środa, 31 lipca 2024

ldap querries are not paged? Windows Active Directory

case:
  • java code

  • forest Active Directory in 2016 version, one parent, two children

  • java code querrying root domain (parent) for group (universal) in child1 domain

  • group has got members from child2 domain

  • uri ldap://parent

  • only first 1000 members are returned

  • ldap policy for returning 1500 objects means that 1500 will be returned, paging is not working



  • possible reason? referrals are not paged so it is prevention against resoure exhaustion of querried domain controller - I've seen it in Technet, but... I can't remember where... maybe on Oracle JNDI?

    wtorek, 23 lipca 2024

    recover/restore security groups in Azure

    Restoring/recovering security groups in Azure is always permanent - we can't back with them... so in case of accidental deletion in On-Premise environment we are always in ... - according to this thread.

    So if You have aadc - Azure AD Connect or something different to sync on premise with Azure every time when accidental deletion occurs every time deleted group will be lost. Stupid. Sollution for small companies.

    Azure AD Connect - prevent mass deletion of groups

    Again we have the same problem with deleted security groups (change in synchronized containers, one of them have groups synchronized - outside of project, but very, very important groups), so how can we counteract groups deletion?

    Maybe I can export last runtime log?

    Get-ADSyncRunProfileResult [-RunHistoryId ] [-ConnectorId ] [-RunProfileId ] [-RunNumber ] [-NumberRequested ] [-RunStepDetails] [-StepNumber ] [-WhatIf] [-Confirm] []

    Get-ADSyncRunStepResult [-RunHistoryId ] [-StepHistoryId ] [-First] [-StepNumber ] [-WhatIf] [-Confirm] []

    Invoke-ADSyncRunProfile -ConnectorName -RunProfileName [-Resume] []



    So I must change default synchronization cycles to my own cycles using Invoke-ADSyncRunProfile with imports for and analysis of deletion - I must stop exports to Azure when deletion of groups appear in syncstep, but can I look for waiting deletion in connector space for Azure?

    Is there any interface, API? Lithnet module for PowerShell?

    czwartek, 18 lipca 2024