-1

I'm currently trying to query a remote Active Directory on a Windows Server 2008 R2. However, I'm not able to query the directory if I enter the following string in the cmd line:

dsquery user -name m* -s ip:389 -u -p

Furthermore, I tried to access the directory with:

ldap://: but it didn't work either.

I received the following error message:

The server is not operational.

Is there an option with which I can enable the remote access of an Active Directory?

I think there is a misunderstanding here: The Server which holds the active directory is a lone server, a playground, without any contact to sensitive informations. It's just a playground which is supposed to be formatted and redone after the testing.

1
  • 2
    Well, have you checked that you have all the basic needs fulfilled (network connection, correct service running, correct user rights etc)?
    – Sandokan
    Dec 7, 2012 at 17:42

2 Answers 2

3

Sounds like you're trying to do this over the internet, which is a really bad idea, per @MDMarra . AD should only be accessible from a private (non-publicly routed) network, or via VPNing into such a network. (As also mentioned by MDMarra, a reverse web proxy isn't going to protect AD, given that it doesn't travel over http ports or protocols. You are essentially playing contact sports and trying to protect your genitals by wearing the cup on your head.

Having said that, since you're trying this really ill-advised thing from over the internet, have you checked whether or not the firewall (the one I really hope sits on the edge of your network) allows LDAP and port 389 through to your Active Directory Domain Controller? It probably doesn't, and it shouldn't.

3
  • 1
    Quote of the week! ... "You are essentially playing contact sports and trying to protect your genitals by wearing the cup on your head." PMSL Dec 7, 2012 at 22:00
  • Would you be so kind to elaborate why I'm playing contact sport if I have this lone server, which doesn't have ANY connection to sensible data or other networks if I open up the local LDAP on the server to Internet access. Your last advise is probably also helpful to open up LDAP Servers in a local network - since they need to be accessible too.
    – theXs
    Dec 8, 2012 at 10:34
  • @theXs Well, because you're still trying to reverse proxy LDAP on the wrong ports from the sounds of things. Great that you're going to set up a reverse proxy with IIS, but if you're not using it to handle the right ports, it's going to be as much good as a cup on your head, regardless of whether or not this is a production environment or test lab or whatever else. Dec 9, 2012 at 13:32
2

Your command has -s :389 in it, which is the incorrect use of that syntax. You should use the server name of the DC that you want to run the query against there. For example: dsquery user -name m* -s DC01 -u -p

Also, -u -p like that is not valid syntax, but I'm assuming you intentionally omitted the username and password.

6
  • Well, I can't use the server name since I'm trying to connect over the internet with that specific server. I think I need to use the ip address in order to identify the server? Once I use the command with -s localhost:389 - it works flawlessly.
    – theXs
    Dec 7, 2012 at 17:45
  • That would work as well. Do you have an AD exposed directly on the Internet? That's a really bad idea if you do.
    – MDMarra
    Dec 7, 2012 at 17:46
  • I don't think it's accessible via Internet right now(hence my question). The server with the Active Directory is some sort of a playground. I wanted to access this host in order to prepare myself for some upcoming tasks with another ( this time, local Active Directory Server ). I would use the IIS as an Reverse Proxy.
    – theXs
    Dec 7, 2012 at 17:49
  • 1
    I'm sorry, that doesn't really make sense to me.
    – MDMarra
    Dec 7, 2012 at 19:12
  • 1
    I'm not sure on how you plan to secure AD behind a web proxy, but your environment doesn't sound like it's really designed well. Your AD should be on an internal private network and if you need access to it, you should be using a VPN.
    – MDMarra
    Dec 7, 2012 at 20:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .