How to disable RC4 and 3DES on Windows Server?

 RC4

To disable RC4 on your Windows server, set the following registry keys:

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 128/128]

        "Enabled"=dword:00000000

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128]

        "Enabled"=dword:00000000

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128]

        "Enabled"=dword:00000000

3DES

To disable 3DES on your Windows server, set the following registry key:

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Triple DES 168]

        "Enabled"=dword:00000000

If your Windows version is anterior to Windows Vista (i.e. XP, 2003), you will need to set the following registry key:

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Triple DES 168/168]

        "Enabled"=dword:00000000

How to Transfer or Seize Active Directory FSMO Roles with PowerShell

There are several ways to move FSMO roles between Active Directory domain controllers: the graphical AD consoles, the ntdsutil command, and PowerShell. When transferring or seizing multiple roles at a time, PowerShell is likely the fastest and simplest method.

The Move-ADDirectoryServerOperationMasterRole cmdlet is used to transfer or seize FSMO roles. It can be run directly on a DC, or on a domain-joined server or workstation with the ActiveDirectory PowerShell module installed. There are two critical parameters that must be supplied to this command: Identity and OperationMasterRole.

The Identity parameter specifies the destination DC - i.e., the DC to which the role or roles are being moved. (It's not necessary to specify the source DC, since role-holder information is stored within AD.) This is typically the hostname of the destination DC but can also be a fully-qualified domain name, distinguished name, or GUID.

The OperationMasterRole parameter specifies which role or roles are being moved. Possible values of this parameter are PDCEmulator, RIDMaster, InfrastructureMaster, SchemaMaster, and DomainNamingMaster, but there are also numeric shortcuts for each of these:

0: PDCEmulator
1: RIDMaster
2: InfrastructureMaster
3: SchemaMaster
4: DomainNamingMaster

This is where the speed and efficiency of PowerShell becomes apparent. To transfer all five FSMO roles to a DC named NewDC, simply run this cmdlet:

Move-ADDirectoryServerOperationMasterRole -Identity NewDC 
-OperationMasterRole 0,1,2,3,4

PowerShell will prompt for confirmation of each role by default, but there is a Yes to All option.

To seize one or more FSMO roles, which should only be done if the existing role holder is permanently offline, simply add the -Force parameter to the cmdlet. Using the example above, if all five roles were held by a domain controller which was in an unrecoverable state, they could all be seized on NewDC with this cmdlet:

Move-ADDirectoryServerOperationMasterRole -Identity NewDC 
-OperationMasterRole 0,1,2,3,4 -Force

An Attempt was to modify an object to include an attribute that is not legal for its class

Cause:
This problem comes when you are using a mixed-mode of OS in your AD environment such as you have Windows Server 2012 and Windows Server 2019 AD. If you have enabled the AD Recycle bin in mixed-mode of OS then this problem may come during the restore due to the schema version.


Solution:
In such environment where you are using mixed-mode of OS, always use the newer version of OS to perform any task. So in this case, you might be using the Win 2012 AD to restore the object. Use the latest OS AD, your restore should work fine.

How to Check if Your Windows PC is Joined to a Windows Active Directory Domain

 

1. Open Command Prompt (Run as Administrator)
   • Press Windows Key + R then enter CMD in the Run window that appears.
   • Search the Start Menu for Command Prompt.
     
     
2. Enter systeminfo | findstr /B "Domain" in the Command Prompt window, and press Enter
   
   
3. If you are not joined to a domain, you should see 'Domain: Workgroup'. If you see something other than Workgroup, then you are likely joined to a domain.

Demote Windows Server 2016 Domain Controllers

Uninstall Using PowerShell –

Import-Module ADDSDeployment

Uninstall-ADDSDomainController -DemoteOperationMasterRole:$true -Force:$true

How do Rejoin a Computer to the Domain without Losing it’s SID

There are a couple of ways do this:

1. In AD right click the computer and select Reset Account. Then re-join without un-joining the computer to the domain. Reboot required.
2. In an elevated command prompt type: dsmod computer “Computer DN” – reset. Then re-join without un-joining the computer to the domain. Reboot required.
3. In an elevated command prompt type: netdom reset MachineName /domain DomainName /User0 UserName /Password0 {Password | *} The account whose credentials you provided must be a member of the local administrators group. No rejoin. No reboot.
4. In an elevate command prompt type: nltest /Server:ServerName /SC_Reset:DomainDomainController  No rejoin. No reboot.

Delegate Moving User, Group and Computer Accounts Between Organizational Units in Active Directory

http://social.technet.microsoft.com/wiki/contents/articles/20747.delegate-moving-user-group-and-computer-accounts-between-organizational-units-in-active-directory.aspx

Object	Organizational Unit	Permission Tab	Apply to	Permission
User	Source Organizational Unit	Object	This object and all descendant objects	Delete User objects
		Properties	Descendant User objects	Write Distinguished Name
		Properties	Descendant User objects	Write name
		Properties	Descendant User objects	Write Name
	Destination Organizational Unit	Object	This object and all descendant objects	Create User objects
Group	Source Organizational Unit	Object	This object and all descendant objects	Delete Group objects
		Properties	Descendant Group objects	Write Distinguished Name
		Properties	Descendant Group objects	Write name
		Properties	Descendant Group objects	Write Name
	Destination Organizational Unit	Object	This object and all descendant objects	Create Group objects
Computer	Source Organizational Unit	Object	This object and all descendant objects	Delete Computer objects
		Properties	Descendant Computer objects	Write Distinguished Name
		Properties	Descendant Computer objects	Write name
		Properties	Descendant Computer objects	Write Name
	Destination Organizational Unit	Object	This object and all descendant objects	Create Computer objects

KDC event ID 27 on Windows 2003 DC

You can also perform the following step to solve the problem on windows 2003 DC by adding the registry DWORD “KdcUseREquestedEtypesForTickets” under registry seeting

Hkey_local_Machine\System\CurrentControlSet\Services\KDC

Value Name : KdcUseREquestedEtypesForTickets
Value Type:  DWORD 
Value Data:  1 

Audit policies are not applied on one DC with event 4719 in eventvwr

Finding:
==========
Server的安全性事件有大量的4719 Audit Policy Change產生, 故判斷Audit Policy並沒有正確套用


Resolution:
===========
1. 先透過資料夾選項顯示隱藏的檔案
2. 檢查是否有下面的設定檔, 如果有請刪除之
   C:\Windows\system32\GroupPolicy\Machine\Microsoft\Windows NT\Audit\audit.csv
3. 確認刪除完後請執行gpupdate /force

Need to know the impact of remoe Domain users group from Local users Groups

When we join a computer to a domain, the Domain Users group will be added to the local users group of the computer automatically. Besides, the local users group also includes the other two groups: Authenticated Users group and INTERACTIVE group.
Even you delete Domain Users group from local users group, Domain Users group still belongs to Authenticated Users group, which means Domain Users group is still a member of local users group due to inheritance. You may also delete Authenticated Users group from local users group, however, when you logon by a domain user interactively, the domain user is a member of INTERACTIVE group, thus it is also a member of local users group. If you even delete the INTERACTIVE group from local users group, the domain users won’t be able to logon to this computer interactively. And I believe to delete these 3 groups from the local users group is a big change, and can probably cause a lot of potential issue. 

Domain Users
===============
This group contains all domain users. By default, any user account created in the domain becomes a member of this group automatically. This group can be used to represent all users in the domain. For example, if you want all domain users to have access to a printer, you can assign permissions for the printer to this group (or add the Domain Users group to a local group, on the print server, that has permissions for the printer).

Users (Local)
===============
Members of this group can perform common tasks, such as running applications, using local and network printers, and locking the server. Users cannot share directories or create local printers. By default, the Domain Users, Authenticated Users, and Interactive groups are members of this group. Therefore, any user account created in the domain becomes a member of this group.

Permission: Access this computer from the network. Allow log on locally; Bypass traverse checking.


Impact of removing the domain users from "Local users and group\Groups\Users"  of a member server.

1: None of the domain users can access that computer until unless you grant permission to the specific user on  the computer. 
2: None of the domain users can access the sharers of that computer, until unless you grant them permission explicitly. 

As the requirement was to remove the domain users group permanently from access list  ( should not get read and execute permission) and not to remove the permission explicitly, while you share a folder, you can go and remove the domain user group from the “local users and groups\groups\users” group. 

NOTE: Please make sure that, you add the specific users and grant permissions explicitly,  who should have access to that computer. Please do not remove the “domain users” from the users group of the local computer if it’s a Domain controller. 


Articles
========
Default Domain Groups: http://technet.microsoft.com/en-us/library/cc756898(WS.10).aspx
Default Local Groups: http://technet.microsoft.com/en-us/library/cc785098(WS.10).aspx 

How to disable "advanced Audit Policy"

1.      Clear the “audit.csv” file from local path

 C:\Windows\Security\Audit

2.      Clear the “audit.csv” file from SYSVOL path

\\<domain.com>\SYSVOL\<domain.com>\Policies\<GUIDofDefaultDomainControllerPolicy>\Machine\Microsoft\WIndowsNT\audit

3.      Run the commands below：

auditpol /clear (Clear the local audit settings)

gpupdate /force

Check Policy

auditpol.exe /get /category:*

NetBIOS over TCP/IP

Symptom
===========

Changing the Primary Domain DNS name of this computer to "" failed on

Windows 7 when joining to domain

Cause
=========

W2K8R2/Win7 known issue when joining to domain

http://support.microsoft.com/kb/2018583/en-us

Workaround

================

Add Domain DNS Suffix in the TCP/IP Properties. 

a) Click Start , click Run , type ncpa.cpl , and then click OK .

b) In Network Connections , right-click Local Area Connection ,

and then click Properties .

c) Click Internet Protocol Version 4 (TCP/IPv4), and then click

Properties .

d) In the Internet Protocol Version 4 (TCP/IPv4) Properties dialog

box, click Advanced .

e) On the DNS tab, select these DNS Suffixes, click Add, type the

FQDN of the domain in the DNS Server Dialogbox, Click Add, and then click OK

three times

Network location cannot be reached on joining domain

1. Open the Network and Sharing center
2. On the left side, click "Change Adapter Settings"
3. Right Click your connection and click on "Properties"
4. On the "Networking" tab, click Install
5. Install "Client for Microsoft Networks"
6. Reboot Server