Search the Community

Hi All I am looking for a way to implement different types of authentication for OWA on Exchange 2013. I want to use forms-based authentication for users who are connection from outside the local network, and standard authentication for users who are on-site (logged onto my network using their AD credentials). Does this make sense - if you are in school, you get automatically logged on when accessing OWA, but if you are off site, you get promoted with the form. This is all to avoid the user having to enter the domain name when logging in from home! Thanks everyone!

Hello everyone, We have just got the booking system up and running and working quite well. I was just wondering if the following authentication scenario is supported: If so, is it possible for it to be set up like this: https://hap.school.lea.sch.uk/hap/bookingsystem - this uses Windows Authentication and logs the user in automatically https://hap.school.lea.sch.uk/hap/helpdesk - this uses Windows Authentication and logs the user in automatically but if they were to go to: https://hap.school.lea.sch.uk/hap - it would show the login form and ask for username and password. Thanks.

Hi, We have recently set up the Parent Portal for iSAMS and have issued all our parents with login details. We are now looking at setting up a CMS system for parents to use to upload photos of students at sporting events. We want the CMS site to be locked down to parents and staff only. Does anyone know of any way to use the authentication process from iSAMS with a third party CMS, like Joomla. Cheers, Barry.

Hello all - After searching and not turning up anything relevant I decided to post a question on here. My situation is this: We are an AD shop. We have numerous Ricoh devices that I have never touched and, the way I understand it, users accounts are currently setup one-by-one in each device's local address book. Users can print and scan documents to their H: drives. Their ricoh mailbox account is setup with folder authentication with their AD username and password manually entered in the web console by a tech. The folder path is the UNC path to the person's H: drive. This works well, although cumbersome. My problem is that we are going to be enforcing 90 day password changes starting next week and users will get failed authentications when trying to scan after their password changes. I understand that the Ricoh can work with AD and has LDAP authentication. My first question is, with Windows or LDAP authentication setup, how will the user be able to change their password in the address book? I'm assuming they do it right on the scanner? Secondly, can LDAP or Windows Authentication pull the user's home directory attribute in their user account? What I want is an easy way for the end users to be able to change their password on the ricoh, or even be prompted for their password when scanning a document to their h: drive. That said, do I even need to turn on LDAP authentication to get what I want? It would be great if new users could walk up, enter their ad username and password, and scan a doc right to their h: drive. Is this possible? Thanks for your help in advance. EDIT: I have also read that a way around the password change issue is to set the scanning up with a generic account who's password never changes and give it access to everyone's H: drive, thus eliminating the need for the each user to enter their username and pw. I don't prefer this method, but I was curious if anyone else has gone this route?

Is anybody else having authentication issues with the Fortinet 100D or similar and Active Directory? Installed 7 months ago and we are no further forward not being able to browse one of the most popular sites on the Internet (YouTube). It appears the agent running on the DC is at fault but as we get little feedback from Talk-Straight its hard to tell.

Hi, I have a SP site which is setup to authenticate with an external two-way trust domain. I've used the stsadm tool to configure the people-picker to browse this domain and add users/groups to this site. For the most part authentication works fine but have a select few (not disabled) which just can't login. The check permissions tool says that have the desired relevant access but the login prompt just keeps re-appearing. Here's where it gets stranger. Sometimes my own trusted domain account takes three attempts to login before this is accepted whereas others are allowed in straight away! Are there any logs for troubleshooting login at all? I'm struggling to find these. What could be the problem? I'd be happier if this just didn't work across the board to make troubleshooting a bit easier but then this job would be easy wouldn't it Any advice much appreciated.

Does anybody have 2 factor authentication on their VLE or external access to MIS?

I thought I'd open this problem up to hopefully get some different perspectives. The problem is as follows: As a school we support our primary cluster in their ICT and for a significant period of time now they have had to authenticate against our GFL proxy to gain internet access. It has always been a problem to the teachers in the primary's to try and get young children to remember the log on details, and the initial concept of authenticating was to track users browsing habits. This never materialised though and is now used for filtering. I'm looking for ideas really how I can get rid of the secondary authentication for internet access. The primary schools log on to the computers within school, all have Windows Server 2003 DC. The secondary authentication then ties into the GFL Smoothwall filtering and I do not think that an ISA server in each school is a viable option as they would then require local filtering also which is unpractical. Google throws up interesting options such as ADFS but haven't really found any references to using it in a situation such as this. Just wanted to get the opinion of others to see if they've encountered this issue and/or solved it. I appreciate any replies.

I'm currently working in an AD environment with an existing OD server that is not bound to AD (standalone). The 10.4 clients & users are managed completely via OD. I wish to use AD auth and still have the OD management (I've read the afp548 sandbox whitepaper) so setup a second OD server, bound it to AD, set the search order, etc and all appears to be working well at the server side. I've bound a client to AD and can login just fine (even without running an OD server) so my question is: how do I specify on the client how to use the OD server for management & how can I slowly migrate users/computers from the old OD server to the new OD server which is bound to AD). In other words, how do the clients know where to get their configuration from -- is it managed completely by the OD server via mac address in the computer group section of WGM? I have apx 350 clients to convert at this early phase. thanks! Eric

Hi - my PowerBi reports no longer show in Modules> Analysis>PowerBI Viewer. "Need to authenticate with PowerBI, please check config". In config my Username and password are correct (My MS details) but it's telling me that it is incorrect and unable to save settings. We haven't implemented 2FA, nothing else has changed over the weekend, but it thinks my MS details are wrong but I can log into PowerBI with them no problem. Cleared Cache, reset all passwords - any other ideas would be appreciated For info This is how it normally works > I use desktop PowerBI to create reports and use app.powerbi.com to schedule them. I publish to ‘my workspace’ and then the reports show for all staff under Modules > Analysis > PowerBi Viewer. I have to configure Bromcom in Config > Analysis > PowerBI config with my PowerBI credentials (i.e. MS account details) Every time I change my system password I have to update in the Bromcom Config – not normally an issue and hadn’t changed my password since about 2 weeks ago and everything was fine until this morning.

Hi all, I lead a small IT team comprising of myself and 4 techncians managing just under 50 schools. I am making it a requirement that all our schools we have global administrator access to have app based MFA setup for access. Currently we have an office mobile receiving SMS codes which we request from our admin staff who are in office during the weekdays which we need to request over teams. I don't find SMS authentication secure and this also limits our access to our portals when attempting to do out of hours work. My ideal setup would be app based authentication that can be shared with all my technicians using a single login. I'm aware MS authenticator can be signed in on multiple devices, however I'm seeing conflicting reports on whether the passcodes actually sync across devices, or whether restoring the accounts saved on another device will de-activate the device the accounts were backed up from. Any one else in a similar position or have suggestions on best practice to work around this?

My daughter cannot connect to her school wifi. I tried and followed the school's wifi instructions including "do not check" for CA certificate. We keep getting Network connection error, Authentication certificate rejected locally. No one at the school was able to figure out why she can't connect. She has a Samsung Chromebook 3. Any help would be appreciated.

Hi I am wondering if i can authenticate CISCO Access Points via Windows Server 2012R2 Radius All CISCO access points are reporting directly to the CISCO Controller. Currently i am using ACS 4 but having issues in certificate of iPhone users. If anyone can share any tips or links to tutorials if its possible thanks

Hi Guys Here at our workplace we are experimenting with 802.1x WIFI I have set up a NPS and our Unifi point to allow it . But when we testing it allows phones to be connected if credentials are correct but when a Windows Laptop tried on 7 and 10 are just saying that it cant connect to it . Event Logs specify that password and username is mismatched but as I mentioned it before if is use same credentials on my phone it works fine. Do you have any suggestions ?

We currently have a problem editting pages in Frog - the toolbar simply won't appear. However, disable AD authentication for a user and the same page can then be editted as normal. Re-enable AD authentication and within minutes the same page cannot then be editted by the same user. After much head-scratching, Frog second line support eventually enabled the "Store encrypted copy of Active Directory password" in the appropriate login profile settings and the problem seems to go away with AD authentication enabled. However I am a bit puzzled as to why this particular setting is needed as it suggests to me an issue with their Active Directory authentication module that relies on the local storage of authentication details to fall back on or for particular actions. If other Frog site admins have a moment, could you check to see what your profile settings are in relation to storing copies of AD passwords please? Particularly in relation to the Staff and Teacher login profiles. I would also be interested to see if this problem could be replicated on your sites by (if it's ticked of course!) unticking the "store copy of password" setting, waiting a bit, and seeing what happens. Thanks in advance!

I’m kinda stuck with something and it’s really bugging the hell out of me and I was wondering if anyone else has seen the same thing? Basically Firefox is still requesting a username and password to the local intranet site even though the following parameters have been set in "about:config": pref("network.automatic-ntlm-auth.trusted-uris", "domain.net"); pref("network.negotiate-auth.delegation-uris", "domain.net"); pref("network.negotiate-auth.trusted-uris", "domain.net"); The pop-up box states the following: Authentication Required A user name and password are being requested by http://www.domain.net. The site says: "Digest" However, when the box is cancelled it then goes on to automatically load the user's credentials correctly using NTLM. It's quite annoying and I want to stop it but I can't seem to find a way how to. It looks like it's trying to authenticate using Digest before accepting the NTLM credentials. Would that be a fair assumption? If so, how do I prevent it? I can't find a setting in Firefox which will change the order of preference or indeed makes any reference to Digest. Is there a setting which needs to be changed in IIS? Any ideas?

I have a problem when i try to log on from my pc to AD in the domain. When i boot the pc, and enter username, password and domain to which i want to log on, i need to wait 3-4 minutes, at Applying your personal settings... pop up. After that i can log on, but when i check logs on my pc, at Application logs i fount thise two logs: -----> LOG1 Event Type: Error Event Source: Userenv Event Category: None Event ID: 1030 Date: 1/27/2011 Time: 10:05:29 AM User: DOMAIN\user1 Computer: user1pc Description: Windows cannot query for the list of Group Policy objects. A message that describes the reason for this was previously logged by the policy engine. For more information, see Help and Support Center at Events and Errors Message Center: Basic Search. ----> LOG2 Event Type: Error Event Source: Userenv Event Category: None Event ID: 1006 Date: 1/27/2011 Time: 10:05:29 AM User: DOMAIN\user1 Computer: user1pc Description: Windows cannot bind to domain.com domain. (Local Error). Group Policy processing aborted. For more information, see Help and Support Center at Events and Errors Message Center: Basic Search. I log off and log on back several times, and its the same situation, 3-4 minutes waiting at log on, and always this two logs. The DFS service is started at DC. ------------- About sysvol: ------------- I have the following path: c:\Windows\sysvol\sysvol\domain.com\ For the File permisions: ******************** C:\Windows\sysvol\ Folder is not shared. Authenticated users and Server Operators have Read&Execute Administrators, Creator Owners and System have Full Control In the column Inherited From: they all have In the column Apply To: Creator Owner: Subfolders and Files only Others: This foler, subfolders and files Check box: Allow inheritable permissions from the parrent to propagate... is Unchecked Check box: Replace permmision enttries on all child objects... is unchecked ************************ C:\Windows\sysvol\sysvol\ Folder is shared. Administrators: Full control Authenticated users: Read & Execute, List Folder Contents, Read Creator Owner: Full control SYSTEM: Full control Server Operators: Read and Execute Everyone: Read & Execute Domain users: Read & Execute In the column Inherited from for Domain users and Everyone is For the rest is "inherited from C:\\Windows\sysvol\" In the column Apply to For Creator Owner: Subfolders and files only For Everyone: This folder only For all the rest: This folder, subfolders and files Check box: Allow inheritable permissions from the parrent to propagate... is Unchecked for all Check box: Replace permmision enttries on all child objects... is unchecked ********************************* Any ideas, solutions?