security
295 TopicsBest practices: sharing folders, NTFS+share permissions and the Everyone permissiion
Hi! Trying to follow best practices on sharing data folders using security groups instead of users, I rolled down the hill and I can't go any further. I have a data folder shared on the network. The data is on my Server 2016 (I tried this on a Server 2012R2 and it does the same). Inside that folder, there is a subfolder that I want to give permissions. So I created a security group and give permission to that security group (following https://social.technet.microsoft.com/Forums/office/en-US/c6242159-d15d-417e-91f8-eb19c0da3a35/best-practices-for-basic-ntfs-permissions-on-a-share?forum=winserverfiles) and put a user into that group. Then I tried to use it to no avail. The user can't access the folder. If I directly put the user in the permission list instead of using the security group, it works as expected. If I analyze the effective permissions, I get X everywhere for the group, with "Share" on the "Access limited by" column. But the network share is Everyone - Full Control (and no other in the list). As you can see https://superuser.com/questions/1276744/windows-file-permission-access-limited-by-share https://social.technet.microsoft.com/Forums/ie/en-US/b58a08ee-7d7c-4d73-a8e3-587a89f0d67a/domain-users-recieve-access-denied-errors-for-folders-they-have-permissions-to-access?forum=winserverfiles, https://social.technet.microsoft.com/Forums/windows/en-US/d1248276-3955-4c68-9027-c8f1a82185b4/quotaccess-limited-by-sharequot-unable-to-access-files-via-security-group-membership?forum=winserverfiles or https://social.technet.microsoft.com/Forums/en-US/7ee5e34c-bbfa-41c9-a08b-49e3eca7353c/access-limited-by-share-for-effective-permission-on-assigned-group-if-the-group-doesnt-have?forum=winserverfiles, I'm not alone. The last post has the correct identification of the problem: the security group that I use is not included in the definition of Everyone for Microsoft, so I have to manually add the security group to the root share permission. But having dozens of security groups, adding all of them to the root share folder's permission list is not a funny thing to do. So, what's the correct way of doing this?Solved161KViews1like5CommentsGetting certificate error warning when accessing server using its internal IP over VPN
I've given my web server an SSL certificate from my own CA. the certificate has (Server and client authentication in addition to IP security IKE because i use the same certificate for my SSTP VPN Server). certificate's subject name (Type=CN Common name) is the external domain name that points to my server's public IP address. In certificate's alternative name, I set it to DNS type and added the server's local domain name (server-2.test.local). so when I type in the external domain name into a browser of a non-local computer, my test website from that server loads fine over HTTPS, no certificate error whatsoever. but when I first connect to my local network using SSTP VPN (VPN host name is the same as the external domain name that points to my server's public IP address), and then once i'm connected, I try to use the local domain name of my server in the browser, i get this certificate error. NET::ERR_CERT_COMMON_NAME_INVALID This server couldn't prove that it's [server's local domain name]; its security certificate is from [server's external domain name]. This may be caused by a misconfiguration or an attacker intercepting your connection. what am i missing or doing wrong? i don't know if it's related but on IIS server, I have set a rule to redirect HTTP to HTTPS. my question is not a duplicate of the other one linked here. that question is not about 2 DNS names (one local and one external) it's about 1 DNS name and 1 localhost.Solved107KViews0likes3CommentsWindows Server 2016 No Internet Access after AD, DNS and DHCP setup
I have a Windows Server 2016 on which is setup as a Domain Controller. I have AD, DNS and DHCP setup on the same server. The DNS server address is localhost and DNS forward has been setup for the default gateway server locally. I cannot get internet access on my server using localhost as mt DNS address. But if I use default gateway as DNS server internet access works so I know there is something wrong in my DNS server setup and forwarding. Please help?107KViews1like14CommentsTLS 1.2 & Server 2019
Trying to get through some prerequisites for an application and it asks about TLS 1.2. We are running Server 2019 and from all that I've Googled, it says that TLS 1.2 is enabled by default in Server 2019. But, when I look for the registry keys that are posted everywhere to verify TLS 1.2 is enabled, I don't see those keys. Also, when I run IIS Crypto from Nartac on the server in question, everything is greyed out, not showing as being enabled. What is the correct answer here?? Do I need to add those registry keys for TLS 1.2 to be enabled, or is it enabled by default? Very confused.Solved49KViews0likes4CommentsKDC error - Cannot find a suitable certificate to use for Smart Card Logons (Hello for Business)
We have been using Hello for Business for over a year now. This morning, I come in and have users that are no longer able to login via PIN or FaceID. On review, I can see that our certificate (PKI) renewed. Everything states that the certificates are valid. For the life of me, I cannot seem to figure out why after a renewal, this would break. Any ideas? The date on the certificate for Kerberos, and DC Authentication are both dated today with 1YR expiration (2019 Aug) Desktops all have valid certificates. Root certificate is valid and does not expire for like 30 years. I even delete the DC, Kerberos certifcates, and reissued them. Found an article about changing the RSA and merging the three certificates into one (Domain Controller Authentication (Kerberos)) and superseded the prior three. Verified that all DCs had the new certificate. Still same error on DCs. Please help!43KViews1like4CommentsDisable automatic proxy setup - Automatically detect settings
Hi There, For my organisation. I want to turn off 'Automatically detect settings' in the settings of Windows server. This is regarding the Automatic proxy setup. I want to do this using a gpo and scope it on all the servers in our domain. Unfortunately I cannot find anything that works. I tried few things, but it didnt gave me the result I wanted to. You have some suggestions?40KViews0likes4CommentsNET::ERR_CERT_COMMON_NAME_INVALID
In a clean lab environment I installed 2 Windows Server 2019 servers. On the first server I installed: - Active Directory Domain Services - Active Directory Certificate Services with: - Certification Authority - Certification authority Web enrollment I joined the second server to the same AD domain and installed - IIS From IIS I attempted to get a certificate using either: - Create domain certificate - Create certificate request I attempted associating either certificates to the Default Web site but I go on getting the same error: NET::ERR_CERT_COMMON_NAME_INVALID that means: This server couldn't prove that it's myserver.mydomain.local; its security certificate does not specify Subject Alternative Names. This may be caused by a misconfiguration or an attacker intercepting your connection. Am I missing any relevant step? How can I solve the problem? Regards36KViews0likes5CommentsWindows Server 2019: The component store has been corrupted. Error 0x80073712
Hi all, I'm trying to install the Server Backup feature on our 2019 Server, but it results in this error: Any ideas on what may have caused this, and how to solve it? The server was installed about 5 months ago, and the installation is basically stock, not much changes made. Thanks in advance.35KViews1like12Comments