#Active Directory Users and Computers (ADUC)

[techdirectarchive]

How to convert distribution group to security group

How to convert distribution group to security group

How to Convert a Distribution Group to a Security Group In Active Directory (AD), distribution groups and security groups serve distinct purposes. Distribution groups are primarily used for email distribution lists, while security groups are used to assign permissions to resources within your network. Converting a distribution group to a security group can be necessary for managing access…

[tuanlinhdt2]

Cách đổi tên user trong Active Directory

Bạn có thể đổi tên tài khoản người dùng trong Active Directory theo một số cách khác nhau. Ví dụ như sử dụng giao diện đồ họa của AD hoặc lệnh PowerShell.

Cách đổi tên Domain User sử dụng Active Directory  

Cách đơn giản nhất để đổi tên người dùng AD là sử dụng Active Directory Users and Computers (ADUC). - Mở bảng ADUC bằng cách chạy lệnh dsa.msc trong CMD; - Tích chọn tùy chọn sau trong menu: View > Advanced Features; - Dùng Active Directory tìm user bạn muốn đổi tên; - Mở bảng user properties rồi nhấn vào tab Object. Tên đầy đủ của người dùng được hiển thị trong trường Canonical name of object. Đây là tên được hiển thị trong bảng điều khiển ADUC và các công cụ Windows và AD khác;

- Để đổi tên user, bạn nhấn phải chuột vào tên người dùng rồi chọn Rename;

- Trong cửa sổ mở ra, bạn có thể thay đổi Full Name (Tên chính tắc của đối tượng), First name, Last name, Display Name, cũng như các thuộc tính userPrincipalName và userlogonname (samAccountName / pre-Windows 2000); - Nhập tên người dùng bạn muốn đổi và nhấn Ok để áp dụng.

Bạn cũng có thể đổi tên người dùng bằng cách chỉnh sửa thủ công các thuộc tính thích hợp trong tab Attribute Editor trong cửa sổ properties của người dùng.

Cách đổi tên User bằng PowerShell?  

Bạn có thể sử dụng lệnh trong PowerShell để đổi tên người dùng trong AD. Các lệnh cơ bản là Rename-ADObject và Set-ADUser. - Rename-ADObject — cho phép bạn thay đổi giá trị của các thuộc tính: cn, DifferentName, name; - Set-ADUser — cho phép bạn thay đổi samAccountName, UPN, given name, surname và other names của người dùng. Nếu bạn muốn đổi tên người dùng sử dụng Rename-ADObject, bạn phải chỉ định DistinguishedName của nó. Ví dụ: Rename-ADObject –identity “CN=Nguyen Van A,OU=Office,OU=User,OU=Sales,DC=blogcntt,DC=com” -NewName "Nguyen Van A" Mẹo: Bạn có thể thêm tham số whatIf vào một lệnh để lấy thông tin về hoạt động mà lệnh đó sẽ thực hiện. Để làm cho lệnh dễ dàng hơn, bạn có thể lấy thông tin của người dùng theo tên hoặc samAccountName bằng lệnh Get-ADUser: Get-Aduser a.nv | Rename-ADObject -NewName "b.nv" Liệt kê các thuộc tính có sẵn và giá trị của chúng: Get-ADUser "Nguyen Van A" | fl *name*

Bạn có thể thay đổi những cài đặt người dùng khác bằng lệnh Set-ADUser. Ví dụ: Get-ADUser b.nv | Set-ADUser –displayname “Nguyen Van B” –SamAccountName b.nv –Surname “B”

Bạn có thể sử dụng lệnh dsmove.exe để đổi tên người dùng. Cú pháp này được sử dụng: dsmove "" -newname "" Ví dụ, Đổi tên của "Nguyễn Van A" thành "Nguyen Van B": dsmove.exe "CN=Nguyen Van A,CN=Office,DC=Users,DC=Sales" -NewName "Nguyen Van B" Read the full article

[enterinit]

Windows Server vNext Preview Build 18917 released

Windows Server vNext Preview Build 18917 released. There also released Windows Admin Center Preview 1906. What’s New: Thanks for staying up-to-date on the Windows Admin Center journey! As our first preview release following the last generally available release in April, Windows Admin Center preview 1906 includes several new preview features: Updates tool: you can now select individual Windows updates to install. Windows Admin Center connectivity settings: We’ve heard from users that are in completely disconnected environments that they would prefer to have a setting in Windows Admin Center where they can specify they are offline, so there will be no notifications about Azure hybrid functionality, extensions updates, or other actions that require public internet access. To give this a try, enter msft.sme.shell.connectivity as an experiment key in Settings-> Development -> Advanced, then visit the new Connectivity settings item. You can select Gateway to restrict online access, or Azure and Gateway if you want to access Azure features only, but nothing else on the public internet. In a future release, this menu item will also provide you with a complete list of URLs so that you can configure your firewall to block all traffic by default and explicitly allow only specific traffic to known services. Virtual machines tool: Import/Export VM – We’ve added Import/Export buttons to the Virtual Machines tool for importing VMs from and exporting VMs to a local volume or remote file share. When importing VMs, you have the option to create a new VM ID, and copy the VM files or use them in-place. When importing a VM and creating a copy of the VM files, if you choose a local volume or cluster shared volume as the destination, it will be saved to the volume’s root folder instead of under the “Hyper-V” folder. This will be fixed in the next release. For now, you can use the Browse button to manually navigate to the actual folder you want to import the VM to. VM tagging – Similar to the UI for tagging connections in Windows Admin Center, you can now tag VMs on a Hyper-V server! In the Virtual machines tool’s Inventory tab, an “Edit tags” button has been added to manage tags. These tags are saved on the Hyper-V host server and can be accessed by other admins. VM tagging is not supported in the Failover Cluster or Hyper-Converged Cluster UI yet. Tags will not show up in the clustered VM view and managing tags from this view may unintentionally overwrite or delete existing tags. Performance improvements – Significant performance improvements have been made to reduce page load time in the Virtual machines tool. Improvements to Azure integration functionality: The Azure Hybrid services tool now loads content from a feed, so that new services can be added at any time without an update of the entire tool.From the Account menu in setting, you can now switch between multiple Azure accounts.When adding a server or Windows PC to your connection list, you have a new option to log in to Azure and browse your Azure resources for the specific server or PC. At this time, Windows Admin Center only enumerates your Azure resources, but cannot guarantee connectivity. Windows Admin Center ecosystem developers: you’ll find a new menu item: Performance Profile, in the Windows Admin Center settings under the Development heading. This new tool will record your browsing session, tracking the times of each request and page load, so that you can identify opportunities to improve performance. Known issues -Windows Admin Center Preview 1906 Network – If you have configured an Azure Network Adapter, the value under Microsoft Azure Virtual Network Gateway Address will be formatted as a hyperlink but leads to an invalid address. Azure Update Management onboarding – If you have already installed the MMA agent, or install the agent using the new integration for Azure Monitor, you will not be able to onboard the server to Azure Update Management through the UI in Windows Admin Center. If Azure Update Management is already configured (whether through Admin Center or another way), you can still onboard the server to the Azure Monitor Virtual Machines Insights solution using the Windows Admin Center UI.Chrome users may see 403 Forbidden response from WAC after upgrading. The workaround is to close *all* open chrome tabs (make sure there are no chrome.exe processes running). After restarting chrome, everything will function normally. We have an error message that makes this clear, but chrome users with multiple windows admin center tabs open during upgrade will not see the message. Windows Server Bug Fixes Fixed an issue where a local user’s last logon time output from “net user username” may not be recorded even when the user has accessed the server’s network share.Fixed an issue when attempting to update Server Standard to Server Datacenter, results in error “Error: 1168. An error occurred while applying target edition component setting. The upgrade cannot proceed.”Fixed an issue when domain trust was broken when the recycle bin configured on the domains carrying the trust.Fixed an issue where an invalid file was being created in %Systemroot%\System32\LogFiles\Sum by User Access Logging. Windows Server Known Issues Using ntdsutil.exe to move of the Active Directory database files may fail with error: “Move file failed with source and Destination with error 5 (Access is denied.)”Auto-logon configured by login scripts may fail to work properlyStatus of online/offline files icon and status bar may not display an accurate status. OfflineFiles event manager logs will show the actual state of the files.PowerShell may report an incorrect NdisPhysicalMedium result on IPoIB adapterApplies to App Compat FOD MMC.exe only: Multiple Active Directory Users and Computers snap-ins added to the same MMC.exe instance could show inconsistent or no data on part of the snap-ins after adding extra columns to the UI view.  Wokaround: for UI user management, use a separate MMC for each ADUC (DSA.MSC) snap-in.Scheduled startup tasks may fail to run. An event is logged, ID 101 with the error code ERROR_LOGON_FAILURE when the failure occurs.DCPromo fails if the interface metric of the physical NIC is larger than Loopback InterfaceRenaming a domain controller may update incorrect attributes in Active Directory (msDS-AdditionalDnsHostName, msDS-AdditionalSamAccountName and servicePrincipalName attributes) leaving orphaned data behind (ValidateSPNsAndDNSHostNameActual)Domain Controller rename updates incorrect attributes in AD leaving orphaned data behind (ValidateSPNsAndDNSHostNameActual).  This can be reproduced by adding a new FQDN, setting it as primary, restarting the domain controller, then removing the current FQDN.  Checking the msDS-AdditionalDnsHostName, msDS-AdditionalSamAccountName and servicePrincipalName attributes will incorrect values.Self-service users cannot install Feature on Demand (FOD) packages and Language Packs for Windows Server Update Service (WSUS), System Center Configuration Manager (SCCM), and Autopilot scenarios.After disabling and re-enabling SR-IOV capability on a NIC on Linux VM, Windows may report “Error applying Network Adapter changes.” Details will show “The Hyper-V Virtual Machine Management service encountered an unexpected error: Call was canceled by the message filter. (0x80010002).”  A side effect of this failure is that the VM will remain in a stopping state when shutting down the VM, and cannot be restarted without a power resetWhen deploying a controller VM, after the last reboot in the deployment process the controller VM is not visible. Read the full article

[allautomaticsystematic]

Active Directory - Saved Queries (ADUC MMC)

Active Directory Users and Computers provides a Saved Queries folder in which administrators can create, edit, save, and organize saved queries. Before saved queries, administrators were required to create custom ADSI scripts that would perform a query on common objects. from Pocket https://ift.tt/2TAwBOO via IFTTT

[softlookup]

Exchange Tasks 2013 1.4.1608.2400

Exchange Tasks 2013 : Easily turn your Active Directory users and computers (ADUC) console into a powerful and reliable management tool for Microsoft Exchange source https://www.softlookup.com/display.asp?id=274934

[techdirectarchive]

How to change Active Directory Group Scope

How to change Active Directory Group Scope

How to Change Active Directory Group Scope Active Directory (AD) groups are essential for managing permissions and access within an organization’s IT environment. The group scope defines how permissions and memberships are applied and propagated across domains and forests. There are three types of group scopes: Universal, Global, and Domain Local. Each has its own characteristics and use cases.…

[techdirectarchive]

Faulting Application Name: mmc.exe: Unable to launch ADUC

In this article, we shall discuss how to fix “Faulting application name: mmc.exe: Unable to launch ADUC (Active Directory User and Computer) “. The application mmc.exe may be faulty when using Active Directory Users and Computers for various reasons such as corrupted system files, incompatible third-party software, insufficient system resources, misconfigured group policies, or issues with the…

[enterinit]

Windows Server vNext Insider Preview Build 18356.1 released

Windows Server vNext Insider Preview Build 18356.1 released. No new features in this build. Windows Server Known Issues Error after remoting to machine with RDP post FOD installation.  The error message indicates immediately that the remote session has ended with potential reasons, followed by a black RDP screen. This only impacts remoting to a physical machine with Server Core + FOD. Applies to App Compat FOD MMC.exe only: Multiple Active Directory Users and Computers snap-ins added to the same MMC.exe instance could show inconsistent or no data on part of the snap-ins after adding extra columns to the UI view.  Wokaround: for UI user management, use a separate MMC for each ADUC (DSA.MSC) snap-in. A local user’s last logon time output from “net user username” may not be recorded even when the user has accessed the server’s network share. Scheduled startup tasks may fail to run. An event is logged, ID 101 with the error code ERROR_LOGON_FAILURE when the failure occurs. A virtual machine may not report all virtual fibre channel (vfc) LUNs after powering on if there are 2000+ vfc LUNs. WMI queries from the host show the LUNS available.  Restarting the VMMs may show the LUNS again as available. DCPromo fails if the interface metric of the physical NIC is larger than Loopback Interface Third-party password filter dlls may not be notified when the local Administrator account’s password was changed. Attempting system image recovery from an image located on a network share may result in error “A specified logon session does not exist. It may already have been terminated”. Server FODs are not retained after in-place (or B2B) upgrade. Domain Controller rename updates incorrect attributes in AD leaving orphaned data behind (ValidateSPNsAndDNSHostNameActual).  This can be reproduced by adding a new FQDN, setting it as primary, restarting the domain controller, then removing the current FQDN.  Checking the msDS-AdditionalDnsHostName, msDS-AdditionalSamAccountName and servicePrincipalName attributes will incorrect values. Invalid file may be created in %Systemroot%\System32\LogFiles\Sum by User Access Logging Self-service users cannot install Feature on Demand (FOD) packages and Language Packs for Windows Server Update Service (WSUS), System Center Configuration Manager (SCCM), and Autopilot scenarios. A container host may become unresponsive due to a deadlock when attempting to mount a volume. On an affected system, Docker hangs on all commands. When a Windows Defender Application Guard container crashes, the resulting type of dump may be unexpected. Read the full article

[enterinit]

Windows Server Insider Preview Build 18346 released

Windows Server Insider Preview Build 18346 released. Server Core App Compatibility feature on demand (FOD): The Server Core App Compatibility FOD was new in Windows Server 2019 and Windows Server, version 1809.  We are continuing investment in the App Compatibility FOD based on customer and Insider feedback. New in this Insider release for App Compatibility FOD: Hyper-V Manager (Virtmgmt.msc) Create and connect to VMs hosted on Server Core + the App Compatibility FOD!! Task Scheduler (Taskschd.msc) Please try it and let us know!  More to come…. Available Content Windows Server vNext Semi-Annual Preview The Server Core Edition is available in the 18 supported Server languages in ISO format and in English only in VHDX format. Windows Server Core App Compatibility FoD Preview Windows Server Language Packs Windows Admin Center 1902 The following keys allow for unlimited activations of Windows Server Previews Server Standard: V6N4W-86M3X-J77X3-JF6XW-D9PRV Server Datacenter: B69WH-PRNHK-BXVK3-P9XF7-XD84W This Windows Server Preview will expire July 5th, 2019. Windows Server Bug Fixes We fixed an issue where RDP to ServerCore and ServerACore SKU’s did not work. Windows Server Known Issues (New) Error after remoting to machine with RDP post FOD installation.  The error message indicates immediately that the remote session has ended with potential reasons, followed by a black RDP screen. This only impacts remoting to a physical machine with Server Core + FOD. (New) Applies to App Compat FOD MMC.exe only: Multiple Active Directory Users and Computers snap-ins added to the same MMC.exe instance could show inconsistent or no data on part of the snap-ins after adding extra columns to the UI view.  Wokaround: for UI user management, use a separate MMC for each ADUC (DSA.MSC) snap-in. A local user’s last logon time output from “net user username” may not be recorded even when the user has accessed the server’s network share. Scheduled startup tasks may fail to run. An event is logged, ID 101 with the error code ERROR_LOGON_FAILURE when the failure occurs. A virtual machine may not report all virtual fibre channel (vfc) LUNs after powering on if there are 2000+ vfc LUNs. WMI queries from the host show the LUNS available.  Restarting the VMMs may show the LUNS again as available. DCPromo fails if the interface metric of the physical NIC is larger than Loopback Interface. Third-party password filter dlls may not be notified when the local Administrator account’s password was changed. Attempting system image recovery from an image located on a network share may result in error “A specified logon session does not exist. It may already have been terminated” Server FODs are not retained after in-place (or B2B) upgrade. Domain Controller rename updates incorrect attributes in AD leaving orphaned data behind (ValidateSPNsAndDNSHostNameActual).  This can be reproduced by adding a new FQDN, setting it as primary, restarting the domain controller, then removing the current FQDN.  Checking the msDS-AdditionalDnsHostName, msDS-AdditionalSamAccountName and servicePrincipalName attributes will incorrect values. Invalid file may be created in %Systemroot%\System32\LogFiles\Sum by User Access Logging. Self-service users cannot install Feature on Demand (FOD) packages and Language Packs for Windows Server Update Service (WSUS), System Center Configuration Manager (SCCM), and Autopilot scenarios. A container host may become unresponsive due to a deadlock when attempting to mount a volume. On an affected system, Docker hangs on all commands. When a Windows Defender Application Guard container crashes, the resulting type of dump may be unexpected. Read the full article