Questions tagged [active-directory]
A Microsoft technology that constitutes an LDAP directory service with centralized management functionality for user accounts, computer accounts, groups, and configuration management across many Windows servers and desktops.
2,288
questions with no upvoted or accepted answers
3
votes
0
answers
1k
views
Is there any way to get an AD bound linux system to mount home directories from a Windows server?
We've been experimenting with integrating linux systems into what is largely a Windows domain, with a Windows-based Active Directory server. After considerable trial and error, we have successfully ...
- 485
3
votes
0
answers
699
views
Pushing RD Gateway Authentication to a 3rd Party
The company where I currently work have a mix of SaaS and older thick client applications, which customers still use, however they want these to be run offsite. As a result, we have a hosted platform ...
- 31
3
votes
0
answers
2k
views
Joining Ubuntu to Azure Active Directory - Insufficient permissions to modify computer account
Why am I being told I have insufficient permission despite my user being a member of AAD DC Administrators in Azure - Which I believe is the requirement for updating computer accounts
Followed the ...
3
votes
0
answers
7k
views
Active Directory Ports to be Allowed
What ports should be allowed in the firewall so that my workstations can access the Active Directory Server and have group policies pushed to the workstations.
The group policies are used to ...
- 131
3
votes
0
answers
852
views
PKI Authentication in HTTPD using Active Directory (LDAP)
In my environment, an external entity provides a Root CA & Intermediate CA(s). They issue thousands of smartcards with PKI certificates for authentication. They provide the Client Authentication ...
- 131
3
votes
0
answers
1k
views
UNC Path Issues: One Way Only
So I have an interesting issue where I have a stretched Server2012r2 domain (all servers running Server2012R2 and fully up to date) that spans two data centers; let's call them SiteA and SiteB. The ...
- 51
3
votes
1
answer
828
views
Hosting Active Directory over Azure VM to connect clients without vpn
We(a small organization) are deploying an Azure VM as Active Directory Domain Controller. Now we want to add clients to this active directory and looking at the network/connectivity solutions.
Have ...
- 31
3
votes
1
answer
150
views
Programmatically/remotely remove untrusted but "bound" Windows from Active Directory
Due to some mistakes, I have a lot of machines that seem to be bound to Active Directory (AD) from their side, but not from the side of the AD. The machines thinks they are still in the AD, but the AD ...
- 143
3
votes
0
answers
6k
views
Centos 7 SSSD based user access stops working after AD password change
We use SSSD to provide AD authentication, and kerberos TGT acquisition, on Centos 7.3 build 1611.
This works correctly for 99% of users most of the time, but we've hit an issue where post-password ...
- 31
3
votes
0
answers
795
views
Computers lose trust relationship - disappearing from domain controller
This happens very seldom but lately a computer lost the trust relationship with our domain so I wanted to reset the computer credentials.
Looking at my main DC (Server 2008 R2) I wasn't able to find ...
- 87
3
votes
0
answers
2k
views
GPO says Version Mismatch on Domain Controller when Versions appear to Match
On my primary domain controller, the AD and Syslog version of each of my GPO policies appears to match correctly:
However, when I run a Group Policy Results report, it says that their is an "AD / ...
- 363
3
votes
0
answers
2k
views
Constant Audit Failures in Event Viewer from Users not logged on
Let me start off with some details on my environment:
Windows Active Directory Domain Environment
Domain Controller: Windows Server 2003 R2
Problem Workstation: Windows 7 Professional 64-bit
Lately ...
- 31
3
votes
1
answer
719
views
Is having an IPv6 reverse lookup zone necessary for an Active Directory network?
Is having an IPv6 reverse lookup zone necessary for an Active Directory network?
Normally I would just create it and move on, however, in this case the prefix is delegated and changes occasionally. ...
- 2,081
3
votes
1
answer
350
views
Office 365 domain alias mail flow rule?
Is there a way to globally route incoming secondary domain mail to a primary domain for all users without having to list every possible combination of account alias and domain alias in each users AD ...
- 695
3
votes
1
answer
99
views
IT helpdesk - remote management of user profiles
I have a question. I wonder what is the best approach for managing user profile enviroment on their computers? For example if there is an task for administrator to solve a problem on users profile on ...
- 145
3
votes
0
answers
78
views
Backup, Modify and Restore of Active Directory
Is there an easy way to do a backup, modify and restore of an active directory instance?
More specifically, I'm looking to do a backup, then change all references of DC=foo,DC=com to DC=foo,DC=dev so ...
- 727
3
votes
0
answers
48
views
Workaround for Bloated Security Groups and Login Issue?
For each client, I have set up a main folder and service subfolders. These folders have Access-Based Enumberation (ABE) enabled and users belonging to the correct Security Groups (SGs) are able to ...
3
votes
1
answer
327
views
How can I join a machine to a domain with duplicate short-names in the same forest?
I have 4 Domains, 1 Forest Root, 3 children. The children are nearly replicas, and have their machines named the same in all 3 child domains.
For Example:
DC1.dev.example.com
DC2.dev.example.com
...
- 8,006
3
votes
0
answers
3k
views
No logon servers available to process your request
Edit: I've added new info in bold
I've got a Windows 10 Pro machine fully updated (Anniversary edition + 1607 update) joined to a Windows AD Domain (on Windows Server 2012).
This is a new install ...
- 1,624
3
votes
0
answers
175
views
Active Directory expired certs causing issues with 802.1x authentication
We are in the process of rolling out 802.1x in our environment. With that said, there are quite a few clients that revert back to an older (expired) certificate which prevents them from ...
- 31
3
votes
0
answers
31
views
W2K3 CA server gone offline, how to clean my AD?
We have decommissioned an old W2K3 DC server, on which was a CA installed.
The CA wasn't really used (no PKI infrastructure), just was here as a test.
After the server 's gone offline, I have several ...
- 183
3
votes
0
answers
2k
views
DHCP Server not responding to relayed DHCP DISCOVER
I'm currently segmenting our network in various subnets. We already have a DHCP server as a part of our Active Directory (Server 2012). I want to use this server for all subnets so I need to work with ...
- 246
3
votes
0
answers
66
views
Why can't I see the file version of files in system32 remotely?
Here's the situation:
I can RDP into a computer, go to C:\Windows\System32, and check file versions to my heart's content. Such as winlogon.exe, explorer.exe, etc.
If I map the drive, and try to ...
- 31
3
votes
0
answers
3k
views
Decrease Logon Timeout Seaching for Domain Controller
I've seen this same question asked on several other forums (and SE) with no definitive answer, so I'll try to explain as best I can so that anyone with info understands the problem:
AD Server
-...
- 2,277
3
votes
0
answers
147
views
Is it possible to use Active directory without a trust relationship for FreeIPA passwords?
I am looking to integrate FreeIPA with an Active Directory environment that I do not have full control over and most likely will not be able to get a trust relationship setup with my FreeIPA install.
...
- 71
3
votes
0
answers
196
views
Group Policy - Not automatically running on all machines
We are facing an issue on one of our domains where machines are not all running group policy refreshes at its default interval. I am not seeing the 1501 events logged in the system log, I occasionally ...
- 31
3
votes
0
answers
1k
views
Kerberos keytab file not working
I have two AD domains and I'm trying to use NFS with Kerberos to both of them. Part of the procedure requires creating keytab files for the host and nfs principals for the client and server ...
- 131
3
votes
0
answers
832
views
How can I programmatically unbind IPv6 from a network interface on a Windows 7 machine?
I need to unbind the IPv6 services from a number of client workstations running Windows 7. ("Untick" the selected box in the screenclip below.)
For what it matters, they currently all have a single, ...
- 54k
3
votes
0
answers
2k
views
Giving users of an OU permission to enable and disable users of their own OU
I want users of an OU to have access to enable and disable user accounts in their own OU.
I believe in order to do this I need to grant the Read and Write userAccountControl property to the SELF ...
- 4,253
3
votes
1
answer
4k
views
AD / SYSVOL Version Mismatch on Default Domain Policy
I've created two test VMs in VMWare, both Server 2012 R2 Standard. One was promoted to a DC, with the domain name being test2.local. I modified the DNS record on the other server, and joined it to the ...
- 266
3
votes
0
answers
575
views
I need help trying to authenticate with AD from my linux machine
I am not experienced in this, so there might be some points that I am missing. Initially I tried to setup Cyrus Mail w/ SASL for AD authentication. After several tries, it failed to work.
I switched ...
- 1,127
3
votes
1
answer
216
views
Use 2008 R2 and 2003 server domain and LDAP with Windows 8.1 and Windows 10?
I have two server domain one with Windows Server 2003 server and other Windows Server 2008 R2.
With this can I use Windows 8.1 and 10 clients to connect with domain and apply policies?
- 31
3
votes
0
answers
1k
views
Active directory filter to get all users on several AD locations without using groups
I'm required to use AD for authorization to some online tools to ease software development across three countries in a big international company.
The tools AD/LDAP section have one line to specify a ...
- 161
3
votes
2
answers
3k
views
IIS AppPools stop working when server joined to domain
I have a Windows 2012 R2 server that was configured with IIS, websites, and other supporting software while not connected to a domain. After the server was joined to a domain IIS AppPools crash when ...
- 131
3
votes
0
answers
1k
views
LDAP over TLS fails to connect, Schannel Alert 48
I am trying to use PHP to edit users in active directory through LDAP.
My test machine is using a simple WAMP setup and is NOT connected to the windows domain. This machine can connect to LDAP on the ...
- 31
3
votes
0
answers
107
views
Universal Group in domain not behaving as expected in multi-forest environment
I have an environment with 2 forests, F1 and F2 with a full, transitive, bi-directional trust between them. F1 has a single domain that holds an SSRS server. F2 has 2 domains, F2parent and F2child, ...
- 191
3
votes
1
answer
2k
views
Active Directory: Permissions to get Kerberos Service Ticket
I have an Active Directory with a KDC running on Windows Server 2012.
At the moment, every user can request service tickets for every service from the TGS. I'm looking for a solution where the KDC ...
- 31
3
votes
0
answers
1k
views
Exchange 2013 and AD/GC issues
I have Exchange 2013 (minimal install and all roles are on a single server) on-premises running on a Windows 2012 R2 server (both Windows and Exchange are patched and up-to-date). Basically this ...
- 308
3
votes
0
answers
51
views
Windows Server - Protect websites with AD user
My question is a bit tricky to explain :)
We have ASP.NET websites running on Windows Server 2012.
Some websites use SqlServer authentication, others use Windows authentication, some don't have any ...
- 129
3
votes
1
answer
2k
views
Adding multiple users from a group to an Active Directory group using Powershell
I have a powershell script that is supposed to go through a specific ou and store the groups into a variable $groups. Here is the code I use in the script:
$Groups = Get-ADGroup -Properties * -...
- 327
3
votes
1
answer
519
views
Fingerprint log on, domain wide
All the users in my company use laptops with fingerprint readers built in. I use this on my laptop but the fingerprint is only stored locally. Is there a way to make it domain wide using the AD ...
3
votes
0
answers
2k
views
Group Policy - Drive Mapping Preferences - slow login even if only using Computer Config side
We are having some users with very slow login times, up to 20 minutes, but only for a handful of users.
I've narrowed it down to a particular GPO that does nothing but Drive Mapping Preferences.
I ...
- 32.8k
3
votes
1
answer
15k
views
Error getting the list of sites from the target environment: An invalid dn syntax has been specified
Trying to add another (second) Domain Controller to an existing Domain. In the second step of "Active Directory Domain Services Configuration Wizard" getting the following error:
Error getting the ...
- 51
3
votes
1
answer
217
views
How do you fix Terminal Server when users are unable to surf to HTTPS websites?
One of the Terminal Servers has been plagued by an unusual HTTPS issue. After enough users have logged in and logged out, eventually users can no longer load HTTPS websites. It seems to only affect ...
- 31
3
votes
0
answers
83
views
Consolidating Domains from 2 UPN's to 1
We currently have 1 domain (no children) at corp.domain.com. We have an alternate UPN so that users can have their UPN as [email protected] (no corp).
Many of our earlier users however have the ...
3
votes
0
answers
7k
views
Allowing LDAP authentication from DMZ to Active Directory. Is my idea secure?
I have a internet-facing application server that I want to use AD authentication. This is my first time doing this for a none MS application or without some sort of proxy. I already have a idea in my ...
- 502
3
votes
0
answers
237
views
Windows 2012 Master & Ubuntu Bind 9 Slave & SOA
I'm kinda like the maid... I don't do Windows. But thanks to new things we're implementing, I'm now attempting replicating a single zone from our AD cluster. We had this working just fine but ...
- 253
3
votes
0
answers
3k
views
SecErr: DSID-031A1190, 4003 (INSUFF_ACCESS_RIGHTS), data 0
I am trying to change the password of the currently logged in user via ldifde using this command:
ldifde -i -f pwd.ldif -t 636
My AD server is running in SSL mode with a self signed certificate. The ...
- 221
3
votes
1
answer
2k
views
How to include all dns records and IP address of a server in automatic certificate enrollment of Microsoft AD CS?
In my company there are a lot of servers which users remotely login to them to do their duties. We have enabled computer certificate auto enrollment for them to assure secure connection. But because ...
3
votes
0
answers
3k
views
How Does an Exchange Alternative Service Account Credential work?
I recently had to assist with setting up an Exchange Alternative Service Account (ASA) credential on an Exchange CAS array. We did get the ASA working properly however I have some questions about how ...
- 31