Publish CRL with a CNAME

TheMSsForum.com: The Microsoft Software Forum

The MSS Forum ‹ Security
- Archive
  - Biz
  - MCSE
  - CRM
  - Drivers
  - Framework
  - ADO
  - ASP
  - Compact
  - Forms
  - Dotnet
  - C#
  - VB
  - FontpageGen
  - Excel
  - WorkSheet
  - Exchange
  - Setup
  - Fox
  - Fontpage
  - ASP
  - IIS
  - Entourage
  - Money
  - Messanger
  - PocketPC
  - Powerpoint
  - Project
  - Publisher
  - Excel
  - VB
  - Security
  - Portal
  - Services
  - SQLServerDev
  - SVCS
  - SQLServer
  - VB
  - VC
  - MFC
  - ExcelGen

- Previous
  - 1
    - Root CA on a VM Hello, I wonder if it a good idea. I want to install my root CA on a Virtual Machine, and burn virtual hard drive into a DVD. It's more handy for me than use a dedicated hardware. What do you think about this way ? Regards, -- P.J.A. Tag: Publish CRL with a CNAME Tag: 95924
  - 2
    - Users cannot modifie files with disable option delete subfolders f SO: sbs windows 2003 one share folder that i want remove possibility of deleting files, I had disable the security option in special permissions delete subfolders files. But when the user try to change documents, he cann't save it and generate temp files. I f I active this option the user can delete files too Any idea? thanks regards Tag: Publish CRL with a CNAME Tag: 95919
  - 3
    - Users cannot connect from external domain. - We have users from an external Domain (DomainB) that can no longer connect to a file share on a server in our Domain (DomainA). - Both Domains have outgoing external trusts setup to each other, which have both been validated and are working OK. - DomainB users logon to their own domain, then connect though a drive mapping, and enter their DomainB credentials and connect to Server1\fileshare in our DomainA. - Server1 at this point gets two identical Security Event Log Audit Failure events for each attempt as follow â?? - Sourceâ??Security, Category-logon/logoff, EventID-537, user-NT AUTHORITY\SYSTEM - Logon Failure: Reason: An error occurred during logon User Name: DomainBUser1 Domain: vtx-alt Logon Type: 3 Logon Process: NtLmSsp Authentication Package: NTLM Workstation Name: DomainBWorkstation1 Status code: 0xC000005E Substatus code: 0x0 Caller User Name: - Caller Domain: - Caller Logon ID: - Caller Process ID: - Transited Services: - Source Network Address: 172.2x.4x.1xx Source Port: 0 - The DomainB\group that has permissions to the share on Server1 can still be seen on the folders with the correct rights assigned, BUT if an attempt is made to add the same DomainB\group to another folder on Server1, whilst DomainB can be seen in the Locations box, it cannot resolve the group and cannot be added. - The above has been tested for other file servers in various VLans in DomainA, and none can resolve or add the DomainB\group. - 2 Domain Controllers from the same VLan as Server1, however, can resolve and add DomainB users & groups OK. And when a user from DomainB maps a drive and connects to a test share to which the DomainB\group has permissions to on these Domain Controllers, they can do so with their DomainB credentials, and all works as expected. - The two DCâ??s are in the same VLan as Server1, and they have the same DNS etc settings, - I believe these two DCâ??s hold the trust for DomainA to DomainB - Network team have confirmed that there are no Firewalls in place between DomainA & DomainB, and all servers on the Vlan that Server1 and the two DCâ??s are on are treated in exactly the same way. - There are no failed logon attempts on the DCâ??s from DomainB. Hope that all makes sense, and any help hugely appreciated! Tag: Publish CRL with a CNAME Tag: 95917
  - 4
    - Today: Q&A with Security MVP Expert Chat Hello everyone, You are invited to join our public chat on December 11th. Security Chat: Q&A With the Security MVP Experts We invite you to attend a Q&A with the Microsoft Security MVPs. In this chat the MVP experts will answer your questions regarding online safety issues such as phishing, spyware, rootkits as well as server related topics. If you have questions on how to protect your PC, please bring them to this informative chat. When: December 11th at 4pm PDT Where: TechNet Chat Room www.microsoft.com/technet/community/chats/chatroom.aspx Password: Public Chat no password required We are also holding similar chats for Exchange Server if anyone is interested. For more information on the Security and Exchange chats and an add to calendar file, please vistit http://www.microsoft.com/communities/chats/default.mspx Exchange Chats: Q&A With the Exchange MVP Experts We invite you to attend a Q&A with the Microsoft Exchange Server MVPs. In this chat Exchange MVPs will be on hand to answer your questions about Exchange Server, Outlook and Exchange for Small Business Server. So if you are thinking of upgrading to Exchange Server 2007 or have questions about Exchange Server 2003 we hope you can join us for this informative online chat! Chat 2: December 12 at 5pm PDT Where: TechNet Chat Room www.microsoft.com/technet/community/chats/chatroom.aspx Password: Public Chat no password required -- Melissa Travers MVP Lead | Microsoft Exchange Server, Virtual Machine, Windows Security, Windows Server: Clustering, DPM, Directory Services, ISA Server & MIIS. Please do not send email directly to this alias. This alias is for newsgroup purposes only. This posting is provided "AS IS" with no warranties, and confers no rights. Tag: Publish CRL with a CNAME Tag: 95913
  - 5
    - Hacked!!! Question on port 137 I've recently had my linksys befsx41 router hacked. I've installed a packet sniffer and am watching the logs. Im noticing a random UDP Packet being sent out port 137 from my XP pro box. Its going to a few addresses in asia. Should I be overly concerned with this? It happens in safe mode which strikes me as odd. No viruses, trojans etc found. Thanks in advance, Ralph Gustavsen Tag: Publish CRL with a CNAME Tag: 95910
  - 6
    - Create certificate with makecert for LDAPS on a DC ? Hi, I would like to use LDAPS on my DC. I have already read this article : http://support.microsoft.com/default.aspx/kb/321051 ... but I am not able to create my self-signed certificate with certreq as I dont have any CA in my domain to submit the "request.req" file. So I tried to create my own certificate with makecert by using this command : "makecert -r -pe -n "CN=FQDN_OF_DC.domain.local" -b 01/01/2000 -e 01/01/2036 -eku 1.3.6.1.5.5.7.3.1 -ss my -sr localMachine -sky exchange -sp "Microsoft RSA SChannel Cryptographic Provider" -sy 12" The certificate is created in Personal\Certificates (under Computer) but when I watch the certificate status, I have a warning saying : "This CA Root certificate is not trusted because it is not in the Trusted Root Certification Authorities store.". When I try to connect (locally)to my LDAPS using ldp.exe , I have an error "Error <0x51>: Fail to connect to FQDN_OF_DC.domain.local." Do you think I have this problem because of the fact the certificate that I have created has not been delivered by a Trusted root CA store ? Is there a way to bypass this limitation by creating a self signed certificate for my DC that will let me try to use LDAPS ? Thank you :) P.S: Sorry for my english ;-) -- bigstyle MVP Windows Server - Directory Services MCSE 2000/2003 Security Tag: Publish CRL with a CNAME Tag: 95909
  - 7
    - lookupaccountname and workgroups hello, i asked this question in win32.programming.networks but got the advice to try here, so here we go... my basic problem is, when im calling LookupAccountName on a process running as localsystem when not member of a domain (i.e., the machine is in a workgroup) it returns 1332: no mapping between account names and security ids was done. i have been experimenting a bit using a small program similar to this pseudo-c++: string username GetUserNameEx (NameSamCompatible, username, username.length) print (username) string domainname // the sid things here are out parameters not relevant for my example if (LookupAccountName (NULL, username, sidbuf, sidbuf.length, domainname, domainname.length, sidthing)) { print (domainname) } else { print (geterror ()) } when running as user on a machine on a domain i get: username: mydomain\jdoe domainname: mydomain running as localsystem on a domain i get: username: mydomain\mycomputer$ domain: mydomain but, running as user on a machine in a workgroup i get: username: mycomputer\jdoe domain: mycomputer and finally, running as localsystem when in a workgroup i get: username: workgroup\mycomputer$ domainname fails with 1332 as noted above an interesting side note is that the domain part of the username differs in the last two examples... after some trial and error i discovered that if i removed the domain part and the trailing $ from the username the call to lookupaccountname succeeds, but returns the same domainname as username (e.g., mycomputer in the example above). do i have to make a condition like if (in_workgroup && localsystem) { ... } or have i got something else wrong here? regards, lars Tag: Publish CRL with a CNAME Tag: 95907
  - 8
    - problem with EFS Recovery agent 4 month ago, i have implemented a certificate autority on my domain and i have create one EFS Recovery Agent. i have deployed many certificates for my users and the efs recovery agnet work fine for these months. today, i have make a change to my "User" certificate in the security tab, i have deployed the updated template to one user and i have tested the recovery of crypted data with my begening "efs recovery agent" certificate. now, i'm unable to recover file with this certificate... Why??? i need to know why my EFS Recovery Certificate does not work after the change. (the only thing i have change is to enable the autoenrollment for this user). for security, i need to have a fonctional EFS Recovery Agent Thanks. Tag: Publish CRL with a CNAME Tag: 95903
  - 9
    - File xfer security Hello, How can I securely transfer files using a recordable CD from one XP to the other. The XP Pro's native file encryption works only in the same HD. The moment the file is copied to any other media it disables its security feature. Is there any Microsoft product or a Freeware software that does not expire nor has a number of files limitation for this purpose? Thanks Jim Tag: Publish CRL with a CNAME Tag: 95902
  - 10
    - SAMR OpenUser fails with C0000022 Hi everybody! A customer of ours operates an AD with one domain and a couple of subdomains spread over few dozens AD-Servers across their intranet. On one of the member servers (W2003) in their HQ there is an application that authenticates users from several sub domains against the respective AD-Servers (W2000). For users from some of the subdomains, the authentication works, for at least three of the subdomains the authentication fails. I do not have source code access for this application but I captured the network traffic and it seems like the SamrOpenUser request gets a c0000022 (STATUS_ACCESS_DENIED) response from the subdomain controllers. We checked the ACL on the "user" object in the AD - it had sufficient access rights for a read access set. Also, a object access audit on the AD "user" object showed no failure. What other settings can cause a STATUS_ACCESS_DENIED response for the SamrOpenUser request? Tag: Publish CRL with a CNAME Tag: 95900
  - 11
    - Security Configuration Wizard Hello, can I use the System Center Configuration Manager 2007 to substitution the SCW? regard Thomas Tag: Publish CRL with a CNAME Tag: 95898
  - 12
    - Group Policy script protection We have an environment with 17,000 pc's which we periodically change the local administrator password with a vbscript using group policy. Does anyone know a way to hide the new password in the script in case a user navigates to the policy script file and opens it and reads it? We have tried the MS script encoder to change the vbs file to vbe but there is simple code on the internet that enables you to read it anyway. Tag: Publish CRL with a CNAME Tag: 95887
  - 13
    - computer restart again and again - does not start even in safe mod Sir, > FOR my computer, I have installed dual Operating System, WINDOWS XP, in C & > D drive. On start up of my computer through C drive system, it boots upto > WINDOWS screen, then instead to go to windows welcome screen, it restarts > again and again. I canâ??t even get it working on 'safe mode'. > On other OS i.e. in D drive my computer works normally. Through D drive OS, > I had scanned full computer, by UPDATED Antivirus AVG & NORTON. But problem > of startup through C drive does not resolved. > ON C drive boot up, selection it restarts each time. PLEASE INFORM ME what > has gone wrong with my OS in C drive and HOW TO RESOLVE the PROBLEM? > MY Email contact: gjanklesaria@hotmail.com > Thanks > G J ANKLESARIA > Tag: Publish CRL with a CNAME Tag: 95886
  - 14
    - Computer Certificate Private Key By default, if i set up auto enrollment for computer certificate, i can from computer export private key. What would happened, if i import these key to different computer. If I use different computer and i tried to authenticate, to IAS, would it exempted as valid ? Tag: Publish CRL with a CNAME Tag: 95885
  - 15
    - Norton Anti virus update Norton prompted me to update the anti virus system. When I did that and tried to restart the computer, it freezes and won't let me start in anything other than "safe mode". Norton uninstalled the software & it is still happening. Any ideas? -- Mary B Tag: Publish CRL with a CNAME Tag: 95877
  - 16
    - Your user profile was not loaded correctly using Vista Business I have a 'strange' problem trying to login to an SBS2003 domain using a new Vista Business workstation using a specific domain account. When I use this account I get a popup with 'Your user profile was not loaded correctly. You have been logged in using a temporary profile. Any changes made to this profile will be lost when you logout. Contact your administrator.' When I login using any other domain account, I can login OK. I have tried the following: -Used an account with identical domain group memberships as the 'bad' account -Removed the 'bad' account profile on the Vista workstation -Removed/Rejoined the Vista workstation to the domain Anyone else see this? -Removed/Rejoined the Vista workstation to the domain after removing the profile Tag: Publish CRL with a CNAME Tag: 95876
  - 17
    - Certificate request only 2 years How can extend certificate request for more than two years for computer certificate. I have Enterprise Ca that is valid for 10 years, but computer certificate is only valid for two years. I have windows 2003 RS Standard server, and I have Enterprise CA. Enrolment is only for V1 certificate. If I edit template for Computer Certificate, than it become v2, and I can not use it, for enrolment. Tag: Publish CRL with a CNAME Tag: 95867
  - 18
    - Web enrollment, only web server template I have CA Windows 2003 R2 Standard with Enterprise CA. When I go to : http:\//localhost/certsrv, I can chose only web certificate ? How can I add other certificates ? Tag: Publish CRL with a CNAME Tag: 95866
  - 19
    - How to request client certificate, non domain computers I have several Non domain computers. I need to request a computer certificate, for 802.1x. Can these be done ? Tag: Publish CRL with a CNAME Tag: 95865
  - 20
    - fastest proxies! Hi all, here are some new and fast proxies : www.gotfiles.org www.g0tbored.com www.isbored.net Happy surfing! Tag: Publish CRL with a CNAME Tag: 95863
  - 21
    - D-Link DI-624 setup I have the subject router installed and use a direct connection (LAN)to my desktop. I never set up a password for the wireless connection. I now have a laptop and want to use the wireless capability. I don't have any installation CD (don't even know if there was one) How do I set this up so that only someone with the proper password can access the wireless network? Tag: Publish CRL with a CNAME Tag: 95860
  - 22
    - Error: 0x00000046 - when requesting certificates Hey, We have an internal PKI utilising an offlint root and policy server, and an AD integrated enterprise issuing server. We've distributed our root certificate via a GPO to all workstations/servers in AD. We have a number of certifcate templates for SSL certs. We permission these with Role groups to define who can request and modify the certs. We have one problematic box, when requesting a certificate via servername\certsrv we get a permission denied error: "An error occurred while creating the certificate request. Please verify that your CSP supports any settings you have made and that your input is valid. Suggested cause: You do not have write permission to save the file to the path Error: 0x00000046 - Permission Denied" The request is for a generic SSL certificate so that a secure channel can be used to communicate between 2 boxes. The certificate request never reaches the enterprise issuing server (no record of failed request). The error message indicates a permission issue, but the way we permission the templates is such that you wont see the cert via the web interface if your not a member of the group which can request this certificate type. The user requesting the certificate is a member of builtin\administrators of the box requesting the certificate. Anyone have any suggestions? Tag: Publish CRL with a CNAME Tag: 95854
  - 23
    - Shutdown (instead of Reboot) on recent Security Update Last Security Update required a complete Shutdown. In the past, only a Reboot was required. Never had to Shutdown before, to install a Security Update. Something not right here? Tag: Publish CRL with a CNAME Tag: 95850
  - 24
    - Failure Audit Error 529 Hi, We are getting the below mentioned event error in one of our exchange server,which is running on windows 2003 sp1. Event Type: Failure Audit Event Source: Security Event Category: Logon/Logoff Event ID: 529 Date: 12/3/2007 Time: 6:44:33 PM User: NT AUTHORITY\SYSTEM Computer: SGHXCH01 Description: Logon Failure: Reason: Unknown user name or bad password User Name: test11 Domain: India Logon Type: 3 Logon Process: Advapi Authentication Package: Negotiate Workstation Name: SGHXCH01 Caller User Name: SGHXCH01$ Caller Domain: IND Caller Logon ID: (0x0,0x3E7) Caller Process ID: 612 Transited Services: - Source Network Address: - Source Port: - For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. The "test11" user not there in our ADS Please let me know the resloution for this error, it's some one is hacking or virus? Shaik Tag: Publish CRL with a CNAME Tag: 95846
  - 25
    - security settings - <not defined> This is a multi-part message in MIME format. ------=_NextPart_000_0006_01C83597.3D4BA2C0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable When reviewing the recommended security settings for XP Professional, = some settings are shown as <not defined>. According to Microsoft's Windows XP Security Guide - = http://www.microsoft.com/technet/security/prodtech/windowsxp/secwinxp/xps= gch03.mspx Policy settings that are not specified for specific environments are = sometimes defined at the domain level, as described in Chapter 2, = "Configuring the Active Directory Domain Infrastructure." Other policy = settings that are listed as Not Defined in this chapter (Chapter 3: = Security Settings for Windows XP clients) are treated in this manner = because the default value is sufficiently secure for that particular = environment. Also, undefined policy settings in these Group Policy = objects (GPOs) facilitate the deployment of applications that need to = modify settings during installation. For example, enterprise management = tools may need to assign specific user rights to the local service = accounts on managed computers. The guidance in this chapter consists of = recommendations, and you should always carefully consider your business = needs before you make any changes in your environment. What if the workstation is a standalone workstation and connecting to = the Internet. It does not have the GPO pushes either site or domain = policy to it. What happens to its security? Any pointers/suggestions are appreciated. ------=_NextPart_000_0006_01C83597.3D4BA2C0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META http-equiv=3DContent-Type content=3D"text/html; = charset=3Diso-8859-1"> <META content=3D"MSHTML 6.00.2900.3199" name=3DGENERATOR> <STYLE></STYLE> </HEAD> <BODY> <DIV><FONT face=3DArial size=3D2>When reviewing the recommended security = settings=20 for XP Professional, some settings are shown as <not=20 defined>.</FONT></DIV> <DIV><FONT face=3DArial size=3D2></FONT> </DIV> <DIV> <P class=3DMsoNormal style=3D"MARGIN: 0in 0in 0pt"><FONT face=3DArial = size=3D2>According=20 to Microsoft=92s Windows XP Security Guide - </FONT><A=20 href=3D"http://www.microsoft.com/technet/security/prodtech/windowsxp/secw= inxp/xpsgch03.mspx"><A=20 href=3D"http://www.microsoft.com/technet/security/prodtech/windowsxp/secw= inxp/xpsgch03.mspx"><FONT=20 face=3DArial=20 size=3D2>http://www.microsoft.com/technet/security/prodtech/windowsxp/sec= winxp/xpsgch03.mspx</FONT></A></A></P> <P class=3DMsoNormal style=3D"MARGIN: 0in 0in 0pt"><FONT face=3DArial=20 size=3D2></FONT> </P> <P class=3DMsoNormal style=3D"MARGIN: 0in 0in 0pt"><FONT face=3DArial = size=3D2>Policy=20 settings that are not specified for specific environments are sometimes = defined=20 at the domain level, as described in Chapter 2, "Configuring the Active=20 Directory Domain Infrastructure." Other policy settings that are listed = as Not=20 Defined in this chapter (Chapter 3: Security Settings for Windows XP = clients)=20 are treated in this manner because the default value is sufficiently = secure for=20 that particular environment. Also, undefined policy settings in these = Group=20 Policy objects (GPOs) facilitate the deployment of applications that = need to=20 modify settings during installation. For example, enterprise management = tools=20 may need to assign specific user rights to the local service accounts on = managed=20 computers. The guidance in this chapter consists of recommendations, and = you=20 should always carefully consider your business needs before you make any = changes=20 in your environment.</FONT></P> <P class=3DMsoNormal style=3D"MARGIN: 0in 0in 0pt"><FONT face=3DArial=20 size=3D2></FONT> </P> <P class=3DMsoNormal style=3D"MARGIN: 0in 0in 0pt"><FONT face=3DArial = size=3D2>What if=20 the workstation is a standalone workstation and connecting to the=20 Internet.  It does not have the GPO pushes either site or domain = policy to=20 it.  What happens to its security?</FONT></P> <P class=3DMsoNormal style=3D"MARGIN: 0in 0in 0pt"><FONT face=3DArial=20 size=3D2></FONT> </P> <P class=3DMsoNormal style=3D"MARGIN: 0in 0in 0pt"><FONT face=3DArial = size=3D2>Any=20 pointers/suggestions are appreciated.</FONT></P> <P class=3DMsoNormal style=3D"MARGIN: 0in 0in = 0pt"> </P></DIV></BODY></HTML> ------=_NextPart_000_0006_01C83597.3D4BA2C0-- Tag: Publish CRL with a CNAME Tag: 95844
- Next
  - 1
    - December 11th: Q&A with the Security MVP Experts Hello everyone, You are invited to join our public chat on December 11th. Security Chat: Q&A With the Security MVP Experts We invite you to attend a Q&A with the Microsoft Security MVPs. In this chat the MVP experts will answer your questions regarding online safety issues such as phishing, spyware, rootkits as well as server related topics. If you have questions on how to protect your PC, please bring them to this informative chat. When: December 11th at 4pm PDT Where: TechNet Chat Room www.microsoft.com/technet/community/chats/chatroom.aspx Password: Public Chat no password required We are also holding similar chats for Exchange Server if anyone is interested. For more information on the Security and Exchange chats and an add to calendar file, please vistit http://www.microsoft.com/communities/chats/default.mspx Exchange Chats: Q&A With the Exchange MVP Experts We invite you to attend a Q&A with the Microsoft Exchange Server MVPs. In this chat Exchange MVPs will be on hand to answer your questions about Exchange Server, Outlook and Exchange for Small Business Server. So if you are thinking of upgrading to Exchange Server 2007 or have questions about Exchange Server 2003 we hope you can join us for this informative online chat! Held on 2 dates/times Chat 1: December 5th at 10am PDT Chat 2: December 12 at 5pm PDT Where: TechNet Chat Room www.microsoft.com/technet/community/chats/chatroom.aspx Password: Public Chat no password required -- Melissa Travers MVP Lead | Microsoft Exchange Server, Virtual Machine, Windows Security, Windows Server: Clustering, DPM, Directory Services, ISA Server & MIIS. Please do not send email directly to this alias. This alias is for newsgroup purposes only. This posting is provided "AS IS" with no warranties, and confers no rights. Tag: Publish CRL with a CNAME Tag: 95842
  - 2
    - Terminal Services I am trying to connect to my pc at home from my Pocket PC6700 using terminal services via the internet or wireless web on my Pocket PC6700. Is that Possible? And if so, how it that done? Tag: Publish CRL with a CNAME Tag: 95839
  - 3
    - Rundll error loading At startup, had error message about error loading a program related to Symantec and support. The address ended in tgctlcm.dll Yesterday, I tried to resolve an issue with Norton Anti-Virus 2007. I attempted to enter their chatroom but cancelled. I have already located one program loaded and I removed it. I have run AVG free and Adaware free and they say my PC is good to go. I tried to search for the specific address listed in the error message, but could not locate. Please advised Tag: Publish CRL with a CNAME Tag: 95838
  - 4
    - windows XP will not start up xp will go through start up, then shut down and give me other start up options. xp will not start up in safe mode or any other listed there. i did use the 6 bootable disk for xp. nothing works. my daughter was last on limewire looking at games. is there anything i can do? Tag: Publish CRL with a CNAME Tag: 95836
  - 5
    - Is there a file access reporting program available On some other OS's there have been (usually optional) programs available to perform what amounts to a security audit of the filesystem (specifically individual file access) on a per user basis; they can provide a complete listing of all files on the system that user 'X' can access, and what that access is, or generate a blanket report of all files that meet certain access specifications (like world read access). Is there any equivalent to that capability for Windows Server 2003 or newer? We really don't want to roll our own but I haven't been able to come up with a google search that isn't overloaded with other security issues. Thanks. Tag: Publish CRL with a CNAME Tag: 95831
  - 6
    - 802.1x wired computers I am implementing 802.1x for WIRED computers. I have a CA which issues machine certificates to all domain computers. I am able to see the machine certificate via mmc. I have IAS installed on my DC and configured the remote policy as ethernet and wiredusers. Now the problem. Some of my computers get "Windows was unable to find a certificate to log you to the network" others work just fine. Not sure where to look. It is a particular model here but when I reimage the computer it works fine. I've tried deleting the certificate and having the CA issue a new one. No go. Added and removed from the domain. No go. Any ideas on where to look? I don't have the time to reimage all the computer with problems. Tag: Publish CRL with a CNAME Tag: 95825
  - 7
    - Change 2003/XP network-connections behavior back to previous mode Probably the answer will be NO, but just thought I'd ask anyway... On NT servers we backup using a service which mirrors the files to a share. Issue is that Microsoft have now implemented a change in the way drive-mappings work, such that a drive mapping or UNC share is now ONLY accessible inside the the user-session which created it. This make it impossible to backup to a network share UNLESS the backup-program itself runs on the desktop instead of as a service. Running the service under the same credentials as the desktop session doesn't seem to work, either, it's as if that just creates two 'clone' users with independent settings instead of running the service in the same session. Is there any way of restoring the previous behavior, which IMHO is the 'right' behaviour, whereas the new arrangement creates all kinds of problems, especially for services which need to access the LAN. The only other solution is to take the password-security off the share - and that is really a ludicrous situation to be in, having to ditch security for the sake of this ill-advised change. Tag: Publish CRL with a CNAME Tag: 95822
  - 8
    - Share Permissions, acting different between Vista and XP Hi there, I am trying to create folder with permissions, My normal routine when setting up a new share is to. 1)Share the folder, Then access the share permissions, Then add the authenticated users group and grant that group full control. Then Iâ??ll remove the everyone group. 2)Then access the NTFS permissions and grant â??xzyâ?? groups the different levels of access; read/list, full control, whatever. Accessing the share from Vista and XP no problems. Now the issue Iâ??m having is, Iâ??m trying to be more â??granularâ?? with the Share permissions and not use the everyone or authenticated user groups for the share permission and want to use â??xyzâ?? groups for share and NTFS permissions. The step I take are as follows. 1)Share the folder, Then access the share permissions, Then add the â??xyzâ?? users group and grant that group full control. Then Iâ??ll remove the everyone group, â??xyzâ?? group is the only group at the share level. 2)Then access the NTFS permissions and grant â??xzyâ?? groups the different levels of access; read/list, full control, whatever. Accessing the share from my XP pc I have no problems, BUT when I try accessing the share from my vista pc Iâ??m getting a deny, you donâ??t have permission. I hope I made sense. I would appreciate any help anyone can give me. Thanks in advance Here's a simplified version of my setup (running on Windows 2003 Server): root_folder "root_folder" is shared, with full control given to Everyone. Security permissions on the folder itself are full control for Administrators, Creator/Owner, and Users (folder, subfolders, and files). Both "completed" and "working" are set to inherit from "root_folder". In addition, "completed" has an extra permission, set to deny everything except read access to Users. What I find is that, this deny permission also applies to the Administrator account, which is in no way a member of the Users group. I want to be able to move any folder from "working" into "completed" (regardless of who the folder owner/creator is), and by doing so, automatically make the folder read-only to members of the Users group. From what I know about NTFS permissions, this basically forces me to use explicit Deny permissions. If I simply remove the Users group from the permission entries of "completed", then any folder created by a member of the Users group will still be under full control of that user, even after being moved to "completed". I also do not want to re-apply all child permissions every time I move a folder into "completed". I hope I made sense. I would appreciate any help anyone can give me. Thanks in advance. Edwin Tag: Publish CRL with a CNAME Tag: 95821
  - 9
    - Access right Hi, Is there a way to find out which folders a user has access to? (from a common line) I want to create document, of our users(1000 in all) and there access rights to the diffirent folders on diffirent servers. Thanks, Shahin Tag: Publish CRL with a CNAME Tag: 95816
  - 10
    - Automatic Updates security concern Hi, Is there any way of setting the AU repository so it never uses https (tcp 443) and only uses http (tcp 80)? Or, it uses only admin allowed update servers? This might be a bit strange, but on a highly security strict LAN with content filtering proxy (as in this case), this imposes a security risk since https doesn't permit content parsing. Meaning that tcp 443 rules *must* be set at the routers/firewalls and so, default configured http clients (browsers on out-of-the box installs for instance) end up rendering content that they weren't suposed to. Thank you, rusga Tag: Publish CRL with a CNAME Tag: 95809
  - 11
    - What does 'hijackthis' mean? In many responses to postings, reference is made to 'hijackthis'. What is meant by this? Thanks. Tag: Publish CRL with a CNAME Tag: 95807
  - 12
    - spam email sender field Some Rolex Replica spam emails sent to me have my email address showing in email-received-list SENDER field. Many more, in the SENDER field, show my email address with a small variation such as an added number or an added letter or a few different letters. Some of these emails are identified in my email-received-list as having attachments. I never open the email to prevent activating a virus or spy action it might contain. I receive a lot of these and most go directly to my spam folder. Does anyone know about such emails? If so, please explain this technique and possible problems they cause if opened. Thank you. Tag: Publish CRL with a CNAME Tag: 95806
  - 13
    - WinXPSP2 IE 7 Security Zones - security concern I recently noticed that in my Trusted Sites zone, there is an entry, "HTTP://", with no further domain identifier. I did not make this entry and when I attempt to remove it, I get a system error beep and the entry is then greyed out. I checked a number of other WinXPSP2 machines in my network, all subject to the same GPOs, and none of them have this entry. (NOTE:The subject machine is a dual-boot with Vista Ultimate; the problem is absent from that instance of IE 7 and from another instance of XPSP2 I have running under VPC 2004 SP1, all on the same machine). As a test, I uninstalled IE 7. When the machine was rolled back to IE 6, the entry was still there but I could delete it - or so it appeared. Upon reopening IE after the apparent delete, the HTTP:// entry had reappeared. Is this some kind of security attack? (possibly trying to wildcard all websites as though they were trusted?). Because the roll back to IE 6 did not solve the problem, I reinstalled IE 7 and the entry persists, with the same behaviour as before. I ran a full system AV scan with up-to-the-minute AVG and no threats were found. Nevertheless, how can I remedy this problem? -- V2 Tag: Publish CRL with a CNAME Tag: 95803
  - 14
    - Just informed that unauthorized people reading hotmail I was just informed that there have been atleast 2 different people reading my personal emails from my hotmail account. I had used that computer before and I guess I didn't log out. Is it legal to continue to read my emails months later? Tag: Publish CRL with a CNAME Tag: 95798
  - 15
    - When will MSRC adopt CVSS v2? It appears that there are multiple forces driving the adoption of CVSS over proprietary, opaque vulnerability rating systems (cf. http://www.microsoft.com/technet/security/bulletin/rating.mspx): 1. NIST/FIRST recently updated CVSS to version 2.0 (http:// www.first.org/cvss), demonstrating that this is a viable, healthy system worthy of significant enhancements. 2. There are increasing signs that major vendors are adopting CVSS (e.g. NIST, DHS, IBM, Qualys, Cisco, Amazon - http://www.first.org/cvss/eadopters.html). These are not the kinds of players to which Microsoft is typically hostile or reticent to join in industry-wide security efforts. MSRC has been using the CVE standard vulnerability identifiers for quite a while, and I notice that the CVE articles call out CVSS ratings as a primary metric (so there's an implicit compatibility and alignment with the MSRC's direction). Many of the factors that historically went into the proprietary MSRC rating system are similar if not identical to the factors included in CVSS v2. As well, I see that CVSS allows for "environmental factors" that are specific to each organization, so I'd imagine that any objection that "this doesn't fit our needs" should have been addressed there. So the ultimate question is this: when does MSRC plan to make the switch to CVSS v2 in their bulletins? It seems to me that this is a question not of IF, but HOW LONG it'll take Microsoft to muster up the strength and energy to tear themselves away from a 5+-year-old proprietary assessment system, and join with the rest of the industry leaders in giving their customers consistency for enterprise IT planning. :) Cheers, Mike Tag: Publish CRL with a CNAME Tag: 95797
  - 16
    - Access denied on share, how to reset to default security settings? I get an Access Denied error from any PC in my workgroup trying to access a share on one XPSP2 pro system. This XP system was removed from a secure domain. Windows Firewall claims some settings are controlled by group policy. How can I reset the security settings to the workgroup defaults so my file share works properly? This is driving me nuts. - Leland Tag: Publish CRL with a CNAME Tag: 95796
  - 17
    - Anyway to find out? Hi , I got the complaint that our VPN device to do a port scan on the another public IP such as DoS portscan VPN device public IP,4500 -> internet user's public, 60189-46231 PR udp len 20680 Hoe do I find out which user logged into VPN to generate portscan traffic? Thank you. Tag: Publish CRL with a CNAME Tag: 95794
  - 18
    - A technical question for implementing CIS's Windows XP Professional There are <not defined> for some security settings in the Benchmark, e.g., Shutdown: Clear Virtual Memory Pagefile, instead of disabled or enabled. What does <not defined> mean? What happens if this "<not defined>" value is implemented? Does it mean that the setting is neither enabled nor disabled? So what is the "net outcome"? What is/are the consequences of having a <not defined> in the setting? Any information/ pointers will be much appreciated. Thanks, DFox Tag: Publish CRL with a CNAME Tag: 95793
  - 19
    - Removing Windows Defender and Microsoft Anti-Spyware Hi, My campus is in a WinXP environment. We have about 2000 computers on our campus and all of them are running various versions of Windows Defender and Microsoft Anti-Spyware. We need to remove all versions of the software from our campus because of software conflicts and errors that users keep receiving. We need to implement this removal through SMS and have been unable to find a removal tool that removes all versions of Defender or all versions of Anti-Spyware. Are there any removal tools that work? Thank you for your help. Tag: Publish CRL with a CNAME Tag: 95792
  - 20
    - user accounts I have a multi user account pc running XP professional SP2. All accts have administrator status but my personal account is the only one password protected. On startup instead of the welcome screen displaying all user accts, the computer goes straight to my acct. To get back to welcome screen I have to log out or switch user. How do i fix as i have folders i want to keep private? Tag: Publish CRL with a CNAME Tag: 95788
  - 21
    - Starting a process under a different user without supplying the As a I administrator can I launch processes on behalf of other users without supplying their passwords? I know psexec can launch processes on behalf of other users, but I have to supply the user's credentials...... saqib http://www.quantumcrypto.de/dante/ Tag: Publish CRL with a CNAME Tag: 95787
  - 22
    - How to set an IP range for an exception in Windows Firewall? Hi, I would like configure Windows Firewall to restrict access to a certain port to a couple of IP ranges. I see that I can set the scope for an IP or a list of IPs. How can I set it for a couple of ranges of IPs? (Reason: Our hosted web server allows connection with RDP. I've already changed it to a non-standard port and have made the exception for this in the Windows Firewall. Want to only allow RDP connections from our offices -- which are on dynamic IPs.) Tag: Publish CRL with a CNAME Tag: 95785
  - 23
    - Assign IPSec Policy via cmd prompt Hello there. Is there a way for me to Assign or Unassign an IPSec Policy via cmd prompt. I know secpol.msc, but thats manually. I also know netsh but i'm not able to reach a command that do the job. My target is to assign the Policy, tehn run a job, and then unassign the policy. Regarding the policy, i'd like to have this as an automatic procedure (running a batch, scheduled task) since the job next is already automatic. Thanks in advance for your help and thougts. regards, P. Tag: Publish CRL with a CNAME Tag: 95781
  - 24
    - How to prevent users on unauthorized machines from w2k3 files I want to prevent a user from accessing the fileshare if they come from an unauthorized machine. As of now, if Joe User brings in his personal laptop and plugs it into the network, and tries to access a Windows 2003 file share, it prompts them for username/password. If they enter their AD uname/pw, they can gain access. How can I prevent authorized users on unauthorized machines from gaining access to W2K3 file shares? Tag: Publish CRL with a CNAME Tag: 95773
  - 25
    - Grant access to external IP address I would be grateful if someone could advise how I could allow access to our domain from an external site. We are on SBS 2003 Std with NAT / Basic Firewall, but are unable to even ping the server public address from the remote site. Can anyone advise how we can allow access to the SBS from the external site. Thanks Tag: Publish CRL with a CNAME Tag: 95772

Hello,

I want to publish my CRL on a webiste using a DNS CNAME. I wonder if
it is compatible with protocol that check certificate chain. What do
you think about ?

Regards,

--
P.J.A.

Top

Re: Publish CRL with a CNAME by Paul

Paul
Thu Dec 13 03:48:47 PST 2007

On Thu, 13 Dec 2007 03:36:46 -0800 (PST), BZP wrote:

> I want to publish my CRL on a webiste using a DNS CNAME. I wonder if
> it is compatible with protocol that check certificate chain. What do
> you think about ?

As long as the location is resolvable then that's fine.

--
Paul Adare
MVP - Virtual Machines
http://www.identit.ca
Computer problems? Have you checked the loose nut in front of the keyboard?

Top

Re: Publish CRL with a CNAME by BZP

BZP
Thu Dec 13 04:57:32 PST 2007

On 13 d=E9c, 12:48, Paul Adare <pkad...@gmail.com> wrote:
> On Thu, 13 Dec 2007 03:36:46 -0800 (PST), BZP wrote:
> > I want to publish my CRL on a webiste using a DNS CNAME. I wonder if
> > it is compatible with protocol that check certificate chain. What do
> > you think about ?
>
> As long as the location is resolvable then that's fine.
>
> --
> Paul Adare
> MVP - Virtual Machineshttp://www.identit.ca
> Computer problems? Have you checked the loose nut in front of the keyboard=
?

Ok thanks.

Regards,

--
P.J.A.

Top