![OsbornePro TV](/img/default-banner.jpg)
- 28
- 200 730
OsbornePro TV
United States
Приєднався 12 кві 2019
Leave a comment in the Discussion/Community area of my channel to let me know what brought you to the channel and I will try to keep you coming back!
If you are a small business looking for IT Services I highly recommend reaching out to my employer Vinebrook Technology (www.vinebrooktechnology.com/contact). We have a great team with tons of experience.
Open Source Projects:
- The B.T.P.S Security Package btpssecpack.osbornepro.com/
- EncrypIT encrypit.osbornepro.com/en/latest/
If you enjoy the content please subscribe. The more subscribers I have the more time I can put into the content and help with your questions.
Subscribe to OsbornePro TV!
Patreon Site: www.patreon.com/osbornepro
If you are a small business looking for IT Services I highly recommend reaching out to my employer Vinebrook Technology (www.vinebrooktechnology.com/contact). We have a great team with tons of experience.
Open Source Projects:
- The B.T.P.S Security Package btpssecpack.osbornepro.com/
- EncrypIT encrypit.osbornepro.com/en/latest/
If you enjoy the content please subscribe. The more subscribers I have the more time I can put into the content and help with your questions.
Subscribe to OsbornePro TV!
Patreon Site: www.patreon.com/osbornepro
How To Install Windows Server 2022 Active Directory (AD DS)
I (tobor), cover How To Install Active Directory Directory Services (AD DS) on Windows Server and how to perform initial configuration actions. If you have any questions about this video please leave them in the comments down below. If you haven't Subscribed yet please do its free! And if you like this video give a thumbs up and share it. Thanks for watching OsbornePro TV!
Link to Default Ports:
social.technet.microsoft.com/wiki/contents/articles/52765.windows-server-2019-step-by-step-setup-active-directory-environment-using-powershell.aspx
Capacity Planning:
learn.microsoft.com/en-us/windows-server/administration/performance-tuning/role/active-directory-server/capacity-planning-for-active-directory-domain-services
Official Site of OsbornePro
osbornepro.com/
View my Verified Certifications!
www.youracclaim.com/users/roberthosborne/badges
Follow us on GitHub!
github.com/tobor88
github.com/OsbornePro
Give Respect on HackTheBox!
www.hackthebox.eu/profile/52286
View PS Gallery Modules!
www.powershellgallery.com/profiles/tobor
The B.T.P.S. Security Package
btpssecpack.osbornepro.com/
EncypIT Application
encrypit.osbornepro.com/
0:00 Intro
0:42 Hostname Naming Convention
1:40 Domain Naming Options to Avoid Split Brain DNS (DO NOT USE .local, .lan, or .corp)
3:19 Capacity Planning Notes
6:53 Install AD DS Roles and Features
8:58 Domain Naming Conventions. Use a TLD!!!
9:57 Promote Domain Controller and Conifgure Domain Forest
14:29 Staically Set IP Address of Domain Controller
15:56 Verify Services are running and SYSVOL is being shared
17:00 Split Brain DNS is not an issue demonstration
17:26 DNS Reverse Lookup Zone Created
19:46 Active Directory OU Structure
24:23 Add short domain to User Logon Names
26:24 Thank you for watching!
Link to Default Ports:
social.technet.microsoft.com/wiki/contents/articles/52765.windows-server-2019-step-by-step-setup-active-directory-environment-using-powershell.aspx
Capacity Planning:
learn.microsoft.com/en-us/windows-server/administration/performance-tuning/role/active-directory-server/capacity-planning-for-active-directory-domain-services
Official Site of OsbornePro
osbornepro.com/
View my Verified Certifications!
www.youracclaim.com/users/roberthosborne/badges
Follow us on GitHub!
github.com/tobor88
github.com/OsbornePro
Give Respect on HackTheBox!
www.hackthebox.eu/profile/52286
View PS Gallery Modules!
www.powershellgallery.com/profiles/tobor
The B.T.P.S. Security Package
btpssecpack.osbornepro.com/
EncypIT Application
encrypit.osbornepro.com/
0:00 Intro
0:42 Hostname Naming Convention
1:40 Domain Naming Options to Avoid Split Brain DNS (DO NOT USE .local, .lan, or .corp)
3:19 Capacity Planning Notes
6:53 Install AD DS Roles and Features
8:58 Domain Naming Conventions. Use a TLD!!!
9:57 Promote Domain Controller and Conifgure Domain Forest
14:29 Staically Set IP Address of Domain Controller
15:56 Verify Services are running and SYSVOL is being shared
17:00 Split Brain DNS is not an issue demonstration
17:26 DNS Reverse Lookup Zone Created
19:46 Active Directory OU Structure
24:23 Add short domain to User Logon Names
26:24 Thank you for watching!
Переглядів: 906
Відео
How To Install Windows Server in VMWare Workstation
Переглядів 2428 місяців тому
I (tobor), cover How To Install Windows Server 2022 on VMWare Workstation Pro 17. If you have any questions about this video please leave them in the comments down below. If you haven't Subscribed yet please do its free! And if you like this video give a thumbs up and share it. Thanks for watching OsbornePro TV! Download VHD: www.microsoft.com/en-us/evalcenter/download-windows-server-2022 Compa...
How To Speed Up a Slow Windows Computer
Переглядів 4268 місяців тому
I (tobor), cover How To improve the performance of your Windows Computer by making a few simple adjustments. If you have any questions about this video please leave them in the comments down below. If you haven't Subscribed yet please do its free! And if you like this video give a thumbs up and share it. Thanks for watching OsbornePro TV! # Repair Corrupt System Files sfc /scannow dism /online ...
How to Set Your DNS Servers (Windows)
Переглядів 1888 місяців тому
I (tobor), cover How To set DNS entries manually on your local Windows machine. If you have any questions about this video please leave them in the comments down below. If you haven't Subscribed yet please do its free! And if you like this video give a thumbs up and share it. Thanks for watching OsbornePro TV! # Get your DNS Servers Get-DnsClientServerAddress -AddressFamily IPv4 # Set your DNS ...
How to Set a Static IP Address (Windows)
Переглядів 2 тис.8 місяців тому
I (tobor), cover How To Configure a Static IP Address on a Windows operating system. If you have any questions about this video please leave them in the comments down below. If you haven't Subscribed yet please do its free! And if you like this video give a thumbs up and share it. Thanks for watching OsbornePro TV! # Set Wi-Fi adapter IP Address From Terminal ```netsh interface ipv4 set address...
VMWare Workstation Stops at Boot Manager
Переглядів 2,6 тис.8 місяців тому
I (tobor), demonstrate how to resolve a VMWare Workstation server from stopping a servers boot process at the Boot Manager. This was done on VMWare Workstation 17 Pro booting a Windows Server 2022 ISO. Official Site of OsbornePro osbornepro.com/ View my Verified Certifications! www.youracclaim.com/users/roberthosborne/badges Follow us on GitHub! github.com/tobor88 github.com/OsbornePro Give Res...
How To Configure Secure Dynamic DNS (Windows Server 2022)
Переглядів 7 тис.2 роки тому
I (tobor), demonstrate how to set up Secure Only Dynamic DNS updates on Windows Server 2022. If you are NOT using best practices, running your DHCP service on your Active Directory server you will need to execute the below command to apply least privilege. CMD: dnscmd /config /OpenAclOnProxyUpdates 0 Script to Configure Dynamic DNS github.com/OsbornePro/ConfigTemplates/blob/main/ConfigureDynami...
Securing Lighttpd (Pi-Hole) [Debian Linux]
Переглядів 1,6 тис.3 роки тому
Securing Lighttpd (Pi-Hole) [Debian Linux] I (tobor), demonstrate some extra measures that can be taken to harden a lighttpd server. I demonstrate settings I have configured for a Pi-Hole running on Lighttpd. If you like what you see please subscribe! CONFIG TEMPLATE FOR /etc/lighttpd/external.conf github.com/OsbornePro/ConfigTemplates/blob/main/lighttpd-external.conf github.com/OsbornePro/Conf...
Securing Apache [Debian Linux]
Переглядів 2,1 тис.3 роки тому
Securing Apache [Debian Linux] I (tobor), demonstrate how to secure an Apache server on a Debian based Linux system and show some of the reasons behind them. If you like what you see please subscribe! COMMANDS TO USE WHAT I USED sudo apt update && sudo apt install -y apache2 apache2-utils libapache2-mod-security2 libapache2-mod-evasive sudo a2enmod ssl headers security2 socache_shmcb unique_id ...
Forgot Admin Password (Windows) [PassFab 4WinKey]
Переглядів 9 тис.3 роки тому
Forgot windows 10 password? How to remove password from windows 10? You can try PassFab 4WinKey(bit.ly/3iGimWm), unlock Windows 10 password. Free Download Best Windows password recovery and password reset tool, 100% working and easy! Forgot Admin Password (Windows) [PassFab 4WinKey] I (tobor), demonstrate how you can reset a forgotten local administrator password on Windows using PassFab's 4Win...
Securing the Local Admin Account (LAPS Password Manger) [Windows Server 2019]
Переглядів 2,7 тис.3 роки тому
Securing the Local Administrator Account (LAPS Password Manger) [Windows Server 2019] I (tobor), demonstrate how to secure the local Administrator account in a domain environment using LAPS password manager. If you like what you see please Subscribe! LAPS Backup Script github.com/OsbornePro/BackupScripts/blob/main/BackupLAPS.ps1 LAPS Installer www.microsoft.com/en-us/download/confirmation.aspx?...
Getting Started with AppArmor (Debian Based Linux) [Linux Mint]
Переглядів 5 тис.3 роки тому
Getting Started with AppArmor (Debian Based Linux) [Linux Mint] I (tobor), demonstrate what you need to know in order to get started with apparmor. Apparmor is a MAC based service control for Debian based Linux operating systems. It applies the principals of least privilege to programs and services. If you like what you see please Subscribe! NEW USER CHECK SCRIPT github.com/tobor88/Bash/blob/ma...
Securing Files with EFS (Encrypting File System) [Windows Environment]
Переглядів 1,6 тис.3 роки тому
Securing Files with EFS (Encrypting File System) [Windows Environment] I (tobor), demonstrate how to set up Encrypting File System (EFS) for use in a domain environment. If you like what you see please Subscribe! 0:00 Intro Summary 0:59 How to use EFS encryption without EncrypIT 1:28 How to use EncrypIT for EFS encryption 1:52 Use EncrypIT to backup an EFS certificate 2:43 Why you want an EFS R...
Securing RADIUS with EAP-TLS (Wired WPA2- Enterprise) [Windows Server 2019]
Переглядів 17 тис.3 роки тому
IMPORTANT NOTE: At 14:47 we want to set the authentication method to "RADIUS, None" not "None". This uses RADIUS authentication and keeps the port authenticated even if the RADIUS server is not available. Brandon Harp was kind enough to point out my misunderstanding here. Thanks Brandon! I put together a script that can be run as a cron job on a Linux device that will generate a private key, cr...
Securing Windows 10 [Windows 10]
Переглядів 6 тис.3 роки тому
Securing Windows 10 [Windows 10] I (tobor), demonstrate how to make your Windows 10 computer more secure and the reasons behind them. If you like what you see please Subscribe! LOG-MD www.imfsecurity.com/free SYSINTERNALS AUTOLOGON docs.microsoft.com/en-us/sysinternals/downloads/autologon POWERSHELL SCRIPT SECURE WINDOWS 10 github.com/OsbornePro/ConfigTemplates/blob/main/Harden-Windows10.ps1 0:...
Securing SMB (Read Note in Description) [Windows Server 2019]
Переглядів 7 тис.3 роки тому
Securing SMB (Read Note in Description) [Windows Server 2019]
Securing RDP (Cover Home and Domain Networks) [Windows]
Переглядів 6 тис.3 роки тому
Securing RDP (Cover Home and Domain Networks) [Windows]
Securing RADIUS with EAP-TLS [Windows Server 2019]
Переглядів 67 тис.3 роки тому
Securing RADIUS with EAP-TLS [Windows Server 2019]
Getting Started Vim [On Raspberry Pi Linux]
Переглядів 1,3 тис.3 роки тому
Getting Started Vim [On Raspberry Pi Linux]
Securing DNS (DNSSEC, DoH, LLMNR, NetBIOS, LMHOSTS) [Windows Server 2019]
Переглядів 3,8 тис.3 роки тому
Securing DNS (DNSSEC, DoH, LLMNR, NetBIOS, LMHOSTS) [Windows Server 2019]
Securing LDAP over SSL Safely [Windows Server 2019]
Переглядів 37 тис.3 роки тому
Securing LDAP over SSL Safely [Windows Server 2019]
Securing FTP over SSL [Windows Server 2019]
Переглядів 4,2 тис.3 роки тому
Securing FTP over SSL [Windows Server 2019]
Securing WinRM over HTTPS [Windows Server 2019]
Переглядів 7 тис.3 роки тому
Securing WinRM over HTTPS [Windows Server 2019]
Securing FTP over SSL (VSFTPD) [Linux]
Переглядів 7723 роки тому
Securing FTP over SSL (VSFTPD) [Linux]
Getting Started Windows Terminal [Windows 10]
Переглядів 1,4 тис.3 роки тому
Getting Started Windows Terminal [Windows 10]
At 23:02 when setting up the network policy and after you chose smart card or other certificate what certificate is your radius server using? I ask because when I set my radius server up I loaded up the MMC and went to the computer certificate store on the new radius server. Under personal I made a request for a certificate and just pulled down the same Radius Client Server certificate I will be using on my client/supplicants. Is this ok to do? On my radius server if you go to the network policy at 23:02 in your video under EAP Types I am using Smart Card or Other Ceriticiate but if you click the edit button you can see its using that certificate under the computer - personal store which is the same certificate my clients will be using for Radius authentication via the wireless? Is there an issue with that or whats the best practice?
Thanks for watching! The certificate I select I have had to choose by its expiration date. I use the RADIUS Server certificate template for that. In this video I made a cert that could be used by both the server and client. In this case I would have selected that one. It is okay to do. For least priv purposes it’s best to have a separate template for server and client
@@OsbornePro Appreciate the feedback. I was not 100 percent sure. I thought it might be best to just setup a cert template for just the radius server that way its not using same cert the clients are using as I currently have the validity period set to 3 months and the renewal period set to 2 months. It may cause issues once I deploy to production if my radius server cert is using the same as the clients.
thank you soo much this helped me
@@TheMeMo1999 thansk for watching glad it was helpful!
with this, should end users devices then automatically connect once setup?
@@ryanmcguire2578 thanks for watching! Yes they will automatically connect to wifi once setup
@OsbornePro ok I had set the up previously on a different dc, and my first test user I had to hit connect for them to connect, in the cert authority should each computer have 2 certs listed?
@@ryanmcguire2578 if you have two certificates on a device capable of being used for radius auth from the same certificate authority. In your client wireless profile you define the CA that assigned the certificate to auto select from. If you have two they may prompt you to
@@OsbornePro I have my original cert authority setup on server 2016(going to decommission) which is still active and it has both certificate templates for radius server client and computer(machine) on it but my server 2022, the new CA only has the radius server client cert template listed for this user
@@OsbornePro sent you an email if you have a chance to take a look...thank you
Really helpful video. I'm a bit new to CAs, do you have a video detailing the installation and best practices for installation/configuration?
Thanks for watching! I do not have a video like that. You want your CA to not have any other services on it. It should just do CA stuff. The best practice that is rarely followed is to have an offline root CA server non-domain joined. Then have an Intermediate CA attached to that which is domain joined. Require NTLMv2 authentication to it. Use SMBv2 and v3 with required signing. Biggest threat to your domain with a certificate authority are Certificate Templates. The guys who wrote an exploit tool called Certify have a white paper that is well worth the read to see the do not so certificate template making. You can run the tool to discover vulnerable certificates on your CA if you are ever unsure
is it free?
@@faizankhanseo4639 thanks for watching! No it is not. Lazesoft has a free one I believe still
@@OsbornePro yes lazesoft is free you are right thanks 👍🏼🙏🏼
Can mac os join Windows domian?
@@shinshen9020 thanks for watching! Yes a Mac can bind to a Windows domain. There is more info on how that is done and requirements in this article. onmac.net/how-to-join-mac-to-windows-domain/
Does anyone know if there is a way to use a Windows Network Policy (RADIUS) server to authenticate users on a different trusted domain? We are using Meraki APs and it works fine on the first domain, but when I copy the GPO to the second domain, clients are not able to connect to the Wireless network. If not, I could add an NPM server on the second domain and give them their own SSID, but that solution won't work if I push this down to switch ports.
Thanks for watching! I would be curious what you do for this. If you are using PEAP I would think trusting the Root CA and a domain trust would be required between the two domains so the user accounts can be found. For EAP-TLS you probably need a non-domain joined CA to issue certs to both domains in order to accomplish that
The best LDAP tutorial, I have ever seen. Thanks.
@@pstz_800 thanks for watching glad it was helpful!
no need for that hassle if the LDAPS is to be used. its enough to have certificate for dc in personal store. also if you enable signing. its should be stated that in corp env you should enable NTDS logging to see who is using simple bind before you wreck havoc =) .also there is no way to force any one except windows clients. if applications are setup to use simple bind they will send plain text passwords without possibility to auth
Guys, real Good Video, Just one question about certificate Authority, how about if the domain controller is the certificate authority as well and there is already a root cert installed, How does this step differ?
@@BGPNetworks thanks for watching! It is not recommended to user your DC as a CA however, that should not affect the setup. The CA cert still needs to be trusted by the server and clients. It is still able to do what you need it too
What if you have DHCP in another subnet and you have everything open between those 2 servers and still it dose not work? But when i put them in an isolated network on the same subnet it works well. Do windows have some sort of firewall rules that affect this...
@@filipfabicevic3077 thanks for watching! The DHCP server is registering the domain and IP resolution on behalf of the client so as long as the client can get a DHCP address it should work. It sounds like you need to set an ip helper-address on the switch for that VLAN. Make sure the forward look up zone exists on the DHCP server also. In the DNS server check your security settings to see if there are restrictions and what subnets allow updates
Covered all the details from cert generation, server bringup and client connection. Thanks. How the user 'tobor' user is mapped to the newly generated certificate? is there any cert-to-username mapping required? We do not see 'ftpsecure` user used anywhere, is there a specific need for creating this user. Why is there a prompt for password if certificate based authentication is enabled?
@@rakesh4a1 thanks for watching! FTP over SSL is not capable of key authentication, only FTP over SSH can use certificates for authentication. FTP over SSL to FTP is the equivalent of what HTTPS is to HTTP. The user tobor does not have a certificate assigned. You will need to create the ftpsecure user. It is used for limiting permissions and employing least privileges.
I put this script together to auto-install using a secure method. If the vsftpd service fails to start it is because UTF8 is no longer an option to set on certain Linux distro github.com/OsbornePro/ConfigTemplates/blob/main/vsftpd-installer.sh
Can you explain how to get mab working with dot1x? Basically I need anything with a cert to authenticate, but for devices like printers/phones that can’t take a cert, I am trying to use MAB. I added the approved macs to my list on my Cisco switch.And it says authenticated. But won’t connect. Do I need to add the macs so where in radius? I’m just using Cisco switch and NPS no ise
@@vladimirarias-antonov9584 thanks for watching! I would suggest taking a look at this article for the NPS side of things documentation.meraki.com/MS/Access_Control/Configuring_Microsoft_NPS_for_MAC-Based_RADIUS_-_MS_Switches
Thank you this is great
To save anyone else typing this out from the screen like I did... Here's the PS one liner to generate a shared secret. Pretty clever. ( -join ((0x30..0x39) + ( 0x41..0x5a) + ( 0x61..0x7a) | Get-Random -Count 36 | ForEach-Object {[Char]$_}))
Thank you for sharing information. I have a question, i am trying to connect linux machind using 802.1x wired authentication method and its failing to connect. This machine has not koined the domain. I am getting user credentials mismatch error. Please share your valuable feedback. Thank you
@@user-zg3pw5qb2j thanks for watching, sounds like the same thing I have seen with Macs. If you check the NPS event logs it probably says it can’t find the account. If that is the case you won’t be able to use EAP-TLS to authenticate Linux devices unless they are domain joined
What tls version will be used here ?
@@hichamlyaacoubi1196 thanks for watching! There is a registry value you can at on the NPS server to define what version you want to use if you want to make sure a modern one is used support.microsoft.com/en-us/topic/microsoft-security-advisory-update-for-microsoft-eap-implementation-that-enables-the-use-of-tls-october-14-2014-d9ba4b83-b4e9-2c01-83a7-e42706e671af
This is great stuff, truly appreciate the time you took to divulge this information. You've got my like. I would like to ask your suggestion on the best way to study APACHE2 configuration? Maybe if you have certain books, courses, channels etc. that helped you. Thanks again.
@@marcusjackman1487 thanks for watching glad it was helpful! Haha I do not unfortunately. The Apache documentation is very extensive. The things I have learned came from doing hackthebox labs and configuring apache for different web services. I don’t know a good source out there for it so I put this together to share things I have run into
thanks a lot
Thanks for watching! Glad it was helpful
First off..your narration and configuration flow together seamlessly..you do good work. Jack of all trades, master of none for a small K-12 here. I have both a staff and student wifi network. I setup NPS last summer (wish I had found your tutorial then) and it connects fast and very reliable for both student chromebooks and staff Win 11 laptops. Everyone (staff and students) have AD accounts. I only use a single AD Service Account I created to authenticate all of the chromebooks to the student wifi via Google Workspace wifi profile. However, I never thought about the fact that students would still be able to connect their phones to the student wifi with their personal AD accounts, something we do not want them to be able to do. I have tried blacklisting them in Aruba Central but the deny list maxes out at 125 entries. SMH. The day after school was out a few weeks ago, I spun up two VMs..an offline RA and a domain joined SA. I have the SA stood up. If I follow your tutorial, will the students be able to download and install the cert to their phones? Ive already burned two weeks of with the RA and CA configs, plus I went down the path of instaling NDES and GCCC (Google Cloud Certificate COnnector, which requires NDES) only to find out NDES would acutally assist the students in connecting their phones to wifi (did I mention master of none??) I uninstalled all of that today. WIth vacation next week, then reconfiguring NPS, and testing student chromebooks and powerwashing all 3,000 of them once NPS is configured...my summer is going by fast. Can you tell me how to configure NPS to keep students from connecting phones? I dont usually ask ppl for help, I research and read and try but Im running out of time for trail and error. Thanks
Thanks for watching! No the students will not be able to download and install the certs on their phone; the important part for you to achieve that is when creating the device certificate template on your CA, the private key can not be marked as exportable. Once the certificate is assigned it will only be able to be used on the device it is assigned too. Also, the device hostname will have to match the subject name of the certificate. You can use PEAP certificates for deployment on a per user basis. However, making the key non-exportable in that situation means only one certificate goes to a user. That one certificate can only be used on the device that received it for that particular user. For example the students will not be able to use a second device like a laptop and desktop. EAP-TLS/Device Certificates allow you to authenticate devices. Users can access a device and that device can access the network. For your situation if possible I would use Aruba as a certificate authority with EAP-TLS for device authentication. The reason being is you may run into issues with devices that are not domain joined using certificates from a domain joined CA to authenticate. The account/user will not be found in AD and dummy accounts will not resolve the issue.
Can I have 2 LDAPS services on two different DC in the same domain.
Thanks for watching! Yes you can. Just have to assign each DC its own LDAPS certificate where the FQDN of each individual DC is in the Subject of the certificate.
Great video. Thank you.
Thanks for watching! Glad it was helpful
Thanks for your courtesy of turning your head to cough , too prevent germs my way through the screen 😂. Seriously , great video .
Lol of course don't want anyone researching to get sick! Thanks for watching!
When i try to do the nltest i get an error "erro_no_such_domain"
Thanks for watching. If you are running the nltest command on a device that is NOT a Windows Domain Controller there may be an issue with the trust or there is something up with the certificate trust on the client. Either of the below commands can be used to repair the trust. nltest /sc_reset:YourDomain.com Test-ComputerSecureChannel -Repair -Verbose # Run on the client device in admin powershell window Otherwise look at the System logs in Event Viewer after you do the above. Look for any events related to secure channel issues, likely with a the source Netlogon. This may help identify what exactly the trouble is.
@@OsbornePro ok thank you very much for your response. I will try to execute the commands. I just forgot to mention that i tried executing the command on a windows 11 in the same network and domain, on a windows 11 in another network (through internet) and on the DC itself. I got the same error in every case. Oh and the DC is also the DNS server
@@OsbornePro but my main issue is how to make LDAP work with iOS because iOS devices somehow dont send bind requests, only search requests from what i see through Wireshark. So i was trying to connect with SSL but apparently the iphone doesn't recognize the certificate. In Wireshark, we can see a "Unknown certificate" error.
@@aliounethiaw1443 if you are not seeing bind requests from the iOS devices they are not trying to perform authenticated searches. They may need an LDAP profile of some sort with credentials specified typically using the distinguished name as the username. An MDM solution will need to be used to push out the Root CA certificate to the devices trusted machine certificate store.
@@OsbornePro so i need to manually register the phone in the LDAP server using the phone's name and a password as credentials, then install the certificate on the phone via an MDM. And then i try to connect using the phone's credentials instead of the user's credentials. Is that what you mean?
Dumb question since I know this is for sure not best practice, but what if you have DHCP and DNS running on your server? Is the DnsUpdateProxy group even necessary at that point? What about even worse yet, your DHCP server is also functioning as DC (holding no fsmo roles) and DNS? In the video, it was mentioned if your DHCP server is also a DC, you should run "dnscmd /config /OpenAclOnProxyUpdates 0" on the server to secure it. What I got from the video was that I should do the following. !--- DHCP ---! 1. Assign only DHCP servers to DnsUpdateProxy group for each domain 2. Create service account for dynamic DNS update from DHCP 3. Assigned service account to only be a Domain Users member 4. Change DHCP advanced DNS dynamic update registration credentials to new service account on DHCP server !--- DNS ---! 5. Change forward zone to Secure dynamic updates Thanks!
Thanks for watching! I would still assign the server to the DnsUpdateProxy group. If there ever comes a time when the role is moved off the server, it can be seen the current server is a member of that group and it will make whoever looks at it take notice possibly preventing or shortening a resolution. Twenty years from now some IT guy will say thank you Wyatt. This is not needed however when you issue that command. The link below references if that helps you decide whatever is best for you. Your summary of actions looks complete to me and yes use "dnscmd /config /OpenAclOnProxyUpdates 0" since your DC is also a DHCP server. Here is a link to Microsoft's mention of this learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ff631099(v=ws.10)#summary
@OsbornePro awesome! Thank you! This was the first video of yours that I have seen and it was perfect. Explain everything so well. Will definitely recommend to others and watch more of your tutorials!
Do you not have to reference the RAS IAS cert in the network policy? I noticed you added smart card or other certificate as the EAP type but never edited it to choose the cert.
Thanks for watching! A valid certificate is typically selected automatically however, its not perfect. Yes you should select the certificate to use on the RADIUS server in the network policy. I forgot to cover this in the video. I updated the description of the video to make mention of this in case someone reaches out to me having that issue. I can also get a quick copy paste responding to emails.
When I request new certificate from the DC, it is showing all my certificates status as unavailable in include LDAP one. Do you know how to fix it? Much appreciated.
I finally figured it out. My CA root certificate was expired. Once it is renew, I see the LDAP certificate is now available.
Thanks for watching! Right on appreciate you sharing that. My approach would have been checking RPC and Windows Firewall. That did not even cross my mind.
thanks man it works for me
Thanks for watching! Glad it was helpful
Great video! Very detailed and simple to follow. I have successfully set this up and is working with our domain joined devices - thank you! However, what could I do to implement this onto non domain joined devices such as iPads. In my org we have 3 groups of iPads all requiring different vlans for internet filtering. I would like to use EAP-TLS so no end user authentication is required.
Thanks for watching! What I have found with non-domain joined Apple devices is they require a non-domain joined Root CA with a domain joined Intermediate CA. The non-domain joined Root CA is for issuing certs to Apple devices not on the domain. The domain joined intermediate is for auto-management of the Windows RADIUS client certificates. Of if you have something like Cisco ISE to act as a CA that issues certs to those devices that can work. If you just have a domain joined Root CA that assigns a device certificate to a non-domain joined Apple device, the authentication fails saying no matching account could be found. I have tried creating dummy accounts etc but nothing worked for me.
This video was amazing. Thank you so much!
Thanks for watching! Very happy it was helpful
under public key policies I don't have anything listed under trusted root certificate authorities and intermediate certificate authorities where do I import these from? Thanks
Thanks for watching! That I am not sure. By default you should have default certificate authorities that exist in both the Trusted Root Certificate Authorities and Intermediate Certificate Authorities stores. If there is nothing there maybe the Windows store is not used for trust and some other technology is handling that? If you want to get your domains Root CA, remote into the Root CA server and open Command Prompt or PowerShell. Then execute the below command mkdir C:\Temp # Creates a directory if it does not exist certutil -ca.cert C:\Temp\RootCA.cer # Exports your domains Root CA certificate to a file that you can import into the trusted stores Once you have the RootCA.cert file you can open certlm.msc and import it into the Trusted Root Certificate Authorities store
Thanks man, really helped me out with my windows installation on my VM
Thanks for watching! Glad it helped to get your VM started like you want!
Thanks for this video works great. What happends if i remove the instance and the role is ldaps still active then? I need te demote the dc running this instance...
Thanks for watching! You actually are do not need to install the Active Directory Lightweight services role and it will not harm anything to remove it. That was bad information circulating at the time I released the video. You do not need to install that Feature and it can be safely uninstalled. As long as the NTDS service is running LDAP and LDAPS are available. The certificate attached to the NTDS service is required and the clients need to trust the Root CA that issued it. If you are moving to a new DC you will need to request an LDAPS certificate for it and attach it to the NTDS service. Once that is done simply point whatever third party apps you need to towards the new DC.
Wow! I was looking / searching for tons of how-to, manuals etc...but only this nice tutorial made it easy and quick to get this going! :) Thanks!
Thanks for watching! Always happy to hear this helped someone implement it!
This is the best video I have seen on youtube covering ldaps. Seriously! I just wish you could cover more cert videos on rdp, smb, and ntlm. Your really good.
Thanks for watching! Glad it was helpful. I love hearing when things like this get implemented you are killing it
Thanks your the video. The only thing I had a trouble with is how to setup the cert auth. I see you need to use enterprise CA that would be a help if you put that in.
Thanks for watching! The length of the video may be deceptive in how much needs to be done. Prerequisites: 1. Certificate Authority a. Contains an LDAPS Certificate Template to issue to DCs 2. Domain Controller a. Assigned the LDAPS certificate from the CA b. LDAPS Certificate template attached to the NTDS service You do not necessarily need an Enterprise CA however it does make the implementation simpler. The LDAPS certificate template can likely be obtained from whatever you are using as your Certificate Authority. The tricky part is the LDAPS certificate can not use a typical SSL certificate such as one you would attach to HTTPS. This is why the service is unable to be a wildcard certificate and it cannot have a Subject Alternative Name.
We are using dynamic updates but without the DHCP updating dns records. We have scavenging setup on one of our dns servers and this is AD integrated. I am seeing an issue though where timestamps for dns records are not updating. We are also noticing that for some reason (seems isolated to win 11 clients) that if a client is moved to another subnet, the dns record fails to update with the new IP. I get a dns event error 8018 on these and this happens when I try and force registerdns. It’s so bizarre. Probably a small amount of records for clients both win 11 and 10 are getting updating timestamps. I have no idea what the issue is. Do I still need an account entered in the credentials area in dhcp manager even if we are having clients updating and create records? Secure updates are selected
Thanks for watching! Event ID 8018 when I looked it up is a Zone Transfer failure. It sounds to me like the DNS records are not able to be updated in DNS because of Zone Transfer restrictions. Open the DNS configuration area. Right click and select Properties (on the DNS server if I remember correctly) and go to the Forwarders tab. Then you want to allow forwarding to your specific DNS servers. This prevents an attacker from having the ability to dump your DNS records. You should not configure the DHCP Dynamic DNS credentials if you are allowing the clients to secure update themselves. This can create overlaps and permission issues and mismatched records. If you have the dynamic DNS account update a DNS entry, the device referenced by that DNS entry will not be able to update that record.
Thank you for your great work
Thanks for watching! Glad you it was helpful for ya!
I do not understand how the radius server knows the machine name. Where is that in the radius request? Is it a specific attribute?
Usually its going to be the Calling-Sation-Id, in this situation he's using EAP-TLS so the certificate the device was issued will have it's name in the certificate metadata.
^ What he said :) Thanks for watching! Thanks for the help @Patmorgan235Us
You should delete this video because it's totally wrong. . You don't have to install Active Directory Lightweight Directory Services because you already have Active Directory Services installed (Your DC). All you need to make it work is to create certificate and configure ports. Another wrong thing in this video is about GPOs. You don't have to add "Domain computers" group to GPOs Security filtering. "Authenticated Users " group are both Users and Computers in Microsoft's world.
Have a Snickers and calm down.
@@user-sh5kx8cx5c I was actually calm but it bothers me when "YT experts" are making misleading videos.
Thanks for watching! Yes you are right you do not need to install that role I get asked that a lot. I initially documented my setup process during the time Microsoft was planning to force everyone to move to LDAPS and that role was mentioned in all the blog articles and clearly misunderstood. Installing that service creates a port for LDAPS and the role is easily removed. I do not see any harm. I will add a note in the description and chapter mentioning the role does not need to be installed.
That is how I felt. I did this to help teach myself and reinforce information. I would suggest try doing your own and how you think it could be better and improve the info available in the IT community. If nothing else it helps someone see what they are buying when they hire you.
you have a mistake in your notes "New-Item -Path "HKLM:\System\CurrentControlSet\Services\LanmanServer\Paraeters" -Force -ErrorAction SilentlyContinue | Out-Null" Paraeters is missing a "m"
Thanks for watching and thanks for pointing that out much appreciated!
Thank you your video helped so much :)
Thanks for watching! Glad it helped!
16:15. Why is there a deny if it's a MAC? Everything should be denied by default anyway. Unless you allowed earlier a wildcard allow and want inside this wilcard selection to deny one single thing? But that would work only when actually writing the rules by hand no?
Thanks for watching! I can make the excuse that the Deny is more of a "Keep Denying" since we are being prompted on what we want to do with the log message entry. I think you are right it is not necessary to have that manual entry created since it was already being denied. The wildcard explanation makes sense to me also.
i do not have laptop or desktops in my domain, im trying to connect with a python script is this part necessary? sorry I'm a first year
Thanks for watching! If you are trying to connect with a Python script you do not need to enforce anything with group policy. You will need to just attach the certificate to the NTDS service on your domain controller. Your Python script may need help trusting the certificate if you are on a host that doesn’t trust the root ca that issued the LDAPS certificate
@@OsbornePro okay, thank you for the quick response. I will try this when I'm back at the lab tomorrow. Much appreciated!
@@invenorofstaw7570 no problem happy to help
Upgrade the micro processor and increase sim memory cards.
These kind of videos are a god send for all of us 'jack of all trades, master of none' IT workers. Superb level of detail and information. Brilliant. Many thanks.
Thanks for watching! Appreciate the compliment very glad it was helpful
Hello bro i have already configured NPS on windows server 2019 and created EAP-TLS policy.But in this case Yealink ip phone and pc cannot work together in this situation pc can get ip from dhcp but ip phone can not get ip what i must configurein NPS policy?:(
Thanks for watching! I believe that Yealink phones are not capable of trusting third party certificates. In order to get them internet you would need to configure a multi-host policy on a Cisco switch. This allows the phones to piggy back on the computers authentication and not have to use RADIUS to authenticate to pass traffic. www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_37_se/configuration/guide/3560scg/sw8021x.html#wp1271507
I think if you plan to cut the key size down, maybe try Curve crypto instead
Thanks I will check that out!
Using Laps can manage Domain account?
Thanks for watching! No unfortunately LAPS can only manage the local admin account of systems and not domain accounts
@@OsbornePro if you disabled user local user/ admins after setting up Laps whats the point setting up esp if device is not authenticated back to domain for period of time?
@@Akira29H you may need to enable the local admin account at some point to rejoin to a domain for example and the account may not vSomeone setting up a device for the first time may set a weak password to get through the setup and log in easily. It’s just defense in depth to keep track of the password in case you need it. If setting longer expirations works better for you because of offline machines there is no harm in doing that
@@OsbornePro thanks for all learning advice. I have question. I have different domain admin accounts but i dont have any controls to them like user account pw reset or join pc to domain i want these users to have min access to AD. A video would be appreciated. Tq very much.
@@Akira29H no problem thanks for the idea. I will do a next video on delegate permissions for some scenarios I have had requested before and include yours
hoping this still works my proff is hounding me to get this code done that connects to a server using ldaps
Thanks for watching! Yes this process is still the same today. You don’t need to install that Rile and Feature in the beginning. Just need to assign the certificate to the port and trust it on your client. Good luck on your project
Question. The step where you create the RADIUS template in the CA template manager. What is the purpose of distributing that machine certificate to all machines in the environment? I don't see any further mention of it in the video and wonder what purpose it serves? I suppose if you point to the cert anywhere in the NPS network policy creation or in the group policy setup and certs in the chain (the machine RADIUS cert) are subsequently accepted as well? Thanks!
Thanks for watching! The RADIUS Client authentication certificate can be assigned to any security group you want. It is best to create a RADIUS Devices security group in AD. It does not necessarily have to go out to everything. The RADIUS Server one will only be distributed to servers with the NPS ability. The root ca certificate needs to be distributed to everything for trust purposes. If a certificate isn’t trusted the connection won’t connect without extra steps that are bad for security. I think I answered the question. Let me know if I can provide any more info