Voltar
-
Título
Can you set a different default msDS-SupportedEncryptionTypes attribute value during join? -
Descrição
Can you set a different default msDS-SupportedEncryptionTypes attribute value during join?
During the domain join the msDS-SupportedEncryptionTypes attribute for the computer object will be set to the following value by default:
524316
This indicates support for:
RC4_HMAC_MD5, AES128_CTS_HMAC_SHA1_96 and AES256_CTS_HMAC_SHA1_96.
With Disable Resource Group Compression bit
In some circumstances you may wish to change the default. -
Resolução
From Safeguard Authentication Services version 5.1.1 onwards you can use the -m option to set this value during the join:
E.g to set the value to 24 (AES128 + AES256 only)
# /opt/quest/bin/vastool -u <admin user> join -m 24 <domain>
If the computer object is already joined to the domain, then you can use the following command to change the value:
# /opt/quest/bin/vastool -u host/ setattrs host/ msDS-SupportedEncryptionTypes 24
-
Informações adicionais
You can check the current value for msDS-SupportedEncryptionTypes with the following command: /opt/quest/bin/vastool -u host/ attrs host/ msDs-SupportedEncryptionTypes