MAB and Active directory check

Hi
I have ISE 1.2
I would like to know if it is possible to configure AD check for MAB user
I have some user that are authenticated by MAB
But I need to add another check for those user, ISE should check the Active directory group user widows session
Is it possible to do it ?
How can I configure it for wired and wireless user ?
Thanks in advance

Yes, you can definitely do this. I have done this in my previous deployments for "Whitelisting" users. My policy was like this:
1. I created an Identity Group called "Whitelist"
2. Statically added all of the needed mac address to that group
3. For wireless, I created a dedicated "Policy Set" for that SSID. In the policy set I created a rule that:
- Checked for domain group membership (For instance, domain users or domain computers)
- Checked if the "Internal Identity Store" was "Whitelist"
4. For wired, I also have a dedicated "Policy Set" and you can basically duplicate the rule from wireless. 
I hope this helps!
Thank you for rating helpful posts!

Similar Messages

  • Sun java directory server and Active Directory

    We are using two different directory servers Sun java directory server and active directory.
    My question is how we can have password synchronization between these two directory servers.
    I have checked Sun Java[TM] System Identity Synchronization for Windows 1 2004Q3
    http://www.sun.com/download/products.xml?id=41537425
    It seems that it's supported platforms is only for solaris and windows , but I have installed my Sun java directory server on linux and obviously it doesn't work for me.
    I would be grateful if anyone can suggest a solution to work around this situation.
    I have checked identity manager , I would like to know that if I can do this using this product.
    http://www.sun.com/software/products/identity_mgr/specs.jsp
    --regards.
    Sara

    Yes RHEL 4 is a supported OS with DSEE 6.0.
    Identity Synchronization for Windows is a part of DSEE that allows synchronization of users, passwords and groups between Sun Directory Server and Active Directory bi-directionally without altering the users environments, ie it does not require that users change their current habits.
    Identity Manager is a complete identity management solution that is targetting enterprise work flow when it comes to user provisioning and de-provisioning, but also allows to build authentication and password change forms that will provision the passwords to many different systems including Sun Directory Server and Active Directory but also IBM mainframes, legacy applications, databases...
    If you are implementing a complete identity management solution, then go with Identity Manager. If you need a lightweight and fast solution for just synchronizing users and passwords between Sun DS and MS AD, Identity Synchronization for Windows should be your choice.
    Regards,
    Ludovic.

  • Cucm 9.1.2 and Active Directory(Windows Server 2003 Standart Edition SP2)

      Hello!
     Can CUCM 9.1.2 support an integration with Active Directory(Windows Server 2003 Standart Edition SP2)? How do I have to write down LDAP Manager Distinguished Name? I can find supporting only Active Directory 2003 in documentations without reference to Operation System.

    Yes, it is possible.
    Check this how-to if you have any doubts about the process.
    http://blog.ipexpert.com/2010/04/28/cucm-and-active-directory-integration/
    http://www.markholloway.com/blog/?p=1189

  • Looking for successful auth debug between cisco 1113 acs 4.2 and Active Directory

    Hello,
    Does anyone have a successful authentication debug using cisco 1113 acs 4.2 and Active Directory?  I'm not having success in setting this up and would like to see what a successful authentication debug looks.  Below is my current situation:
    Oct  6 13:52:23: TPLUS: Queuing AAA Authentication request 444 for processing
    Oct  6 13:52:23: TPLUS: processing authentication start request id 444
    Oct  6 13:52:23: TPLUS: Authentication start packet created for 444()
    Oct  6 13:52:23: TPLUS: Using server 110.34.5.143
    Oct  6 13:52:23: TPLUS(000001BC)/0/NB_WAIT/46130160: Started 5 sec timeout
    Oct  6 13:52:23: TPLUS(000001BC)/0/NB_WAIT: socket event 2
    Oct  6 13:52:23: T+: Version 192 (0xC0), type 1, seq 1, encryption 1
    Oct  6 13:52:23: T+: session_id 763084134 (0x2D7BBD66), dlen 26 (0x1A)
    Oct  6 13:52:23: T+: type:AUTHEN/START, priv_lvl:15 action:LOGIN ascii
    Oct  6 13:52:23: T+: svc:LOGIN user_len:0 port_len:6 (0x6) raddr_len:12 (0xC) data_len:0
    Oct  6 13:52:23: T+: user: 
    Oct  6 13:52:23: T+: port:  tty515
    Oct  6 13:52:23: T+: rem_addr:  10.10.10.10
    Oct  6 13:52:23: T+: data: 
    Oct  6 13:52:23: T+: End Packet
    Oct  6 13:52:23: TPLUS(000001BC)/0/NB_WAIT: wrote entire 38 bytes request
    Oct  6 13:52:23: TPLUS(000001BC)/0/READ: socket event 1
    Oct  6 13:52:23: TPLUS(000001BC)/0/READ: Would block while reading
    Oct  6 13:52:23: TPLUS(000001BC)/0/READ: socket event 1
    Oct  6 13:52:23: TPLUS(000001BC)/0/READ: read entire 12 header bytes (expect 16bytes data)
    Oct  6 13:52:23: TPLUS(000001BC)/0/READ: socket event 1
    Oct  6 13:52:23: TPLUS(000001BC)/0/READ: read entire 28 bytes response
    Oct  6 13:52:23: T+: Version 192 (0xC0), type 1, seq 2, encryption 1
    Oct  6 13:52:23: T+: session_id 763084134 (0x2D7BBD66), dlen 16 (0x10)
    Oct  6 13:52:23: T+: AUTHEN/REPLY status:4 flags:0x0 msg_len:10, data_len:0
    Oct  6 13:52:23: T+: msg:  Username:
    Oct  6 13:52:23: T+: data: 
    Oct  6 13:52:23: T+: End Packet
    Oct  6 13:52:23: TPLUS(000001BC)/0/46130160: Processing the reply packet
    Oct  6 13:52:23: TPLUS: Received authen response status GET_USER (7)
    Oct  6 13:52:30: TPLUS: Queuing AAA Authentication request 444 for processing
    Oct  6 13:52:30: TPLUS: processing authentication continue request id 444
    Oct  6 13:52:30: TPLUS: Authentication continue packet generated for 444
    Oct  6 13:52:30: TPLUS(000001BC)/0/WRITE/46130160: Started 5 sec timeout
    Oct  6 13:52:30: T+: Version 192 (0xC0), type 1, seq 3, encryption 1
    Oct  6 13:52:30: T+: session_id 763084134 (0x2D7BBD66), dlen 15 (0xF)
    Oct  6 13:52:30: T+: AUTHEN/CONT msg_len:10 (0xA), data_len:0 (0x0) flags:0x0
    Oct  6 13:52:30: T+: User msg: <elided>
    Oct  6 13:52:30: T+: User data: 
    Oct  6 13:52:30: T+: End Packet
    Oct  6 13:52:30: TPLUS(000001BC)/0/WRITE: wrote entire 27 bytes request
    Oct  6 13:52:30: TPLUS(000001BC)/0/READ: socket event 1
    Oct  6 13:52:30: TPLUS(000001BC)/0/READ: read entire 12 header bytes (expect 16bytes data)
    Oct  6 13:52:30: TPLUS(000001BC)/0/READ: socket event 1
    Oct  6 13:52:30: TPLUS(000001BC)/0/READ: read entire 28 bytes response
    Oct  6 13:52:30: T+: Version 192 (0xC0), type 1, seq 4, encryption 1
    Oct  6 13:52:30: T+: session_id 763084134 (0x2D7BBD66), dlen 16 (0x10)
    Oct  6 13:52:30: T+: AUTHEN/REPLY status:5 flags:0x1 msg_len:10, data_len:0
    Oct  6 13:52:30: T+: msg:  Password:
    Oct  6 13:52:30: T+: data: 
    Oct  6 13:52:30: T+: End Packet
    Oct  6 13:52:30: TPLUS(000001BC)/0/46130160: Processing the reply packet
    Oct  6 13:52:30: TPLUS: Received authen response status GET_PASSWORD (8)
    Oct  6 13:52:37: TPLUS: Queuing AAA Authentication request 444 for processing
    Oct  6 13:52:37: TPLUS: processing authentication continue request id 444
    Oct  6 13:52:37: TPLUS: Authentication continue packet generated for 444
    Oct  6 13:52:37: TPLUS(000001BC)/0/WRITE/46130160: Started 5 sec timeout
    Oct  6 13:52:37: T+: Version 192 (0xC0), type 1, seq 5, encryption 1
    Oct  6 13:52:37: T+: session_id 763084134 (0x2D7BBD66), dlen 16 (0x10)
    Oct  6 13:52:37: T+: AUTHEN/CONT msg_len:11 (0xB), data_len:0 (0x0) flags:0x0
    Oct  6 13:52:37: T+: User msg: <elided>
    Oct  6 13:52:37: T+: User data: 
    Oct  6 13:52:37: T+: End Packet
    Oct  6 13:52:37: TPLUS(000001BC)/0/WRITE: wrote entire 28 bytes request
    Oct  6 13:52:37: TPLUS(000001BC)/0/READ: socket event 1
    Oct  6 13:52:37: TPLUS(000001BC)/0/READ: read entire 12 header bytes (expect 33bytes data)
    Oct  6 13:52:37: TPLUS(000001BC)/0/READ: socket event 1
    Oct  6 13:52:37: TPLUS(000001BC)/0/READ: read entire 45 bytes response
    Oct  6 13:52:37: T+: Version 192 (0xC0), type 1, seq 6, encryption 1
    Oct  6 13:52:37: T+: session_id 763084134 (0x2D7BBD66), dlen 33 (0x21)
    Oct  6 13:52:37: T+: AUTHEN/REPLY status:7 flags:0x0 msg_len:27, data_len:0
    Oct  6 13:52:37: T+: msg:  Error during authentication
    Oct  6 13:52:37: T+: data: 
    Oct  6 13:52:37: T+: End Packet
    Oct  6 13:52:37: TPLUS(000001BC)/0/46130160: Processing the reply packet
    Oct  6 13:52:37: TPLUS: Received Authen status error
    Oct  6 13:52:37: TPLUS(000001BC)/0/REQ_WAIT/46130160: timed out
    Oct  6 13:52:37: TPLUS(000001BC)/0/REQ_WAIT/46130160: No sock_ctx found while handling request timeout
    Oct  6 13:52:37: TPLUS: Choosing next server 101.34.5.143
    Oct  6 13:52:37: TPLUS(000001BC)/1/NB_WAIT/46130160: Started 5 sec timeout
    Oct  6 13:52:37: TPLUS(000001BC)/46130160: releasing old socket 0
    Oct  6 13:52:37: TPLUS(000001BC)/1/46130160: Processing the reply packet
    Oct  6 13:52:49: TPLUS: Queuing AAA Authentication request 444 for processing
    Oct  6 13:52:49: TPLUS: processing authentication start request id 444
    Oct  6 13:52:49: TPLUS: Authentication start packet created for 444()
    Oct  6 13:52:49: TPLUS: Using server 172.24.5.143
    Oct  6 13:52:49: TPLUS(000001BC)/0/NB_WAIT/46130160: Started 5 sec timeout
    Oct  6 13:52:49: TPLUS(000001BC)/0/NB_WAIT: socket event 2
    Oct  6 13:52:49: T+: Version 192 (0xC0), type 1, seq 1, encryption 1
    Oct  6 13:52:49: T+: session_id 1523308383 (0x5ACBD75F), dlen 26 (0x1A)
    Oct  6 13:52:49: T+: type:AUTHEN/START, priv_lvl:15 action:LOGIN ascii
    Oct  6 13:52:49: T+: svc:LOGIN user_len:0 port_len:6 (0x6) raddr_len:12 (0xC) data_len:0
    Oct  6 13:52:49: T+: user: 
    Oct  6 13:52:49: T+: port:  tty515
    Oct  6 13:52:49: T+: rem_addr:  10.10.10.10
    Oct  6 13:52:49: T+: data: 
    Oct  6 13:52:49: T+: End Packet
    Oct  6 13:52:49: TPLUS(000001BC)/0/NB_WAIT: wrote entire 38 bytes request
    Oct  6 13:52:49: TPLUS(000001BC)/0/READ: socket event 1
    Oct  6 13:52:49: TPLUS(000001BC)/0/READ: Would block while reading
    Oct  6 13:52:49: TPLUS(000001BC)/0/READ: socket event 1
    Oct  6 13:52:49: TPLUS(000001BC)/0/READ: read entire 12 header bytes (expect 43bytes data)
    Oct  6 13:52:49: TPLUS(000001BC)/0/READ: socket event 1
    Oct  6 13:52:49: TPLUS(000001BC)/0/READ: read entire 55 bytes response
    Oct  6 13:52:49: T+: Version 192 (0xC0), type 1, seq 2, encryption 1
    Oct  6 13:52:49: T+: session_id 1523308383 (0x5ACBD75F), dlen 43 (0x2B)
    Oct  6 13:52:49: T+: AUTHEN/REPLY status:4 flags:0x0 msg_len:37, data_len:0
    Oct  6 13:52:49: T+: msg:   0x0A User Access Verification 0x0A  0x0A Username:
    Oct  6 13:52:49: T+: data: 
    Oct  6 13:52:49: T+: End Packet
    Oct  6 13:52:49: TPLUS(000001BC)/0/46130160: Processing the reply packet
    Oct  6 13:52:49: TPLUS: Received authen response status GET_USER (7)
    The 1113 acs failed reports shows:
    External DB is not operational
    thanks,
    james

    Hi James,
    We get External DB is not operational. Could you confirm if under External Databases > Unknown User           Policy, and verify you have the AD/ Windows database at the top?
    this error means the external server might not correctly configured on ACS external database section.
    Another point is to make sure we have remote agent installed on supported windows server.
    http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_solution_engine/4.2/installation/guide/remote_agent/rawi.html#wp289013
    Also provide the Auth logs from the server running remote agent, e.g.:-
    AUTH 10/25/2007 15:21:31 I 0376 1276 External DB [NTAuthenDLL.dll]:
    Attempting Windows authentication for user v-michal
    AUTH 10/25/2007 15:21:31 E 0376 1276 External DB [NTAuthenDLL.dll]: Windows
    authentication FAILED (error 1783L)
    thanks,
    Vinay

  • ### How to make integration between UCCX and Active Directory##

    Hello,
    I want to know what is the right procedure to perform a right integration between the UCCX and the Active Directory?
    Waiting Yours Reply,,,,
    Thanks a lot......

    What version?
    Assuming a current version (5.0 and higher): there is NO direct integration between CCX and Active Directory. The CCX server must not be joined to a domain.
    CCX uses UC Manager End Users for synchronized usernames and passwords. If UC Manager is synchronized with an LDAP source, such as Active Directory, then this will carry forward to CCX. CCX would pass authentication requests to CCX through AXL. UCM would perform the LDAP authentication and inform CCX of the success/failure.

  • Difference between Windows NT domain registry and Active Directory registry

    What are the difference(s) ?

    Frank, thanks for your response :)
    I want WebSphere Application Server to take advantage of a directory service. There are multiple options available for a directory service. 
    In my configuration the requirement is to make WebSphere Application server to use Microsoft's Active Directory. 
    While I was going through (WebSphere) documentation, I see following note.
    " With Windows NT domain registry support for Windows 2000 and 2003 domain
    controllers, WebSphere Application Server only supports Global groups that are the Security type. It is recommended that you use the Active Directory registry support rather than a Windows NT domain registry if you use Windows 2000 and 2003 domain controllers
    because the Active Directory supports all group scopes and types. The Active Directory also supports a nested group that is not support by Windows NT domain registry. The Active Directory is a centralized control registry."
    You can find the above note in this link (somewhere after 7th line)
    http://www-01.ibm.com/support/knowledgecenter/SSAW57_7.0.0/com.ibm.websphere.nd.multiplatform.doc/info/ae/ae/csec_localos.html?cp=SSAW57_7.0.0%2F3-11-5-1-0-0
    Does it mean that they are recommending to use Active Directory over Windows NT (which is an older approach) with windows server 2000 or windows server 2003 because Active directory is
    advanced ?
    I was under the impression that, Active Directory was started with Microsoft Windows Server 2003 and Windows NT registry was used till Windows 2000 server.
    After going through above links, 
    Windows NT registry in an old method. However, it is compatible with Windows Server 2000 and Windows server 2003 but it is recommended to use Active directory with Windows Serve 2003 as it is more advanced. And the same is recommended in WebSphere documentation
    (I am aware that support for Windows Server 2000 is over and only extended support is available for Windows Server 2003 however this is to clear doubt). Is my understanding correct ? And does windows server 2000 also support both i.e we can use either Windows
    NT registry or Active directory and similarly, Either of them (Windows NT or Active Directory) could be used with Windows Server 2003 ?
    And if I got it correct, Is Windows NT and Active Directory, both directory service offering from Microsoft? While NT being an old method and Active Directory being a new/advanced approach ?

  • Step by step process to create domain name and active directory in windows 7 64 bit

    Step by step process to create domain and active directory in windows 7 64 bit
    I work in an organization
    I want to create a domain name SBBYDP and make it server for other computers
    I want that, all users’ have a personal account while they use any computer from this organization, even they use any computer from this network they use their own account to login to network.
    And this may be in Active directory option.
    I installed windows 7 professional edition 64 bit
    Can any person help me? Step by step process, I always thanks full all of you

    Hi,
    You must use the Windows Server platform system for the AD service, you can refer the following KB first:
    Active Directory
    http://technet.microsoft.com/en-us/library/bb742424.aspx
    AD DS Deployment Guide
    http://technet.microsoft.com/zh-cn/library/cc753963(v=ws.10).aspx
    Hope this helps.
    We
    are trying to better understand customer views on social support experience, so your participation in this
    interview project would be greatly appreciated if you have time.
    Thanks for helping make community forums a great place.

  • DNS and Active Directory error 4000 server 2008

    Hello all,
    My network skills aren't very good and I'm facing a dilemma. First off we have two Windows servers on the network. The newest is 2008 Standard (named Vader) and the other is 2000 (dells3). Obviously I'd like to get rid of the 2000, but the people in charge
    of my budget haven't given me the option to do so and it's the only back up we have.
    Earlier in the week we had lots of problems. One of our nas boxes locked everyone out who was mapped to it and it would only let me log in through the web portal. Two of our Macs our marketing department uses suddenly locked up and wouldn't let them back
    in (both were part of the Active Directory). A second nas box won't let certain people map to it and for awhile I had issues logging into Vader itself.
    I believe all of these problems are connected to some issues on Vader and possibly in conduction with dells3. In Server Manager under DNS I get error 4000 "The DNS server was unable to open Active Directory. 
    This DNS server is configured to obtain and use information from the directory for this zone and is unable to load the zone without it.  Check that the Active Directory is functioning properly and reload the zone. The event data is the error code."
    Then under Active Directory Domain Services I get error 2042 "It has been too long since this machine last replicated with the named source machine. The time between replications with this source has exceeded
    the tombstone lifetime. Replication has been stopped with this source."
    Followed by more text I can post if needed.
    Under File Services error 1202 "The DFS Replication service failed to contact domain controller  to access configuration information. Replication is stopped. The service will try again during the
    next configuration polling cycle, which will occur in 60 minutes. This event can be caused by TCP/IP connectivity, firewall, Active Directory Domain Services, or DNS issues."
    And finally if I try to open Active Directory Domains and Trusts "The configuration information describing this enterprise is not available. The server is not operational."
    I'm not sure where to start or what to post that might help. Any and all help is appreciated.
    Edit: Also I can only add dells3 as the DNS on Vader in the DNS Manager if I try to add Vader to itself I get an error.

    It's the other way around.  Overall, I'm advising ripping the 2008 server out of AD and adding it back . Let's look at this as a series of steps:
    1.) You do a force demote of the 2008 server because it's tombstoned.  This means the 2008 server is no longer a DC. You are doing a force because it doesn't have the ability to replicate.  If it could replicate, we'd just do a graceful demotion
    and be done with it.
    2.) Once the 2008 server is demoted, we go to the 2000 server which holds the only good copy of AD.  From that server we run a metadata cleanup using the ntdsutil utility.  We use that utility to clean out references to the 2008 server which is
    no longer a DC.
    3.) Once you have a clean AD, you can then promote the 2008 server back into Active Directory.  Make sure Vader is pointing to Dells3 as its primary DNS server before promoting or you'll run into issues.
    Hopefully that clarifies things. 

  • NAC, OOB wireless and Active directory

    Hello.
    Here we need to set up Network Access with OOB wireless and authentication via Active Directory. I have followed this guide but still can't get it work.
    http://www.cisco.com/en/US/products/ps6128/products_configuration_example09186a0080a138cc.shtml
    In my scenario:
    CAM NAC: 192.168.7.100
    CAS NAC: 192.168.9.9
    WLC 5508: 192.169.9.2
    AD and DHCP servers: 192.168.7.2 and 192.168.8.2
    APs and clients range: 192.168.9.0/23
    when i Check "Radius Server Overwrite interface" and select NAT state: SNMP NAC on the following images....
    I try to navegate and I get the Login default page that I already configured asking me for credentials, I type them but it get stucks there. I have already configured everything showed on the guide posted above. Do I need to do something else that is not explicitly explained in the guide?
    Thanks in advance.

    Sarayanan
    I just tried without "Radius Server Overwrite interface" checked and got the same results. WLAN is mapped with interface managment
    AP group is the default one.
    Here are the CAM logs
    On the NPS windows server 2008 cant see any log about this connection. Please give me some advices.
    Thanks in advance.

  • Word 2013 and Active Directory attribut

    Hi,
    I'm working with WS2008R2 SP1 AD and Office standard 2013 and W7 SP1 x64. Our compagny wants to create .dotm/.dotx with automatic fields.
    For example, we want that when a user opens a .dotx his name appears automatically. This one is easy it's the {AUTHOR \*MERGEFORMAT}.
    But What we want to do is to do the same for the:
    - street adress
    - email adress
    - the job title
    All informations are in our Active Directory, but it seems that Word does not read directly the Active Directory info but some cached info on the computer.
    So, is there a way or workaround to create some .dotx with the possibility to extrat some AD fields attribut attached with some user and at the end to build a semi automatic doc with the information of the user who has open this .dotx/.dotm?
    So far, clues say that I have to write some vba script and 2 kind of solution/workaround:
    The first lead is:
    To retrieve the user account properties from Active Directory, we have to turn to some VBA scripts, no way to achieve this via any built-in features.
    As far as I know, you can bind to the user account object by using the
    GetObject function and the LDAP provider.
    Then use the GetInfo method to initialize the local cache with attributes of the user account object. This step will ensure that the most up-to-date attribute values of the ADSI object are retrieved.
    For example:
    Set objUser = GetObject _
    ("LDAP://...")
    objUser.GetInfo
    If you want to get this attributes when you create a new document based on a template (.dotx/.dotm), you'll need to use the
    AutoNew macro.
    the second lead is:
    http://heureuxoli.developpez.com/office/word/creermodele/#L2-G
    Thank you in advance for any king od answer.
    best regards

    Hello,
    Have you tried these two methods? What is the result and what is your decision?
    If you're familiar with Visual Studio IDE and .Net Framework, I would recommend that you create a application-level or document-level Add-In for word. Because it's easy to access the AD with managed code, and it's suitable in your case. You can check the
    MSDN document here for the related objects you need to use in .Net Framework to access AD:
    https://msdn.microsoft.com/en-us/library/gg145037(v=vs.110).aspx
    But if you just want to use VBA for Word, this kb article tells you how to do this via ADO connection:
    https://support.microsoft.com/kb/187529/en-us?wa=wsignin1.0
    If you want to know something about Active Directory itself, then it's not the correct forum, you can open up new thread in the AD forums for help.
    Thanks for your understanding.
    We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
    Click
    HERE to participate the survey.

  • DNS, Certificates, and Active Directory - School Setup Issues

    Our school has been piloting a small iPad depolyment.  I have been struggling with getting Profile Manager to work correctly since August of last year. Here's the setup:
    1. Active Directory DNS/DHCP server (set as "school.local"--yes, I know .local is bad form, but it was set before I got here). I have changed the "Digest" to "Basic" setting
    2. Mac Mini server that has its own external IP and hostname ("mac.school.org") and is also bound to the AD server for user authentication for services (Profile Manager, WebDAV, wiki, etc.). I have a self-signed SSL certificate installed under the name "mac.school.org"
    3. About 90 iPads, and a handfull of Mac desktops
    In a perfect world, users would be able to login (with their AD credentials) to the Profile Manager self-service portal using the external hostname of the mac server ("mac.school.org/mydevices"), install the Trust Profile, and enroll the device (iPad, Mac, etc).
    However, this is not the case.  The setup seems to work for awhile; quite perfectly in fact. But then for reasons unknown to me, everything just "breaks" and Profile Manager ceases to work like it should. Here are some of issues I am seeing:
    a.) DNS service on the Mac server turns itself ON randomly.  DNS should NOT be running this server, correct? All DNS lookups internally are done by the AD server. I've used changeip and everything matches (both say "mac.school.org")
    b.) Whenever we use VPN, and at other seemingly random times, the server's hostname changes from "mac.school.org" to "mac.school.local" I would make the server external only, but it needs to have an internal IP to talk to the AD server.
    c.) AD binding breaks randomly and I have to rebind the server to AD
    d.) When enrolling devices, Profile Manager starts rejecting certificates (not a trusted source, etc.) and I have to destroy OD and PM and start all over again.
    I know this is a lot and I'm not necessarily expecting anyone to answer all of these questions. I guess I'm wondering if anyone could point me in the right direction? I've looked for help with these issues all over the place, but none of the environments I read about are quite like the one I'm in.

    Yes, I am not giving the real domain name here.
    No prob. just checking, sometimes people have weird domain names never know if they are real or they expect them to be real or they put domain names owned by someone else on their internal network eek.
    Not really needed to use mac.school.org internally, that is in local LAN. The thing to understand about DNS is the scope for which a DNS zone is relevant WRT a client machine — inside LAN or on Internet, and which DNS server is authoritative for a domain. Authoritative in the sense of 'the final word'.
    Go to Network Utility on your mac, type in your real domain name (whatever you are changing to school.org to hide it) what comes back. On my server I see the below (I have replaced my real, Internet legal domain, to 'example.com')
    In my setup I have, on the LAN, setup the Mac server to be authoritative for domain 'example.com'. On the Internet however it is another external DNS server.
    So you have set DNS forwarders on the Mac machine?
    I really don't believe that the machine's hostname is changing, it is statically configured. What I believe is happening is that DNS name resolution is telling you different things at different times because you are using different DNS servers.
    On mac machine terminal type $less /etc/resolv.conf and copy paste what it says. In server app Services | DNS right side does it say you have forwarders?
    Still it is not good to have two DNS domains in your internal LAN, there is no need to have school.org on the mac DNS unless it is going to be fully setup to be authoritative in the internal LAN for the domain school.org. You can have school.org on the Internet (Internet scope of users point 1) and school.local on internal machine (LAN scope of users).
    Lookup has started…
    Trying "example.com"
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53292
    ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1
    ;; QUESTION SECTION:
    ;example.com.                   IN        ANY
    ;; ANSWER SECTION:
    example.com.     10800          IN        SOA          example.com. admin.example.com. 2013010907 3600 900 1209600 86400
    example.com.     10800          IN         NS          server.example.com.
    example.com.     10800          IN         MX          10 server.example.com.
    ;; ADDITIONAL SECTION:
    server.example.com. 10800       IN          A          192.168.1.20
    Received 145 bytes from 127.0.0.1#53 in 2 ms

  • Oracle 9i and Active directory

    Hi,
    We have Oracle 9i R2 and windows 2003 Active Directory as domain controller on the same server.
    I'm not comfortable with this idea having both on the same machine and I am considering to put them on separate servers, and to integrate Oracle with Active Directory.
    Is it advisable to leave then on the same machine? are there any known problems?
    I couldn't find any documents from Oracle regarding this. any suggestions any links will be appreciated.
    Tony Garabedian

    If I remove the server of being a domain controller with AD (dcpromo out, and losing the Administrator profile on that machine) and leave only Oracle on it, will Oracle still be functional?Yes. But I'd check file access rights. Anyway you'll still have local Admin account available. Think about:
    . I got a domain admin account
    . I install Oracle
    . I leave the company and my account is deleted
    => oracle is still working perfectly
    I can't see any reason this would work otherwise in your case. Anyway you could just create a full server backup, and if any problem restore it (Ghost for example).
    The sole problem would be if you defined oracle users identified via AD acess, but that works weird anyway.
    Furthermore, I totally agree with Jaffar. Use OID rather than AD. We had many problems to setup a working config there... afterwards this was too much time-consuming to manage and I changed it to OID. Since then it's working kind of magic.
    Regards,
    Yoann.

  • Route mail and Active Directory Sites and Services configuration

    Folks,
    I have a problem in the internal email routing. My network is spread across various regions and the branch offices are connected together in a mpls network (full mesh). Every region has its own Exchange Server with all roles installed and the smtp connection
    to the outside world is linked to two Exchange servers in the headquarter server farm.
    The problem is that internally I often see emails going across the Exchange Servers in the branch offices where there is low bandwidth (from 3 to 5 Mbps), thus email are sent first to these servers instead of going immediately to the Exchange hosting
    the mailboxes of the intended recipients. This happens also with inbound emails.
    This causes slowness in the email system and sometimes also the network with these branch offices suffers from packet loss or very high latency.
    I know that Exchange is a site-aware application and uses the Active Directory topology for message routing and to communicate with the services that are running on other Exchange 2013 computers. For this reason I have checked the Active Directory Sites
    and Services and surprisingly I have found that there are no sites, no subnets, nothing has been defined but the default settings, included the Inter-Sites transport which contains the default DEFAULTIPSITELINK.
    Apart from the fact that clients use logon servers which are not supposed to use in the far remote offices, I am concerned of changing the Exchange Infrastructure whilst the email system is running and I would like to ask your opinion about my next steps:
    1) Create subnets for every office
    2) Create sites and then link them to the subnets done in point 1
    3) Delete the DEFAULTIPSITELINK and create new site links based on the costs (network speed) in order to determine the best routing server. I have 5 remote offices with 5 different network bandwidth, so I'll have to create 5 IP site links: high cost for
    link with slow network, low cost for fast network.
    4) (Optional) Configure the Exchange-specific cost using the Set-AdSiteLink cmdlet to the AD IP site links created previously
    Apart from the valid questions on why the previous Exchange Administrator have forgotten to set up the Active Directory (Topology) Sites and Services...
    ...And why have chosen to install all Exchange Roles to each server when there was no reason to do that (there are two servers connected to the external smtp gateways in the headquarter, so in my opinion the Exchange Servers in the remote branch offices
    should have had only the mailbox and the cas role)...
    As a matter of fact, my idea is to go further and create the sites,subnets and the ip site link. If I still notice a wrong email flow, I can configure an ad-hoc Exchange-specific cost using the Set-AdSiteLink cmdlet. Does this sound reasonable to you guys
    or I am taking the wrong decisions?
    Thanks

    Thank you very much for your link. This is exactly the page I have read just before posting my question here. It is not easy for me to understand why this has been setup this way by a Microsoft certified engineer.
    There are specific rules to follow when Active Directory and Exchange are located in multiple sites and I am not a skilled Exchange Administrator... he keeps saying that it is correct and also tells that if I go forward with my ideas there is the
    risk to increase the level of complexity. I prefer more complexity than default setting, and as a consequence of that, connectivity problems!
    Hopefully everything goes well. I will post my results here once I have done the changes
    Regards

  • OS X Server and Active Directory

    Hi
    I'm trying to use OS X Server 10.5 with Active Directory and have got to the stage where I can view AD users and groups in Workgroup Manager and have authenticated on the domain.
    However, if I try and change a user's password I get "The password could not be set. The action failed because you are not authorized to perform the operation."
    Also, if I try and create an account on the domain I receive the following - "Got unexpected error Error of type eDSNoStdMappingAvailable (-14140) on line 4267 of /SourceCache/WorkgroupManager/WorkgroupManager-319/PMMUGMainView.mm".
    I can delete accounts using Workgroup Manager and have confirm this has worked by checking in AD so can't understand what's going on.
    Any help greatly appreciated!

    You should post your question in the OS X Server forums:
    http://discussions.apple.com/category.jspa?categoryID=96

  • ITunes U and Active Directory

    Hello All,
    We would like to have iTunes U podcasts available based on a user's course and role info. Furthermore, we are looking to have Active Directory provide this info. I am currently researching possibilities and have discovered two potential solutions:
    1) Group membership
    2) Extend the Active Directory schema
    a) Do you recommend one over the other, or have you successfully implemented an alternative?
    b) Is there any step by step documentation available on a successful implementation?

    We're using eDirectory rather than Active Directory, but we're having much the same discussion. I think it's a question of what you'd ultimately like to do with iTunes.
    Right now, I'm doing simple authentication against eDirectory, checking to make sure the user has a valid username and password, and then determining what group they belong in: Student, Faculty or College (the last of which is a catch all for those not belonging to the first two groups). Most of the content is identical, but I expect to post different welcome messages and how to's to the home page based on groups, particularly the Student ("how do I get my club's content into iTunes?") and Faculty ("How do I use this with my courses?") roles.
    This authentication is handled via Perl, using Perl's LDAP functions to retrieve directory information and then build credentials based on that. I have an example version of that script; if anyone would like a copy, please e-mail me off-list at newquisk (at) lafayette.edu.
    That's good for big groups and even smaller ones, depending on how you've got your directory set up (for example, we have a group for our department that we're using to distribute department-specific materials). But I think it breaks down at the course level which is why we're looking to extend eDirectory to support the eduCourse object class (and while we're at it, eduPerson).
    The goal here would be able to have a person's course information and roles for those courses in LDAP and then use that to authenticate against iTunes and other web-based applications (in particular, Moodle). We expect to populate these fields based on regular imports from our administrative system.
    We're at the beginning of that process, and have just started experimenting with expanding our eDirectory schema. I'm in the process of looking for schools that have implemented the eduCourse and eduPerson object classes so that we can get a better idea of what an operational system looks like.
    I hope this helps,
    Ken Newquist
    Lafayette College

Maybe you are looking for

  • When trying to install v8.6.1 (upgrading from v8.5) on a Windows 7 machine, I get error -12

    I'm trying to upgrade our LV 8.5 machine to 8.6.1 on a PC running Windows 7 Pro.  8.5 runs fine, but I can't even get through the installation without getting the following error: Error: Windows SDK function returned an error (Error code -12). Is the

  • Invalid tag generated in result XML file, xslt mapping done using MAPFORCE

    HI My requirement is File to File using xslt mapping I have done a very simple XSLT mapping, but through MAPFORCE tool Here are the steps, I followed: 1. Supplied source xsd and xml file to MAPFORCE 2. Supplied target xsd file 3. mapped it as require

  • F8 (play/pause) Key running real time player

    Hi I have just brought a new mac wireless keyboard for my mac mini. I am having problems with one of the shortcut keys F8, to play/pause media. Once pressed itunes playes which is generally the main idea but it also causes realtime to start up and pl

  • Sony Vegas vs Premiere Pro CC

    I used Sony Vegas before, the main feature I used was the keyframes to make the video move with the music, and now I switched to Pr, but the keyframes here are sooo diferent and 10 times more difficult to use for no reason, when I select the keyframe

  • URL_ENCODE

    am i doing something wrong. i keep getting an error when i try this select client_name, APEX_UTIL.URL_ENCODE(client_abbr) client_abbr from clients order by client_name i am using this query to populate a LOV. here is the error. * LOV query is invalid