HPlum78

Just updated the links in my post (so they work!)! as they point out the limitations that @dayzd is referring to...

Seen Keith and the Prodigy more time than I can remember sad loss.

So I thought I would look into this a little more as I always think that there maybe a more PS centric way of doing this type of thing WMI/CIM is always a fall back position. So here is what I found:- https://docs.microsoft.com/en-us/windows/desktop/cimwin32prov/win32-mappedlogicaldisk You can read to the bottom of that page or just go to here:- https://devblogs.microsoft.com/scripting/how-can-i-determine-which-drives-are-mapped-to-network-shares/ But I would look at the Get-PSDrive -PSProvider FileSystem way not totally sure about this mind would have to run some tests...

First thought would be look @ Invoke-Command

Having individual contact lists setup for this is a data breach waiting to happen! There are loads of ways to set this and would be governed by your data polices I guess that having the type of information that this group would be sharing would be a no to external mail addresses so I am with @Boredguy having these users in your tenancy is the way to go. We have a policy for staff accounts that says they are not allowed to forward their mail this also applies to our contributer accounts that what your govs would have i guess. I am happy to talk through this in more detail when I am not on a screen the size of a postage stamp as you should maintain a golden source for these types of groups amoungst other things.

NetBT stop UDP ports 137 and 138 being forwarded on your router(s) / switches. (in a meeting, sorry for the lack of detailed explanation) https://support.microsoft.com/en-gb/help/135464/8003-browsing-errors-with-udp-forwarding Will save me going into it.....

Not scratched the surface then, just thinking if you where close to exhausting the RID Pool then it would be more advisable to migrate to a new domain.

function Get-RIDsRemaining { param ($domainDN) $de = [ADSI]”LDAP://CN=RID Manager$,CN=System,$domainDN” $return = new-object system.DirectoryServices.DirectorySearcher($de) $property= ($return.FindOne()).properties.ridavailablepool [int32]$totalSIDS = $($property) / ([math]::Pow(2,32)) [int64]$temp64val = $totalSIDS * ([math]::Pow(2,32)) [int32]$currentRIDPoolCount = $($property) – $temp64val $ridsremaining = $totalSIDS – $currentRIDPoolCount Write-Host “RIDs issued: $currentRIDPoolCount” Write-Host “RIDs remaining: $ridsremaining” } Oh need to run powershell as admin. That's ripped from somewhere in the past you can also use dcdiag to get the count. [color=#000000][font=WOL_Bold]Dcdiag.exe /test:ridmanager /v [/font][/color]

How many staff/ students and computers? Just thinking about what the RID count looks like?

Yeah no support for Azure Sync on local domain rename. Although there is a notion that if you switch the sync off and then reininstall it starts to work again but that would be a full sync so depending on how many objects you have to sync it could take a while. (Not sure what the MS support position on this would be, so maybe worth a proactive call first) How old is this Domain the you are renaming?

I don't know what the cost is to you guys but is ATP not worth considering?

tasklist /svc /fi "imagename eq svchost.exe from a command prompt will get you a list as well.

So from the task manager you can see what services are using the SVCHOST service from there can you not see the name of the actual service/ program that is spawning the svchost process? maybe if you need more detail you could download a copy of process explorer https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer

Do a gpresult /r in an elevated PS/ command prompt, then take a look at the applied group policy objects part.

If your users change their passwords while they are logged on then this can cause issues, a log off and back on should solve this type of issue. Is this what is happening? what are the other applications? Where is your mail hosted?

Did you take a look at the link above? Are you still experiencing issues?

Before running anything just run the following commands to check the sysvol share and DFR replication state. For /f %i IN ('dsquery server -o rdn') do @echo %i && @(net view \\%i | find "SYSVOL") & echo For /f %i IN ('dsquery server -o rdn') do @echo %i && @wmic /node:"%i" /namespace:\\root\microsoftdfs path dfsrreplicatedfolderinfo WHERE replicatedfoldername='SYSVOL share' get replicationgroupname,replicatedfoldername,state (elevated command prompt) i will dig out some more info and post when i get a few more mins, just put the output of the commands above on here before doing anything else as i have not seen any mention of event id 2213 and from memory that's what i would be looking for before running the command that has been noted above.... Ah now its all coming back to me, as i have just looked at event 2213 and your mention of kb2663685 so that's the reason you have not seen evt id 2213 as you have said you do not have the kb installed. So in you instance as the events are telling you DFS has automatically initiated the recovery. Here is more info https://support.microsoft.com/en-gb/help/2846759/dfsr-event-id-2213-in-windows-server-2008-r2-or-windows-server-2012

@DrCheese Azure SSO is not yet a direct replacment for ADFS its close but not everything is there yet... I would and keep looking at doing as you have done but just leverage some bits of ADFS that stop us. Oh and you can still do MFA and have all the impossible travel reports and compromised account reporting and still leverage ADFS as that's what we do, not a mutual Azure SSO feature.

@free780 that would allow auth to continue for some applications and is something I have setup as a fall back position. I dont know how many apps @Uber22 is securing behind ADFS and where they actually exist (cloud/ on prem) but in a DR situation how important are those apps? Some of my users would argue that they need access to the apps I have behind our ADFS environment but I have ~40 apps that leverage it, we have considered a small IaaS deployment in Azure to use in an DR situation, and we a number of data centers.

Yeah exactly what @EddyAllen has said. Although you still need to solve the file server dependencies.

Use powershell and email. I wrote some code to do this a while ago and have often mentioned it on here. Need to dig it out and dust it off and refractor now. Thats what I would be telling you to do. But I would all so say look at a propper solution for SSPR so that your staff and students are able to reset their own passwords if you can. MIM is free if you use Azure AD! Just had a quick play can connect to an O365 mailbox using the graph API read a message that had come in picked out the details and moved the mail to a subfolder, then its use the detail from the mail and get PowerShell to change the password for the requested user (I have just used a static password but you can use PS to generate a random password) then send a mail back to the requester with the password that has been set. An hours worth of playing and the bones of a PS script is done, you then just secure the mailbox so that only a subset of your users can mail into that mailbox and if you really want you could get PS to check for an attribute on the staff account as a double check valve affair.

@localzuk has beat me to it and I would have to agree SSD does not mean that you can disregard RAID and @supportman we need to be careful advocating a certain way as unless we understand the use case in its finite detail we risk misleading those who are asking for help. Sometimes it's better to give some general pointers than put your head and someone else's job on the block. Again as @localzuk says the options and decisions are very much dependant on what the work load looks like (as mentioned in my initial post) and on the appetite for risk and down time along with a load of other architectural decisions.

Need to iron our a few things, so you have two DC's connected to a (1) DAS host? (how many nodes are in your virtual environment?) on a host you also have an ADFS sever (is this multi role?) on the same or another host you have a files server? (again where is this? On the same server as your one of your DC's/ADFS server) what versions of the OS are we talking about?

The answer depends on how the underlying network is setup, if you subnet/ vLAN based on buildings then thats your answer, if you subnet/ vLAN based on device or something along those lines then that your answer. Don't reinvent the wheel unless you are thinking about a whole scale architecture review of your network infrastructure.

Select-Xml -Xml $XmlDocument -XPath "//Section" | foreach {$_.Node.ChildNodes} | export-csv /Users/h/Documents/PowerShell/xml_csv_Expt.csv