Windows server domain group membership with functional level 2003 - windows API

Hello,
I am a programmer trying to get members of a global domain group using windows server 2008 enterprise edition,
in the past there wasn't a functional level 2003 on windows server, but when 2003 functional level appeared a new features were added like adding
a global group as a member to another global group in the domain,
in the past the API written could get the members if the member was a user, but it can't get a member if it was a global group.
I am using this API "NetGroupGetUsers" to get a members of a global domain group, and it gets the users but it doesn't get the
members if they were global groups...
I tried another API "NetLocalGroupGetMembers" it is getting a global group as a member but it is working only if the owner group was a local group on the server
or on another machine that is added to the server, but this API doesn't work if the owner group was a domain global group.
My question is how to get members of a global group including the members that are global groups too???
Thanks,
- Shomaf

> I am using this API "NetGroupGetUsers" to get a members of a global
This interface is based on Win 2000, and since Win 2000 did not support
global group nesting, this interface does not, too...
> domain group, and it gets the users but it doesn't get the
> members if they were global groups...
You should use
http://msdn.microsoft.com/library/aa706032.aspx - and
don't forget to track down the nestings :)
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Similar Messages

What is the effect if I Raise my domain functional level to Windows Server 2012 R2 ?

Hi,
my current servers:
Domain Controllers= Windows Server 2012 R2 (current domain functional level is windows 2008 R2)
Mail servers= Exchange 2010 SP3 on Windows 2008 R2
Lync= Lync 2010 on Windows server 2008 R2
What is the effect if I Raise my domain functional level to Windows Server 2012 R2 ?
I am very worried about Exchange & Lync if we do this action
please advice

Do not raise the forest functional level higher if you have or will have any domain controllers running
an earlier version of Windows Server , which is (windows Nt4.0, Window 2000 or windows 2003)
but as a matter of fact I dont see any of those in your network so you can easily upgrade the funtional level without any issues
Listed below link has the table which shows the effects of upgrading the domain functional levels to Windows 2012
http://technet.microsoft.com/en-us/library/understanding-active-directory-functional-levels
http://www.arabitpro.com

Windows Server 2008 black screen with mouse *PLEASE HELP*

Hello fellow techs,
I have been tearing my hair out for the past 12hrs on this issue.
About 3 weeks ago, one of our clients reported that they were experiencing
issues on the network so one of the staff went into the server room and noticed
the screen was black with only the cursor. As they couldn't reboot, they
decided to hold the power button to power it off. When they powered it back
up, it went passed the windows loading
splash screen, and again the screen is black with
the mouse pointer in the center of the screen.
I am diagnosing the server and find that at the black screen, I’m able to move
the cursor and beyond that nothing happened. I started in safe mode with the
exact same results.
I have been trying many different solutions from posts that I have found in
Google but no change.
From other machines you can type \\servername in
the run box and see the shared folders, as well as ping it.
This is a very urgent request as I need to have the Server back up and running
by tomorrow.
I am quiet willing to pay for phone support with anyone that can assist as soon
as possible. I am happy to transfer founds via Paypal.<o:p></o:p>
PLEASE HELP!

Hi,
I agree with sm, you should give us more details. Also you should use sfc /scannow
command to scans the integrity of all protected system files and repairs files with problems when possible. For more details, please refer to the following article.
Sfc
http://technet.microsoft.com/en-us/library/ff950779.aspx
Before going further, would you please let me know whether there were any changes on the affected server? Has windows update or any new device been added? Please also check your shadow copies.
The Windows Server black screen may be caused by them.
In addition, there are similar questions, please refer to.
Windows Server 2008 black screen
http://social.technet.microsoft.com/Forums/en-US/463b529b-26a6-4d5d-88f5-7d8b3460d165/black-screen-windows-2008-r2
Windows Server 2008 and the Black Screen of Waiting
http://projectdream.org/wordpress/2009/03/03/windows-server-2008-and-the-black-screen-of-waiting/
By a way, you also can be able to boot into last know good configuration to solve the trouble. You can refer to the following similar question that provide the detailed operations.
Windows Server 2008 black screen with only the mouse pointer showing
http://social.technet.microsoft.com/Forums/en-US/5c878af8-78f2-430d-9530-a0e5ad73ff03/windows-server-2008-black-screen-with-only-the-mouse-pointer-showing
Hope this helps.
Best regards,
Justin Gu

Installing Flash Player 12 on Windows Server 2008 R2 X64 with IE 8

I have an app that runs on Windows Server 2008 R2 X64 that requires Flash Player 12. When I try to install Flash Player 12 it says that Windows Server R2 X64 is not supported by way of eliminating it from the list of supported operating systems. When I do a search I can find many people who indicate they have it running or explain "hacks" to get it running. Since the app requires it there is an implimcation that it should be running on this OS. What is the offical word on this? This is a production server and I really don't want an "unsupported hack" running in this environment. Is there a supported means of having Flash Player 12 run on Windows Server 2008 R2 X64 with IE8 even if it is within the 32 bit version of the browser?

Server 2008 (x86) is supported, and I had an x64 machine set up last month that had FP12 installed and running in IE and Firefox. 64 bit IE wouldn't run it for some reason, but the 32 bit did. It installed in C/Windows/System32/Macromed/Flash and C/Windows/SysWOW64/Macromed/Flash, but I was unable to get the ActiveX plug-in to enable outside of 32 bit IE.
I also set up a Server 2012 machine that DID support the x64 ActiveX, but that's probably not an option for you.
Like you, I'd be leery of "hacks" to get it to run as an x64 pkug-in, as it may have unintended and undesired consequences in other areas.

Microsoft Windows Server 2008 R2 Datacenter with SP1 Activation Failed

I'm new here,
I've got the following problem:
For my study I had to install a Windows server. I Activated this Windows Server and all was good. I configured Windows Server and found out it wasn't configured as I wished and a clean install would be much quicker than a re-configuration... So I did a clean
install, configured it and bumped into the next issue:
My product key isn't valid anymore because it's already in use (my deleted Windows Server). How can I release this product key so I can use it for my new installation? My evalation period is over but I still need to use it. And it's a key provided by my
school via Dreamspark.
Thanks in advance,
Jay

Hi,
Good to hear that and thanks for your feedback.
Have a good day!
Best regards,
Susie

HT1222 I have a new MacBook Pro and running Windows 7 on that side with Parallels. My Windows side keeps locking up. Help

I have a new MacBook Pro and running Windows 7 on that side with Parallels. My Windows side keeps locking up. Help

You should be able to get the CS3 programs installed and running on the new pc since CS3 is spec-ed for Windows 7 Service Pack 1. Downloading the programs does not require a serial number. You can find them here: Download CS3 products but you will need the serial number to activate the programs. You might be able to find that thru your Adobe account online.
You will not be able to install the CS5 Mac version on a PC and you won't be able to trade it to a PC version either due to it being an older version. Trades are allowed only for the latest version (CS6)

Windows Server 2012 Group Policy Block USB Storage devices @ User Level Not getting applied on a Domain Client machine with Windows Server 2008 R2. Why?

Hello,
I have a Windows Server 2012 R2.
I have configured the Group Policy on it to block the usage of USB - Storage Devices @ user level on the client machines. It works properly for my Windows 7 client machines but it's not working on one of the machine having Windows Server 2008 R2 installed
on it (this machine is also a domain client in the same domain).
I will really be thankful if anyone can suggest some solution to this issue.
Please feel free to write back in-case I have missed anything obvious to be shared.
Thanks!
-Vinay Pugalia
If a post answers your question, please click "Mark As Answer" on that post or
"Vote as Helpful".
Web : Inkey Solutions
Blog : My Blog
Email : Vinay Pugalia

Hi,
Any update?
Just checking in to see if the suggestions were helpful. Please let us know if you would like further assistance.
Best Regards,
Andy Qi
TechNet
Subscriber Support
If you are TechNet
Subscription user and have any feedback on our support quality, please send your feedbackhere.
Andy Qi
TechNet Community Support

AD Group Membership with User From Domain Outside of Forest

Here's one to twist your brain around -
I have kerberos authentication using Active Directory working between a client's web browser and my web-app hosted in JBoss. I also have limited authorization working by checking group memberships using LDAP. This currently only works if all users are in the same domain. The ever-helpful adler_steven has detailed in another thread (http://forum.java.sun.com/thread.jspa?threadID=603815&tstart=15) how to do a group membership check for all Users/Groups in a single forest using the Global Context.
I need to go beyond the domain and even beyond the forest and try to authorize a user from a trusted domain by checking if the user is a member of a group in my domain. Authentication works fine using kerberos. It's the authorization by group check I am having trouble with. I believe there are two ways to approach this:
Approach #1
Access the MS-specific PAC in the kerberos token from the client to get the group SIDs. The structure of the PAC is nicely defined in this article: http://appliedcrypto.com/spnego/pac/ms_kerberos_pac.html. However, I have no idea how to access the decrypted token. I pass the encrypted token that I receive from the browser to myGssContext.acceptSecContext(...) to complete the authentication.
Question: Does anyone know how to get the decrypted kerberos ticket from there, specifically the authorization-data field?
Approach #2
Try to walk through the Active Directory structures in both domains using LDAP. In the domain group that I am checking, I can see a member attribute that references a foreignSecurityPrincipal object. The CN of this object happens to be the objectSID of the user I am looking for in the remote domain. Unfortunately, I have to check the remote domain server directly to verify that. The foreignSecurityPrincipal object itself does not contain any hint about what user it refers to aside from the SID (no originalDomainName attribute or something similar). It is feasible that I could walk the chain of references back to the remote domain AD server. That would require that my configuration include a list of remote domain servers to check (since I could have users from multiple trusted domains) and that my JBoss server have access to those servers.
Question: Does anyone know of some other LDAP-related way of finding information about a user from a remote, trusted domain without having to hit the server for that domain directly?
adTHANKSvance
Eric

You should be able to work back from the foreignSecurityPrincipal object :-) He says with a wry smile..
This post prompts me to think whether one day someone will draw the entity relationship diagram for AD. Oh well, I've been procrastinating for years, a few more won't hurt !
If it was a user from within the same forest, you should just be able to perform a search against a GC using the objectSID as the search filter. I've forgotten, but I don't think they will be represented as foreign security principals.
Have a look at the post titled JNDI, Active Directory and SID's (Security Identifiers) available at
http://forum.java.sun.com/thread.jspa?threadID=585031&tstart=150 that describes how to search for an object based on their SID.
Now if it is a user from another forest, with which you have a trust relationship, then we begin the navigation excercise.
You'll need obtain the user's SID (either from the cn or from the objectSID attributes) from the foreignSecurityPrincipal object. For example CN=S-1-5-21-3771862615-1804478405-1612909269-2143,CN=ForeignSecurityPrincipals,DC=antipodes,DC=com
objectSID=S-S-1-5-21-3771862615-1804478405-1612909269-2143Then obtain the domain RID, eg.S-1-5-21-3771862615-1804478405-1612909269Next you will have to recurse each of the crossRef objects in the Partitions container, in the configuration naming context (which you will find listed in the RootDSE). The crossref objects that represent trusted domains or forests will have values for their trustParent attributes. A sample query would be something like//specify the LDAP search filter
String searchFilter = "(&(objectClass=crossRef)(trustParent=*))";
//Specify the Base for the search
String searchBase = "CN=Partitions,CN=Configuration,DC=antipodes,DC=com";For each crossRef object, you can then use the dnsRoot attribute to determine the dns domain name of the forest/domain (if you want to later use dns to search for the dns name,ip address of the domain controllers in the trusted domains/forests), and then use the nCName attribute to determine the distinguished name of the trusted forest/domain.dnsRoot = contoso.com
ncName = dc=contoso,dc=comPerform another bind to the ncName for the trusted domain/forest and retrieve the objectSID attribute, which will be the domain's RID. You may want to cache this information as a lookup table to match domain RID's with domain distingusihed names and dns names.String ldapURL = "ldap://contoso.com:389";
Attributes attrs = ctx.getAttributes("dc=contoso,dc=com");
System.out.println("Domain SID: " + attrs.get("objectSID").get());Once you find out which domain matches the RID for the foreignSecurityPrincipal, you can then perform a search for the "real user" .And then finally you should have the user object that represents the foreign security principal !
Just one thing to note. Assume that CONTOSO and ANTIPODES are two separate forests. If you bind as CONTOSO\cdarwin against the CONTOSO domain, the tokenGroups attribute (which represents teh process token) will contain all of the group memberships of Charles Darwin in the CONTOSO domain/forest. It will not contain his memberships if any, of groups in the ANTIPODES forest. If Charles Darwin accesses a resource in ANTIPODES, then his process token used by the ANTIPODES resource will be updated with his group memberships of the ANTIPODES forest. Also you can have "orphaned foreignn security principal", where the original user object has been deleted !
BTW, If I was doing this purely on Windows, IIRC, you just use one API call DsCrackNames, to get the "real user", and then the appropriate ImpersonateUser calls to update the process token etc..
Good luck.

Windows Server 2008 - Group policy for domain client to start/stop services installed on it

Hello Experts
I am a newbie to windows server administration , though did a Google , but ended up with these question with my requirements
I have created a new domain and 2 client/computer (A & B namely) to domain . Now A & B has tomcat server running with port 8080 , 9090 which i have installed
domain ADMIN account .
&& now i am want to start/stop/restart services enabled for domain users !! How do i achieve this !!
basic question : How can i access A & B tomcat services on DOMAIN CONTROLLER server to create a GPO and that are on (A & B)
what is the easiest way to achieve the same , (if not using GPO)???
similarly I am looking for many features : where I want to control the permission to user on (A & B ) like : If the binaries of tomcat is available on machine say : A , if the user can install (now
it ask for ADMIN credentials)
Thanks
Mike~Ed

Controlling services with Group Policy is done under Computer Configuration\Policies\Windows Settings\Security Settings\System Services.
The limitation is that system services can only see the services the computer running the Group Policy management console. To access other services, you will either need to create the services on your computer (install the software the adds the service)
or install the remote server administration toolkit (RSAT) on the computer with the service already on it.
If my answer helped you, check out my blog:
Deploy Happiness

Missing nodes in new GPO objects after adding ADMX to DC (Server 2008 Domain Functional Level 2003)

Hello,
we discovered an issue in GPO console.
DCs: multiple 2008 there is one 2003DC somewhere over the rainbow (don't ask why) :)
Domain Functional Level is 2003.
In June I added Policydefinitions folder into Policy folder in sysvol\domain_name.
I did this for adding ADMX.
Today we found missing nodes when adding new GPO objects and trying to modify them.
Under Computers\Administrative Templates there is only ADMX node. No Administrative Templates with sub nodes: Systeme, Network, Printes, Windows Components.
When edit old GPOs There is Administrative Templates in Administrative Templates with ADMX folder. SEE Screenshot.
My colleague insists that it happened after I made changes by adding ADMX things. Looks that he is right.
Please any help on this issue... How to get back nodes for managing new GPOs as it was before adding ADMX.
Is this something known? I didn't find any prerequisites before adding PolicyDefinistions folder.
Thanks.
"When you hit a wrong note it's the next note that makes it good or bad". Miles Davis

Meinolf,
1. I would like to know if it is normal behaviour that after creating a Central Store (adding PolicyDefinitions folder into Policies) Classical Administrative Templates will not appear for any new GPO (they do exist to all previously created) see
picture
2. I followed the links. And eventually will use the script for cleaning up duplicate adms in all GPOs. It is great feature of ADMX. But first I would like to bring back the option of Admin Templates.
So I downloaded latest 2012 ADMXs. Run setup on my computer. Now I have Policydefinitions folder containing new ADMXs with languages (culture) folders.
Am I right? I have to copy all *.admx files to my Central Store Policydefinitions folder and all En admls drop to En-Us language folders. What will happen if I will add Fr-Fr? Would it be correct to have 2 languages for the same admxs. And how they will
appear. Or it will depend on OS language were GP console will be opened?
No conflict to expect?
I will do this "surgery" after your answer.
Thanks for pointing out..
"When you hit a wrong note it's the next note that makes it good or bad". Miles Davis

Testing windows server 2012 R2 Essentials with a "diferent" Domain name.

Hi, i've been testing the essentials version server and i've found some tips to change the Domain name at the setup install moment of the server.
but, when i try to use a Domain name like this: Mylocaldomain.com.mx
it allows me to use the .com name but doesn't allow me to use the .mx suffix.
do you know if there is a way to workaround this detail? or it won't be permitted at all. ?
thanks in advance!

Hi,
Based on my experience, an internal corporate namespace that used for internal purpose does not need to end in a valid top-level domain. That is to say you can use .ux as the top-level domain if you only use the domain on internal.
In your configuration, com is the second-level domain and
mx is the top-level domain. In general, com is a kind of the core group of generic top-level domains
which indicates that this name has been registered to a business organization for commercial use. Maybe it is due to you cannot use
com as the second-level domain and you can use another second-level domain instead of
com to see if the issue persists.
Best regards,
Susie

Ricoh Aficio MP C2051 Scan to Folder - Windows Server 2012 Error: Authentication with the destination has failed check settings

I have recently upgraded a clients servers to Windows Server 2012 & since doing so have lost the ability to scan to folder.
Both servers are domain controllers and previously on a 2008 domain controller I would have had to make the following change to allow scan to folder:
Administrative Tools
Server Manager
Features
Group Policy Manager
Forest: ...
Default Domain Policy
Computer configuration
Policies
Windows Settings
Security Settings
Local Policies
Security Options
Microsoft Network Server: Digitally Sign Communications (Always)
- Define This Policy
- Disabled
However I have applied this to the Windows 2012 server but am still unable to scan, possibly due to added layers of security in server 2012. The error on the scanner is Authentication with the destination has failed check settings.
I have also tried the following at the server:
Policies -> Security Policies
Change Network Security: LAN Manager authentication level to: Send LM & NTLM - Use NTLMv2 session security if negotiated.
Network security: Minimum session security for NTLM SSP based (including secure RPC) clients and uncheck the require 128 bit.
Network security: Minimum session security for NTLM SSP based (including secure RPC) servers and uncheck the require 128 bit
I have created a user account on the server for the ricoh and set this in the settiings of the Ricoh and verified everything is correct.
Are there any other things I have missed?

I can email anybody the firmware module if interested and how to...
Tell me your model and email
If your offer still stands we have an Aficio MP C3300
Firmwareversion
Modulnavn Version Delnummer
System/Copy 1.13 D0255562H
Network Support 8.16.1 D0255563D
Font EXP 1.03 D0255588
OptionPCLFont 1.02 D0255589
animation 1.3.1 D0255568A
Fax 01.10.00 D0255569B
RemoteFax 01.10.00 D0255564B
Printer 1.11 D0255572A
RPCS 3.7.5.4.1 D0255574A
Option PCL 1.00 D0255580A
Scanner 01.17 D0255570C
Network DocBox 1.00 D0255567B
Web Support 1.06 D0255565B
Web Uapl 1.07 D0255566C
libcvm(v4) 4.13 D4135765B
GWFCU3-13(WW) 03.00.00 D3935570C
PowerSaving Sys 1.10 D0255560C
Engine 1.51:09 D0255117E
OpePanel 1.03 D0251492A
LANG0 1.03 D0251496
LANG1 1.03 D0251496
ADF 03.420:02 D3665604
Finisher 01.090:03 D3725112
Best Regards/
Henrik Plougstad
henrik(a)pieroth.dk

JAAS - Kerberos - windows 2000 domain - groups

I need to find out if a user is in 2 different groups. If they are in group a, I display results a.m. If they are in group b, I display results b.n. If they are in a and b, then I display a.m union b.n. Any ideas?
I am validating the user through kerberos already. Windows NT domain says they are valid if correct username/domain/password are enterted. Now I need to find out if they are part of a group on a domain. Any ideas? Am I making sense. Mail me at perry2of5 at yahoo.com if you need clarification or have ideas and don't want to post here.
I suspect i need to use the subject from the original login and ask for access to the group, but I don't know how to do this. Help!

I've a very simular problem (maybe even simpler).
My webapp (Struts) is running on a Tomcat and the user login has to be proofen against a Win2000 active directory server. If login is successfull I'll need the users roles from the W2k ADS. That's it.
What I know till know:
- authentication uses Kerberos
- communication with ADS uses LDAP
Has anybody an easy solution (example). I've already read all the JAAS stuff from Sun, but I'm still not sure how to implement it.
Thx, Chrise

Windows 2003 functional level and Windows 2012 additional DC installation

I was trying to add a windows 2012 Domain controller('D') to my windows 2003 functional level domain. My domain FSMO roles are running in
two DC's which is on windows 2003 functional level. (schema master, domain naming master and the PDC
running on
server 'A' and RIP pool manager and the infrastructure master running on server B. DC's A and B is running in site London and the windows 2012 DC I am planning to install is in
US. I have a
vpn tunnel between london and the US office.
In US office one of the branch
office i have a DC 'C' which is already replicating to DC 'A' in
london. The DC 'D' i am planning to install is for my disaster recovery office in the US. (DR for the US office)
While adding the 2012 server as an additional domain controller, I am getting the below error message,
"Error determining whether the target environment requires adprep: Validation error: Unable to check the domain upgrade status for
server (server name). Exception: The specified server cannot perform the requested operation \n
Details:Test.Verify Domain upgrade status.ADPrep.Win32Exception,-2147
467259
Find below the print screen. Please somebody help.

Hi,
This error my be caused by no active Schema Master in your domain. Please check the active schema owner.
Hope this helps:
http://serverfault.com/questions/436532/fix-error-determining-whether-the-target-environment-requires-adprep-in-windows
Regards.
Vivian Wang

Is it possible to join a Windows server domain?

Hi, We have a mixtures of Windows and Mac clients at school. We have recently had installed a Windows Server 2003. The windows all work well - but other than as a file server can I expect more from the macs? Is it possible to join the windows domain - and log in as different users so that different network drives are mounted at log in? Thanks in advance!

Hi, We have a mixtures of Windows and Mac clients at
school. We have recently had installed a Windows
Server 2003. The windows all work well - but other
than as a file server can I expect more from the
macs? Is it possible to join the windows domain - and
log in as different users so that different network
drives are mounted at log in? Thanks in advance!
Yes. The server does not have to be running Services for Macintosh.
If the server is running Active Directory, you'll have to work with the windows admin people to create the AD account.
Otherwise, you'll just hae access to the shares.
On the Mac, I think the AD options are under Directory Services.
To map drives at login, the easiest way is to write an Applescript, save it as an application, and add it as a login item.
I can't recall the exacy syntax, but for each drive, the script should look something like this:
Tell Application "finder"
try
mount "smb:\\windows.server.ip.address\sharename"
end try
You will get a user id/pw/domain prompt for each share.
For e-mail, assuming they use Exchange, you'll need exchange server 2000 SP 2 or higher with OWA, IMAP, and LDAP active on the mail server to be able to access mail through Entourage or Apple mail.
Otherwise, you'll be limited to Outlook Web Access.
Printing: Standard IP,LPR, or appletalk printer setup.

Windows server domain group membership with functional level 2003 - windows API

Similar Messages

Maybe you are looking for