Managing Local Administrator Passwords on Windows Workstations

Microsoft offers the Local Administrator Password Solution (LAPS) to allow administrators to set random and unique passwords on each workstation/server joined to active directory. This tool works by installing a small application on the client machine and then configuring a GPO to apply the specific settings for the password format and expiration intervals. Below are the steps required to configure LAPS.


Server Setup 

1. Download LAPS from https://support.microsoft.com/en-us/kb/3062591
2. Run the install on your management workstations and select the three items under the management tools and select next to complete the install.
3. Next run the following command to extend the schema to add the ms-Mcs-AdmPwd & ms-Mcs-AdmPwdExpiration attributes to the computer objects class

4. Next run the following command to set the permission to allow the computer account to update itself and allow domain admins to reset the password.

Customizing the AD FS Sign-In Page

If you are not happy with the default design of the AD FS Sign-In page you can use the commands below to update the page. Below are a few of the commands that i have used to customize the page but other options are available.

Default Sign-in Page:

Change Company Name

You can change the company name with the following powershell command:

Set-AdfsGlobalWebContent -CompanyName "New Company Name"

Change Company Logo

When changing the company logo Microsoft recommends the dimensions for the logo to be 260x35 @96 dpi with a file size no larger than 10KB.

Set-AdfsWebTheme -TargetName default -Logo @{path"c:\images\logo.png"}


Change Graphic on the left

To change the image on the left you can use the following powershell cmdlet. Microsoft recommends that the illustration be 1420x1080 @96 dpi and no larger than 200KB.

Set-AdfsWebTheme -TargetName default -Illustration @{path="c:\images\illustration.png"}

Add a description to sign-in page

You can use the following powershell command to change the description on the sign in page. The text for "signInPageDescriptionText" paramter supports html tags.

Set-AdfsGlobalWebContent -SignInPageDescriptionText "For assistance please visit our support site here.
"

Additional Resources:
https://technet.microsoft.com/en-us/library/dn280950.aspx

SAML Authentication with Jive 8.0 and Active Directory Federation Services 2.0

Overview:
This document outlines the process required to configure Jive 8.0 to work with Active Directory Federation Services 2.0.
This document only outlines how to setup a new installation of Jive to authenticate using ADFS it does not outline how to migrate from
an alternate authentication source to ADFS.


Assumptions:
1. Active Directory Federation Services 2.0 on Windows 2012 R2 is installed
2. AD FS will be using Active Directory to authenticate users.
3. Jive 8.0 (Jive 7 & 6 *should* work also) is installed
4. Your Jive instance must be using https for this to work

Configuring ADFS

1. Open AD FS console and expand trust relationships and right click on the Relying party trusts and select Add relying party trust
2. Click start and on the next screen enter the URL for your Jive SP Metadata in the first section. By default the URL is "https:///saml/metadata"

3. Type a displayname to identify this trust. Click Next
4. On the multi-factor authentication step makre sure "I do not want to configure multifactor authentication settings....." is selected and click next.

5. Accept the default option "Permit all users to access this relying party" and click next