joeware - never stop exploring... :)

Ever hear that one? Of course the problem is that some user was granted admin on their laptop and they went and did something silly with that power and then when they try to hook back up to work they realize they don’t have the necessary rights to fix it…

That seems to be a common issue in the newsgroups and my response to those folks if I respond at all is that they need to contact their admins and hopefully they learned a valuable lesson. And if admins ask how they can stop that behaviour I usually say “stop giving out admin rights!”. Of course we all know that latter item is MUCH easier to say than do with the plethora of poorly behaving apps, etc out there.

Well I was chatting with some very bright IT people this week and one of them pointed out another solution that they implemented at their company and I thought it was so slick I wanted to share it… It doesn’t block everything that could be used but it blocks the main front door that is used by most folks who hurt themselves…

Normally most folks are CLI challenged so always use the GUI to change their domain. They do this by right clicking My Computer and selecting Properties and then you get a nice dialog something like…

Then you click on the tab labeled Computer Name and see this…

Well… You can stop that dead in its tracks… The DLL that controls that tab is called c:\windows\system32\netid.dll, something I never personally had to go figure out as I am not a client person. The interesting thing is that if you lock that DLL down, you can make it so that tab doesn’t show up. So say you do something like set an ACE on the ACL of that DLL to DENY Everyone Full Control. What happens?

This is what happens

Cool huh? Front door closed. If you have a script or other process that handles all of the domain join stuff then you are all set. If you still want to let some people be able to muck with that dialog then you need to get a little more creative with the ACLing and allow some group but disallow everyone else. That is done with more intrusive ACL modifications and using passive deny instead of explicit deny.

In the location I was at, they were doing this lockdown with a GPO so it will be put back if someone figures out a way around it.

I was impressed with how simple the solution was and the fact that I hadn’t ever heard of it before.

  joe

Received an email today from someone who loved AdFind, to paraphrase the note

AdFind rocks! How the heck do I do Tab Delimited CSV output?

Err duh. My bad… I thought I put that in the usage and didn’t or must have commented it or must have been dreaming of all of the above. You can use the CSV Delimiter (-csvdelim) switch to specify a tab by entering \t. Those with a c or perl background understand this one, others should just write it down. This only works with \n (newline) and \t (tab), not all escaped characters supported by c/perl.

Just one reason I tell people that virtualization of Domain Controllers in production scares me… This is a post from one of the Microsoft newsgroups. As more and more people move to virtualizing their DCs I expect to see more and more of this.

Newsgroups: microsoft.public.windows.server.active_directory

Hi,

Due to a VMWare problem the local time of one of my remote site DCs was set
back to July 2006. So the other DC in the same site believes that there are
lingering objects and stopped replication.
Is there any way to safely enable replication again without demoting the DC
?

Thanks
Mario

Really this goes back to reason #1 which is that most Windows admins really aren’t up to the task of understanding Active Directory well enough to properly run Domain Controllers (or ADAM) in a virtualized environment safely.

     joe