Starting 70-640 training, a few questions.

-

working way through beginning of kit, , have few questions.

1.  identities subject kerberos authentification (users, groups, etc)?

2.  domains part of server, vice versa, or it's own separate entity?

3.  can identities denied kerberos authentification?

4.  identities subject kerberos authentification , username/password protocol?  can these set by administrator turned on/off?

5.  can individual documents/applications issued access control list?

that's comes mind @ moment.  appreciate input.

time.

 

hi,

1.    kerberos default authentication method in ad domain.

2.    domain not part of server. domains container objects. domains collection of administratively defined objects share common directory database, security policies, , trust relationships other domains. in way, each domain administrative boundary objects. single domain can span multiple physical locations or sites , can contain millions of objects.

3.    yes, can denied.

note:

although kerberos protocol authenticates user's identity, not authorize access. kerberos ticket proves user user claims be. after user’s identity verified, local security authority authorize or deny resource access.

4.    windows operating system supports several protocols verifying identities of users claim have accounts on system. may disable kerberos authentication turning off kdc service on dc.

5.    the access control list, or acl, used specify list of individual access control entries (aces). can configure acl on individual file/folder.

 

additionally, here articles related ad domain , kerberos authentication may understand more clearly:

 

what kerberos authentication?

http://technet.microsoft.com/en-us/library/cc780469.aspx

 

what domains , forests?

http://technet.microsoft.com/en-us/library/cc759073.aspx



Windows Server  >  Windows Server General Forum



Comments

Post a Comment

Popular posts from this blog

Domain migration ERR3:7075 Failed to change domain affiliation, hr=8007054a This operation is only allowed for the Primary Domain Controller of the domain

-
dear all hope 1 faced issue , can me solution member server migration. i'm in process of intraforest migration using admt 3.1, have established trust between domains. domain (source domain) have both dc's running on windows 2003 functional level windows 2003 , while in domain b ( target domain )we have both windows 2008 , windows 2003 domain same functional level of windows 2003. have installed exchange 2007 sp2 in domain b. have installed admt in domain b , created necessary service acct used migration purpose , provide them whatever privileges required on both source , target domain. issue user , group migration done, while member server migration failed eventhough migration service account added local admin group of these member servers in source domain need migrated , domain local setting policy network access has been enabled llcsrpc, browser, netlogon ...(named pipes can accessed anonymously.) also have unistall , install microsoft network client services gett...
Read more

2008 Windows Deployment Server Properties Error

-
currently wading through setup , configuration of wds on 2008 server. have captured xp sp2 image , purposes of testing not prestaging. pxe response settings have been set "respond (known & unknown) client computers" leaving "for unknown clients, notify administrator etc" unchecked when ok properties sheet error "server properties error" "the system cannot find file specified" when attempting use command "wdsutil /approve-autoadddevices /requestid:1" in response pending devices within gui "an error occurred while trying execute command. error code: 0x6 error description: access denied" surely if not attempting add workstations domain (no prestaging) there shouldn't problem. any appreciated  answering part of own question although if can explain reason appreciated. server properties error occurs when launching windows deployment services using start>all programs>administrative tools. if access via server manager...
Read more

How do a find data in one file, search for it in another file and if not found, write a custom message to another file

-
in file if.txt, starting on 2nd line of file, data formatted follows: ah10551,a10551,cn=a10551,a10551@qts.com ah10600,a10600,cn=a10600,a10600@qts.com ah10608,a10608,cn=a10608,a10608@qts.com in file sf.txt, data formatted follows: 2011-02-16 17:26:44 sid acme\ah10551 added sid history of qts\a10551 2011-02-16 17:26:44 sid acme\ah10244 added sid history of qts\a10244 2011-02-16 17:26:45 sid acme\ah10425 added sid history of qts\a10425 please provide suggestions on how following: 1. in if.txt file, read first field first ',' , store in variable called $if1 2. in sf.txt file, search for the value stored in $if1 , if found, ignore.  if not found, write custom message in another file such as: $if1 sidhistory not migrated. these files wont large.  im trying build 'exception file' of items in if.txt file not occurring in sf.txt file. thanks in advance ideas. mtv99 many ways that... here's one... (using example data) [array]$if1=@() gc d:\if.txt...
Read more