A Microsoft technology for sharing one set of user accounts, security permissions, and management information across many Windows servers and desktops.

learn more… | top users | synonyms (2)

0
votes
0answers
5 views

Copy data from Azure AD to vm AD?

Currently I only have Azure AD that work with Office 365. Now I am planning to create a vm to use RADIUS server. I need to copy user and groups from Azure AD to vm AD. So, how can I do that? I read ...
-1
votes
1answer
41 views

How do you “prevent powerful accounts from being used on unauthorized systems”? [on hold]

I was browsing through Microsoft's Best Practices for Securing Active Directory and saw the chart linked which includes some of the best practices included in the document, rated by importance. At ...
4
votes
1answer
32 views

Powershell - Merging Results in one table

I am new to powershell. I am trying to create a report that shows AD accounts that expire soon. The report should include the User Name, AccountExpirationDate and the Manager. I have the ...
1
vote
1answer
18 views

csvde to find 1 user based on SamAccountName

I want to use csvde to find 1 user based on SamAccountName and export all the details about that person to a CSV file. The problem I am having is filtering by SamAccountName csvde -f search.txt -p ...
2
votes
2answers
40 views

How to clone, disjoin & rename a Windows 2008 R2 VM offline, then rejoin domain online

I have a Windows 2008 R2 domain joined server, which should be cloned as test server in the same domain! There is an MSSQL 2012 instance and Team Foundation Server 2013 installed, but this shouldn't ...
0
votes
1answer
21 views

AD FS and DC on same Server

i have to connect AD with Azure AD but we have a 2008 r2 server and wwe don`t want to upgrade the server to 2012 r2. Is it possible to have the domain controller and the ADFS server on the same ...
1
vote
0answers
38 views

How do I workaround inaccessible DCs in a spoke site, in a hub and spoke configuration?

I have a Hub and Spoke configuration. The spokes can never see another spoke. SCOM is reporting errors that GPO can't access \company.com probably because every Domain Controller has an NS record, ...
3
votes
1answer
25 views

Integrating FreeIPA or RH IdM in an existing MS AD environment

I want to deploy FreeIPA or Red Hat IdM in my existing environment Currently my domain is managed by MS AD which is controlled by a separate group. Assume that changing anything in MS AD is going to ...
0
votes
0answers
17 views

Clients not authenticating with RODC - nltest gives SERVICE_NOT_ACTIVE

I am new to the Windows world and pretty much followed the guide from this Windows Server Blog For the life of me I can not get clients to authenticate with the RODC. When I have the on-site RWDC ...
4
votes
1answer
109 views

sAMAccountName used for logged on users

When RDP'd to a server I'll often find that there are no available sessions as there are users currently logged in. Within our environment we utilise a user privilege management solution which creates ...
0
votes
3answers
35 views

Active Directory Export GPO user

I would like to get in .csv (or any other readable format) all my AD users and the policies that they need to comply (the type of authentication each user needs, his event logging properties and even ...
1
vote
2answers
50 views

How to setup a Domain Controller in the cloud

We are implementing a new Windows Server 2012 R2 domain controller for our 2 small offices, and we want to set it up on Amazon EC2. I have read that with this type of setup you normally use a VPN. How ...
1
vote
1answer
29 views

Deleted GAL in EMC and ADSIEDIT now Error

I attempted to delete a Global Address List via Exchange Management Console and ADSIEDIT as I made a typo during the creation. Now when I try to create a new GAL, i get the following error [PS] ...
1
vote
1answer
33 views

Accessing local groups remotly for a Windows Fileshare where user accounts are on an AD

I am asking this question with almost no knowledge of Windows and Active Directory. I have a Windows Server (2012), that I am using as a file server (FILE01.domain.tld). There are some local groups ...
5
votes
1answer
46 views

Windows 7 login issues

I have one user who has been having this issue I have never seen before. She is always having issues starting up her machine, such as Windows getting stuck on welcome screen after logging in, or stuck ...
0
votes
0answers
16 views

Removable Storage User Configuration Group Policy not working when Windows Server 2008 R2 is used as a client

I have enabled read write restriction for a group of users, if a user from this group is to log onto a win 8.1 system or Windows 7 system and tries accessing a USB drive it says access is denied, ...
1
vote
2answers
33 views

Server 2008 R2 > 2012 Migration

I am pretty new to windows server so please bare with me, i am looking to upgrade our current small server from server 2008 rs to windows server 2012 essentials, however we are only using one server ...
3
votes
1answer
27 views

Why does a SPN on a different host cause a server to lose its trust? How should I fix it?

I have a brand new server image that loses its trust as soon as it's joined to the domain. I suspect it's because of the duplicate SPN I discovered using the LDAP version of this Powershell script ...
7
votes
1answer
53 views

Exchange Server Using Wrong Active Directory Site

Our Exchange 2013 server suddenly started logging errors about bad replication between sites (there should be no replication as there is no other server) as well as several other issues that appear to ...
0
votes
1answer
33 views

Link server 2012 account picture with active directory

We have a Windows Server 2012 R2 remote desktop deployment, with a session collection consisting of 6 session hosts. We also use Office365 and DirSync to enable single sign on with ADFS running also. ...
5
votes
1answer
73 views

In Active Directory, how do I delegate write permissions on specific attributes of protected user accounts?

We have a tool being developed that will keep specific attributes of Active Directory user objects up to date with an authoritative source of employee information truth elsewhere, so that when ...
24
votes
3answers
1k views

What features of Windows 8.1 Pro will not work without a Microsoft Account?

With respect to domain-joined Windows 8.1 Pro machines, what features of Windows will not work unless a Microsoft Account is used? Also, aside from "feature loss," are their any gotchas of not using ...
5
votes
2answers
301 views

Is there a way to tell how long a machine has been in an security group?

Machines get added to a security group to prevent them from getting a GPO. I'd like the machines to get removed after 30 days of being in the group. Ideally, I'd like to also be able to generate a ...
1
vote
1answer
27 views

User blocked in AD by some windroid device

We have a user that is constantly blocked. We checked the logs in the domain controllers and all the information shown is that a WINDROID device is the source. How can I know which device is causing ...
0
votes
1answer
23 views

Adding additional 2008R2 DC to Window 2012 R2 domain

I am migrating our company's AD from a Windows SBS 2008 to a news Windows 2012 R2 Essentials server. Everything went fine and the new AD now is in production stage. The last step is adding an ...
0
votes
1answer
39 views

User logged in with temporary profile

User logs into a domain-joined Windows 7 Pro PC and gets the temporary profile error pop-up. Event 1511 User Profile Service in Event Viewer logs. Typically with this problem I delete a user's ...
0
votes
0answers
35 views

Would a duplicate DC on same subnet be bad, if ALL auth is only internal to the server?

Here's a weird scenario I'm looking for some guidance on. I have a VM that is a purpose-built "self-contained" demo environment. It has an application stack installed, as well as Active Directory, ...
0
votes
1answer
15 views

Moving site server (not PDC) into it's own new domain keeping current user accounts and permissions intact on file shares

I haven't been officially Microsoft trained so forgive my incompetence discussing what we want done and how to go about it. We currently have a MPLS style network hosting different sites which each ...
0
votes
1answer
24 views

2 Domains - 1 ADFS - 1 SharePoint - 1 Authentication way

I'm wondering if this if possible: I have 1 AD Domain: InternalDomain. I want to create a secondary domain: CustomersDomain. I would like my SharePoint to be able to authenticate users from both ...
0
votes
0answers
20 views

Powershell and dsget do not return full results when querying group membership

I'm trying to get information about group membership of certain users. Ultimately I want to automate this in some way but I'm having difficulty extracting the information at all. The problem is that ...
0
votes
0answers
12 views

AWS Directory Service compatibility with XenApp / XenDesktop

I have a question regarding AWS Directory Service compatibility with Citrix XenApp / XenDesktop. I am about to deploy a Citrix XenApp environment in AWS. A requirement for XenApp is a working Active ...
0
votes
1answer
32 views

Powershell AD Group creation script

I am making an AD Group creation script New-ADGroup -Name "CS-WS-PROD-Admin" -GroupCategory Security -GroupScope Global -Path "$OU" -Description "Admin Rights on PROD" -ManagedBy CS-WS-SAR-ADMINS ...
1
vote
1answer
37 views

How to fallback to out-of-site login server - ActiveDirectory

I pretty much spend all of my time on Linux\Networking however I am trying to set up a multi-site AD configuration. There is no root site or anything like that, I simply have two DCs in SiteA and one ...
0
votes
0answers
32 views

machine in domain is not accepting domain credentials

I have added a windows server 2008 (Virtual machine) into a domain. 1. The newly added machine properties shows the system name as systemname.domainname 2. The AD is listing the newly added machine ...
5
votes
3answers
173 views

In a Windows PKI, what is a Workstation Authentication CA Template used for? What happens if it expires?

Many workstations have an expiring computer certificate that was issued using the Workstation Authentication CA template. The CA of this template expires in 2 days. I've deployed a new CA, with an ...
5
votes
2answers
61 views

Is it possible for a schema change to not replicate, and a object that uses that schema arrive at a DC?

I'm trying to understand the risk of updating the schema of a very large AD forest, where the schema has not been on every DC, and then an object that uses that schema object is replicated An example ...
-3
votes
2answers
48 views

BYOD - AD Authentication Issues [closed]

I am a guy who brings his "own rig" to work. In this new gig I have to run some apps as a domain user provided. I shift + "right click" -> run as a different user and insert the domain credentials, ...
2
votes
2answers
59 views

Restrict access to active directory attributes from a particular computer?

I know that some attributes in AD are classified as personal information and some are classified as public information (see the "property set" column here - ...
0
votes
1answer
26 views

Official name for AD/LDAP targets

Say I have an AD user called flimflam that is "located" at OU=System, DC=fizzbuzz, DC=myorg, DC=com: What is the technical/appropriate verbiage for OU=System, DC=fizzbuzz, DC=myorg, DC=com? Location? ...
0
votes
1answer
34 views

find given subnet is overlapping in Active Directory subnet

i am looking for vb / power shell script. i need to check given subnet is overlapping with AD subnet or not. For eg. if i gave input as 192.168.2.0/24 subnet the script need to check this subnet is ...
0
votes
1answer
36 views

cloned windows 2003 Domain Controller wont let me add windows 2012 as member

I did a P2V of my Windows 2003 Domain Controller. I'm trying to add a Windows Server 2012 VM (Computer name: SQL-SERVER) as a member of the domain but I can't. I can ping to both VMs. I can do a ...
1
vote
0answers
33 views

cifs Required Key Not Available

I have joined to a zentyal domain (AD Domain) using PowerBroker IS and I want it to mount my remote home directories when a remote user logs in. this is the config for PBIS: AllowDeleteTo "" ...
0
votes
1answer
59 views

Fix unknown sid security groups

I have the following situation: my security groups of the active directory I'm belonging to are not shown anymore in a "friendly name", but I have just the SID. When I run whoami /groups I see a list ...
1
vote
1answer
23 views

When an Active Directory User Logs in to Local Windows 2012 Server Launch a Virtual Machine; Possible?

I won't get into the reasons why this needs to happen, however, is this possible. I have a Windows Server 2012 R2 box that needs to be used as a daily driver for a few of a clients employees. Ideal ...
1
vote
0answers
25 views

LSA SID cache keeps old entry for renamed domain user - why?

I have a question about LSA SID cache on a domain member server. Recently I run into the issue when some users after their name was changed in AD has difficulties accessing application I support, and ...
1
vote
1answer
38 views

Read Only Domain Controller not replicating after writable domain controller outage

I have a RO domain controller that replicates with a writable DC which is at another site. The other week the writable DC was out for about 2 days because of maintenance at that site. After this ...
2
votes
1answer
22 views

Retrieve “IP Phone” Attribute from AD for Exchange Disclaimer/Signature

I'm trying to build a company-wide signature in Exchange using the Transport Rules and Disclaimers. I'd like to include our Skype names as part of this signature. In ADAC, the closest field I could ...
0
votes
2answers
40 views

1. Adding printer share to file server 2. AD Account lock after changing password. WHY?

I have a mindbender that I am looking for help to solve. After changing my AD password my account keeps getting lock. I found the workstation that was sending the wrong password and locking me. The ...
5
votes
1answer
55 views

Child Domain Logons to Cross Forest Trust Domains

I have a cross forest trust between two Windows Server 2008 R2 domains/forests (domain and forest functional levels at Windows Server 2008 R2). Domains A and B are the forest root domains in their ...
5
votes
2answers
162 views

Active Directory Permissions: Delete vs Move

I want our help desk to be able to move user accounts but NOT delete them. Here is the summary of our current permissions set on the affected OU's (this DOES allow them to delete user accounts): ...