AD replicate for specific DC

Source dc–> dc01

Destination dc–>dc03

Loopback group policy Demo

 Demo Setup details

DC01 & DC02 -> Domain Controllers both are in same site

PC01-> client machine (Windows 10)

Without Loopback policy scenario

User name : Ravi

Computer name : PC01

When user (Ravi) login computer (PC01),

Computer configuration 1 + User configuration 2 both policy will apply.

Computer configuration 1 ( disable mspaint)+ user configuration 2 ( remove task manager)

Computer GPO-India

I have blocked mspaint application

User GPO-India

Task manager has been removed.

Now Ravi login the PC01 machine below policy will apply.

Computer GPO-India –> mspaint block

user GPO-India–> task manager disable

Group policy Loopback two modes:

1. Merge Mode
2. Replace Mode

Loopback policy with Replace mode

User-1 GPO-India

This policy, I have enabled desktop wallpaper.

Now, User Ravi login into PC01 the will apply below.

Computer configuration 1 ( disable mspaint)+ user configuration 1 ( wallpaper policy)

user configuration 2 policy will replace user configuration 1 policy.

Loopback policy with merge mode

Computer configuration 1 ( disable mspaint)+ user configuration 1 ( wallpaper policy) +user configuration 2 (remove Task manager)

Refer :

https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/circle-back-to-loopback/ba-p/400212

Best Practices

• Create two purpose-built GPOs to enable it loopback processing (one for each mode). These GPOs should only contain this one setting. Lock down who can edit these GPOs (I’d go as far limiting permissions to Domain Admins).
• Link your loopback processing GPOs as necessary, and enforce these links, to ensure any loopback processing setting change in any other GPO does not cause any unexpected issues.
• Create user setting GPOs as needed, and link them to the necessary OUs containing computer objects that you want to control the user experience on.
• Don’t enable loopback processing if you don’t need to. If your computers and users are in distinct OU structures, apply policies to them as needed.
• In the situation of not being able to apply any policy to user objects, enforce replace mode from the top down across all OUs containing computer objects.

DirectReports report

Get-ADUser -Identity test_director -Properties directreports |
    Select-Object -ExpandProperty directreports |
    Get-ADUser -Properties mail |
    Select-Object SamAccountName, mail

AD FS Deployment

https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/ad-fs-deployment

What is KRBTGT

https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/faqs-from-the-field-on-krbtgt-reset/ba-p/2367838#:~:text=The%20KRBTGT%20account%20is%20a,addressing%20conventions%2C%20see%20RFC%204120%20.

https://www.windowstechno.com/what-is-krbtgt-account/

Kerberos Token Size Using the MaxTokenSize Parameter

https://docs.microsoft.com/en-us/troubleshoot/windows-server/group-policy/group-policy-add-maxtokensize-registry-entry

AD notes-2

Loop back group policy

https://docs.microsoft.com/en-us/archive/blogs/askds/circle-back-to-loopback

SETSPN

https://docs.microsoft.com/en-us/archive/blogs/askds/interesting-findings-on-setspn-x-f

Change Notification on a MANUALLY created Replication partner

https://docs.microsoft.com/en-us/archive/blogs/askds/configuring-change-notification-on-a-manually-created-replication-partner

Document Quarantine with Windows Server 2012 Dynamic Access Control

https://docs.microsoft.com/en-us/archive/blogs/wincat/document-quarantine-with-windows-server-2012-dynamic-access-control

New Slow Logon, Slow Boot Troubleshooting Content

https://docs.microsoft.com/en-us/archive/blogs/askds/new-slow-logon-slow-boot-troubleshooting-content

Managing RID Pool Depletion

https://docs.microsoft.com/en-us/archive/blogs/askds/managing-rid-pool-depletion

What does DCDIAG actually… do?

https://docs.microsoft.com/en-us/archive/blogs/askds/what-does-dcdiag-actually-do

KCC Offline Bridgehead Behaviors

https://docs.microsoft.com/en-us/archive/blogs/askds/kcc-offline-bridgehead-behaviors

RESTOREDFSR.VBS Version 3 now available

https://docs.microsoft.com/en-us/archive/blogs/askds/restoredfsr-vbs-version-3-now-available

Get-DFSRBacklog PowerShell Script Available

https://docs.microsoft.com/en-us/archive/blogs/askds/get-dfsrbacklog-powershell-script-available

The Case for Migrating SYSVOL to DFSR

https://docs.microsoft.com/en-us/archive/blogs/askds/the-case-for-migrating-sysvol-to-dfsr

How Domain Controllers are Located in Windows

https://social.technet.microsoft.com/wiki/contents/articles/24457.how-domain-controllers-are-located-in-windows.aspx

Group policy Foreground and background processing

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj573586(v=ws.11)

Active Directory Replication Registry Entries

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc739941(v=ws.10)

Two lines that can save deny delete objects in AD

Temporary Group Memberships

https://docs.microsoft.com/en-us/archive/blogs/askds/previewing-server-2016-tp4-temporary-group-memberships

SHA1 Key Migration to SHA256 for a two tier PKI hierarchy

https://docs.microsoft.com/en-us/archive/blogs/askds/sha1-key-migration-to-sha256-for-a-two-tier-pki-hierarchy