A Microsoft technology for sharing one set of user accounts, security permissions, and management information across many Windows servers and desktops.

learn more… | top users | synonyms (2)

134
votes
6answers
181k views

How can I find out what AD groups I'm a member of?

I'm running a Windows XP desktop in a corporate environment. How can I find out what AD groups I belong to?
107
votes
2answers
195k views

What is Active Directory Domain Services and how does it work?

This is a Canonical Question about Active Directory Domain Services (AD DS). What is Active Directory? What does it do and how does it work? How is Active Directory organized: Forest, Child Domain, ...
82
votes
9answers
515k views

Command line to list users in a Windows Active Directory group?

Is there a command line way to list all the users in a particular Active Directory group? I can see who is in the group by going to Manage Computer --> Local User / Groups --> Groups and double ...
77
votes
3answers
116k views

Is there a way to view the members of an Active Directory group if you aren't a domain admin and can't log into to a domain controller?

Is there a way to view the members of an Active Directory group if you aren't a domain admin and can't log into to a domain controller?
73
votes
6answers
157k views

Find name of Active Directory domain controller

How can I find out the name/IP address of the AD domain controller on my network?
72
votes
6answers
316k views

How can I figure out my LDAP connection string?

We're on a corporate network thats running active directory and we'd like to test out some LDAP stuff (active directory membership provider, actually) and so far, none of us can figure out what our ...
62
votes
5answers
19k views

Active Directory explained

If you had to explain Active Directory to someone how would you explain it?
56
votes
4answers
59k views

Windows Active Directory naming best practices?

After experimenting with Windows domains and domain controllers in a virtual environment, I've realized that having an active directory domain named identically to a DNS domain is bad idea (Meaning ...
38
votes
6answers
10k views

If a Windows shop moves “everything” to the cloud, does it still need Active Directory?

Taking a spin off of this question: Do I really need MS Active Directory? in a new direction for 2014. Taking into account a basic Windows infrastructure: domain controllers Exchange 2007/2010/2013 ...
35
votes
8answers
26k views

Should I expose my Active Directory to the public Internet for remote users?

I have a client whose workforce is comprised entirely of remote employees using a mix of Apple and Windows 7 PCs/laptops. The users don't authenticate against a domain at the moment, but the ...
34
votes
7answers
166k views

Disable password complexity rule in Active Directory

Where do I go to disable the password complexity policy for the domain? I've logged onto the domain controller (Windows Server 2008) and found the option in local policies which is of course locked ...
34
votes
1answer
1k views

What's the meaning of logging in as “username@mydomain.com:something”

My Windows 2008 R2 machine is joined to a domain. In the logon screen, if I type in "username@mydomain.com:something" as the username, I can still logon properly, what's the meaning of ":something" ...
31
votes
10answers
124k views

Group Policy installation failed error 1274

I'm trying to deploy an MSI via the Group Policy in Active Directory. But these are the errors I'm getting in the System event log after logging in: The assignment of application XStandard from ...
30
votes
7answers
14k views

Is it best practices to have separate login for a domain for domain admins?

I typically like to set up separate logins for myself, one with regular user permissions, and a separate one for administrative tasks. For example, if the domain was XXXX, I'd set up a XXXX\bpeikes ...
29
votes
6answers
151k views

Finding why a user is locked out in Active Directory

A user's account keeps getting locked out in Active Directory. It's probably caused by an app that's using Windows authentication to connect to SQL Server. Is there a way to find out which app is ...
28
votes
13answers
21k views

Do I really need MS Active Directory? [closed]

I manage a shop of arround 30 machines and 2 terminal servers (one production, one standby.) Should I really deploy Active Directory in our network? Are there any really benefits, that could ballance ...
28
votes
4answers
77k views

Any difference between DOMAIN\username and username@domain.local?

I'm trying to troubleshoot an obscure authentication error and need some background information. Is there any difference between how Windows (and programs like Outlook) process DOMAIN\username and ...
28
votes
4answers
5k views

Should I still have a physical DC, even post-Server 2012?

Back in the pre-Windows Server 2012 days, the recommendation seemed to be to have at least one physical domain controller sat along-side your virtualised DCs. One justification for this was because ...
27
votes
2answers
1k views

Why can a and o in samAccountName be replaced with danish å and ø?

A coworker just demonstrated to me that accounts in our test AD was able to authenticate when replacing every a character in their samAccountName with Danish character å (ASCII 134 / å). E.g. ...
26
votes
12answers
45k views

Active Directory: delete vs. disable departed employees [closed]

When an employee leaves your organization, do you delete or disable their Active Directory account? Our SOP is to disable, export/purge the Exchange mailbox, and then after "some time" has elapsed (...
25
votes
3answers
2k views

What features of Windows 8/8.1 Pro will not work without a Microsoft Account?

With respect to domain-joined Windows 8/8.1 Pro machines, what features of Windows will not work unless a Microsoft Account is used? Also, aside from "feature loss," are their any gotchas of not ...
25
votes
3answers
13k views

How are cached Windows credentials stored on the local machine?

How are cached Active Directory domain credentials stored on a Windows client? Are they stored in the local SAM database, thus making them susceptible to the same rainbow table attacks that local user ...
25
votes
0answers
1k views

What should I name my Active Directory? [duplicate]

Possible Duplicate: Windows AD Domain naming recommendations There are a lot of really screwed up configurations out there, because people didn't take a minute to sit down and think about ...
24
votes
5answers
16k views

Common wisdom about Active Directory authentication for Linux Servers?

What is the common wisdom in 2014 about Active Directory authentication/integration for Linux servers and modern Windows Server operating systems (CentOS/RHEL-focused)? Over the years since my first ...
24
votes
3answers
45k views

What should the order of DNS servers be for an AD Domain Controller and Why?

This is a Canonical Question about Active Directory DNS Settings. Related: What is Active Directory and how does it work? Assuming an environment with multiple domain controllers (...
23
votes
4answers
143k views

How to delete domain user profile from a computer?

I'm wondering how to safely remove a domain user profile from a computer that is a part of a domain. I don't want to delete the account from the domain itself, I just need to remove the profile from ...
23
votes
4answers
219k views

How to find time server in a domain?

In a Windows domain PDC isn't necessarily the domain time server. How could I identify the authoritative time server?
23
votes
4answers
3k views

Active Directory Health Checks

I've had some Active Directory troubles lately was was wondering what checks I could do on a regular basis I could do to ensure everything is working optimally?
23
votes
3answers
17k views

What is Group Policy and how does it work?

This is a Canonical Question about Active Directory Group Policy Basics What is Group Policy? How does it work and why should I use it? Note: This is a Question & Answer to new administrator ...
23
votes
7answers
22k views

Is there an equivalent of SU for Windows

Is there a way (when logged in as an administrator, or as a member of the administrators group) to masquerade as a non-privileged user? Especially in an AD environment. e.g., in the Unix world I ...
23
votes
6answers
107k views

How to allow active directory users to remote desktop in?

This is my first time setting up or even using active directory. I set it up, and added the computers(Actually VMs in Hyper V) to the active directory, and if if I use hyper-V to connect to the VMs, ...
22
votes
6answers
2k views

What causes a workstation to lose trust with the domain controller?

I've received the error several times on Windows 7 Workstations and Laptops where it loses trust with the domain controller, and I know how to fix it, but why does it do that?
21
votes
4answers
4k views

Accidentally deleted entire Active Directory [closed]

While re-partitioning a Server 2003 R2 domain controller, we accidentally deleted the partition that held the Active Directory database folder (D:\AD\Data). The D:\ was a partition on a disk shared ...
21
votes
6answers
6k views

Can windows domain controller be virtualized?

Just the question on the title. There is any problem? Any experience on this?
21
votes
6answers
78k views

last time an AD user has logged in?

I've noticed that we have in Active Directory more users than the company has actual employees. Is there a simple way to check multiple Active Directory accounts and see if there are any accounts that ...
21
votes
6answers
36k views

Choosing local versus public domain name for Active Directory [duplicate]

What are the pros and cons of choosing a local domain name such as mycompany.local versus a publicly registered domain name such as mycompany.com (assuming that your org has registered the public name)...
21
votes
3answers
21k views

How to use Google Apps as an OD/AD/LDAP Provider

I see tons of solutions for allowing Google Apps to use external AD and LDAP services for login. However, I already have a ton of users setup in Google Apps already, and I'm trying to go the other ...
21
votes
2answers
5k views

Authenticating OpenBSD against Active Directory

Edit: Reformatted this as Q&A. If anyone can change this from Community Wiki to a typical question, that's probably more appropriate as well. How can I authenticate OpenBSD against Active ...
20
votes
1answer
1k views

How to time-bomb a GPO?

I am doing a lot of work in higher education where it is a rather common requirement to reconfigure a number of Windows domain members (e.g. PCs in a classroom) for the duration of a specific course ...
20
votes
2answers
1k views

HALP! I've inherited a permissions nightmare for redirected folders/home directories

My new employer has folder redirection setup for its hundreds of users, and the person who set it up didn't really know what he was doing. As a result, the best practices for permissions on ...
19
votes
10answers
125k views

Get list of AD groups a user is a member of

Suppose I have the user id of a user in Active Directory. I'd like to get a list of all AD groups in which that user is currently a member of. How can I do this from the Windows command line? I've ...
18
votes
3answers
8k views

Naming a new Active Directory forest - why is split-horizon DNS not recommended?

Hopefully, we all know what the recommendations for naming an Active Directory forest are, and they're pretty simple. Namely, it can be summed up in a single sentence. Use a subdomain of an existing,...
18
votes
2answers
23k views

How does a client system in an Active Directory network find in which site it resides?

As I was putting together a presentation for beginning Windows administration, I was struck with a question that I'm amazed I haven't asked sooner. I know that: AD is logically setup in sites to ...
18
votes
4answers
31k views

How does SSO with Active Directory work whereby users are transparently logged in to an intranet web app?

I'm told that it's possible to make a web application that does not require a login. The user logs in to Windows, which authenticates via an Active Directory (LDAP) Lookup. Then, they should be able ...
18
votes
3answers
49k views

Force authenticated user immediate logoff (emergency case)

In Active Directory if you want to prevent a user from logging in you can either disable their account or simply reset their password. However, if you have a user who is already logged in to a ...
18
votes
1answer
38k views

How is DNS related to Active Directory and what are some common configurations that I should be aware of?

Please note that I do know the answer to this and have provided one below. I see a lot of newer systems administrators that don't understand the contents of my answer, so I hope that all of the ...
18
votes
2answers
9k views

Setting Mercurial with Active Directory authentication and authorisation

I am evaluating the possibilities of moving my organisation to Mercurial, however I am stumbling on two basic requirements which I can't find proper pointers to. How do I set up Mercurial's central ...
18
votes
3answers
7k views

How do I delete this orphaned Active Directory computer object (preferably with PowerShell)?

I'm working from a Windows 7 workstation, with PowerShell v2.0, and trying to delete a particular (orphaned?) object from the LostAndFound container in a 2008 R2 FL forest and domain with the Active ...
17
votes
4answers
77k views

How to create Active Directory user account with powershell

I am constantly setting up research and development environments that require active directory accounts. Since we place these environments in isloated networks each environment needs its own active ...
17
votes
1answer
33k views

What does the downwards arrow symbol on a User mean in Active Directory

I have created a user account called "MyUser" via Powershell, and the icon graphic in active directory different to that of the user test that I create via the UI. The scripted one has a circle ...