Thursday, June 28, 2018

AD Query still returns old user name after user name was changed at domain controller

Symptoms:

Consider the following scenario:

  1. On the domain member computer, an application calls the LsaLookupSids function to translate a security identifier (SID) to a user name.
  2. The user name has been changed on a domain controller.
  3. In this scenario, the LsaLookupSids function may return the old user name instead of the new user name. This behavior may prevent the application from working correctly.


Cause:

The local security authority (LSA) caches the mapping between the SID and the user name in a local cache on the domain member computer. The cached user name is not synchronized with domain controllers. The LSA on the domain member computer first queries the local SID cache. If an existing mapping is already in the local SID cache, the LSA returns the cached user name information instead of querying the domain controllers. This behavior is intended to improve performance.

The cache entries do time out, however chances are that recurring queries by applications keep the existing cache entry alive for the maximum lifetime of the cache entry.


Workaround:

To work around this issue, disable the local SID cache on the domain member computer as follows.

  1. In RegEdit, locate HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
  2. Create a new DWORD directly under "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa", name it LsaLookupCacheMaxSize and assign value 0.
  3. Reboot may not be required.

Note The LsaLookupCacheMaxSize registry entry sets the maximum number of cached mappings that can be saved in the local SID cache. The default maximum number is 128. When the LsaLookupCacheMaxSize registry entry is set to 0, the local SID cache is disabled.


Resources:
https://support.microsoft.com/en-us/help/946358/the-lsalookupsids-function-may-return-the-old-user-name-instead-of-the
https://marclsitinfrablog.wordpress.com/2011/06/25/lsa-lookup-cache/

Wednesday, June 13, 2018

Steps to add VS solution to Visual Studio Team Services

Steps to add an existing Visual Studio solution to a repository on Visual Studio Team Services (or Team Foundation Server).


  1. Install Git on your PC first.
  2. Create a project with Git as version control on your Visual Studio Team Services website.
  3. Get the URL of the new project after it is created,
    i.e., https://developer2201.visualstudio.com/WebApp1/_git/WebApp1
  4. Assuming your Visual Studio solution folder is C:\Dev\VS2017_Eval\WebApp1...
  5. Open command line console. Go to "C:\Dev\VS2017_Eval\WebApp1".
  6. Run command: git init
  7. Run command:
    git remote add origin https://developer2201.visualstudio.com/WebApp1/_git/WebApp1
  8. add ".gitignore" file to the folder. You can download it from github at
    https://github.com/github/gitignore/blob/master/VisualStudio.gitignore
  9. Run command: git add .gitignore
  10. Run command: git commit -m ".gitignore file added"
  11. Run command: git add *
  12. Run command: git commit -m "Initial source codes"
  13. Run command: git push -u origin --all

Step 13 can be done in Visual Studio by using Sync and Push in outgoing commit in Visual Studio, too.