The NET Command is used to manage network security resources as follows:
View user account password and logon requirements (also displays the machine type - NT Server or NT workstation)
NET ACCOUNTS
View password and logon requirements for the network domain.
NET ACCOUNTS /DOMAIN
Set the number of minutes a user has before being forced to log off when the account expires or valid logon hours expire
NET ACCOUNTS /FORCELOGOFF:minutes /DOMAIN
Prevent forced logoff when user accounts expire
NET ACCOUNTS /FORCELOGOFF:NO /DOMAIN
Set the minimum number of characters for a password.
NET ACCOUNTS /MINPWLEN:C /DOMAIN
The range is 0-14 characters; the default is 6 characters.
Set the maximum number of days that a password is valid.
NET ACCOUNTS /MAXPWAGE:dd /DOMAIN
The range is 1-49710; the default is 90 days.
Set passwords to never expire.
NET ACCOUNTS /MAXPWAGE:UNLIMITED /DOMAIN
Set a minimum number of days that must pass before a user can change a password (default = 0)
NET ACCOUNTS /MINPWAGE:dd /DOMAIN
Require that new passwords be different from 'x' number of previous passwords
NET ACCOUNTS /UNIQUEPW:x /DOMAIN
The range for 'x' is 1-24
Synchoronise the user accounts database (PDC and BDC)
NET ACCOUNTS /SYNC /DOMAIN
View user account details
NET USER [/DOMAIN]
Add a user account.
NET USER username {password | *} /ADD [options] [/DOMAIN]
Modify a user account.
NET USER [username [password | *] [options]] [/DOMAIN]
Delete a username
NET USER username [/DELETE] [/DOMAIN]
Generate a random password:
NET USER administrator /random
Add a Workgroup
NET GROUP groupname /ADD [/COMMENT:"text"] [/DOMAIN]
Edit a workgroup
NET GROUP [groupname [/COMMENT:"text"]] [/DOMAIN]
Delete a group
NET GROUP groupname /DELETE [/DOMAIN]
Add a user to a group
NET GROUP groupname username [...] /ADD [/DOMAIN]
Delete a user from a group
NET GROUP groupname username [...] /DELETE [/DOMAIN]
To View, Add or modify a local workgroup replace GROUP in the commands above with LOCALGROUP.
Monday, January 3, 2011
Friday, December 31, 2010
Export Active Directory data
Show me the samid and upn name of all disabled user accounts in the domain.
C:\>dsquery user -disabled | dsget user -samid -upn
Show me the samid and upn of each user account in the domain and show me when the user account expires.
C:\>dsquery user | dsget user -samid -upn -acctexpires
Show me the samid and upn of each user account in the domain and show me when the user account expires. Send output to a file called c:\log.txt
C:\>dsquery user | dsget user -samid -upn -acctexpires > c:\log.txt
Show me the samid and upn name of each user account in the Production OU in the TEST.COM domain with a password age of 14 days or older and also show me if the account is flagged for "user must change password" and if the user account is allowed to change its password
C:\>dsquery user "OU=Production,DC=test,DC=com" -stalepwd 14 | dsget user -samid -upn -mustchpwd -canchpwd
C:\>dsquery user -disabled | dsget user -samid -upn
Show me the samid and upn of each user account in the domain and show me when the user account expires.
C:\>dsquery user | dsget user -samid -upn -acctexpires
Show me the samid and upn of each user account in the domain and show me when the user account expires. Send output to a file called c:\log.txt
C:\>dsquery user | dsget user -samid -upn -acctexpires > c:\log.txt
Show me the samid and upn name of each user account in the Production OU in the TEST.COM domain with a password age of 14 days or older and also show me if the account is flagged for "user must change password" and if the user account is allowed to change its password
C:\>dsquery user "OU=Production,DC=test,DC=com" -stalepwd 14 | dsget user -samid -upn -mustchpwd -canchpwd
Wednesday, December 29, 2010
Restoring objects with Microsoft ADRestore (previously Sysinternals)
Formerly Sysinternals and now Microsoft, Mark Russinovich has created a command-line freeware application called ADRestore. The tool enumerates all of the currently tombstoned objects in a domain and allows you to restore them selectively, and provides a convenient command-line interface for using the Active Directory reanimation functionality. If you run it from the command line you will be prompted to choose which object you want to restore, and since there could be quite a few tombstoned objects, this process might take some time as you answer NO to each and every prompt.
To add a little selectivity to the restore operation, you can run ADRestore with a parameter to narrow down the search. For example:
adrestore -r daniel
would search for all objects with "daniel" as part of its name.
The -r switch forces the program to prompt the user for each restoration. Otherwise, all the objects found matching said criteria will be automatically restored. The default (no criteria supplied) is that all tombstoned objects will be enumerated and restored.
Note that deleted items may no longer be members of specific organizational units or OUs. Restoring these objects from deleted status will not automatically restore them to their respective OUs; this will need to be done manually.
Recovering Deleted Items in Active Directory
Restoring objects with ADRestore.net
Guy Teverovsky, a fellow MVP from Israel, has written a cool tool that allows you to easily restore deleted AD objects. The tool is provided as freeware and has no kind of support, but from what I've seen, it works great. Some of the tools features include:
- Browsing the tombstones
- Domain Controller targeting
- Can be used with alternative credentials (convenient if you do not logon to your desktop as Domain Admin, which you should never do anyway)
- User/Computer/OU/Container reanimation
- Preview of tombstone attributes
Enumerating tombstones
Previewing the tombstone attributes
Restoring a deleted user account
For more information on Guy's tool, please see Guy's blog entry announcing ADRestore.net
Tuesday, December 28, 2010
Windows Server : Managing the Terminal Services - RDP Permissions
Managing the terminal services includes various tasks such as assigning RDP permissions, configuring connection limits, session time limits, assigning session permissions, viewing process, monitoring sessions, logging off users, disconnect sessions, and resetting the terminal services. Terminal Services Manager is used to perform these administrative tasks. Ensure you have a thorough understanding of every task and the implications before you apply it on a production network. Improper configuration of permissions may result in assigning additional permissions to the users where not required and inadequate access where required.
RDP Permissions
Terminal Services Manager allows you to configure various RDP permissions. Permission sets such as Full Control, User Access, Guest Access, and Special Permissions can be assigned to users, clients, and groups. Each permission set has one or more permissions (see Tables 1 and 23). Figure 1 shows the RDP properties. Figure 2 shows the advanced security settings for RDP. Figure 3 shows RDP permissions.
| Permission[*] | Description |
|---|---|
| Full Control | Permission set providing Query Information, Set Information, Remote Control, Logon, Logoff, Message, Connect, Disconnect and Virtual Channels permissions |
| User Access | Permission set providing Query Information, Logon, and Connect permissions |
| Guest Access | Logon permission only |
| Logon | Logon to Terminal Server session |
Figure 1. RDP Properties
Saturday, December 11, 2010
windows xp service pack 3 access denied error
Procedure to follow
1) Download and then install the Subinacl.exe file from the following link
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=e8ba3e56-d8fe-4a91-93cf-ed6985e3927b&displaylang=en
2) Start Notepad
Copy and then paste the following text into Notepad.
cd /d "%ProgramFiles%\Windows Resource Kits\Tools"
subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f /grant=system=f
subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrators=f /grant=system=f
subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f /grant=system=f
subinacl /subdirectories %SystemDrive% /grant=administrators=f /grant=system=f
subinacl /subdirectories %windir%\*.* /grant=administrators=f /grant=system=f
secedit /configure /cfg %windir%\repair\secsetup.inf /db secsetup.sdb /verbose
3) Save this file as sp3fix.bat
Double-click the sp3fix.bat file
to run the script.
Note This script file may take a long time to run. You must run this script as an administrator.
1) Download and then install the Subinacl.exe file from the following link
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=e8ba3e56-d8fe-4a91-93cf-ed6985e3927b&displaylang=en
2) Start Notepad
Copy and then paste the following text into Notepad.
cd /d "%ProgramFiles%\Windows Resource Kits\Tools"
subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f /grant=system=f
subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrators=f /grant=system=f
subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f /grant=system=f
subinacl /subdirectories %SystemDrive% /grant=administrators=f /grant=system=f
subinacl /subdirectories %windir%\*.* /grant=administrators=f /grant=system=f
secedit /configure /cfg %windir%\repair\secsetup.inf /db secsetup.sdb /verbose
3) Save this file as sp3fix.bat
Double-click the sp3fix.bat file
to run the script.
Note This script file may take a long time to run. You must run this script as an administrator.
Tuesday, October 12, 2010
Microsoft DOS route command
Route
Command to manually configure the routes in the routing table.
Availability
The route.exe command is an external command that is available in the below Microsoft operating systems.
Windows 95
Windows 98
Windows ME
Windows 2000
Windows XP
Windows Vista
Windows 7
Syntax
ROUTE [-f] [-p] [command [destination] [MASK netmask] [gateway] [METRIC metric] [IF interface]
| -f | Clears the routing tables of all gateway entries. If this is used in conjunction with one of the commands, the tables are cleared prior to running the command. | |||||
| -p | When used with the ADD command, makes a route persistent across boots of the system. By default, routes are not preserved when the system is restarted. When used with the PRINT command, displays the list of registered persistent routes. Ignored for all other commands, which always affect the appropriate persistent routes. This option is not supported Windows'95. command | |||||
| command | One of these: PRINT Prints a route | |||||
| destination | Specifies the host. | |||||
| MASK | Specifies that the next parameter is the 'netmask' value. | |||||
| netmask | Specifies a subnet mask value for this route entry. If not specified, it defaults to 255.255.255.255. | |||||
| gateway | Specifies gateway. | |||||
| interface | the interface number for the specified route. ll symbolic names used for destination are looked up in the network database file NETWORKS. The symbolic names for gateway are looked up in the host name database file HOSTS. If the command is PRINT or DELETE. Destination or gateway can be a wildcard, (wildcard is specified as a star '*'), or the gateway argument may be omitted. If Dest contains a * or ?, it is treated as a shell pattern, and only matching destination routes are printed. The '*' matches any string, and '?' matches any one char. Examples: 157.*.1, 157.*, 127.*, *224*. Diagnostic Notes: Examples: > route PRINT
If IF is not given, it tries to find the best interface for a given > route PRINT One way to use this would be as follows: You can't ping the server that you are connecting to, but you know the ip address to be 127.16.16.10 >route PRINT Interface List Active Routes: ** notice that no gateway for the current ip goes to 255.255.255.0, so it must be added. Now do the below command. >route ADD 127.16.0.0 MASK 255.255.255.0 **Then do the below command: >route print Active Routes: **Notice the ** ip address gives me the default gateway. |
Subscribe to:
Posts (Atom)