Some notes from work
When replacing an domain controller you might need to reuse computer name of the old domain controller. To do that you can create an DNS alias for it. If you for some reason you want to change computer name to the alias you need to run Reboot server for the name change to take effect… Continue Reading Add DNS alias for Domain Controller
After enabling auditing for event 4688, see post about auditing Microsoft AD DS(TBD). You can collect logs to see cmd activity for a user. I have wrote this powershell function little quick to help me out with this. But I do recommend an greylog for this purpose.
After enabling auditing for event 4624, see post about auditing Microsoft AD DS(TBD). You can collect logs to see login activity for a user. I have wrote this powershell function little quick to help me out with this. But I do recommend an greylog for this purpose.
if an Certificate Template has enabled Publish certificate in Active directory it will publish the certificate in an attribute on the user object. This usally is not requiered to do and it might cause some problems. To find what account that has certificate published to their user object run following oneliner.
Some times for some reason this issue occure. It can be a pain because when google on it you be adivsed to follow steps that will remove the computer from domain and then rejoin. You do not always want to do that. It is much easier to just reset the password for the computer object.… Continue Reading The trust relationship between this workstation and the primary domain failed