Enable Inheritance Security Setting wont stay applied on Domain User Accounts

The Weirdest thing is happening on a 2012 R2 DC, in order to fix the ActiveSync error event ID 1053 on exchange
2010, the fix is to Enable inheritance on the Advanced Security settings of the domain users that will be using ActiveSync...Ok...but here is the weird thing...I set the Enable inheritance on the users and apply them, then when I check back after however
long...the setting has now reverted back to disabled inheritance? this is happening on all user accounts?
This screen shot is from this morning...Last night I changed this setting and enabled inheritance...this morning it reverted back to disabled inheritance?

Hi John,
Are you sure it's for quite literally all users, or all users in protected groups like the Domain Admins, Enterprise Admins and so on?
My guess - and it's only that at this stage, is that you're seeing this affecting protected groups and their members, in which case this is an expected behaviour based on how the AdminSDHolder functionality works.
You can read more about AdminSDHolder mechanics
here and
here.
Cheers,
Lain

Similar Messages

Developer 10g - Security Setting do not allow Websites to user Active X

Hi
I am Salman
I Install Developer 10g (10.1.2.0.2) on Windows Vista 32 Bit
I make a Test Form and Run through IE 7, following error generate:
"Your Security Setting do not allow websites to user Active X controls installed on your computer. This page may not display correctly"
What will be the solution ?
Can any one guide me in this regard
My ID is [email protected]
Salman

change the following browser setting:
Tool > Internet Options > Advanced > Security: Allow active content to run files on my computer.
Checking this box may resolve your issue but be weary that fi you use your pc for internet then it will also allow external Active X content to run on your pc too.

Color management setting wont stay set?

Running Acrobat Pro 9.4.1 in conjunction with CS5 Design Premium. Not only does the color management setting in Acrobat not change when set and synced from Bridge. The setting wont stick when set directly in Acrobat. Does anybody have a similar issue or a solution? I run Europe prepress 3 in bridge which has no effect on Acrobat but if I select Europe prepress 3 directly in Acrobat it will stay on that setting until I quit Acrobat then when re-launched it will be set to Europe Prepress 2! Any help or explanation much appreciated.

Guys I appreciate your help but nothing is working.
I tried deleting the preferences file and the same thing happened again anyway.
I then uninstalled the whole Creative Suite and deleted all files associated with it and all entries in the Windows Registry related to it.
I then reinstalled everything ( spending the hours it took) and it is doing the same thing again. I can not think of anything that has changed on the machine at all and I have never had this happen before in the years I have been using Premiere.
Everything used to work fine and Captures would go without a hitch even if they took hours as long as the Preferences were set to “None” on Device Control. But now it just won’t stay set, even after reinstalling everything. The Capture Window Device Control will stay set to “none” but not Preferences regardless of what I do.
I tried changing other Preference Settings and they stay changed but not device control. And it is the same regardless of whether the ADVC-300 is on or off. I even tried deactivating the Firewire Port in the Bios just to see what would happen and it made no difference.
Does anyone have any ideas?
My last option is to reformat my drive and reinstall everything from scratch but that will take me a day and a half.
I can not understand what is making it do this when it never did it before.
Here is what I am using:
Premiere Pro CS4 with a Canopus ADVC-300 Capture Box. It is installed via Firewire and goes to the Firewire Port on the Motherboard.
I am using XP Home SP3 on a Core I7 Computer with an Asus motherboard.
If no one has any ideas do me one favor. Go into your own Preferences file and set Device Control to “None”, close the panel and open it again to see if it is still set to none.
It may help me feel a little better about reinstalling all my software and spending the day and a half doing it if I know it is something with my machine and not the program itself.

Security update 2010-04-14 corrupted my user account

Has anyone else had a corrupted user account after installing the security update for Snow Leopard, 14th April ?
I applied the update, restarted my machine fine at home last night. Then I shut down my machine in full.
This morning I connected the ethernet to connect to my work Windows network domain. Turned the machine on and could not log in at all, my user account was corrupt. I ran permissions verification and repair from the admin account which has fixed the issue.
Anyone else experiencing this ?
Regards,
-- Ross

Sorry for not being more specific. I was trying to update the WebKit rendering engine of Safari by replacing the following frameworks in the system folder: Javascriptglue (PrivateFrameworks), Javascriptcore, Webcore, Webkit. After discovering that this caused problems with software update and installer, I reverted back from the Time Machine backups of these frameworks. Now, I can not open any application that relies on these frameworks in my user account, which leads me to believe that a cache or preference file is corrupted, but I have no idea where to start looking. Most applications in other users accounts work fine, but for some reason Pacifist will not open the 10.5.2 package (to replace the frameworks). I'm writing this in Safari right now, and everything is fine. That's why I think the main system folders are fine, except for a cache here or there. Unfortunately, Onyx won't open so I can't replace the caches and do other tasks of that sort.
I could just roll back to before I tampered using Time Machine. Will that solve the problem, or is an archive and install a safer bet? I'm not sure that an archive and install will fix any problems that my user account is having, since I just created this new account today (thank god i enabled the guest account so I could access system preferences!) and it works fine, as I have already said. I hope this helps explain the specific problem. I'm just not sure how or why only my user account is affected. If the system files were corrupted, every account would have the same issue.

How to enable IE11 x64 browser in windows 8.1 domain user

Hi all,
I was trying to enable IE11x64 bit browser in windows 8.1x64 bit ent for domain users and i was unable to enable it.
step 1: i enabled Enable enhanced Protection mode
step 2:It will be 64bit, only when this feature is checked, otherwise IE will still use a 32bit process.
Tabs are displayed in 32 bit.
can anybody help me with this issue.
i want 64 bit tabs to be opened instead of 32 bit

Start secpol.msc and go to Local policies > Security Options. Set "Accounts: Block Microsoft accounts" to "User's can't add Microsoft accounts".
Blogging about Windows for IT pros at
www.theexperienceblog.com

Setting up a sysprepped image with user account customisations

I'm trying to create a sysprepped image of a Windows installation for cloning (basically, as a VM template I can clone to create throwaway test environments quickly). I'm using a new build of Windows 8.1, going into audit mode and configuring my environment,
then using sysprep to generalise the image for cloning (sysprep /generalize /oobe /shutdown /unattend:C:\MyUnattendFile.xml).
I have customised the default account by setting things up the way I want in audit mode (under the administrator account that audit mode defaults to). My unattend.xml file has CopyProfile set to true (in the specialize phase, the only one I can set it in
IIRC). I also have my local account configured for creation in the OOBE phase in the unattend.xml file.
When I boot a copy of the sysprepped image, it starts up fine, exactly as I'd expect. But when it gets to the OOBE phase, it goes into the "Setting up a few things" sequence, and when I get the login screen and log in, I see a clean account (default
start page and taskbar, Windows theme is the default, etc). It's as if the default profile I set up hasn't been applied.
I can't tell what I am doing wrong - I saw a note somewhere (via google) that I need to set CopyProfile in the unattend file I boot from, not the one I sysprep with, but that can't be right as in this case I'm not incorporating the image into a setup process
- it's just a VM disk image that I boot normally.
I'm new to all this, and I'm a developer rather than a deployment specialist, so the discussion around images, PE boot disks, custom install disks, etc, is very confusing to me. If I'm doing something wrong, I'd appreciate any explanation someone can give
as to how to achieve what I want relatively simply.
Many thanks in advance,
Paul

I checked the log file, and I see "CopyProfileDirectory from C:\Users\Administrator succeeded. CopyProfile succeeded."
So it looks like the default profile was set up properly.
The desktop background is set correctly on the account, it's just the start page and taskbar, so the blog entry you mentioned seems like it's relevant. The problem is, there's no solution given in there :-(
From what I can see, the issue appears to be that when I initially log onto the user account created in the unattended startup, it runs the "first login" process - "Hi... We're setting things up for you... Installing your apps". So I
guess the key question is how I stop it from running that process, which is messing up the customisations I already made.
From the articles you mention, it seems like there isn't a particularly straightforward way to script the start page/taskbar changes I want. I didn't see anything that suggested I could make the changes once, then back up some data from the registry and/or
some user config files, and then set up a postinstall script to restore them (that probably still wouldn't work, as the "Hi... We're setting things up" process would probably still overwrite them :-(
If it's not possible to do things this way, maybe I'm going to have to go down the route of making a custom install disk. Is there a simple tutorial that assumes no deployment experience, and walks through the process of creating a custom install disk that
includes:
Setting the product key, the default language/locale etc (a fully unattended install)
Selecting to overwrite the whole disk, no dialog about disk partitions, etc
Create a local user account
Install various items of software (7-zip, conemu, virtualbox guest additions, chrome, probably a few others)
Pre-configure the local account with a custom start page, taskbar items, program settings like Internet Explorer home page and search providers and conemu defaults, desktop background
Set up a few other configurations (such as enabling WinRM) that can be done from an automated postinstall Powershell script.
I'm assuming this must be possible somehow, as I can't imagine corporate deployments will use the default start page. It's just how to do this as a home user. I just have a single PC, plus I can set up any VirtualBox VMs I need on it, so approaches
that talk about setting up a lab of machines and deployment servers and shares are probably out of my reach :-(
Thanks,
Paul

Setting previleges to a non-root user account to access ports

Hello ,
I am tring to do an icmp-ping to a machine in the network from an application by connecting to icmp port through a raw socket.
My question is i am able to connect to icmp port using raw socket only in root user account. But my application should run under a non root user account and do the ping for me.
1)How do i set previleges to a particular user to access icmp port?
I am running the application on solaris 9
2)I read a paper on net saying ports from 0 to 1024 can only be accessed by a root user account?
Why is this and what can be done for a non-root user account to access these ports.
3) Is this possible in solaris 9.
Thanks in Advance,
cheers,
pal

There is only one solution: create a new Standard user account and set it as your auto login account, if you use that feature.
Using what you describe is mostly a false sense of security. Were someone to hack into the computer they could hack into the standard account, so you would not wish to keep any sensitive data in that account. Other things to consider:
Turn on your Firewall in Security & Privacy preference panel.
Use software to mask your online presence such as ProxyCap 2.03, MacProxy, Proxifier, or Hotspot Shield.

Can an iPad be set up for more than one user accounts?

I have an Ipad wifi. i would like to let my son use it, but would like to set up a separate user account for him. Is this possible on an Ipad?

No, an iPad is a single-user device, it can only have one set of apps and content on it

How do I share the Photo Library on my desktop with another User. I have Apoerture set up on my wife's user account but cannot figure out how to access the photo library from her desktop.

I just got a new IMac. I transferred all the photos from our old PC to the Aperture Library on my User account. My wife is set up as another User. She can access Aperture from her User account but there are no photos in the Library. How can I share or giver her access to the photos so that she can work with them on Aperture from her User account?

Move the Aperture library to separate disk or disk partition with plenty of space for all your photos. On a separate disk or partition it will be possible to set the "Ignore ownership on this volume" flag. Then two users can write to the same Aperture library without permission problems.
The procedure is describe here for iPhoto libraries, but this will work for Aperture libraries as well:
iPhoto: Sharing libraries among multiple users
If you want to use a drive for your Aperture library, that has been used with a PC, format it for Mac, before you move the Aperture library there. This can be done with Disk Utility.

IIS GROUP POLICY APPLY IN DOMAIN USER

IS IIS RUN DOMAIN USER

Please provide more details on this.
Kindly elaborate.
Arnav Sharma | http://arnavsharma.net/ Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading
the thread.

SDK service using domain user trying to set SPN for computer account

I have a SDK service running under a domain user account, but it tries to register the SPN for the computer account of the machine?!
Therefore I get the following alert:
The System Center Data Access service failed to register an SPN. A domain admin needs to add MSOMSdkSvc/WIN-9IAJC0HS9RJ and MSOMSdkSvc/WIN-9IAJC0HS9RJ.domainxx.local to the servicePrincipalName of CN=WIN-9IAJC0HS9RJ,CN=Computers,DC=domainxx,DC=local
Which makes sense because it has not the permissions to do that.
When I make the domain user account member of domain admins it has the concerning permissions and it indeed registers that SPN to the computer account. But why?? The SPN should be registered to the domain user account instead (and therefore I had given the
domain user account the read/write permissions to itself to do that).
I have the following SPN registered now for the computer and domain user account:
setspn -l WIN-9IAJC0HS9RJ
Registered ServicePrincipalNames for CN=WIN-9IAJC0HS9RJ,CN=Computers,DC=domainxx
DC=local:
MSOMSdkSvc/WIN-9IAJC0HS9RJ
MSOMSdkSvc/WIN-9IAJC0HS9RJ.domainxx.local
MSOMHSvc/WIN-9IAJC0HS9RJ
MSOMHSvc/WIN-9IAJC0HS9RJ.domainxx.local
TERMSRV/WIN-9IAJC0HS9RJ
TERMSRV/WIN-9IAJC0HS9RJ.domainxx.local
WSMAN/WIN-9IAJC0HS9RJ
WSMAN/WIN-9IAJC0HS9RJ.domainxx.local
RestrictedKrbHost/WIN-9IAJC0HS9RJ
HOST/WIN-9IAJC0HS9RJ
RestrictedKrbHost/WIN-9IAJC0HS9RJ.domainxx.local
HOST/WIN-9IAJC0HS9RJ.domainxx.local
setspn -l domainxx\omdas
Registered ServicePrincipalNames for CN=OMDAS,CN=Users,DC=domainxx,DC=local:
none for this account
I don't get it. Anyone?
I am using SCOM 2012 R2
Pls help.
Thanx in advance.
Regards
Chris

SCOM SDK service really tries to set its SPN to the computer account (although the SDK service is running using a domain user account). The alert is no bug!
I know this for sure because I gave the SDK service permission to do it - by making the domain user account member of the domain admins security group - and it indeed sets the SPN on the computer account.
The latter is the actual bug I would say! It should try to set the SPN for the domain user account the sdk service is running with.
Then again, nog having the SPN been set correctly to this domain user account, does not seem to bother SCOM at all indeed. Perhaps it uses NTLM instead in this scenario.
Can anyone comfirm?

When i start up imac it goes through set up creates a new user account then starts over againj, when i start up imac it goes through set up create user account then starts over again over and over

when i start imac it goes through set up gets to creating new user account then it re boots and does it all again and again and again

Apple may still supply the original restore CDs/DVDs for a nominal fee. Have a your serial number and model information available when you call them.
AppleCare Support Phone Number: 1-800-275-2273
open 6am to 6pm Pacific Time
Apple Phone Sales 1-800-692-7753
International Technical Support Numbers
http://www.apple.com/support/contact/phone_contacts.html
"You have to call Apple & likely ask for a Product Specialist to get it (Leopard), if they still have it... helps if you tell them you have a new iPhone (iPad) that needs it!"
BDAqua
Requirements for Mac OS X v10.5
http://support.apple.com/kb/HT3759
Query by serial number "A serial number is a unique, identifying number or group of numbers and letters assigned to an individual piece of hardware or software. It's used for various things depending on the product / brand but what is your Mac's serial number for and more importantly... what is it hiding and what can it do for you ?"
http://www.appleserialnumberinfo.com/Desktop/index.php or

'Disable or enable software Secure Attention Sequence' GPO setting | Security Risk

Hello,
In implementing SCCM we discovered that the 'ctrl+alt+del' button for the SCCM Remote Control client, will not work, unless we enable the 'enable software Secure Attention Sequence' GPO setting with 'Services and Ease of Access Applications' set.
Our info sec team is looking for some reassurance that this introducing a lot of risk to our orgnization. Does anyone have any guidance they can provide for this?
Thanks

Hi jh，
As you mentioned In Configuration Manager 2012 does bring the 'ctrl+alt+del' back which required enable the 'enable software Secure Attention Sequence' GPO setting.
by default, only Ease of Access applications running on the secure desktop can simulate the SAS. If you set this policy setting to "Services and Ease of Access applications," both services and Ease of Access applications can simulate the SAS.
When services or other application simulate the SAS, since services or application which could launches at logon it takes risks.
We suggest you refer to system center configuration manager forum because you might get more useful suggestion there
https://social.technet.microsoft.com/Forums/en-US/home?category=systemcenter2012configurationmanager
Regards
D. Wu

Wallpaper wont stay set.

I have a late 2011 MBP running ML - system is entirely up to date. i set my wallpaper frm SP and it will stay as long as the comp system is active. The moment the harddrive is set to sleep and completely inactive. I turn the comp back on and the wallpaper is back to "galaxy". Iv removed third party apps but still the wallpaper folder wont stay set? i am rather experienced with my mac so advanced help would be great. thanks:-/

You have a corrupt preference file most likely, see if this can help also install the free OnyX from Macupdate.com and under Verify there is a preference file checker.
The procedure is the same, seek and destroy it, reboot and reset that apps preference, it creates a new files free of the corruption.
Deleting the System Preference or other .plist file
https://discussions.apple.com/community/notebooks/macbook_pro?view=documents#/?p er_page=50

How to Export local security setting all filed name & value against filed.

HI all,
I am trying to export local security setting from local policy using bellow scrip. but it is showing only these are configured. I need expert help which allowed me to export all filed with value where it is configure or not. Please give me.
$output=@()
$temp = "c:\"
$file = "$temp\privs.txt"
[string] $readableNames
$process = [diagnostics.process]::Start("secedit.exe", "/export /cfg $file /areas USER_RIGHTS")
$process.WaitForExit()
$in = get-content $file
foreach ($line in $in) {
if ($line.StartsWith("Se")) {
$privilege = $line.substring(0,$line.IndexOf("=") - 1)
switch ($privilege){
"SeCreateTokenPrivilege " {$privilege = "Create a token object"}
"SeAssignPrimaryTokenPrivilege" {$privilege = "Replace a process-level token"}
"SeLockMemoryPrivilege" {$privilege = "Lock pages in memory"}
"SeIncreaseQuotaPrivilege" {$privilege = "Adjust memory quotas for a process"}
"SeUnsolicitedInputPrivilege" {$privilege = "Load and unload device drivers"}
"SeMachineAccountPrivilege" {$privilege = "Add workstations to domain"}
"SeTcbPrivilege" {$privilege = "Act as part of the operating system"}
"SeSecurityPrivilege" {$privilege = "Manage auditing and the security log"}
"SeTakeOwnershipPrivilege" {$privilege = "Take ownership of files or other objects"}
"SeLoadDriverPrivilege" {$privilege = "Load and unload device drivers"}
"SeSystemProfilePrivilege" {$privilege = "Profile system performance"}
"SeSystemtimePrivilege" {$privilege = "Change the system time"}
"SeProfileSingleProcessPrivilege" {$privilege = "Profile single process"}
"SeCreatePagefilePrivilege" {$privilege = "Create a pagefile"}
"SeCreatePermanentPrivilege" {$privilege = "Create permanent shared objects"}
"SeBackupPrivilege" {$privilege = "Back up files and directories"}
"SeRestorePrivilege" {$privilege = "Restore files and directories"}
"SeShutdownPrivilege" {$privilege = "Shut down the system"}
"SeDebugPrivilege" {$privilege = "Debug programs"}
"SeAuditPrivilege" {$privilege = "Generate security audit"}
"SeSystemEnvironmentPrivilege" {$privilege = "Modify firmware environment values"}
"SeChangeNotifyPrivilege" {$privilege = "Bypass traverse checking"}
"SeRemoteShutdownPrivilege" {$privilege = "Force shutdown from a remote system"}
"SeUndockPrivilege" {$privilege = "Remove computer from docking station"}
"SeSyncAgentPrivilege" {$privilege = "Synchronize directory service data"}
"SeEnableDelegationPrivilege" {$privilege = "Enable computer and user accounts to be trusted for delegation"}
"SeManageVolumePrivilege" {$privilege = "Manage the files on a volume"}
"SeImpersonatePrivilege" {$privilege = "Impersonate a client after authentication"}
"SeCreateGlobalPrivilege" {$privilege = "Create global objects"}
"SeTrustedCredManAccessPrivilege" {$privilege = "Access Credential Manager as a trusted caller"}
"SeRelabelPrivilege" {$privilege = "Modify an object label"}
"SeIncreaseWorkingSetPrivilege" {$privilege = "Increase a process working set"}
"SeTimeZonePrivilege" {$privilege = "Change the time zone"}
"SeCreateSymbolicLinkPrivilege" {$privilege = "Create symbolic links"}
"SeDenyInteractiveLogonRight" {$privilege = "Deny local logon"}
"SeRemoteInteractiveLogonRight" {$privilege = "Allow logon through Terminal Services"}
"SeServiceLogonRight" {$privilege = "Logon as a service"}
"SeIncreaseBasePriorityPrivilege" {$privilege = "Increase scheduling priority"}
"SeBatchLogonRight" {$privilege = "Log on as a batch job"}
"SeInteractiveLogonRight" {$privilege = "Log on locally"}
"SeDenyNetworkLogonRight" {$privilege = "Deny Access to this computer from the network"}
"SeNetworkLogonRight" {$privilege = "Access this Computer from the Network"}
$sids = $line.substring($line.IndexOf("=") + 1,$line.Length - ($line.IndexOf("=") + 1))
$sids = $sids.Trim() -split ","
$readableNames = ""
foreach ($str in $sids){
$str = $str.substring(1)
$sid = new-object System.Security.Principal.SecurityIdentifier($str)
$readableName = $sid.Translate([System.Security.Principal.NTAccount])
$readableNames = $readableNames + $readableName.Value + ", "
$output += New-Object PSObject -Property @{
privilege = $privilege
readableNames = $readableNames.substring(0,($readableNames.Length - 1))
#else = $line."property"
$output

As an alternate approach wee can preset the hash and just update it. This version also deal with trapping the errors.
function Get-UserRights{
Param(
[string]$tempfile="$env:TEMP\secedit.ini"
$p=Start-Process 'secedit.exe' -ArgumentList "/export /cfg $tempfile /areas USER_RIGHTS" -NoNewWindow -Wait -PassThru
if($p.ExitCode -ne 0){
Write-Error "SECEDIT exited with error:$($p.ExitCode)"
return
$selines=get-content $tempfile|?{$_ -match '^Se'}
Remove-Item $tempfile -EA 0
$dct=$selines | ConvertFrom-StringData
$hash=@{
SeCreateTokenPrivilege =$null
SeAssignPrimaryTokenPrivilege=$null
SeLockMemoryPrivilege=$null
SeIncreaseQuotaPrivilege=$null
SeUnsolicitedInputPrivilege=$null
SeMachineAccountPrivilege=$null
SeTcbPrivilege=$null
SeSecurityPrivilege=$null
SeTakeOwnershipPrivilege=$null
SeLoadDriverPrivilege=$null
SeSystemProfilePrivilege=$null
SeSystemtimePrivilege=$null
SeProfileSingleProcessPrivilege=$null
SeCreatePagefilePrivilege=$null
SeCreatePermanentPrivilege=$null
SeBackupPrivilege=$null
SeRestorePrivilege=$null
SeShutdownPrivilege=$null
SeDebugPrivilege=$null
SeAuditPrivilege=$null
SeSystemEnvironmentPrivilege=$null
SeChangeNotifyPrivilege=$null
SeRemoteShutdownPrivilege=$null
SeUndockPrivilege=$null
SeSyncAgentPrivilege=$null
SeEnableDelegationPrivilege=$null
SeManageVolumePrivilege=$null
SeImpersonatePrivilege=$null
SeCreateGlobalPrivilege=$null
SeTrustedCredManAccessPrivilege=$null
SeRelabelPrivilege=$null
SeIncreaseWorkingSetPrivilege=$null
SeTimeZonePrivilege=$null
SeCreateSymbolicLinkPrivilege=$null
SeDenyInteractiveLogonRight=$null
SeRemoteInteractiveLogonRight=$null
SeServiceLogonRight=$null
SeIncreaseBasePriorityPrivilege=$null
SeBatchLogonRight=$null
SeInteractiveLogonRight=$null
SeDenyNetworkLogonRight=$null
SeNetworkLogonRight=$null
for($i=0;$i -lt $dct.Count;$i++){
$hash[$dct.keys[$i]]=$dct.Values[$i].Split(',')
$privileges=New-Object PsObject -Property $hash
$privileges
Get-UserRights
A full version would be pipelined and remoted or, perhaps use a workflow to access remote machines in parallel.
¯\_(ツ)_/¯

Enable Inheritance Security Setting wont stay applied on Domain User Accounts

Similar Messages

Maybe you are looking for