HPlum78

I do a lot of DIY as seemingly outside of IT I fix cars, build and fit kitchens and bathrooms... I have sworn by makita gear for years and my trusted drill of 12 years (it did some work in that time) packed up. Since then in the past 4 years I have replaced it twice, I have took my original and subsequent drills apart and there is a clear difference in the quality of the parts and builds. I was going to go and buy yet another one but in the mean time the better 1/2 has been out and got some of the ryobi one+ gear so I strayed into the world of ryobi and will say after using the drill for the past 2 months I am happy with it and right now even tho I dipped in to ryobi I am in no rush to go and get another makita (even tho I have a fair few batteries).

So yeah Group Policy works (in the most part) if your users use a Windows Machine to access their "stuff" now more than ever users may never touch what I will call classic devices to access their "stuff" so this lays waste to some of those classic administrative tools like group policy. So yeah the brave new world it is then as we have users who will never touch a windows devices and have to come up with automation in the cloudy world. As @chaplic has said if this group exists in the cloud then you can poke the graph api for the membership of the group, if its an on prem AD group then get it synced so you can poke the graph api! The graph explorer is your freind here: https://developer.microsoft.com/en-us/graph/graph-explorer

I have broke, ripped and pulled almost everything in my body! (Arm alone 47 times including once when they counted over 100 fractures) but I will say this when I did a couple of ribs it was horrible and just as I started to feel normal I slipped down the stairs and put one through my lung (that was fun...). Take it easy and be careful, if you can sleep in a chair rather than laying down and if it is on one side use a sling to take the weight of the arm on the same side. Hope you get better soon. H.

Those permission can be large in scope and if it was just about GDPR that would be one thing but there is more to this than just that... I have seen even well known companies have bat crazy permission requests.

I would turn off the ability for users to request application permissions via this mechanism. Have a process in place for people requesting these and any thing that asks for app delegated permissions needs questioning.

I love the smell of PowerShell in the morning, interesting note on the performance as that .foreach should out stip the other uses as its a method now and they did a lot of work with the .net team to improve performance. Love that you have done some grunt work @Sephiroth, and yeah not many will work at the scale where it make a significant difference.

@Sephiroth is right, the one thing I will add is that if you import that csv in to a var then use %$varname%.foreach({}) as this is way more performant than | foreach. On a small scale this is not a massive issue but at scale the use of the above makes a big difference in the iteration speed I will not go into the why as you can dig it out of my previous posts on here or Google will tell you.

No that's right no home use benefits for Defender/ security for students on *5 agreements.

Yeah in teams the meeting organiser and presenters can disable both the mic and cameras of either individuals/ all attendees. so could be just that...

Ha clearly this issue is escalating, quick switch the internet off!

Sorry my wording is not the best, but what I am saying is primary should be a another DC and secondary should be itself. The idea is that if its its own address first then there is a risk thar replication will be isolated if there is a problem with DNS. In a nutshell... Glad you are back up and running, nice work.

Cityfiber is about to be called virgin O2 shortly... if they get their own way.

Sorry i have just edited my initial post and changed the order, either way right now just want to make sure that the servers are not trying to point to a DC that is no longer available, so as @djm968 says just to try and get this back up and running. We can deal with the what points to what and replication islands and all that later....

so before i will pin it on either DC, can you do the same on the other DC with regards to host files to get DNSmgmt working, can you check the settings on of DNS on each server and check that it is pointing to itself secondary (ip address) and then to the other DC's address (ip address) as the primary (in the network configuration). Hope that makes sense....

oh the joy, So DNS lets try to get access to that, if you open up the host file on one of the DC's (c:\windows\system32\drivers\etc\) - use notepad and will probably need to be an elevated an all. (take a copy of the original) Add the following to it: 127.0.0.1 localhost ::1 localhost then try yo open dnsmgmt.msc See if that lets you get in, if not there are other things we can try.

So what I am trying to say if anything, understand where you are right now before doing anything that is going to change the underlying AD environment especially if those changes are going to rely on the underlying replication topology to update the other DC.

So @djm968 is probably right but the issue here is that I dont think that replication is currently working so where you run these commands from will matter. If replication is an issue then just blindly removing meta data and grabbing roles will cause you more issues!

https://www.microsoft.com/en-gb/download/details.aspx?id=30005 - is the GUI based repadmin tool essentually, if you can download it and run it.

So did DC3 hold any FSMO roles prior to it being removed from AD?

I have seen this a number of times before and its around the redundant internet connection risk, we dont operate a redundant internet connection and have been using cloudy based services of all flavours for well a long time (since the Azure portal had 3 things in it lets say!). Is internet connectivity so unreliable these days? or is this related to an individual supplier? is it not better to write up the risks and accept those risks (and yes I understand that those risks are not the IT departments risks to sign off on) than paying for a whole load of redundant links? It would be interesting to here from those that have/ are cloud only environments on this subject. To be clear I am not calling anyone out here, just interested in how this is being assessed and how big an issue this is in this space, also brings me on to the point I was about to make around even MS have stopped saying migrate everything to cloud and Hybrid cloud is going to be the operating model for the foreseeable future in most organisations.

oh and just out of interest is there any newish events in the directory service logs with the source of NTDS KCC? (clearly there will be some as you have demoted a DC but just wondering if there have been any others of note?)

A few questions here: How many DC's do you have? What OS are they running? How did you move the FSMO role and are you sure that it was successful? - can you run Get-ADForest | Format-Table SchemaMaster,DomainNamingMaster and then Get-ADDomain | format-table PDCEmulator,RIDMaster,InfrastructureMaster (or netdom query fsmo) I dont care what command is used TBH.

The thing that springs to mind is graph api but would need sometime to investigate it mind...

So the script I posted above will give you an output like the one in the picture giving you the total computer accounts in the given OU's and the number that have a lastlogoon time stamp older than 180 (this is a var and can be changed!), the script will also output a csv file. If you really want to you can grab the csv output and use test-netconnection (more advanced ping) and check if the computers are indeed on the network or not (bit over kill as after 180 days there are other questions I would have about the workstation in question...) but like @phydii has said this script also moves the account to a pending deletion OU along with disabling the accounts in question (not included here as you will all have different requirements).

$ous = ("OU=Win7,OU=StaffPC,OU=Workstations,DC=yourdomain,DC=ac,DC=uk","OU=Win7,OU=StudentPC,OU=Workstations,DC=yourdomain,DC=ac,DC=uk") $inactiveDays=180 $inactiveCMPs = @() write-output "Inactive computer objects, based on inactive days filter of: $inactiveDays" foreach ($ou in $ous){ $inactiveCMP1 = Search-ADaccount -ComputersOnly -AccountInactive -Timespan (New-TimeSpan -Days $inactiveDays) -SearchBase $ou $allcomps = (Get-ADComputer -Filter * -SearchBase $ou | measure).count foreach ($comp in $inactiveCMP1){ $mycomp = Get-ADObject $comp.DistinguishedName -Properties operatingsystem,canonicalName,Modified,operatingsystemversion $comp | Add-Member -MemberType NoteProperty -Name canonicalName -Value $( $mycomp.canonicalName.substring(0, $mycomp.canonicalName.lastIndexOf("/")) ) -Force $comp | Add-Member -MemberType NoteProperty -Name Modified -Value $mycomp.Modified -Force $comp | Add-Member -MemberType NoteProperty -Name OS -Value $mycomp.OperatingSystem -Force $comp | Add-Member -MemberType NoteProperty -Name OSVersion -Value $mycomp.operatingsystemversion -Force } $inactiveCMPs += $inactiveCMP1 Write-output "$ou, All computers: $allcomps, inactive computers: $(($inactiveCMP1 | measure).count)" #$inactiveCMP1 | group canonicalname | select name, count } $mydate = get-date -Format HH-mm_dd-MM-yyyy $inactiveCMPs | export-csv C:\temp\inactivecomputerreport_daysinactive_$inactiveDays_$mydate.csv