =====
+Because these settings are under **Computer Configuration**, they apply according to the location and permissions of the **computer account**, not the user account.
+Create a Group Policy Results report:
+<code cmd>
+mkdir C:\Temp
+gpresult /scope computer /h C:\Temp\ComputerPolicy.html
+start C:\Temp\ComputerPolicy.html
+</code>
+In the report, examine:
+  * **Applied Group Policy Objects** — your legal-notice GPO should be listed.
+  * **Denied Group Policy Objects** — look for security filtering, WMI filtering, or other denial reasons.
+  * The resulting settings under:
+  ''Computer Configuration → Windows Settings → Security Settings → Local Policies → Security Options''
+Microsoft recommends ''gpresult'' for viewing the full resulting policy set because ''rsop.msc'' does not necessarily display every setting. ([[https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/gpresult|Microsoft gpresult documentation]], [[https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/use-resultant-set-of-policy-logging|Microsoft RSoP guidance]])
+For a quick text-only check:
+<code cmd>
+gpresult /r /scope computer
+</code>
+===== Check the GPO itself =====
+In **Group Policy Management**, verify all of the following:
+  - The GPO is actually **linked** to the domain or an OU containing the affected computer accounts.
+  - The link is enabled.
+  - **Computer Configuration Settings** are not disabled.
+  - Security filtering permits the computer to **Read** and **Apply Group Policy**.
+  - A WMI filter is not excluding the computer.
+  - The computer’s OU does not have **Block Inheritance** enabled.
+  - Another GPO linked closer to the computer’s OU is not replacing the title or message with blank values.
+A common source of confusion is **GPO Status: Enabled**. That status only means the GPO’s Computer and User sections are available for processing. It does **not** prove that the GPO is linked, within scope, permitted by security filtering, or applied to a particular computer.
+===== If it still does not apply =====
+Check the client’s Group Policy operational log:
+<code>
+Event Viewer
+  Applications and Services Logs
+    Microsoft
+      Windows
+        GroupPolicy
+          Operational
+</code>
+Look for errors at the time you ran ''gpupdate''.
+Since three weeks have passed, this is not an ordinary refresh-delay problem. Computer policy normally refreshes approximately every 90 minutes plus a randomized interval and is also processed at startup. The most likely causes are an incorrect link/scope, security filtering, blocked inheritance, or another higher-precedence GPO overriding the values. ([[https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-processing|Microsoft Group Policy processing documentation]])
+====== Configure Microsoft Entra hybrid join ======
+<WRAP center round box >
+Bringing your devices to Microsoft Entra ID maximizes user productivity through single sign-on (SSO) across your cloud and on-premises resources. You can secure access to your resources with Conditional Access at the same time.
+https://learn.microsoft.com/en-us/entra/identity/devices/how-to-hybrid-join
+</WRAP>
+====== Viewing the active Directory with ADSIEDIT.MSC ======
+http://forums.msexchange.org/m_1800466536/mpage_1/key_/tm.htm#1800466536
+Active Directory Search Expression = http://msdn.microsoft.com/en-us/library/ms675768%28v=vs.85%29.aspx
+Also: http://technet.microsoft.com/en-us/library/ee198834.aspx
+====== List Active Directory Email Addresses ======
+dsquery user -limit 0 | dsget user -ln -fn -email >employee-list.txt
+ADSIEdit:
+http://exchangeinbox.com/article.aspx?i=73
+File: ListEmailAddresses.zip
+http://exchangepedia.com/2005/09/how-to-export-all-email-addresses-from-a-domain.html
+Control Panel's Administrator Tool called Active Directory Users and Computers
+http://www.cmsconnect.com/praetor/webhelpg2/chapter_7_-_log_viewer/ad_export_users.htm
+If all you want is the primary SMTP address then the following will do the trick:
+http://www.petri.co.il/forums/showthread.php?t=7690
+Another Script
+http://forums.techarena.in/active-directory/64389.htm
+http://www.msexchange.org/articles_tutorials/exchange-server-2007/management-administration/uncovering-new-export-list-feature-exchange-server-2007-service-pack1.html
+====== Server4 Aphelian Connection to Active Directory ======
+  Host info
+  Name: activedirectory
+  Host: etspowergroup.local
+  Port: 389
+  Version: 3
+  Base DN: DC=ETSPowerGroup,DC=local
+  User Info
+  User DN: Matthew Jados,CN=Users,DC=ETSPowerGroup,DC=local
+  Password:
+====== Mac OS/Linux/Windows Single Sign-On ======
+http://weblog.bignerdranch.com/?p=6
+====== Well Known Security Identifiers ======
+From: https://support.microsoft.com/en-us/help/243330/well-known-security-identifiers-in-windows-operating-systems
+<code>
+SID: S-1-5-11
+Name: Authenticated Users
+Description: A group that includes all users whose identities were authenticated when they logged on.
+Membership is controlled by the operating system.
+</code>
+====== Computer login ======
+<WRAP center round box >
+-04-05
+Deny User or Group to Sign in Locally in Windows 10
+From <https://winaero.com/deny-user-group-sign-in-locally-windows-10/>
+From: https://community.spiceworks.com/topic/216823-implications-of-removing-nt-authority-authenticated-users-user-from-users-list
+Andre Canis
+Jalapeno
+Best Answer
+Andre Canis Apr 17, 2012 at 6:08 AM
+A better way would be to do it in the security policy (secpol.msc)
+Security Settings > Local Policies > User Rights Assignments > **Allow log on locally**.\\
+Remove the "Users" group from this policy and\\
+add those users you want to allow to log on.
+From: https://community.spiceworks.com/topic/199167-active-directory-2008-r2-control-user-login-to-computer
+ChristopherO
+Mace
+ChristopherO Feb 15, 2012 at 6:54 AM \\
+You could certainly do this in 2003.\\
+If you want to be granular, you will need to update the Users group on each computer\\
+- remove Domain Users and add in the specific accounts/groups that can log into that computer.\\
+If it's going to be the same for a large number of computers (ie, users in the Sales group can log into any computer in the Sales department) you can use Restricted Groups in Group Policy - just remember, with Restricted Groups it will remove ALL other users/groups from that local computer group and ONLY allow in what you set in the policy.
+From: https://community.spiceworks.com/topic/338040-how-to-stop-domain-users-from-logging-into-my-pc
+From: https://community.spiceworks.com/topic/126427-restrict-certain-users-from-login-on-certain-computers
+From: http://windowsitpro.com/security/restricting-interactive-user-logons
+</WRAP>
+====== Remote Login Active Directory ======
+Local Secpol.msc security "Allow login Through Terminal Services"
 ====== PowerBroker Identity Services ======
 From: http://www.powerbrokeropen.org/
+Download: http://download1.beyondtrust.com/Technical-Support/Downloads/PowerBroker-Identity-Services-Open-Edition/?Pass=True
+linux login active directory
 <code>