Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm currently trying to query a remote Active Directory on a Windows Server 2008 R2. However, I'm not able to query the directory if I enter the following string in the cmd line:

dsquery user -name m* -s ip:389 -u -p

Furthermore, I tried to access the directory with:

ldap://: but it didn't work either.

I received the following error message:

The server is not operational.

Is there an option with which I can enable the remote access of an Active Directory?

I think there is a misunderstanding here: The Server which holds the active directory is a lone server, a playground, without any contact to sensitive informations. It's just a playground which is supposed to be formatted and redone after the testing.

share|improve this question
Well, have you checked that you have all the basic needs fulfilled (network connection, correct service running, correct user rights etc)? – Sandokan Dec 7 '12 at 17:42
up vote 3 down vote accepted

Sounds like you're trying to do this over the internet, which is a really bad idea, per @MDMarra . AD should only be accessible from a private (non-publicly routed) network, or via VPNing into such a network. (As also mentioned by MDMarra, a reverse web proxy isn't going to protect AD, given that it doesn't travel over http ports or protocols. You are essentially playing contact sports and trying to protect your genitals by wearing the cup on your head.

Having said that, since you're trying this really ill-advised thing from over the internet, have you checked whether or not the firewall (the one I really hope sits on the edge of your network) allows LDAP and port 389 through to your Active Directory Domain Controller? It probably doesn't, and it shouldn't.

share|improve this answer
Quote of the week! ... "You are essentially playing contact sports and trying to protect your genitals by wearing the cup on your head." PMSL – Simon Catlin Dec 7 '12 at 22:00
Would you be so kind to elaborate why I'm playing contact sport if I have this lone server, which doesn't have ANY connection to sensible data or other networks if I open up the local LDAP on the server to Internet access. Your last advise is probably also helpful to open up LDAP Servers in a local network - since they need to be accessible too. – theXs Dec 8 '12 at 10:34
@theXs Well, because you're still trying to reverse proxy LDAP on the wrong ports from the sounds of things. Great that you're going to set up a reverse proxy with IIS, but if you're not using it to handle the right ports, it's going to be as much good as a cup on your head, regardless of whether or not this is a production environment or test lab or whatever else. – HopelessN00b Dec 9 '12 at 13:32

Your command has -s :389 in it, which is the incorrect use of that syntax. You should use the server name of the DC that you want to run the query against there. For example: dsquery user -name m* -s DC01 -u -p

Also, -u -p like that is not valid syntax, but I'm assuming you intentionally omitted the username and password.

share|improve this answer
Well, I can't use the server name since I'm trying to connect over the internet with that specific server. I think I need to use the ip address in order to identify the server? Once I use the command with -s localhost:389 - it works flawlessly. – theXs Dec 7 '12 at 17:45
That would work as well. Do you have an AD exposed directly on the Internet? That's a really bad idea if you do. – MDMarra Dec 7 '12 at 17:46
I don't think it's accessible via Internet right now(hence my question). The server with the Active Directory is some sort of a playground. I wanted to access this host in order to prepare myself for some upcoming tasks with another ( this time, local Active Directory Server ). I would use the IIS as an Reverse Proxy. – theXs Dec 7 '12 at 17:49
I'm sorry, that doesn't really make sense to me. – MDMarra Dec 7 '12 at 19:12
I'm not sure on how you plan to secure AD behind a web proxy, but your environment doesn't sound like it's really designed well. Your AD should be on an internal private network and if you need access to it, you should be using a VPN. – MDMarra Dec 7 '12 at 20:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.