Howto: VPN server authing off Active Directory

It is indeed possible to use the VPN server on OS X Server to authenticate VPN users against Active Directory using Radius. I've set it up twice now and it works well. Binding your server to AD doesn't work for the VPN service, you only have this option at the present for using those AD accounts.
http://www.afp548.com/article.php?story=20060517222656622

This might help:
http://www.afp548.com/article.php?story=20060517222656622&query=radius

Similar Messages

  • Windows Server 2008 R2 - Active Directory Replication over DynDNS

    Hello,
    I have one server that Windows Server 2008 R2 - Active Directory / DNS
    Now some users shifted to new office with the server
    Some users still in the original place that now don't have ADDS/DNS
    i want to install one replication server in the original place to retrieve AD/DNS form new office via DynDNS
    is that possible of not?
    Best regards,

    Badr, I don't think you want AD replication occurring over the internet - even if that was possible the server would need access to all the SRV records, a records, And all the ports required for communication - See here for an exhaustive list
    http://social.technet.microsoft.com/wiki/contents/articles/584.active-directory-replication-over-firewalls.aspx - I don't think I have to tell you how bad opening all these ports to the internet would be.
    You may want to look at Setting up a vpn or DirectAccess from the original site to the new site. This will give you more security and generally won't cost to much.
    http://technet.microsoft.com/en-us/network/dd420463.aspx
    Another thing that may work for you would be if you setup remote desktop services in the new location and had the original location remote into via a gateway server -
    http://blogs.technet.com/b/windowsserver/archive/2012/05/09/windows-server-2012-remote-desktop-services-rds.aspx as a starting point. With RDS your users would be able to access the new location from anywhere, although there would be upfront costs associated,
    licensing and server being part of them - I don't recommend turning your domain controller into an RDS server.These are just some ideas to help you with your issue

  • Can't connect to Small Business Server 2003 via Active Directory

    I have done lots of searching, both in these forums and the wider internet, and cannot find a solution to my specific problem.
    I am trying to connect my G5 (10.3.9) to a Windows network. We have a Microsoft Small Business Server 2003 with Active Directory. The PCs have no problem using this, and I can connect to shares setup on the server via AFP.
    But I am having problems when I try to configure the AD plug-in in Directory Access on the Mac. When I click 'Bind', I enter the Server's Administrator username & password and when I click 'OK', it gets to Step 3 of 5 "Verifying Credentials". It ticks away at this step for about 30 seconds, then comes up with error message saying "Invalid user name and password combination."
    I have tried other users with admin privileges, but they don't work either. I know the usernames and passwords aren't invalid, because I created them. I have tried fiddling around with other settings in the AD setup, but nothing gets any further.
    Without any other 3rd party software (that's my final option), is there something I need to check/change, either on the Mac or the server, to make this Mac to authenticate via AD? Please help!

    Hi Andbrowny, thanks for your response.
    Your advice didn't really help my Active Directory problem (AD doesn't require SMB does it?), but it gave me some progress on my SMB problem. I can connect via AFP, but previously when I tried to connect via SMB, it kept coming up with the error "Could not connect to the server because the name or password is not correct".
    Now, after changing the policies on the server, I get an error -43 message saying "The operation could not be completed because one or more required items cannot be found."
    So now I have two problems! SMB is not finding something it needs, and Active Directory is not "verifying credentials".
    Actually, I have three problems: When I am connected via AFP, filenames over 31 characters long are truncated on the server, and I can't copy long filenames onto the server without renaming them. I have read that SMB would fix this to a degree (256 characters for the complete file path), but is there anything (a protocol or software) that allows long filenames to be read/written with ease?
    Side note: The server is not 100% configured, the bloke installing it still has some work to do, but Active Directory works for all the XP machines, and I can connect to each XP workstation with SMB.

  • Error when joining a leopard server to an active directory

    Hi all,
    I'd like to add my mac os x server to an active directory. If I fill the "Active Directory Domain" with ip address, "Unable to add the domain, there was no response from the ip,please check that the address you entered is correct", if I fill with domain name, "Unable to add domain, An unexpected error of type -14987 (eUndefinedError) occurred.
    What's going on there???

    Hi all,
    I'd like to add my mac os x server to an active directory. If I fill the "Active Directory Domain" with ip address, "Unable to add the domain, there was no response from the ip,please check that the address you entered is correct", if I fill with domain name, "Unable to add domain, An unexpected error of type -14987 (eUndefinedError) occurred.
    What's going on there???

  • Directory Security Strange Permissions Issues (Windows Server 2003 running Active Directory)

    I have a user that all of a sudden was not able to open 70% of her files located on a file server, Windows Server 2003 running Active Directory, from her laptop. The same user can access all the same files from a different machine, logging on with the same
    credentials. Just looking for a point in the right direction and a possible theory as what could cause this problem, an why all of a sudden. I did go back through the logs but nothing sticks out. For the most part the logs on the server and the laptop are
    pretty clean. 
    Both machines are Latitude E5420s running Windows 7 Enterprise Service Pack 1. Both machines are 64bit and connect to the network via hard-wire, not wireless.
    Thanks in advanced.
    Grajek

    I would recommend proceeding that way:
    Check that your DCs are in a healthy state and AD replication is fine: It might be that the user is member of security groups and the membership is not getting replicated properly which can cause this random behavior. You can use
    dcdiag and repadmin for checks and you can refer to my recommendations here: http://social.technet.microsoft.com/wiki/contents/articles/18513.active-directory-replication-issues-basic-troubleshooting-steps-single-ad-domain-in-a-single-ad-forest.aspx
    Make  sure that the file server is reachable from the user client computer. Start with
    ping and nslookup. Also, you need to make sure that the traffic between the client and the server is not blocked or filtered. You might want to temporary disable security software for testing
    This posting is provided AS IS with no warranties or guarantees , and confers no rights.
    Ahmed MALEK
    My Website Link
    My Linkedin Profile
    My MVP Profile

  • New Server 2012 install - Active Directory not working properly

    We recently converted from 2003 to 2012. Our 2012 R2 server seems to be running fine. We did a DCPROMO on the OLD 2003 DC just fine but now there are all sorts of odd errors (Sharepoint can't authenticate users, Can't run Exchange 2013 on another 2012 server
    because it can't find AD, etc.)
    on the DC we have a Group Policy error 1096. "Group Policy Object LDAP://CN=User,cn={2B476B3E-2749-4B1B-8EC1-F5672A66F94F},cn=policies,cn=system,DC=mydom,DC=local\\mydom.local\SysVol\mydom.local\Policies\{2B476B3E-2749-4B1B-8EC1-F5672A66F94F}\User\registry.pol"
    So far I haven't found anything on how to fix this (and the AD itself.) There are some errors in the DCDIAG log, too:
          Starting test: NetLogons
             Unable to connect to the NETLOGON share! (\\ISD-DC1\netlogon)
             [ISD-DC1] An net use or LsaPolicy operation failed with error 67,
             The network name cannot be found..
    Starting test: FrsEvent
             There are warning or error events within the last 24 hours after the
             SYSVOL has been shared.  Failing SYSVOL replication problems may cause
             Group Policy problems.
    Any suggestions how we can fix these errors are greatly appreciated!

    Hi,
    Did you migrate the Active Directory from Windows server 2003 to Windows server 2012?
    Please refer to this article:
    https://blogs.technet.com/b/canitpro/archive/2013/05/27/step-by-step-active-directory-migration-from-windows-server-2003-to-windows-server-2012.aspx
    Regards.
    Vivian Wang

  • VDI 3.4 Inegrate with Windows Server 2008 R2 Active Directory

    OK,I follow the official documents step by step,I installed the vdi 3.4 in Oracle Linux 5.7(oraclevdi.jiayutester.com),then installed a window server 2008 r2 64bit(jiayudc.jiayutester.com) that made it to be the Domain Controller(jiayutester.com) and DNS,at the end,I edit the /etc/krb5.conf.I execute the following commands:
    1.getent hosts jiayudc.jiayutester.com
    --------------------My Note:Normal-----------
    2.kinit -V [email protected]
    Authenticated to Kerberos v5
    This is my krb5.conf------------------------------------
    [logging]
    default = FILE:/var/log/krb5libs.log
    kdc = FILE:/var/log/krb5kdc.log
    admin_server = FILE:/var/log/kadmind.log
    [libdefaults]
    default_realm = JIAYUTESTER.COM
    default_checksum = rsa-md5
    dns_lookup_realm = true
    dns_lookup_kdc = true
    ticket_lifetime = 24h
    forwardable = yes
    [realms]
    JIAYUTESTER.COM = {
    kdc = space-21pel8ghu.jiayutester.com
    admin_server = space-21pel8ghu.jiayu.com:749
    default_domain = jiayutester.com
    [domain_realm]
    .jiayutester.com = JIAYUTESTER.COM
    jiayutester.com = JIAYUTESTER.COM
    [appdefaults]
    pam = {
    debug = false
    ticket_lifetime = 36000
    renew_lifetime = 36000
    forwardable = true
    krb4_convert = false
    Then,I login to the web console to set company, I select Active Directory to use as User Directory,then I fill up all the needed information(I am sure that all the information I fill in the form is correct),when I click the next,error occured....it's the context:
    Unable to Connect to User Directory
    Failed to connect, no servers available
    Now,I searched everywhere for information,but I can't resolve the problem...Please help me,smart guys

    Would probably need to see your VDI instance cacao log file to see why this is failing, but you might need to add the following to [libdefaults] section of your krb5.conf file, for 2008R2 AD server:
    default_tkt_enctypes = rc4-hmac
    default_tgs_enctypes = rc4-hmac
    And then restart VDI services (/opt/SUNWvda/sbin/vda-service restart)
    Note that VDI will actually try to query individual AD servers as defines as part of your AD Global Catalog when it tries to lookup AD domain data. This means you need to verify that your global calalog referenced servers are valid and having matching forward and reverse DNS information:
    For example:
    $ *nslookup -querytype=any gc.tcp.vdi.com.*
    Server:          win2008.vdi.com
    Address:     192.168.1.100#53
    gc.tcp.vdi.com     service = 0 100 3268 win2008.vdi.com*.
    $ nslookup win2008.vdi.com.
    Server:          win2008.vdi.com
    Address:     192.168.1.100#53
    Name:     win2008.vdi.com
    Address: _192.168.1.100_
    r$ nslookup 192.168.1.100
    Server:          win2008.vdi.com
    Address:     192.168.1.100#53
    100.1.168.192.in-addr.arpa     name = win2008.vdi.com.*
    You'd want to verify that every record returned by the *nslookup -querytype=any gc.tcp.yourdoamin.com* command refers to a server that can be reached and has matching forward and reverse DNS. Otherwise, this may trigger VDI to have failures or delays in performing directory queries.
    Beyond that, you need to look in the cacao.log file for errors that you can find and post.
    Edited by: DoesNotCompute on Oct 13, 2012 11:48 AM

  • Windows 2008 Server - Cannot run Active Directory Users and Computers

    Hi,
    I am running Windows 2008 Server with latest windows updates installed. Directory Services Role also.
    I attempt to open Active Directory Users and Computers tool and I get a;
    Microsoft Visual C++ Runtime Library error;
    "The Application has requested the runtime to terminate it in a unusual way. Please contact the application's support team for more information"
    I click ok, then get the following debug info;
    Problem signature:
    Problem Event Name: APPCRASH
    Application Name: mmc.exe
    Application Version: 6.0.6001.18000
    Application Timestamp: 47919524
    Fault Module Name: msvcrt.dll
    Fault Module Version: 7.0.6001.18000
    Fault Module Timestamp: 4791ad6b
    Exception Code: 40000015
    Exception Offset: 0000000000029b06
    OS Version: 6.0.6001.2.1.0.272.7
    Locale ID: 3081
    Additional Information 1: 43aa
    Additional Information 2: cf3a46656318492c1997480001b6b0e0
    Additional Information 3: 3837
    Additional Information 4: 92f72e0d0589ff77cef51e0a413aeff6
    Read our privacy statement:
    http://go.microsoft.com/fwlink/?linkid=50163&clcid=0x0409
    If someone could please assist, it would be very much appreciated.
    Regards
    B

     
    Hi,
    To solidly troubleshoot this kind of issue, we need to debug dump file. A suggestion would be to contact Microsoft Customer Service and Support (CSS) via telephone so that a dedicated Support Professional can assist with your request.
    To obtain the phone numbers for specific technology request please take a look at the web site listed below:
    http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone#faq607
    However, I am also glad to share my research.
    Some third party applications may lead to this error. Please check if you install other third party applications on Windows server 2008?
    Also, please follow the article below to perform necessary steps to see how it's going?
    FIX: You receive an "invalid page fault in module MSVCRT.DLL" error message after you install the run-time libraries from Visual C++ 6.0
    http://support.microsoft.com/kb/190536/en-us
    Hope this helps.
    Best wishes
    Morgan Che

  • Upgrade from Windows Server 2012 Active Directory to Windows Server 2012 R2 Active Directory

    We are currently running Windows Server 2012 Active Directory and would like to upgrade to Windows Server 2012 R2 AD. Is it OK to just do an in-place upgrade, or is it advisable to build new domain controllers on R2? Are there any guides or articles anyone
    can recommend?

    Hi Ginandtonic,
    To upgrade DC(Domain Controller) from windows server 2012 to windows server 2012 r2, please refer to these articles:
    Upgrade from windows Server 2012 to 2012 R2                                 
    Upgrade Active Directory from 2012 to 2012 R2
    I hope this helps.
    Best Regards,
    Anna

  • Lion Server not reading Active Directory Groups reliably

    I am trying to upgrade one of our XServes from Snow Leopard Server to Lion Server and am running into a strange issue with our Active Directory based users and Groups.
    The current Snow Leopard Server serving files from a XSan volume is running fine, though we find a very long Lag time for Windows users to connect. Once a few users have connected the lag seems to go away, but it is still not nearly as fast as Mac users connecting or Windows connecting to a PC server.
    So I have connected a second Xserve to the SAN and performed a clean install of Lion Server. Initially while it would find my Active Directory Groups it would not import any of the users, so obvioulsly no one could connect. In a last ditch effort I installed the beta of 10.7.4, which seemed to resolve the issue for a small group of test users. However as I expanded the test I found that some users would get a message that the were no resources available to them, or they didn't have the correct permissions. This is very strange as everyone is in the same group so should have the same permissions. As a test I took one of the user accounts and created a new share and gave him R/W permission to that share and suddenly all of the shares that he should have had permission to in the first place popped up.
    The only thing that I can think of is that we have such a large Active Directory structure that the authentication is timing out or reaching some user limit and stops looking. (we have over 50,000 users and thousands of groups spread through multiple OUs in the AD structure)
    The new Server.app in Lion looks nice, but it does not seem to have nearly the robustness of the previous Server Admin tools. For instance, I never needed or wanted to setup a "Golden Triangle" but with Lion it is required. Perviously I could search for AD users or groups and drag them from the search window to the share to assign permission, now even though I've imported the groups and users it needs to search the entire directory when assigning permissions - why can't it see the groups that are already there? Why can I run a dscl search and find a user or group instantly, but the Server.app hangs for 5 minutes and shows 0 results?
    Has anyone found a way to make Lion Server work in an enterprise environment?

    Yesterday morning I bound a 10.7.4 server to our AD, and in the afternoon I eventually saw all the AD users, groups, etc show in Workgroup Manager. Now, with dscl, I can see all the AD user and group records, and with Workgroup Manager, I can search the groups, users, and computers, but with the Server.app, when trying to create new group of the type "Imported group from another directory", the searches returned nothing. Directory Utility can show all the AD information also. Our AD has thousands of user record, and so it is reasonable that it may take some time for the Mac server to get all the info. But from the add users or groups interface, I just could not get any search results. What could be wrong then? 

  • Does Sun Messaging Server support Microsoft Active Directory

    Hello,
    I just got this qustion. Does Sun Messaging Server work with Microsoft Active Directory?
    Thanks.

    Please post in the messaging server forum: [http://forums.sun.com/forum.jspa?forumID=708|http://forums.sun.com/forum.jspa?forumID=708]

  • X-Serve not finding active directory

    My X-Serve has begun to behave somewhat peculiarly.
    I recently had SNow Leopard installed, and it had been working fine. I was deploying using deploy studio, it was all working fine. Then one day suddenly it just seems not to be able to find the active directory.
    The AD is the PC network, I also can't connect to the internet. (And I've checked the proxies)
    Also Server Admin has started throwing up errors saying it can't find the X-Serve... I'm a little confused as to why it can't find itself. Also the workstations now can't find the deploy studio server.
    I can see the X-Serve remotely and operate it.
    Any clues?
    I've rebooted, I've fixed preferences, I'd update, but I can't get on the internet.

    Just speaking to the loss of AD, If you are running Deep Freeze you may need to run a command that sets passinterval to 0.
    http://www.mikespike.org/2008/08/12/osx-leopard-deep-freeze-and-active-directory -oh-my

  • SBS 2008 to Server 2012 R2 Active Directory Migration

    Is there a tool that i can use to migrate Active Directory from SBS 2008 to Server 2012 R2?

    There is no special tool for your situation. While there is a tool called ADMT that you may see mentioned if you search enough, it isn't really well suited for what you want.
    With that said, there is also no *need* for a tool as I've already said. Nor do you need to recreate the users and have mismatched SIDs. You will add the 2012 machine to your existing domain and make it a domain controller. Yes, that means you will have
    two DCs (for a time.)  This is how larger organizations handle multiple DCs all the time, and they obviously don't go and create the same user on each DC. That is where the domain replication comes in.  Your new server will be a DC and will replicate
    all of the users *and* SIDs from the existing SBS server. 
    Then, when you are ready, you decommission the SBS 2008 server gracefully and the new 2012 server becomes your sole DC, but has AD completely intact. It is a tried and true practice, both within and outside of the SBS world, and has been done many many times.

  • Server 2012 restrict active directory dynamic ports

    Hello,
    Has anyone encountered issues with restricting the Active Directory dynamic ports for Netlogon and NTDS in Server 2012?  I have followed the added the typical registry entries as described below but I still see my RDS gateway in the DMZ trying to communicate
    to my internal DC over other ephemeral ports (49158).  I have rebooted the DC after the registry changes and still no effect.  Are the reg entries the same in 2012?  Any help would be appreciated.  Thank you
    Registry key 1 
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters 
    Registry value: TCP/IP Port 
    Value type: REG_DWORD 
    Value data: 49152 (This value needs to be specified in decimal format)
    Registry key 2 
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters 
    Registry value: DCTcpipPort 
    Value type: REG_DWORD 
    Value data: 49153 (This value needs to be specified in decimal format)
    Eddie Espino | Secure Data Solutions | Miami, Florida | Microsoft Partner

    Hi,
    There are at least two options that can be used to allow replication when there are network traffic filters (aka firewall) in the network, across two DCs:
    1. Use registry keys on the DCs to force communication over specific ports
    2. Use IPsec to restrict the traffic to two ports only (IP 50 and IP 51)
    I tried to find some relevant documents, but could not find support for restricting the Active Directory dynamic ports for Netlogon and NTDS in Server 2012. You could refer to the following article, it may help you to solve your issues:
    Restricting AD Replication Traffic between DCs to only a few ports
    http://blogs.technet.com/b/luistog/archive/2012/05/08/restricting-ad-replication-traffic-between-dcs-to-only-a-few-ports.aspx
    Regards,
    Mandy Ye

  • Cannot Bind Leopard Server to Windows Active Directory

    Trying to Bind new Leopard Server but keep getting an Unknown error. it there an issue with the new Server OS?
    This is the error
    12/10/07 6:36:37 PM com.apple.launchd[1] (0x0-0x2c02c.com.apple.ServerAdmin4479) Exited abnormally: Segmentation fault
    12/10/07 6:37:08 PM Directory Utility236 Step 1 of 6: Searching for Forest/Domain information
    12/10/07 6:37:08 PM Directory Utility236 Binding failed with error -14120
    12/10/07 6:37:29 PM DirectoryService4626 * +NSCFArray shouldAttemptCheck: unrecognized selector sent to class 0xa0101740
    12/10/07 6:37:30 PM com.apple.launchd[1] (com.apple.DirectoryServices4626) Exited abnormally: Bus error

    Okay, I have now managed to setup up the server. I did this by creating a Open Directory Master and then binding that to our Active Directory. I have setup Active Directory and LDAP binding on the client Macs.
    I then added a user from AD into Workgroup Manager and applied a few preferences. They worked brilliantly. However, the computer Workgroup Manager preferences are not working at all! Is there a different way to add computers to Workgroup Manager (I added them by using the + sign and dragging them in from AD) and is there a way to automatically add a computer once it's joined to the domain, like it goes in to AD?

Maybe you are looking for