LAPS managed computers can be any joined domain computer, the domain-joined clients or servers on the domain controller including DC. There are the steps to configure LAPS
1 Installation of GP CSE (Group Policy Client Side Extension) via MSI installation
1-1 On management computers
1-2 On clients to be managed
2 AD preparation
2-1 schema extension
2-2 Permission updates
3 Group policy configuration
In this article we use ssls.com certificate as example to show you how to renew or reactivate certificate.
2. Click Renew or Reactivate.
3. In Reissue for： Verify that the domain name you want a reissued certificate for is correct.
4. Save private key： You have two options, download the new key automatically generated in your browser (this is default) or submit a manually generated CSR.
Note: The private key will be downloaded to the local computer, perhaps, download folder.
5. Complete Domain Control Validation (DCV)
Before the Certificate Authority (CA) can issue SSL, they need to verify that the organization or individual has the right to receive the SSL certificate.
You may have three options:
Email Validation — receive an email at a domain-based or whois email.
HTTP Validation — upload the validation file at your host.
DNS Validation — set up a CNAME record in the domain’s DNS zone.
6. Choose approval email
In our example, select “Receive an email” as the domain control validation method. The contact email address from WHOIS or one of the following generic domain-based emails:
7. Domain Control Validation by email.
The organization administrator may receive the email. It looks like this.
8. Follow the email link to complete DCV.
9. You should receive the Certificate after DCV
It may take a few minutes. It looks like this email.
Note: You can also download the certificate from website
10. Install Certificate in Windows server using MMC
Step 1: Run Microsoft Management Console (MMC).
Step 2. Add Snap-in
Step 3. Add Certificate.
Step 4. Check Computer account.
Step 5. Import Certificate, for example Highlight Personal>All Tasks>Import.
Step 6. Click Next in Welcome to the Certificate Import Wizard and make sure Local Machine is checked.
Step 7. Follow the wizard to complete the import.
11. Check the Certificate by double click on the imported certificate.
Situation: The client has multiple email addresses for their users. They would like to know how to setup multiple email addresses for each domain account.
Resolution: we can modify Attribute Editor in Active Directory Users and Computers.
2. Right click on Properties.
3. Click on Attribute Editor.
4. Highlight proxyAddresses and click on Edit.
5. Add your default email address using SMTP (UP CASES), other email addresses smtp (low cases).
6. Click OK to save the settings.
Situation: After configuring Local Administrator Password Solution (LAPS), the client finds LAPS generates a password for all computers local administrator passwords. However, some of computers are using Local administrator to run apps and Servies. They wonder if they can disable LAPS temporarily or exclude computer administrator.
Resolution: you can disable “Link Enable” Group Policy or remove those computers from the OU policy. You may re-apply group policy by running gpupdate /force
Yes, you can. Quoted from Microsoft:
Force Password Reset
If this machine needs to be managed, we need to manually reset the LAPS password on the domain controller or wait for the expiration time to reset the password automatically, and then the new LAPS password can be used to log in (this is what you do in step 7).
Summary: For machines in the domain, the local administrator can still manually reset the local administrator password through the local management tool, but the new password will not be reflected in the computer object of AD. At this time, you can only log in with the reset password.
If you manually reset the LAPS password on the domain controller (I set new expiration day manually) or wait for the LAPS password expiration time to automatically reset the LAPS password, let the system reassign a password that complies with the password policy, after that you can use the new LAPS login.
Right click on the Backup Job. Click on Active Full.
Situation: The client use Microsoft 365 / Azure DirSync to synchronize their Active Directory to Azure Directory. The default setup is 15 minutes to sync. They would like to know how to force sync.
You can run Powershell command: Start-ADSyncSyncCycle -PolicyType Initial
Situation: When working on Outlook, you may receive this message “The operation cannot be performed because the message has been changed” randomly.
Resolution 1: Run Outlook repair. Go to File>Account Settings>Repair.
You can use the Inbox Repair tool (SCANPST.EXE) to diagnose and repair errors in your Outlook data file.
Resolution 2: Run office online repair.
Resolution 3: Try running the SARA Tool: https://diagnostics.outlook.com/#/
Resolution 4: It could be add-ins issue. Go to Outlook add-in Adobe Send & Track for Microsoft Outlook – Acrobat. Disabling it.
Resolution 5: Enable Exchange cached mode.
Resolution 6: That happens because you may have a large email size so that you must wait a moment for the sync completed.
Resolution 7: This seems to be a problem only with IMAP accounts.
I fixed my problem on the IMAP account (which, ahem, started after a Microsoft update) by using Outlook’s “repair” tool:
– In Outlook, right click on the mailbox in the left-side navigation bar.
– Choose “Account Properties.”
– In a blue toolbar about 1/3 of the way down the window, “Repair” is one of the choices.
– Click Repair. It only took about 5 seconds.
If you move the emails and receive this popup,
2. If above doesn’t work, uncheck all options under Conversation Clean Up
3. Account Settings > Open your account > More settings > Under Advanced tab, put INBOX in Root Folder Path. (If your all folders disappear, simply remove INBOX from here). Note: Do NOT use option # 3 above. With an IMAP account this will empty an entire folder! Really, REALLY dumb suggestion that cost me a ton of data!
4. Select Cleaned up items will go to this folder.
This is a known issue with IMAP accounts. The change (read state) needs to sync with the server before you can move it, which only takes a split second, but outlook keeps a hold on the message until you switch messages.
To find the size of your mailbox, follow these steps;
1. With Outlook open, click your account.
2. Click Folder on the top menu.
3. Click on Folder Properties.
4. Click Folder Size at the bottom of the pane.
5. You’ll see that the size for the mailbox and each subfolder is indicated in kilobytes (KB).
To find the email file (*.ost) location, right click on your email account and select Open File Location.
You will see *.ost file located in C:\Users\username\AppData\Local\Microsoft\Outlook
Situation: You can create a folder and use rule to organize group emails. In our example, we will move all emails from a sender, Budget in our example to a folder, Vacation in our example.
3. Enter the folder name, for example Vacation.
4. Rick click on the email you want to move to the folder you just create and select Rule.
5. Select Alway Move Message From:…
6. Select the folder you just created, Vacation. Note: you have an option to create the folder here by clicking New.
7. The click OK. All emails from Budget will be moved to Vacation Folder.
