A Microsoft technology for sharing one set of user accounts, security permissions, and management information across many Windows servers and desktops.

learn more… | top users | synonyms (2)

2
votes
3answers
87 views

What should happen when I browse to my Windows domain name via UNC?

A while back I setup a DFS namespace \\my.dom.com\somecrap. Its working great, but I've always notice something that confused me and I never asked about it. When I just browse to \\my.dom.com it ...
1
vote
1answer
20 views

Gpresult provides wrong output on vista machine regarding UAC settings

I have two workstations running Windows 7 Professional 64bit with SP1 and Windows Vista Business 32bit with SP2. Both are in the same OU and have a GPO linked named Hardening_Computers_Clients. This ...
0
votes
2answers
40 views

Connecting AD to multiple networks. Use firewall rule or dual NIC?

We want to connect our AD to multiple networks. There is a firewall between these networks. I wanted to find out if it is best practice for us to open up a firewall rule for the DNS/AD or to connect ...
0
votes
1answer
26 views

Does Active Directory uses LDAP natively?

I was asked to use LDAP over SSL (LDAPS) in our domain. Does it require any change in AD itself? Does AD use LDAP natively? Or is it something need to be done in application level that approach AD ...
24
votes
4answers
1k views

Should I still have a physical DC, even post-Server 2012?

Back in the pre-Windows Server 2012 days, the recommendation seemed to be to have at least one physical domain controller sat along-side your virtualised DCs. One justification for this was because ...
0
votes
0answers
43 views

Unable to join PCs / Servers to domain. Had been working

I have a virtual host running 4 VMs, one of which is the Domain Controller. All of them are joined to the domain, as well as another virtual host, and 1 workstation. I went to add another domain ...
-1
votes
0answers
25 views

How to create an Active Directory restricted user for binding only

I keep reading in different man pages that I should only be binding with a user credential that has 'bind only' permissions and no administrative permissions on the domain. How do I create this locked ...
1
vote
2answers
20 views

“dsconfigad: Invalid credentials supplied for binding to the server” when baking in password

I am using apple remote desktop to try to bind our macs to the AD. Every time I get the error dsconfigad: Invalid credentials supplied for binding to the server. dsconfigad -add domain.com -computer ...
-2
votes
0answers
13 views

Push updates to Active Directory to Samba client

I have FreeNAS 9.2 connected to Active Directory on Server 2011 with Samba to handle CIFS file shares. However, when I add or update a user in Active Directory, it appears to take hours for the change ...
2
votes
0answers
34 views

Kerberos KDC has no support for encryption type while getting credentials

I am configuring an apache/SSO authentication with an AD with Kerberos. My http server is a Debian Wheezy and the AD is a Windows Server 2012. I generated keytabs files on WS2012 with kpass command ...
0
votes
0answers
17 views

LDAP Browser(Softerra) vs LDP.exe

Here is the issue; -> There is a Deny All(FullControll) set on 2 OUs for a service account. -> When i use LDP.exe to query those OUs, it can read their names but can not display any objects ...
1
vote
2answers
45 views

Suitable AD Structure - Users by Org, Devices by Network?

I am working on my first AD structure design and I have read quite a few documents on best practices and most of them say to build users by company org and devices as they would pertain to GP. Our ...
-1
votes
1answer
51 views

Ldap Active directory checking (and securely storing it) user provided password [closed]

Hey all I am needing to know if it is possible to check a users typed in password against the AD to make sire it's the correct password? Reason being is that once they log in I need to use their user ...
2
votes
2answers
52 views

Restrict user account to 'only' remote Powershell sessions

Is it possible to only delegate a enough permissions for a user to only be able to utilize a Remote Powershell session? I have a limited set of scripts that I want to run from a central location ...
0
votes
0answers
24 views

DFS Namespace is inaccessible when DC4 is up and running

DC1, DC2 and DC3 are at site A. DC4 and DFS server (2008 R2) are at Site B. DC4 is Server 2003 and not a Global Catalog. DC1, DC2 and DC3 all are Server 2003, FSMO role holders and a Global Catalog. ...
-1
votes
1answer
51 views

How can I host active directory from Amazon EC2? [closed]

I know EC2 pretty well, but I'm totally new to Active Directory. I'm trying to set up a computer hosting Active Directory on EC2. I want to be able to join the domain from computers running on EC2, ...
0
votes
1answer
20 views

giving AD users shared email account

I have a microsoft platform, with active directory and exchange. Normally, all AD users are assigned mailboxes associated to that userid. Our organization employs many transient personnel, who come ...
2
votes
0answers
22 views

need to migrate single label domain name

Our company has 8 sites, all on different subnets and connected via (slow) MPLS, and about 250 users in AD, and Exchange 2007. The current infrastructure was put into place prior to me coming on ...
0
votes
0answers
62 views

Nslookup not working in Active Directory on Windows Server 2012 R2

A few days ago, a colleague had to hard reset one of our servers runnning Windows Server 2012 R2. This server is in our Active Directory and has two DNS servers configured. After that reset, the ...
0
votes
0answers
14 views

using icacls to set traverse/execute without setting change permissions

I'm having trouble with network shares. Specifically with mac clients accessing home shares on a NAS. The fix has been to remove certain permissions on the Library folder. in the past, i've used ...
0
votes
1answer
32 views

how to translate an Active Directory group into a NIS netgroup?

The goal is to be able to add + : @DL-MyCompany-MyTeam : ALL to /etc/security/access.conf and have it work as expected. This is my sssd.conf: [domain/default] cache_credentials = True [sssd] ...
1
vote
0answers
17 views

Event 2042 - Replication-Error Lies?

On a windows 2008 R2 server, in the Event Viewer under Applications and Services logs > Directory Service I'm getting the following error twice an hour: Invocation ID of source directory server: ...
0
votes
1answer
34 views

Windows Server 2012 - GPO settings - Security Filtering and “Authenticated Users” confusion

So I want to add a GPO for a few computers at first then deploy this rule to all computers when everything is confirmed OK on the test systems. I am having troubles getting the GPO to deploy to only ...
2
votes
2answers
44 views

Can you run Active Directory 2008r2 on Windows Server 2012?

We are upgrading all domain controllers to Windows Server 2012. But we have some legacy systems which won't work with Active Directory past 2008r2. Is it possible to run AD 2008r2 without any 2008r2 ...
1
vote
0answers
12 views

ad lds create buildin administrator

I created an Administrator user in AD LDS but cannot login with it. I used ADSI Edit to create a user CN=LDSAdmin,CN=Admin,O=MyCompany,C=CH and added it to the build in group ...
1
vote
0answers
55 views

Security considerations for AD one way trust from DMZ to corporate LAN

I am a Sharepoint developer and have been asked to deploy a Sharepoint server within a DMZ which will be accessed from a corporate LAN. Currently the DMZ has public IP's (which are protected by a ...
0
votes
2answers
38 views

Active Directory Multi Domain Enviornment

I work for a small organization which will be starting another branch of business here shortly. We have an existing active directory infrastructure and are looking to add another domain to the ...
0
votes
1answer
36 views

Protecting AD object from being accidentally disabled?

If I set a "Deny" type permission to the "Everyone" well-known principal, in the "Write userAccountControl" property of an AD Object, like a User, it works kind of the same as the "Protect the object ...
2
votes
1answer
59 views

How to hide running logon scripts from users (.vbs) without using a wrapper script?

I have a GPO (configured with loopback replace) that runs a logon script (.vbs) and linked it to an OU containing a W2012R2 RDS host. I have made these (question related) changes to the policy: ...
0
votes
0answers
9 views

configure realmd to allow login without domain name

Is it possible to configure realmd to allow users to login via a domain without specifying it? I've used the "fully-qualified-names = no" option so that usernames don't show the domain name, but they ...
0
votes
1answer
57 views

'realm join --client-software sssd' on centos-7 joins two realms (one with sssd and one with winbind)

On clean installed centos-7 host: realm join -U foo --client-software sssd AD.EXAMPLE.COM After running realm list output looks initially like this: AD.EXAMPLE.COM type: kerberos realm-name: ...
1
vote
3answers
34 views

nslookup shows wrong data

I am currently an administrator and have about 150 windows systems running. The previous administrator turned out be be a real nightmare for me before he left. The network assignes some windows ...
1
vote
1answer
72 views

File extension .QCOW2 on Windows [closed]

While I was researching for solution, I saw the file extension could have something to do with vmware, thats why I am asking my question here. I would like to know how, what software should I use, to ...
2
votes
1answer
23 views

How to handle (and test) hybrid multi-forest with Office365

Let's say we have two domains: contoso.com and fabrikam.com. Both have: two UPNs (.local and .com) Then: Contoso.com have Lync servers on-premise. Exchange, Sharepoint 2013 and Azure AD on ...
-1
votes
0answers
43 views

Kerberos Active Directory Domain Failure (uBuntu)

I try to join Active Directory and Samba 4 in Ubuntu 12.04.05. When I run host -t SRV _kerberos._udp.test.sg I get the error: Host _kerberos._udp.test.sg not found: 3(NXDOMAIN) meanwhile $# host ...
-1
votes
1answer
56 views

Can I replace local Microsoft Active Directory with AWS Directory Service?

We have a very basic AD usage (basically manage user password reset) and for that we have to maintain a old Windows server. All the services our internal users access are on the cloud (GMail, Google ...
-2
votes
1answer
35 views

Are the UID of users from a domain maintained locally in a machine?

This could be total nonsense but as I am new and am trying to learn. I came across this question. I have seen many of my office linux machines connected to some domain. I am wondering as if a ...
1
vote
1answer
32 views

What does a new user object in an AD domain have access to by default?

Background: An application requires that user objects be created to contain various users' information. These user objects exist for their data only, and the user objects should not be able to log in, ...
0
votes
0answers
28 views

Active directory creates network issues

I have an OpenStack virtualization environment, where I created 3 VMs using the same Windows Server 2012R2 image. Each machine is syspreped after initial deployment. My goal was setting up a simple AD ...
1
vote
0answers
45 views

ADFS 3.0 SSO Form authentication Issue - Subdomain not found under certain circumstances

Let me preface that I'm not near the server at the moment so I cannot give a direct readout of any error messages. We have implemented an ADFS 3.0 Server and are using Microsoft's included SSO ...
1
vote
2answers
34 views

Parse a copy of the SYSVOL

I have a full copy of a client's SYSVOL folder. The only DC on site had failed and been restored, but that got me wondering if there was a tool to look through a copy of the SYSVOL folder for ...
0
votes
0answers
26 views

Windows 2003 error 2902 “server is the owner of this FSMO role, but does not consider it valid” after DCPROMO run

I am in the process of adding a Windows 2008 R2 DC (MTC2008DC) to an existing legacy Windows 2003 SBS domain, with a view to decommissioning the old server. There is already one 2008 DC in the domain ...
0
votes
0answers
24 views

Configuring Separate Forest for DMZ

Our DMZ currently has just two Winddows Server 2008R2 servers in it. One runs Exchange 2010 Edge Transport and the other is an IIS 7 server. Currently, these are just in a workgroup. We plan to ...
0
votes
2answers
43 views

ldap query with nested group

I try to build a ldap query to MS Active Directory. I found that there is a LDAP_MATCHING_RULE_IN_CHAIN type to do so. Which results in the follow syntax: ...
2
votes
1answer
32 views

Changing default UPN for iPhone/ActiveSync seamless Setup: any downsides?

Setting up a brand-new domain and want to achieve ActiveSync/Autodiscover Nirvana: no certificate warnings, no having to enter in Server Names or Domains, just pure Contoso-like buttery bliss. Have ...
1
vote
1answer
33 views

Enabling LDAPS: Cannot get to open port 636

I have a domain controller, which has Active Directory (AD). I want to turn on LDAPS on this AD, so that I could access the AD via secure connection. I have followed the following guide: ...
0
votes
0answers
10 views

DFS Database Error

I am trying to setup DFS on 2 computers. I have successfully setup and created a replication group among the folders on each servers. The replication is not happening. On checking the logs i found ...
3
votes
1answer
49 views

ADFS Claim to Flatten Groups and Return full DN

Is there way to create a claim that will the return the DN of all groups and super-groups a user is a MemberOf? Currently running Windows 2012 R2 ADFS. Example: I have a structure of groups like ...
0
votes
1answer
50 views

Unable to join win 7 machines to a domain running Server 2003

I am fairly new to server administration, but have worked with computers a long time. I am experienceing a problem I have never had before; I am unable to join any new machines to the domain because ...
4
votes
1answer
84 views

ADFS - Restrict to AD Group

I just implemented an ADFS server to connect a third-party chat tool with our Active Directory via SAML 2.0. Everything works fine so far but there's a little problem: As soon as a user logs in, the ...