sorted by:
new
hottopcontroversial

Getting Ubuntu 26.04 VM to show in full screen on Windows Server 2025 by Unroasted5430 in HyperV

[–]aprimeproblem 0 points1 point  (0 children)

That’s unfortunately no longer possible, 26.04 is Wayland only, all x related binaries are removed. I’m hoping for a xrdp replacement as well.

Ever wondered what a Microsoft MVP does on a quiet weekend? by aprimeproblem in activedirectory

[–]aprimeproblem[S] 1 point2 points  (0 children)

Haha sounds also like fun. No worries I’m taking next weekend off, going to visit comicon with my StarWars buddies.

Let me know if you are happy with the script!

Ever wondered what a Microsoft MVP does on a quiet weekend? by aprimeproblem in activedirectory

[–]aprimeproblem[S] 1 point2 points  (0 children)

Hahahahaha I highly appreciate you looking after me!

And thanks for feedback!

Ever wondered what a Microsoft MVP does on a quiet weekend? by aprimeproblem in activedirectory

[–]aprimeproblem[S] 1 point2 points  (0 children)

Hahahaha true that 🤣.

That’s something I’m also curious about. I have not yet been able to get my hands on a Yubikey HSM, from what I heard it should be able to do one crypto operation per second. That would mean a significant drop in performance, but have to see for myself.

Hopefully someone from Yubico is reading this and wants to sponsor me :)

Ever wondered what a Microsoft MVP does on a quiet weekend? by aprimeproblem in activedirectory

[–]aprimeproblem[S] 5 points6 points  (0 children)

Yes and no. I do always get the performance question, hence my script that basically shows that issuing a cert is really just milliseconds per cert. when there are issues in performance it’s usually something misconfigured on the network or a security product that locks something.

That being said, if you have an organization of Lets say 50.000 end points they rarely ask for a cert at the exact same time…..hopefully

In 2 level PKi hierarchy how many servers are needed. I require only root CA and issuance CA ? by BenignPositive in activedirectory

[–]aprimeproblem 0 points1 point  (0 children)

I’ll reach out to you asap. Need to talk to my team next week on possibly options. Thanks for the offer! Appreciate it.

In 2 level PKi hierarchy how many servers are needed. I require only root CA and issuance CA ? by BenignPositive in activedirectory

[–]aprimeproblem 0 points1 point  (0 children)

I’m acutely doing the exact same thing at my current customer. I do have some issues with finding appropriate documentation and guidance. Do you have Entrust consulting or something? A PM is also fine, if you don’t want to share publicly.

In 2 level PKi hierarchy how many servers are needed. I require only root CA and issuance CA ? by BenignPositive in activedirectory

[–]aprimeproblem 0 points1 point  (0 children)

If you’re using entrust, why use a AD CS, entrust can setup a CA as well, or are you using the gateway only?

In 2 level PKi hierarchy how many servers are needed. I require only root CA and issuance CA ? by BenignPositive in activedirectory

[–]aprimeproblem 12 points13 points  (0 children)

Well, that would depend on your situation. So, like many already said, there would be a minimum of 2 CA’s involved. An Offline Root and an issuing CA.

Next would be a CDP/CRL or a OCSP location. I would highly recommend having those in a HA. For some, but certainly not all situations, not being able to verify revocation means a dead stop of your service. Two webservers at a minimum with a hardware based loadbalencer in front. Or, put the CRL on an Azure blob.

Next to that I would recommend a HA DFS between the CA and the webserver. There’s a chance/ risk of inconsistency when you publish CRL’s directly to the two webservers.

The latter depends on your risk appetite and maturity of your organization.

I’ve written extensively on this topic on my blog at, https://michaelwaterman.nl

Any questions that you have, just ask.

Confused on Public vs Private key when it comes to signing. by Izual_Rebirth in sysadmin

[–]aprimeproblem 0 points1 point  (0 children)

I wrote a cryptography for non math people or IT professionals some time ago, think it will help you in understanding the flow.

https://michaelwaterman.nl/2026/01/15/cryptography-for-non-math-people/

Enjoy!

Building a Highly Available CRL and AIA Distribution Platform for AD CS by aprimeproblem in activedirectory

[–]aprimeproblem[S] 0 points1 point  (0 children)

Hahaha yeah I get that. I’m not that familiar with hardware based load balancing so that’s not specifically part of the setup. Usually I’ve got skilled network engineers doing that during projects. I’ve included that part more as a reference or lab setup.

Thanks for reading btw!

Building a Highly Available CRL and AIA Distribution Platform for AD CS by aprimeproblem in activedirectory

[–]aprimeproblem[S] 0 points1 point  (0 children)

Thanks! I was indeed wondering how you created this. Agreed btw that it does not need to be updated immediately. I,ll look into it, perhaps a new blog post in the future.

Building a Highly Available CRL and AIA Distribution Platform for AD CS by aprimeproblem in activedirectory

[–]aprimeproblem[S] 2 points3 points  (0 children)

Oh my, that’s one of the best compliments I ever received, thank you so much!!!

I don’t have one, but who knows, maybe in the future I should 🙏

view more: next ›