WinOS Central

  📌 Introduction Microsoft Local Administrator Password Solution ( LAPS ) is a free tool that enhances security by automatically managing local administrator passwords on domain-joined computers. This guide will walk you through the installation and configuration of LAPS in a step-by-step manner. 🔍 Prerequisites Before you begin, ensure you have the following: ✅ Active Directory configured ✅ Domain Admin or equivalent privileges ✅ Windows Server with Group Policy Management ✅ Windows Clients (Windows 10/11) joined to the domain 📥 Step 1: Download and Install LAPS 1️⃣ Download LAPS from the official Microsoft Download Center: 👉 https://www.microsoft.com/en-us/download/details.aspx?id=46899 2️⃣ Run the LAPS.x64.msi installer on your Domain Controller (DC) and client machines. 3️⃣ On the Installation Wizard , select: ✅ AdmPwd GPO Extension ✅ PowerShell Module ✅ Management Tools 4️⃣ Click Install and wait for the process to complete. 🔗 Step 2: Extend Active Directory Schem...

 Renewing a certificate in a Windows RADIUS server involves several steps. Here's a step-by-step guide to help you through the process: 1. Generate a New Certificate Request Open the MMC (Microsoft Management Console) : Press Win + R , type mmc , and press Enter. Add/Remove Snap-ins : Go to File > Add/Remove Snap-in . Select Certificates and click Add . Choose Computer account , then Next , and select Local computer . Click Finish and OK . Create a New Certificate Request : Navigate to Certificates (Local Computer) > Personal > Certificates . Right-click on Certificates , go to All Tasks , and select Request New Certificate . Follow the wizard to generate a new certificate request. Ensure you select the appropriate certificate template (e.g., RAS and IAS Server). 2. Submit the Certificate Request to a CA (Certificate Authority) Submit the Request : Save the certificate request file (usually with a .req extension). Open the Certification Authority console ( certsrv.ms...

  The "trust relationship between this workstation and the primary domain failed" error typically means that the secure channel between the client (your Windows Server 2008 R2 machine) and the domain controller (DC) is broken. This can happen if the computer's account password in Active Directory (AD) has become unsynchronized with the password stored on the client computer. Here are a few methods to resolve this issue: Method 1: Rejoin the Computer to the Domain This is the most common fix but requires local administrative access. Here’s how you can do it: Log in with a Local Admin Account (instead of the domain account). Remove the Computer from the Domain : Right-click on Computer > Properties . Click on Change settings next to the computer name. Click Change , then select Workgroup and enter a workgroup name (e.g., WORKGROUP ). Restart the server when prompted. Rejoin the Computer to the Domain : After restarting, go back to the System Properties > Change s...

 This error typically occurs when the Web Application Proxy (WAP) is unable to authenticate with the ADFS server. Here are some common causes and troubleshooting steps: Possible Causes: Service Account Password Expiry or Mismatch The WAP server authenticates with ADFS using a trust relationship that relies on a certificate and/or service account. If the password has changed or expired, WAP cannot authenticate. Expired or Incorrect ADFS Proxy Trust Certificate The WAP server uses a certificate to establish trust with ADFS. If the certificate is expired or mismatched, authentication will fail. Time Synchronization Issues ADFS and WAP must be synchronized within a few minutes of each other. If there is a time difference, authentication may fail. Network Connectivity Issues Ensure WAP can reach the ADFS server on port 443 (HTTPS). Check firewall rules and proxy settings. ADFS Authentication Issues The ADFS server may not be accepting requests from the WAP server. There may be an issue...

Renewing an Active Directory Federation Services (ADFS) certificate involves multiple steps, depending on which certificate you are renewing. The impact on users depends on the type of certificate being updated. Types of ADFS Certificates Service Communications Certificate – Used for encrypting SSL/TLS traffic (external users may be impacted if not updated properly). Token-Signing Certificate – Used to sign SAML tokens (users may face login issues if relying parties are not updated). Token-Decrypting Certificate – Used to decrypt incoming encrypted tokens. Step-by-Step Guide to Renew ADFS Certificates 1. Renewing the Service Communications Certificate (SSL/TLS) This is a standard SSL certificate renewal . Steps: Obtain a new certificate from a trusted CA (internal or external). Import it into the Local Computer > Personal Certificates store on the ADFS server. In the ADFS Management Console , go to Certificates > Service Communications . Select Set Service Communications Ce...

1. Choose a Reliable Time Source You can use NTP (Network Time Protocol) servers from a reliable provider such as: Microsoft NTP servers : time.windows.com NIST (U.S. Government) : time.nist.gov Singapore NTP servers : sg.pool.ntp.org   2. Configure the PDC Emulator to Sync with an External NTP Server The PDC Emulator (Primary Domain Controller Emulator) is responsible for time synchronization in an AD domain. Step 1: Identify Your PDC Emulator Run this command on any Domain Controller (DC) to check which DC holds the PDC Emulator role: powershell netdom query fsmo The PDC Emulator should be listed under PDC Role . Step 2: Configure the PDC Emulator to Use an External NTP Server Run the following command on the PDC Emulator: powershell w32tm /config /manualpeerlist:"sg.pool.ntp.org time.windows.com time.nist.gov" /syncfromflags:manual /reliable:yes /update Then, restart the time service: powershell net stop w32time && net start w32time Step 3: Force Sync and Verif...