Restrictions in Domain-Structure?

Hi everybody,
we have a situation with a portal running with an URL like http://<Hostname>.<part3>.<part2>.<part1>:50000 and we have connected a BW system with an URL like http://<Hostname>.<part2>.<part1>:8080.
Now we have many problems with domain relaxing, session management and so on.
Well, until now we haven't found any restrictions to unequal domain-parts (the number of points in the URL ). Does someone has information about such scenarios?
Best regards,
Christian

Hi Micus,
Since the two systems are running on different domains most probably u will have to open connections between the portal system and the system from which you want to access the BW reports. For displaying the BW reports, we will have to make use of the Web Application Server which is integrated with your BW System.In your post , you have mentioned that the HTTP port for the Web Application Server as 8080. If the Portal System and the backend system (in your case BW System)are in different domains, the 8080 port of the BW server should be opened in such a way that the portal can access the BW reports. So the 8080 port of the BW system has to be opened in single direction. After this step, you will have to add an entry for your BW system in the hosts file of your portal server in this format ..
<IP Address> <servername> <Fully Qualified Domain Name of the BW Server>
Keep these things also in your mind when working different systems which are on different domains..You can have help from your Network Administrators and Basis consultants.
Regards,
Kishor Gopinathan

Similar Messages

Restrict non-domain computers

Does anyone know if it is possible to restrict access based on domain membership or an AD Group?
The purpose is to restrict non-domain computers even if the client has a legitimate domain credential to use for authentication.

That is correct. The only way to restrict these computers would be to make a rule (above your auth group policies), that states the specific IPs / subnets are granted certain / no access.
As long as the rule is above all your auth rules, it will trigger first and take precedence. Be sure to disable WBRS for this rule as well, since there is a potential for +6 sites to be allowed.

DFS Best Practice and domain structures

We currently have built a new domain structure for our client which consist of domains in separate forests with the approapriate trusts in place. The domains being:
user, resource, legacy resource and Test.
It is assumed that the resources will be migrated out of the legacy domain to the new resource domain in the medium term.
Given we have circa 650 file shares, which causes problems with logon scripts, I want to present those shares via a DFS. Internally our view is that the DFS should be built in the user forest to reference file shares in the resource domain(s).
Our client, however believes the DFS is a resource, and therfore should be presented in the new resource domain.
What are the pros / cons of each and what would be the Microsoft recommendation and why ?

Hi,
As the purpose is to migrate shares to new domain (in new forest), it seems DFS is not required to do this job.
From your description, it seems that DFS is not created yet.
If so, you can simply migrate files to new domain. Then you could export the following key and import to new file server:
HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Shares
Note: If folder location is changed, you need to edit the key before importing to new server.
In addition, if DFS is already existing, you could export it, edit configuration files and import to new domain. See:
Migrating your DFS Namespaces in three (sorta) easy steps
http://blogs.technet.com/b/askds/archive/2008/01/15/migrating-your-dfs-namespaces-in-three-sorta-easy-steps.aspx
Note: If you need to keep NTFS permissions, firstly you need to create a one-way trust (source domain trusts the target domain) and use ADMT to migrate domain users/groups to new domain so that all NTFS permissions could be recognized.
Note2: To copy files with NTFS permission, you could use Robocopy.
If you have any feedback on our support, please send to [email protected]

SPA 122 remove restricted access domains

Hello
My spa 122 has a customization profile active and i want to remove it. But i don't know how to do it. Firmeware Update, Factory reset, disabling provisioning don't help.
I tried to create a sample config file with the Cisco Profile Compiler but no luck, the spa 122 tell me everytime Restore failed...
All i want is to remove the settings from the customization, like "restricted access domains" ect.
Can anyone help me?
Thanks
mfg
Pascal

OK thank you Dan for your answer.
I bought the box from an ISP, but i don't want to use this ISP, so i can not reset the config to default settings without customization ect? With a sample.cfg file from anywhere?

Create Domain Structure Using ODM

I'm trying to create a Domain Structure ie. uk.oracle.com using
directory manager 3.01 and keep getting the dreaded 112 error.
I have set dc=com added the <top> and <domain> object classes
and set the mandatory attribute to be com
Anyone shed any light onto this ??
The only thing I can get working is c=uk !!

you can create ou=uk, dc=oracle, dc=com
that means below dc=com, create another dc as oracle and further below that create ou=uk (use organizationalUnit as object class).
Cheers...
Nishant

Server restrict from domain administrator account

I have a server 192.168.1.XXX which is added in AD domain but I would like to restrict this server from domain administrator account.
192.168.1.XXX server will be access by local account only.
Please help..

I have a server 192.168.1.XXX which is added in AD domain but I would like to restrict this server from domain administrator account.
192.168.1.XXX server will be access by local account only.
Please help..
You received some great suggestions and info. Curious, why would you want to remove the domain admin account from accessing the server?
Maybe a stand alone server may be a better solution? You can still access domain resources from a stand alone using specific domain accounts, but the machine won't be joined to the domain preventing the domain admin account from accessing it.
Ace Fekay
MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php
This posting is provided AS-IS with no warranties or guarantees and confers no rights.

User Folders in a Parent / Child Domain Structure

Hi,
I have a forest setup with a parent and 3 child domains.
We have a DFS share setup for home folders.
I used Group Policy to create the User's share folders, map the drive, and setup folder redirection.
Each user has a separate ID for each domain.
The desire is for each user to be able to use the same \\parent.com\home\%logonuser% share path from each domain in order to access files from any domain, and have privacy from other users doing so.
The problem I have is, after "child1\JohnD" signs into a workstation on domain CHILD1.com, his folder is created at "\\parent.com\home\JohnD" and mapped.
But if child2\JohnD then signs into domain CHILD2.com, he does not have permissions to map the drive.
I realize why, but I'm wondering if anyone can think of a way to change this setup so that parent\JohnD, and child1\2\3\JohnD, all have rights to map and use the same Home Folder.
Having domain specific home folders has been shot down.
Giving all shares EVERYONE access has been shot down.
Open to other suggestions.
Thanks!
-Matt
There's no place like 127.0.0.1

You might want to try creating a script that will grant the required rights to both user accounts using Powershell: http://blogs.technet.com/b/heyscriptingguy/archive/2014/11/22/weekend-scripter-use-powershell-to-get-add-and-remove-ntfs-permissions.aspx
Once you create the script, you can schedule it using Task Scheduler.
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile
Interesting. I've been playing with this module off and on today. From what I can tell, this would have to be scripted to some sort of function like this:
dir \\parent.com\dfshome | Get-NTFSAccess
For each dir in "\\parent.com\dfshome", set $folder
For each $folder where account = "childx\User", set $User
For each $User, Add-NTFSAccess: child1\$user, child2\$user, and child3\$user
(head scratch)
I'll give it some more thought. :)
Thanks!
There's no place like 127.0.0.1

Transport Rules - Restricting inbound Domains (How to allow subdomains?)

We have a transport rule that blocks all outside emails unless a user is in a security group then it will allow the domains that are in the "except when the from address contains" exception.
What we are finding is if we have contoso.com in the exception list and its abc.contoso.com the abc.contoso.com gets blocked. But we would need to allow both contoso.com and abc.contoso.com
I read somewhere (can't find it now) you could do contoso.com$ and it would allow subdomains but it does not seem to be working.
Any assistance would be great.

Hi Ryan,
Agree with Jatin's opinion, you can use "*.contoso.com" instead of "contoso.com" as an exception.
The asterisk ( * ) character matches zero or more instances of the previous character. For example,
ab*c matches the following strings: ac, abc,
abbbbc.
More details refer to the following article:
Regular Expressions in Transport Rules
Best regards,
Niko Cheng
TechNet Community Support

GP on Domain User to Restrict other PC Access

Hi Team,
Thanks for reading, I have the following scenerio -
Being the administrator of Domain i have to restrict other domain user to access other PC.
Domain User should not able to access the other PC's WITHIN the domain.
Awaiting for your response..
OS - Windows Server 2008 R2.
Client pc using OS- Windows 7
Thanks,
Regards, Ravi Kumar

Hi,
you can set the User Attribute "userWorkstations"
Source of Picture: http://www.selfadsi.de/user-attributes-w2k8.htm
So yo can restrict where the users can logon.
Is this what you searched for?
Regards
Eric
Eric Berg -- http://www.ericberg.de -- MCSE: Private Cloud MCSE: Server Infrastructure MCSE: Desktop Infrastructure

Procedure for creating transparent table, data element and domain

Hi,
Can anybody let me know the procedure for creating transparent table, data element and domain.
Thanks,
Mahathi

Hi
Database table and its components
A database table is the central data structure of the ABAP/4 data dictionary.
The structure of the objects of application development are mapped in tables on the underlying relational database.
The attributes of these objects correspond to fields of the table.
A table consists of columns (fields) and rows (entries). It has a name and different attributes, such as delivery class and maintenance authorization.
A field has a unique name and attributes; for example it can be a key field.
A table has one or more key fields, called the primary key.
The values of these key fields uniquely identify a table entry.
You must specify a reference table for fields containing a currency (data type CURR) or quantity (data type QUAN). It must contain a field (reference field) with the format for currency keys (data type CUKY) or the format for units (data type UNIT). The field is only assigned to the reference field at program runtime.
The basic objects for defining data in the ABAP Dictionary are tables, data elements and domains. The domain is used for the technical definition of a table field (for example field type and length) and the data element is used for the semantic definition (for example short description).
A domain describes the value range of a field. It is defined by its data type and length. The value range can be limited by specifying fixed values.
A data element describes the meaning of a domain in a certain business context. It contains primarily the field help (F1 documentation) and the field labels in the screen.
A field is not an independent object. It is table-dependent and can only be maintained within a table.
You can enter the data type and number of places directly for a field. No data element is required in this case. Instead the data type and number of places is defined by specifying a direct type.
The data type attributes of a data element can also be defined by specifying a built-in type, where the data type and number of places is entered directly.
Two Level Domain Example
A domain defines a field technically and therefore it may
be used at different business levels.
A data element describes the meaning of a domain in a certain business context.
A domain, however, is used for the technical definition of a table field (for example field type and length).
Therefore, although a take-off airport (data element S_FROMAIRP) would have a different business meaning from an airport where a plane lands (data element S_TOAIRP), they could still have the same domain(here S_AIRPID) because technically we could assign the same number of characters whether the airport is a take-off or a landing airport.
Definitions of Table in Database
In SAP R/3 tables are defined as
A) Transparent tables: All of the fields of a dictionary table correspond to a field in the real database table.
B) Pooled tables: Different tables which are not linked to each other with a common key are combined into a TABLE POOL. Several logical tables thus exist as a single real database table.
C) Cluster tables: Several tables linked by a common key may sometimes be combined by the data dictionary and made to exist on the database schema as a single table.
SAP is evolving R/3 tables in transparent tables.
Elaboration on each of the definitions
A transparent table is automatically created on the database when it is activated in the ABAP Dictionary. At this time the database-independent description of the table in the ABAP Dictionary is translated into the language of the database system used.
The database table has the same name as the table in the ABAP Dictionary. The fields also have the same name in both the database and the ABAP Dictionary. The data types in the ABAP Dictionary are converted to the corresponding data types of the database system.
The order of the fields in the ABAP Dictionary can differ from the order of the fields on the database. This permits you to insert new fields without having to convert the table. When a new field is added, the adjustment is made by changing the database catalog (ALTER TABLE). The new field is added to the database table, whatever the position of the new field in the ABAP Dictionary.
Tables can also reside on the database as Pooled tables or cluster tables
Pooled Tables: Different tables which are not linked to each other with a common key can be combined into a Table Pool. The tables contained within this pool are called Pooled Tables. A table pool is stored in the database a simple table. The table's data sets contain, in separate fields, the actual key for the data set to be stored, the name of the pooled table and the contents of the data set to be stored.
Using this schema, several logical tables are combined into a single real database table. Although the data structure of each set is lost during the write to the table pool, it is restored during the read by the ABAP/4 Data Dictionary. The ABAP/4 Data Dictionary utilizes its meta-data to accomplish this.
Since information must be prepared (defined) within the ABAP/4 Data Dictionary when it is read or written to (or accessed), this process itself defines these as not transparent tables
Cluster Tables: Occasionally, several tables may be linked by a common key. The ABAP/4 Data Dictionary can also combine these tables into a single table. Each data set of the real table within the database contains a key and in a single data field, several data sets of the subsequent table for this key.
As mentioned above, these table types require special data handling, therefore they are not transparent tables.
Technical Settings in Dictionary
The data class logically defines the physical area of the database (for ORACLE the table space) in which your table should be created. If you choose the data class correctly, the table will automatically be created in the appropriate area on the database when it is activated in the ABAP Dictionary.
The most important data classes are master data, transaction data, organizational data and system data.
Master data is data that is rarely modified. An example of master data is the data of an address file, for example the name, address and telephone number.
Transaction data is data that is frequently modified. An example is the material stock of a warehouse, which can change after each purchase order.
Organizational data is data that is defined during customizing when the system is installed and that is rarely modified thereafter. The country keys are an example.
System data is data that the R/3 System itself needs. The program sources are an example.
Further data classes, called customer data classes (USER, USER1), are provided for customers. These should be used for customer developments. Special storage areas must be allocated in the database.
The size category describes the expected storage requirements for the table on the database.
An initial extent is reserved when a table is created on the database. The size of the initial extent is identical for all size categories. If the table needs more space for data at a later time, extents are added. These additional extents have a fixed size that is determined by the size category specified in the ABAP Dictionary.
You can choose a size category from 0 to 4. A fixed extent size, which depends on the database system used, is assigned to each category.
Correctly assigning a size category therefore ensures that you do not create a large number of small extents. It also prevents storage space from being wasted when creating extents that are too large.
Modifications to the entries of a table can be recorded and stored using logging.
To activate logging, the corresponding field must be selected in the technical settings. Logging, however, only will take place if the R/3 System was started with a profile containing parameter 'rec/client'. Only selecting the flag in the ABAP Dictionary is not sufficient to trigger logging.
Parameter 'rec/client' can have the following settings:
rec/client = ALL All clients should be logged.
rec/client = 000[...] Only the specified clients should be logged.
rec/client = OFF Logging is not enabled on this system.
The data modifications are logged independently of the update. The logs can be displayed with the Transaction Table History (SCU3).
Logging creates a 'bottleneck' in the system:
Additional write access for each modification to tables being logged.
This can result in lock situations although the users are accessing different application tables!
Create transparent table
Go to transaction SE11. Enter name of table you want to create (beginning with Y or Z) and click on create pushbutton
Enter the delivery class and the table maintenance criteria
The delivery class controls the transport of table data when installing or upgrading, in a client copy and when transporting between customer systems .
The display/maintenance indicator specifies whether it is possible to display/maintain a table/view using the maintenance tools Data Browser (transaction SE16) and table view maintenance (transactions SM30 and SM31).
Enter the name of the table field and the data element. The
System automatically populates the technical details for
existing data elements.
So far as possible it is advisable to use existing data elements which befit the business requirements.
However, we may create data elements if need be. The same is shown in the next slide.
To create a data element simply double click on it.
Alternately create a data element by simply choosing the
data type radio button on SE11 initial screen.
Create data element
The system prompts you to create a new data element.
Choose the Yes pushbutton.
Under the data type tab enter the domain name which
determines the technical characteristics of the field.
Further characteristics tab: Allows you to specify a search help assigned to the data element.
It also allows you to specify a parameter id which helps you populate a field from SAP memory.
Field label: Can be assigned as prefixed text to a screen field referring to the ABAP Dictionary. The text is displayed on the screen in the logon language of the user (if the text was translated into this language).
Create domain
If the domain does not exist in the data dictionary the
system prompts you to create one.
Give the technical characteristics under the definition
tab. Value range allows you value restriction at domain
level.
Value range tab:
As explained in the section Consistency through input checks one can restrict the possible values for a field at domain level itself by either entering fixed values or by specifying a value table under the tab Value range.
Currency/Quantity fields in a table
A currency or a quantity field must be assigned a reference field from a reference table containing applicable qty unit or currency unit.
Field of the reference table, containing the applicable quantity unit or currency
A field containing currency amounts (data type CURR) must be assigned a reference field including the currency key (data type CUKY).
A field containing quantity specifications (data type QUAN) must be assigned a reference field including the associated quantity unit (data type UNIT).
Create transparent table continue
Maintain the technical settings of the table by clicking on the tab

Problem with Queries Structures in Bex Query Designer and Universe Designer

Hi everyone,
I have a problem when i try to do a Universe from a Bex Query Designer.
When I use a Characteristic Restrictions in a Structure, the universe only show me the structure without the objects inside it.
EJ:
1) Bex Query Designer
Colunms
(Structure) ZSRT_123
                      - (Characteristic Restrictions) Reg Guayana
>          (InfoObject)     0Product = 'XXX'
>          (InfoObject)     0Country = 'YYY'
     - (Characteristic Restrictions) Reg Caracas
>          (InfoObject)     0Product = 'AAA'
>          (InfoObject)     0Country = 'BBB'
Rows
(Structure) ZSRT_456
               (Key Figure)     Net Sales
2) Universe designer
(Class) ZSRT_456
>(Measure)      Net Sale
(Class)     ZSRT_123
>(Dimension)      ZSRT_123
The universe dont translate the two Characteristic Restrictions in the structure ZSRT_123.
Any information would be much appreciated. Thank you.

Hi,
I assume that you are using BOE XI 3.1 SP2.
We have added an option in SP2 to generate or not the L00 level.
Unfortunately this option applies not only on characteristics but also on hierarchies, hierarchies variables and structures: that's the reason why you have no elements belonging to the structure generated.
I recommend to always generate L00 in order to have your structure generated correctly.
This issue will be fixed in SP3.
Regards,
Didier

Multiple objects, multiple domains, for-loops the problem?

Hi,
I've based a small amount of Powershell code off the code I've found here: http://halfloaded.com/blog/powershell-using-posh-to-search-across-multiple-domains-in-forest/
Ideally what I'm aiming for is for it to find the current forest, enumerate the domains, and then for each domain to search for a specific user. If it finds the user it should then do something, for now just clear a value extensionAttribute8.
What I suspect is happening is it finds the users but then tries to modify them while attached to the current domain, which is child1.
Domain structure:
- Root
- child1
- child2
cls
$objForest = [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()
$DomainList = @($objForest.Domains | Select-Object Name)
$Domains = $DomainList | foreach {$_.Name}
foreach($Domain in ($Domains))
$ADsPath = [ADSI]"LDAP://$Domain"
$objSearcher = New-Object System.DirectoryServices.DirectorySearcher($ADsPath)
$objSearcher.Filter = "SamAccountName=testuser"
$objSearcher.SearchScope = "Subtree"
$colResults = $objSearcher.FindAll()
foreach ($objResult in $colResults)
$userDomain = $objResult.GetDirectoryEntry()
Set-ADUser $userDomain.DistinguishedName[0] -clear extensionAttribute8
It errors with
Set-ADUser : Cannot find an object with identity: 'CN=testuser,CN=Users,DC=root,DC=company,DC=co,DC=uk' under: 'DC=child1,DC=root,DC=company,DC=co,DC=uk'.
At line:17 char:9
+ Set-ADUser $userDomain.DistinguishedName[0] -clear extensionAttribute8
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (CN=testuser,C...pny,DC=co,DC=uk:ADUser) [Set-ADUser], ADIdentityNotFoundException
+ FullyQualifiedErrorId : Cannot find an object with identity: 'CN=testuser,CN=Users,DC=root,DC=company,DC=co,DC=uk' under: 'DC=child1,DC=root,DC=company,DC=co,DC=uk'.,Microsoft.ActiveDirectory.Management.Comman
ds.SetADUser
Set-ADUser : Cannot find an object with identity: 'CN=testuser,CN=Users,DC=child2,DC=root,DC=company,DC=co,DC=uk' under: 'DC=child1,DC=root,DC=company,DC=co,DC=uk'.
At line:17 char:9
+ Set-ADUser $userDomain.DistinguishedName[0] -clear extensionAttribute8
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (CN=dttestuser,C...ita,DC=co,DC=uk:ADUser) [Set-ADUser], ADIdentityNotFoundException
+ FullyQualifiedErrorId : Cannot find an object with identity: 'CN=dttestuser,CN=Users,DC=its,DC=ad,DC=capita,DC=co,DC=uk' under: 'DC=central,DC=ad,DC=capita,DC=co,DC=uk'.,Microsoft.ActiveDirectory.Management
.Commands.SetADUser
Please help!

cls
Import-Module ActiveDirectory
Foreach ($Domain in (Get-ADForest).Domains)
#Performing Search Operation per Domain
$Objects = Get-ADObject -LDAPFilter "SamAccountName=dttestuser" -Server $Domain -Properties extensionAttribute8
Foreach ($Object in $Objects)
Set-ADUser $Object -clear extensionAttribute8
If anyone could tell me why removing the loop:
Foreach ($Object in $Objects)
And saying
Set-ADUser $Objects -clear extensionAttribute8
Errors I'd be interested. $objects only finds 1 object so having the loop makes no sense but it does seem to stop it error'ing!

Parent/Child Domain

I have a parent/child domain structure. The parent domain consists of domain controllers in three different locations (HO1, HO2, HO3). I have set Sites and Services up so that each remote VPN site (Child domain) has a site link to HO1 and HO2 only. When
I attempt to ping the parent domain name from a site server it sometimes resolves to HO3 and times out as there isn't an active VPN tunnel between the 2. My question is why would HO3 be replying when it doesn't have a site link to the remote site and in turn
how can I stop that from being the domain controller that replies?
Thanks for any advice
Chris

Hi,
To add, Mr. Ace got a good blog regarding Site and Site links, see if it could help here:
AD Site Design and Auto Site Link Bridging, or Bridge All Site Links (BASL)
http://blogs.msmvps.com/acefekay/2013/02/24/ad-site-design-and-auto-site-link-bridging-or-bridge-all-site-links-basl/
Best regards
Michael
If you have any feedback on our support, please click
here.
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Document Restriction Interactive Form

Hey guys
i have generate an Interactive Form like the ABAP Program FP_TEST_IA_01. Now we try to "configure" the PDF restrictions over the structure sfpoutputparams (parameter PDFCHANGESRESTRICTED).
Our problem is, that the generated PDF doesn't allow the "Document Assembly" and "Page Extraction". Is it possible to allow this points over the parameters or is a configuration of the ADS Service necessary?!
Arr... i need your help!
Best Regards
Christian Wiegleb

Hello,
unfortunately this cannot be done. As far as I know, you can only restrict "no print", but not any other restrictions.
There were few threads with the same questions with the same answer if you want to confirm my info. Search a bit.
If you would like to apply these restrictions, you would need to buy Adobe standalone policy server.
Regards, Otto

Windows SMTP service - restrictions

Hi
I have installed a SMTP service under IIS 6.0 in windows 2008 R2
I would like to know if is possible to restrict the SMPT traffic to specific domains
Example: i only want that only relay traffic to google.com
Thanks in advance.

Hi,
Please refer to Don's suggestion in following thread and check if can help you.
restrict destination domain on SMTP service
In addition, for your current issue, I suggest that you should post it in
IIS forum. I believe we will get a better assistance there.
Hope this helps.
Best regards,
Justin Gu
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Restrictions in Domain-Structure?

Similar Messages

Maybe you are looking for