A Microsoft technology for sharing one set of user accounts, security permissions, and management information across many Windows servers and desktops.

learn more… | top users | synonyms (2)

51
votes
4answers
50k views

Windows Active Directory naming best practices?

After experimenting with Windows domains and domain controllers in a virtual environment, I've realized that having an active directory domain named identically to a DNS domain is bad idea (Meaning ...
104
votes
2answers
183k views

What is Active Directory Domain Services and how does it work?

This is a Canonical Question about Active Directory Domain Services (AD DS). What is Active Directory? What does it do and how does it work? How is Active Directory organized: Forest, Child ...
23
votes
3answers
38k views

What should the order of DNS servers be for an AD Domain Controller and Why?

This is a Canonical Question about Active Directory DNS Settings. Related: What is Active Directory and how does it work? Assuming an environment with multiple domain controllers ...
12
votes
2answers
4k views

Website and Active Directory domain share the same name

In our network the name of the network domain is also the domain of the organization's website (say, example.com). Externally, people can enter example.com to visit our website, but internally, this ...
18
votes
3answers
7k views

Naming a new Active Directory forest - why is split-horizon DNS not recommended?

Hopefully, we all know what the recommendations for naming an Active Directory forest are, and they're pretty simple. Namely, it can be summed up in a single sentence. Use a subdomain of an ...
27
votes
6answers
131k views

Finding why a user is locked out in Active Directory

A user's account keeps getting locked out in Active Directory. It's probably caused by an app that's using Windows authentication to connect to SQL Server. Is there a way to find out which app is ...
21
votes
6answers
35k views

Choosing local versus public domain name for Active Directory [duplicate]

What are the pros and cons of choosing a local domain name such as mycompany.local versus a publicly registered domain name such as mycompany.com (assuming that your org has registered the public ...
61
votes
5answers
18k views

Active Directory explained

If you had to explain Active Directory to someone how would you explain it?
36
votes
6answers
8k views

If a Windows shop moves “everything” to the cloud, does it still need Active Directory?

Taking a spin off of this question: Do I really need MS Active Directory? in a new direction for 2014. Taking into account a basic Windows infrastructure: domain controllers Exchange 2007/2010/2013 ...
21
votes
6answers
6k views

Can windows domain controller be virtualized?

Just the question on the title. There is any problem? Any experience on this?
25
votes
0answers
1k views

What should I name my Active Directory? [duplicate]

Possible Duplicate: Windows AD Domain naming recommendations There are a lot of really screwed up configurations out there, because people didn't take a minute to sit down and think about ...
22
votes
4answers
14k views

Common wisdom about Active Directory authentication for Linux Servers?

What is the common wisdom in 2014 about Active Directory authentication/integration for Linux servers and modern Windows Server operating systems (CentOS/RHEL-focused)? Over the years since my first ...
15
votes
5answers
3k views

Mercurial (hg) with active directory

Can I setup Mercurial to authenticate users on Active Directory? In my case, hg can run on Windows, Linux or FreeBSD, but I need to use AD users. Note: if it is possible, then please point me to a ...
22
votes
7answers
20k views

Is there an equivalent of SU for Windows

Is there a way (when logged in as an administrator, or as a member of the administrators group) to masquerade as a non-privileged user? Especially in an AD environment. e.g., in the Unix world I ...
5
votes
2answers
4k views

Migrate user accounts from Azure AD to on-premise AD?

My company uses Office 365 for Exchange, SharePoint, Lync etc. including the build-in user administration via Azure Active Directory. Now we want to switch to a local AD on a Windows Server. It shall ...
4
votes
4answers
11k views

My public website name and AD domain name are the same. How can I get to my external website from inside my network?

I am using my domain example.orgin my firm. I can use www.example.orgto view my website. If I try http://example.org from outsite my firm there is no problem, but if I try it from inside, my windows ...
14
votes
3answers
7k views

Removing old computers on a domain

The Windows Domain I manage has hundreds of computer names which I don't recognise and I'd like to remove old ones which aren't in use before trying to track down the misnamed ones. Is there someway ...
28
votes
13answers
19k views

Do I really need MS Active Directory? [closed]

I manage a shop of arround 30 machines and 2 terminal servers (one production, one standby.) Should I really deploy Active Directory in our network? Are there any really benefits, that could ballance ...
15
votes
1answer
21k views

What needs to be done after a Domain Controller crash?

Assuming that at least two domain controllers were present in the domain to start with, what steps need to be taken to make Active Directory healthy after a domain controller crash?
9
votes
5answers
7k views

Active Directory: Is it required that the “A” record for a domain point to a Domain Controller?

Currently we have an Active Directory setup, and say the name is 'domain.com'. The DNS entries for domain.com has two A records pointing to the two domain controllers. I would like internal users to ...
13
votes
4answers
26k views

Restrict access to IIS site to an AD Group

Is it possible in IIS to set up a site in IIS and only let users of a certain AD Group get access to it?
4
votes
3answers
909 views

Active Directory in the cloud

My company is considering implementing Active Directory and Windows Server to manage our local network and workstations. The main benefits sought are central management of machines, security ...
3
votes
2answers
2k views

things to check prior to moving all FSMO roles to a new domain controller before decommission original old domain controller

need to move a domain controller, the first in the forest that holds all the fsmo roles, to another location in a clients building. it will require turning off this dc, call it dc1 for this question. ...
3
votes
3answers
4k views

Issues with using real domain for Active Directory domain?

Is there any reason why I shouldn't use example.com as my AD domain versus example.local or some other non-existant variant?
22
votes
3answers
14k views

What is Group Policy and how does it work?

This is a Canonical Question about Active Directory Group Policy Basics What is Group Policy? How does it work and why should I use it? Note: This is a Question & Answer to new ...
33
votes
8answers
21k views

Should I expose my Active Directory to the public Internet for remote users?

I have a client whose workforce is comprised entirely of remote employees using a mix of Apple and Windows 7 PCs/laptops. The users don't authenticate against a domain at the moment, but the ...
17
votes
4answers
73k views

How to create Active Directory user account with powershell

I am constantly setting up research and development environments that require active directory accounts. Since we place these environments in isloated networks each environment needs its own active ...
8
votes
6answers
18k views

How can I have a Linux machine join a Windows Domain?

Sorry if I am misusing terms here; I actually don't know much about Active Directory and the related technologies. Basically I have a Linux computer and I'd like it (or my user on that computer) to ...
17
votes
3answers
39k views

Force authenticated user immediate logoff (emergency case)

In Active Directory if you want to prevent a user from logging in you can either disable their account or simply reset their password. However, if you have a user who is already logged in to a ...
7
votes
13answers
18k views

Windows: Can domain controllers also serve other functions?

This question was a discussion about whether Active Directory is necessary to run Terminal Services. But a chain of answers and comments (mostly by me) brought up a related question around Domain ...
2
votes
3answers
2k views

running Samba Active Directory Server on Windows desktop (for developing)

Huh, I completely confused by others editing my post... breaking all system of referencing and linking into a mess... Bifurcating the question (1) Can anybody share experience and/or links on ...
28
votes
10answers
112k views

Group Policy installation failed error 1274

I'm trying to deploy an MSI via the Group Policy in Active Directory. But these are the errors I'm getting in the System event log after logging in: The assignment of application XStandard from ...
20
votes
2answers
5k views

Authenticating OpenBSD against Active Directory

Edit: Reformatted this as Q&A. If anyone can change this from Community Wiki to a typical question, that's probably more appropriate as well. How can I authenticate OpenBSD against Active ...
15
votes
10answers
132k views

Best way to find the computer a user last logged on from?

I am hoping that somewhere in Active Directory the "last logged on from [computer]" is written/stored, or there is a log I can parse out? The purpose of wanting to know the last PC logged on from is ...
12
votes
7answers
39k views

VPN Connection causes DNS to use wrong DNS server

I have a Windows 7 PC on our company network (which is a member of our Active Directory). Everything works fine until I open a VPN connection to a customer's site. When I do connect, I lose network ...
5
votes
3answers
6k views

Active Directory in a DMZ

What is the best way to manage user accounts for Windows servers in a DMZ? We are expanding our web presence and adding several IIS servers to our DMZ. I would prefer not to manage a bunch of local ...
4
votes
2answers
16k views

Active Directory Time Synchronisation - Time-Service Event ID 50

I have an Active Directory domain with two DCs. The first DC in the forest/domain is Server 2012, the second is 2008 R2. The first DC holds the PDC Emulator role. I sporadically receive a warning ...
11
votes
4answers
2k views

Windows Domain replication monitoring tool

I am looking for web-based interface GUI, or some kind of monitoring tool that will show replication status for a domain. I know I can use repadmin with various options on the command line to query ...
8
votes
3answers
3k views

How is software deployed via Active Directory?

What are the steps required for deploying a software package via Active Directory / GPO?
4
votes
8answers
6k views

Suggestions for using Active Directory credentials (user name/password) with Google Apps?

I run a small college network with approximately 150 user accounts both in my Active Directory and in Google Apps. I'm looking to link AD with G-Apps. Currently my users are required to maintain ...
11
votes
5answers
39k views

How can I clear cached domain credentials?

Related: How can I enable domain authentication over wireless in Windows 7/2k8? To test the domain login over wireless connection feature I'm trying to set up in the above question, I need an ...
7
votes
3answers
5k views

Combined NFS, Samba server w users from Active Directory

I want to build a server that exports user home directories over SMB/CIFS and NFS. This server would be joined to a Win2k3 AD domain controller that holds our user database. As I understand it, ...
4
votes
1answer
2k views

Mounting windows shares with Active Directory permissions

I've managed to get my Ubuntu (server 10.04 beta 2) box to accept logins from users with Active Directory credentials, now I'd like those users to access their permissible windows shares on a W2003 R2 ...
11
votes
2answers
9k views

Is there a way to refresh computer group membership without rebooting?

I am using Windows Server 2008 R2 and have a windows service running under "network service" account in computer ComputerA. This windows service want to access a share folde (on another computer ...
7
votes
3answers
5k views

How to clean up orphaned SID's in ACEs in AD?

As a follow up to my question Do backlinks clear in AD for deleted users I have another related but different question. Since I am informed in the answers there that a deleted object's SID (Group or ...
7
votes
6answers
4k views

Active Directory OU design for <500 users, 4 locations

We are looking to add some logical structure to our (Win 2003) AD hierarchy. We have a single domain and around 500 users. All users and computers are currently organized into one OU. All security ...
5
votes
5answers
7k views

OpenVPN with Active Directory integration

Is anyone successfully running OpenVPN with Active Directory integration? Are you using the openvpn.net or the openvpn.net/opensource version of OpenVPN? Any tips, tricks or gotchas or did it "just ...
8
votes
2answers
2k views

What is the best way to allow a domain user to start and stop services on the machine?

What is the best way to allow a domain user to start and stop services on the machine? The domains user cannot be made admin.
7
votes
3answers
20k views

What happens when a computer joins an Active Directory domain?

What changes are applied to a client when it joins an AD domain? How is a domain member supposed to behave when disconnected to the network? Are users able to login? Will domain user policies still ...
3
votes
1answer
1k views

Avoiding shared accounts on an Active Directory environment

Is it possible to somehow force that one and only one account (in the case the account is shared) is logged to an Active Directory environment at any moment? What we want to do is to discourage the ...