System Admin

Re: Same user name but difference SID

10-Nov-09 16:21

Hi, As far as I know, windows grant the permission to the file on the server based on the SID of the user account.

But my laptop that join to the domain which already has the local user account and password that the same as the domain user account and password when it mapped the network drive, it could map successfully and could do anything as the permission which is grant to my domain user account.

Why this is possible while the SID of my domain user account is difference with the SID of my local user account?

Thank in advance!!!

Dave Kreskowiak16-Nov-09 5:06

Dave Kreskowiak

16-Nov-09 5:06

Mapping drive doesn't use a SID. It uses a username and password which can be the same between two accounts in different SAMs. When you mapped the drive, you did so using the account in the domain SAM and not the local account.

Other than that, your description of the circumstances isn't entirely clear.

A guide to posting questions on CodeProject[^]

Dave Kreskowiak
Microsoft MVP
Visual Developer - Visual Basic
2006, 2007, 2008
But no longer in 2009...

Setting up domain controller and Active Directory on a Virtual PC.

Brady Kelly8-Nov-09 8:21

Brady Kelly

8-Nov-09 8:21

I would like to set up an environment where I have a primary domain controller and AD on a VPC, and then authenticate to that domain from my VPC host, which plays the role of a workstation.

How can I go about this? I am running SBS 2003 as the guest VPC

Re: Setting up domain controller and Active Directory on a Virtual PC. [modified]

Zach Burnett9-Nov-09 3:51

Zach Burnett

9-Nov-09 3:51

I'm not 100% sure, but I think you may need a second DC off that host. If the host goes down, it will not be able to authenticate to the DC because the DC went down with it. With a second DC off the host the host will be able to authenticate to the backup, which will be a copy of the primary DC.

edit: After looking around a bit I found this http://technet.microsoft.com/en-us/library/dd239199(WS.10).aspx[^]. It shows the best practices of 2008 but the principles filter down to 2003.

AD Best Practices wrote:
2003 Do not join the instance of Windows Server 2008 that is running on the parent partition to the Windows SBS 2008 domain.

If you install the primary and second servers on virtual machines on a single physical computer, and you join the instance of Windows Server 2008 that is running on the parent partition to the Windows SBS 2008 domain, a cyclic dependency is created between the parent and child partitions. If this occurs, the domain controller on the virtual machine is unavailable, and it can become more difficult to manage the parent operating system. However, you can mitigate this issue if you have an additional Active Directory domain controller on a different physical computer in the domain. In this case, you can join the parent partition to the domain.

/edit

Zach

modified on Monday, November 9, 2009 10:00 AM

connection lost on windows lock

cofi++2-Nov-09 4:03

cofi++

2-Nov-09 4:03

hi i just formated my pc and installed WinXP sp3. now when i lock my comp. (Windows + L) or (ctrl + alt + del) it loses connection (LAN). is there any registry hack or something else because it didn't do this before formating?

On Win 2K & IIS 5.0 hangs : Request for reslolution

ptr_Electron28-Oct-09 21:19

ptr_Electron

28-Oct-09 21:19

I have a client server applicaion. on the server side it uses ISAPI.dll and ilaServer.exe on windows 2000 server with IIS 5.0
build in C++

for some reasons the IIS hangs. and the IIS need to be restarted to set back to work.

I want to know the root cause for this hangs, and analyse the problem and reslove it.

source was in VS 2005. I tried using Dr. Watson Dumps

And tried to analise it in VS 2005, but it is not compatable (VS says it is old version of dump file )

Can you pls help & advice

Prevent of reset built-in admin user account

Mekong River27-Oct-09 17:21

27-Oct-09 17:21

Hi, how could we disable other created admin user account to reset the password of built-in admin user account in windows xp?

Thank in advance!!!

Indivara30-Oct-09 5:06

30-Oct-09 5:06

What do you mean? Disabling other admin accounts won't affect the built-in administrator.

Mekong River31-Oct-09 5:27

31-Oct-09 5:27

I mean when I create the other admin account for the other user, they usually reset my built-in admin account. What I prefer is not allow them to reset my admin account while they still have the other right to perform my system.

Please let me know if you still unlear about this point.

Indivara1-Nov-09 2:00

1-Nov-09 2:00

Oh you mean a human is changing the password...
Do the other users need administrative privileges? Can't they operate as standard users?
(Just to check the obvious solution)

Strictly speaking, there is really no certain way of preventing people from resetting the password if they have physical access to the machine. Utilities like this[^] make it quite simple.

-- edit --
I dug around the security policies, but there seems to be no way of doing what you want. Anyway, even if you did restrict it by a security policy, anyone in the administrators group can remove the policy.

One idea is to rename the administrator account, to make it hard to identify.
Go to Administrative Tools -> Local Security Policy
Inside Local Policies -> Security Options, there is an option to rename the administrator account. Set it to something like Jack, or whatever will pass as a regular user there.
Of course, this will only make it a little difficult, anyone can check the same setting.

The best way is not to add anyone to the administrators group, and fix whatever doesn't run as a regular user. Or tell them not to touch the admin account...

Mekong River1-Nov-09 3:42

1-Nov-09 3:42

Indivara wrote:
Oh you mean a human is changing the password...
Do the other users need administrative privileges? Can't they operate as standard users?

Yes, the human change the password. He was grant the administrator privileges because of the management team decide so based on his task. So it is ok if he just his task. But that is not enough. He change my built-in administrator password which it mean like steal my identiy to do something. I still be able to reset it back because I'm the enterprise admin but this problem cause me a lot of time to monitor it. That is why I just want to give him an admin privileges but not allow him to reset my admin password.

Indivara wrote:
One idea is to rename the administrator account, to make it hard to identify.
Go to Administrative Tools -> Local Security Policy
Inside Local Policies -> Security Options, there is an option to rename the administrator account. Set it to something like Jack, or whatever will pass as a regular user there.

Well this is not solve my problem. Since he as an admin priviledge, it is very easy for him to view admin account name and especially reset an admin account password.

Now I might set the auditing on account management policy to determine when he reset the user account of my built-in admin account.

Thank for your idea!!!

Indivara1-Nov-09 13:50

Exchange Server Transition

1-Nov-09 13:50

You are welcome!

As I said earlier, it is probably better to ask the person concerned not to reset the password. Using auditing to monitor him is a good idea...

MWRivera27-Oct-09 15:34

MWRivera

27-Oct-09 15:34

Hi All,

I'm new to the Exchange Server and at the moment I'm researching options for transitioning Exchange server 2000, so at this point I'm looking at 2003 or 2007 (we aren't wanting to consider 2010 even though it could be released by the time we are ready to carry the transition out, due to the bugs new software usually come with).

Please could you give me some pointers on what I should be looking for? What should I be comparing e.g. number of storage groups/databases?

It seems to me that 2007 is the obvious choice but why 2007 over 2003?

Are there guidelines I should follow, information on the existing system I need to gather?

Any help/advice on this would be really appreciated.

Thanks,

MWRivera

Re: Exchange Server Transition

Jörgen Andersson31-Oct-09 5:45

Jörgen Andersson

31-Oct-09 5:45

That's a slightly large subject to reply on.
I usually find that Slipstick[^] has the info or articles I need on the subject though.

FTP UPLOAD SCRIPT

sris 42627-Oct-09 5:50

sris 426

27-Oct-09 5:50

I need a script to upload a file to an FTP server on a daily basis. The code can be in VB Script or Active-X or DOS commands in batch file. I can use window's scheduler to run that script daily. The FTP Server will have user name, pw to upload files.

Please help me in above regard.

Thanks in advance
Srinivas Mateti

Re: FTP UPLOAD SCRIPT

Indivara31-Oct-09 4:20