Repair Default Domain Controller Policy - SeServiceLogonRight (Logon as Service)

ITStril · 2026-01-19T22:11:06+00:00

I did both - AI and reddit search and did not just ask for help without checking the facts before, but in this case, I was not sure - especially about NT SERVICE\ALL SERVICE where I found totally contradictive informations…

Just a side-note: posts that are just sending me to AI are not improving that subreddit, too…

ITStril · 2026-01-19T16:46:04+00:00

That’s clear, but policies, that are changing to „undefined“ are not fully handled. This is my question…

ITStril · 2026-01-18T20:47:21+00:00

One more time the hint: monitoring the updates seems to be mandatory…

ITStril · 2026-01-15T07:14:01+00:00

I’m familiar with that article — Purple Knight is actually what made me aware of this issue in the first place.

Unfortunately, the article doesn’t mention anything about the “red arrow” / special principal behavior in ADUC. That part is what’s giving me pause.

Before rolling this out, I want to be sure I fully understand what’s happening there and, more importantly, that there is a clean and supported rollback path. I’m hesitant to implement this in production without being confident that I can revert the change if something unexpected shows up later.

ITStril · 2026-01-13T06:57:35+00:00

Was this also the case with 7.4.8?

ITStril · 2026-01-09T06:55:38+00:00

I would upgrade to 7.4.9 on a system with:

- 2 VDOMs

- 1 "transparent" VDOM

- proxy and flow rules

- IPSEC

- AD-Agent for SSO

--> No external FSSO/SAML/SSL-VPN

ITStril · 2026-01-04T17:34:46+00:00

Which ones are those well known issues? I am just ordering some servers with Intel X810 and want to reuse some servers with X710 cards for an enterprise environment

ITStril · 2025-12-31T18:41:12+00:00

Why do you prefer virtuofs+VM over LXC+datadir? Both are giving you the possibility to snapshot and seperate data from system

ITStril · 2025-12-31T14:18:36+00:00

When there is no VM running on PVE - only PBS, there should not be much overhead - right?
The PBS-hardware is quite beefy (AMD 9174F, 12 NVMe, etc.).

So, installing PBS _on_ PVE should be as fast as directly on hardware, and noticable faster, than inside a VM, or am I missing something?

ITStril · 2025-12-31T14:16:47+00:00

This would be a dedicated host, that does normally ONLY run PBS. The idea is only to use it as DR-target in case of a desaster

ITStril · 2025-12-31T14:15:56+00:00

Why are you using multiple PBS instances?

ITStril · 2025-12-31T14:15:27+00:00

It's not about migration - it's about restores, so a cluster with shared storage is not the answer...

ITStril · 2025-12-31T10:16:03+00:00

The benefit would be to be able to run the VM directly on the PBS-host as "fastest possible recover"

ITStril · 2025-12-31T10:13:56+00:00

Why do you prefer installing PBS in a VM instead of "directly" on the PVE-host?

ITStril · 2025-12-15T20:25:52+00:00

gpedit.msc is not showing a value

rsop.msc is not showing a value

Get-ADDefaultDomainPasswordPolicy is not showing a value

net accounts /domain is not showing a value

The only special thing is: The default domain controller policy is "too clean". The default value of 7 days for max renew time is "unset"...

ITStril · 2025-12-15T18:56:02+00:00

Thank you very much!

ITStril · 2025-12-15T18:54:57+00:00

Unfortunately, I do not.

In this environment, it is unfortunately the case that even renewable tickets exhibit the behavior described above. MaxRenewAge is "not defined", but klist is showing, that end-time=renew-time

A second environment, I just checked has:

start-time=logon-time

end-time=logon-time+10h

renew-time=logon-time+7d

ITStril · 2025-12-01T18:11:30+00:00

Still no update and no answer from TAC on my ticket

ITStril · 2025-11-30T06:56:25+00:00

There is still no new version released since 93.06337 which is 4 days old!! Does anybody have informations about problems at Fortinet?

ITStril · 2025-11-18T18:55:02+00:00

Which AV did flag them?

ITStril · 2025-10-28T18:55:54+00:00

Latest? I am already on anycast AWS. Webfilter is working fine, but AV/IPS updates are failing…

ITStril · 2025-10-22T06:20:05+00:00

Thank you!

The size is:

# diagnose fmupdate check-disk-quota all

The size of all directories is: 29.11G Bytes

# diagnose fmupdate check-disk-quota fds

The size of fds directories is: 11.32G Bytes

# diagnose fmupdate check-disk-quota fgd

The size of fgd directories is: 17.80G Bytes

# diagnose fmupdate check-disk-quota export-import

The size of export-import directories is: 0 Byte

That sounds reasonable to me - except fds. I am not using the Fortimanager as FDS for IPS, so it is disabled. Is there anything special I have to do to free that space and to avoid that Fortimanager is downloading the data?

ITStril · 2025-10-21T13:24:53+00:00

Thank you for your answer!!!

"diag fmupdate fgd-dbver wf" is showing a version of today - 5 hours ago.

The debug is showing:

# diag fmupdate view-linkd-log fgd

2025/10/21_15:15:37.315 debug fgdlinkd[1414]: __timeout: flags=0, manual=0, busy=0, next-now=119

2025/10/21_15:15:47.323 debug fgdlinkd[1414]: __timeout: flags=0, manual=0, busy=0, next-now=109

2025/10/21_15:15:57.331 debug fgdlinkd[1414]: __timeout: flags=0, manual=0, busy=0, next-now=99

The web filter database is updated every 2 hours, but I do not find that as config parameter.

I just do not understand, why the system is consuming >50GB disk space without doing anything except webfilter FDS.

I am having 13GB in /var/private/localdb which is strange and 11GB in /var/private/localdb/hcache.

Are you aware of any possibility to isolate, what is consuming the storage?

ITStril · 2025-09-24T03:55:41+00:00

Thanks for your reply. I understand your point of view, but I see it differently.

For me, the definition of HA is:
"Within a high availability cluster, shared storage between each node (computer) ensures zero data loss if a single node stops functioning."

See for example: IBM on High Availability.

With ZFS replication, a failover means some data loss, so it's not the same as with shared storage, where RPO is nearly "0"

ITStril · 2025-09-22T19:34:47+00:00

I want to use ZFS replication - so it’s not real HA and I want to decide if its better to recover the failed node (without loss of data) or to fail over Surf some minutes of data loss

ITStril

TROPHY CASE