Skip to main content

Posts

Showing posts with the label Windows server 2003

How to change DNS server in a remote machine

Download regfind.exe from here  .Extract the zip file .Browse to the extracted location from command prompt and run the utility using the following syntax regfind   -m \\computer1 -p HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\parameters "Old DNS IP" -r "New DNS IP" Where Cumputer1 can be the name or Ip of the remote machine whos DNs is to be changed Once the command completes successfully, the old dns IP in the server will be replaced by the new one

Active Directory User Account Information Tool

Troubleshooting issues relating to user accounts can usually be a time consuming effort.D etermining the "freshness" of the user's credentials and password history is key to understanding if there could be a potential issue with their Active Directory account.   This document provides information on the AcctInfo Tool that has been developed to assist investigation of such issues. AcctInfo Tool This tool provides a subtle addition to any user's AD account profile by an additional tab in their account properties labelled Additional Account Info v2 .   It can be installed on a domain controller, or on the desktop of the person doing the investigation. Below is a screen shot of the additional information this tool provides: The three most important pieces of information provided, as shown above, are the Password Last Set and Password Expires fields and the Most Recent Logon button which polls all the DC's in the domain for the selected user ...

How to : Track deletion of windows folders using security policy

1) Enable auditing via policy Click Start->Run->secpol.msc Under Local Policies \ Audit policy, enable "Audit object access" for 'success' events (means that the access was 'successful' - failures would indicate permission problems to do so 2) Enable auditing on the 'object'.   Right-click a folder/file and choose properties From the security tab , click Advanced From the Auditing tab, click Add  Now, if you want to find 'who' - it's best to 'add' the Everyone group For the audit access, choose Delete, again under Successful (for a successful deletion) 3) Check the events   Open event viewer  (Start->Run->Eventvwr)   Look for/filter on the event ID 560