search for: executescriptpassword

...e-password-hash-sync the required password hashes are "NTLM and Kerberos password hashes". I setup client specific logging on our DC for the Azure AD Sync server, and a grep for "password" on the generated logs: > passwordAttribute: pekList > passwordAttribute: msDS-ExecuteScriptPassword > passwordAttribute: clearTextPassword > passwordAttribute: userPassword > passwordAttribute: ntPwdHash > passwordAttribute: sambaNTPwdHistory > passwordAttribute: lmPwdHash > passwordAttribute: sambaLMPwdHistory > passwordAttribute: krb5key > passwordAttribu...

...uired password hashes are "NTLM and Kerberos password hashes". > > I setup client specific logging on our DC for the Azure AD Sync server, > and a grep for "password" on the generated logs: > >> ? passwordAttribute: pekList >> ? passwordAttribute: msDS-ExecuteScriptPassword >> ? passwordAttribute: clearTextPassword >> ? passwordAttribute: userPassword >> ? passwordAttribute: ntPwdHash >> ? passwordAttribute: sambaNTPwdHistory >> ? passwordAttribute: lmPwdHash >> ? passwordAttribute: sambaLMPwdHistory >> ? passwordAttribute: kr...

...t, so had to repeat the seizing of roles and removal then > install 4.7.5 and re-join. > Strange, if you read the release notes for 4.8.0rc2. you will find this: Encrypted secrets Attributes deemed to be sensitive are now encrypted on disk. The sensitive values are currently: pekList msDS-ExecuteScriptPassword currentValue dBCSPwd initialAuthIncoming initialAuthOutgoing lmPwdHistory ntPwdHistory priorValue supplementalCredentials trustAuthIncoming trustAuthOutgoing unicodePwd clearTextPassword This encryption is enabled by default on a new provision or join, it can be disabled at provision or join time...

Hi, First some background: ================== I had a test environment which had two samba DCs (running v 4.8.0rc2) and 1 Windows Server 2008R2 DC. The samba DCs had been upgraded from v 4.6x and the secrets database was not encrypted (as far as I know). I decided to downgrade one of the samba DCs to v 4.7.4. On re-starting samba after the downgrade the log shows: ldb: unable to dlopen

...records match the case of the hostname rather than being in all capitals. This can be set with the following settings: 'mdns name = mdns' Encrypted secrets ----------------- Attributes deemed to be sensitive are now encrypted on disk. The sensitive values are currently: pekList msDS-ExecuteScriptPassword currentValue dBCSPwd initialAuthIncoming initialAuthOutgoing lmPwdHistory ntPwdHistory priorValue supplementalCredentials trustAuthIncoming trustAuthOutgoing unicodePwd clearTextPassword This encryption is enabled by default on a new provision or join, it can be disabled at provision o...

...records match the case of the hostname rather than being in all capitals. This can be set with the following settings: 'mdns name = mdns' Encrypted secrets ----------------- Attributes deemed to be sensitive are now encrypted on disk. The sensitive values are currently: pekList msDS-ExecuteScriptPassword currentValue dBCSPwd initialAuthIncoming initialAuthOutgoing lmPwdHistory ntPwdHistory priorValue supplementalCredentials trustAuthIncoming trustAuthOutgoing unicodePwd clearTextPassword This encryption is enabled by default on a new provision or join, it can be disabled at provision o...

...records match the case of the hostname rather than being in all capitals. This can be set with the following settings: 'mdns name = mdns' Encrypted secrets ----------------- Attributes deemed to be sensitive are now encrypted on disk. The sensitive values are currently: pekList msDS-ExecuteScriptPassword currentValue dBCSPwd initialAuthIncoming initialAuthOutgoing lmPwdHistory ntPwdHistory priorValue supplementalCredentials trustAuthIncoming trustAuthOutgoing unicodePwd clearTextPassword This encryption is enabled by default on a new provision or join, it can be disabled at provision o...

...records match the case of the hostname rather than being in all capitals. This can be set with the following settings: 'mdns name = mdns' Encrypted secrets ----------------- Attributes deemed to be sensitive are now encrypted on disk. The sensitive values are currently: pekList msDS-ExecuteScriptPassword currentValue dBCSPwd initialAuthIncoming initialAuthOutgoing lmPwdHistory ntPwdHistory priorValue supplementalCredentials trustAuthIncoming trustAuthOutgoing unicodePwd clearTextPassword This encryption is enabled by default on a new provision or join, it can be disabled at provision o...

...records match the case of the hostname rather than being in all capitals. This can be set with the following settings: 'mdns name = mdns' Encrypted secrets ----------------- Attributes deemed to be sensitive are now encrypted on disk. The sensitive values are currently: pekList msDS-ExecuteScriptPassword currentValue dBCSPwd initialAuthIncoming initialAuthOutgoing lmPwdHistory ntPwdHistory priorValue supplementalCredentials trustAuthIncoming trustAuthOutgoing unicodePwd clearTextPassword This encryption is enabled by default on a new provision or join, it can be disabled at provision o...

...records match the case of the hostname rather than being in all capitals. This can be set with the following settings: 'mdns name = mdns' Encrypted secrets ----------------- Attributes deemed to be sensitive are now encrypted on disk. The sensitive values are currently: pekList msDS-ExecuteScriptPassword currentValue dBCSPwd initialAuthIncoming initialAuthOutgoing lmPwdHistory ntPwdHistory priorValue supplementalCredentials trustAuthIncoming trustAuthOutgoing unicodePwd clearTextPassword This encryption is enabled by default on a new provision or join, it can be disabled at provision o...

...records match the case of the hostname rather than being in all capitals. This can be set with the following settings: 'mdns name = mdns' Encrypted secrets ----------------- Attributes deemed to be sensitive are now encrypted on disk. The sensitive values are currently: pekList msDS-ExecuteScriptPassword currentValue dBCSPwd initialAuthIncoming initialAuthOutgoing lmPwdHistory ntPwdHistory priorValue supplementalCredentials trustAuthIncoming trustAuthOutgoing unicodePwd clearTextPassword This encryption is enabled by default on a new provision or join, it can be disabled at provision o...

...records match the case of the hostname rather than being in all capitals. This can be set with the following settings: 'mdns name = mdns' Encrypted secrets ----------------- Attributes deemed to be sensitive are now encrypted on disk. The sensitive values are currently: pekList msDS-ExecuteScriptPassword currentValue dBCSPwd initialAuthIncoming initialAuthOutgoing lmPwdHistory ntPwdHistory priorValue supplementalCredentials trustAuthIncoming trustAuthOutgoing unicodePwd clearTextPassword This encryption is enabled by default on a new provision or join, it can be disabled at provision o...

...records match the case of the hostname rather than being in all capitals. This can be set with the following settings: 'mdns name = mdns' Encrypted secrets ----------------- Attributes deemed to be sensitive are now encrypted on disk. The sensitive values are currently: pekList msDS-ExecuteScriptPassword currentValue dBCSPwd initialAuthIncoming initialAuthOutgoing lmPwdHistory ntPwdHistory priorValue supplementalCredentials trustAuthIncoming trustAuthOutgoing unicodePwd clearTextPassword This encryption is enabled by default on a new provision or join, it can be disabled at provision o...

...records match the case of the hostname rather than being in all capitals. This can be set with the following settings: 'mdns name = mdns' Encrypted secrets ----------------- Attributes deemed to be sensitive are now encrypted on disk. The sensitive values are currently: pekList msDS-ExecuteScriptPassword currentValue dBCSPwd initialAuthIncoming initialAuthOutgoing lmPwdHistory ntPwdHistory priorValue supplementalCredentials trustAuthIncoming trustAuthOutgoing unicodePwd clearTextPassword This encryption is enabled by default on a new provision or join, it can be disabled at provision o...

...records match the case of the hostname rather than being in all capitals. This can be set with the following settings: 'mdns name = mdns' Encrypted secrets ----------------- Attributes deemed to be sensitive are now encrypted on disk. The sensitive values are currently: pekList msDS-ExecuteScriptPassword currentValue dBCSPwd initialAuthIncoming initialAuthOutgoing lmPwdHistory ntPwdHistory priorValue supplementalCredentials trustAuthIncoming trustAuthOutgoing unicodePwd clearTextPassword This encryption is enabled by default on a new provision or join, it can be disabled at provision o...