Questions tagged [active-directory]
A Microsoft technology that constitutes an LDAP directory service with centralized management functionality for user accounts, computer accounts, groups, and configuration management across many Windows servers and desktops.
10,224
questions
1
vote
0
answers
364
views
Specific accounts cannot change AD passwords, affected users always told complexity requirements not met
I have an organisation where I've had to do sitewide password changes for all users.
For the most part this has been fine, but there are three specific accounts where passwords cannot be changed, ...
- 51
0
votes
0
answers
217
views
AD Trusts deprecated with Server 2019?
I need to setup a AD Trust relationship between two forests. I'm unable to find a Microsoft doc for this case (all I can find is a short doc for Azure DS), is it still advised for on-premise Server ...
- 151
0
votes
1
answer
51
views
How to move ADUser to child domain while preserving original Object for password replication purposes
So, we have one forest with one domain currently, which is working pretty good.
Now we got a new remote office for 5 users. They should get their own Domain Controller and Domain.
Our original Domain ...
- 5
0
votes
2
answers
4k
views
Microsoft ADV190023: How to force LDAPS on RHEL 7?
I am working in a company who works with an Active Directory domain, running on Win Server 2016.
I have some Linux servers (RHEL6) AD integrated with Samba.
I've read Microsoft will release soon an ...
0
votes
1
answer
270
views
What is "redirect write" in Active Directory?
I'm looking at setting up ADConnect to sync users into ADAzure and found the following warning:
Azure AD Connect does not follow any write redirects
On the follow page:
https://docs.microsoft.com/...
- 113
3
votes
2
answers
3k
views
How to Confirm or Enable LDAP/SSL for Azure AD Connect?
Microsoft has an advisory that states they will be prepping LDAP/SSL (LDAPS). https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV190023
While Microsoft doesnt specifically list ...
- 387
0
votes
1
answer
744
views
Connect to active directory over peered VPC
I have a VPC(VPC1) where my main instances are running, and I have another one (VPC2)specifically for directory service (AD Connector) and a MS AD server running. I have created a VPC peering (which ...
- 764
0
votes
0
answers
357
views
Dual Stack issues with Active Directory
I'm trying to set up a dual-stack environment with two Windows Server 2019 domain controllers. However, when I test the client as IPv6-only, the client fails to authenticate with the AD servers. The ...
0
votes
0
answers
546
views
Unable to SSH to GCP Linux server with exact AD username
First, the standard stuff: I'm on Windows 10 company PC logged in as my Active Directory user. I'm using the built in openssh with either PS or CMD. I generated my RSA key using ssh-keygen, and ...
google-cloud-platform
1
vote
1
answer
840
views
apply GPO only if specific user OU on specfic computer OU
The question is relatively simple:
how to apply a GPU (let's say folder redirection) only when a certain OU of users (e.g. employees) on a certain OU of computers (e.g. Desktops)?
the problem:
...
- 123
3
votes
1
answer
230
views
How to change Fedora hostname while being AD-member
i#m using a Fedora Workstation in our company Active Directory Domaine. The fedora box is member of the ActiveDirectory (Server 2012 R2).
Now my hardware died and i moved my harddisk to a new ...
- 181
2
votes
1
answer
273
views
Cannot login to SQL Server instance installed on Debian using domain account
I can login to SQL Server 2019 (installed on Debian Buster) with SA account using SQL Management Studio on Windows Server 2016, but I cannot do this with the domain account using integrated ...
- 495
2
votes
1
answer
11k
views
What is the difference between Group Policy and Registry Policy processing in Windows?
I sometimes need to temporarily change some registry settings related to Group Policy on a computer part of Active Directory, so I can perform some work.
After having read some articles on how to do ...
- 429
0
votes
1
answer
53
views
HP DL360 G6 raid50 - drive will fall soon
My server have problem with raid battery and in same time one drive have flag: Box 1 bay 3 predicted to fail soon. Also my server 2012 r2 is in mess, error: Online - Cannot get performance counter ...
2
votes
1
answer
1k
views
Why does realmd list multiples of the same realm?
I'm setting up an Ubuntu server so that users can authenticate against a Windows AD server. Not knowing about realmd, I used Samba Winbind's net join command to join the machine to the domain. ...
- 252
2
votes
1
answer
13k
views
What does it mean DNS Suffix Search List?
Just for me to understand more, when I run ipconfig /all on my work laptop, at the beginning of the information I see 3 parameters: Host Name, Primary DNS Suffix and DNS Suffix Search List.
I know ...
- 121
0
votes
0
answers
227
views
Decommission Active Directory Certificate Services server: side effects
I have a private domain to which I later added AD CS, NPS, RRAS and setup SSTP VPN access. I used AD CS to create a certificate for the SSTP connection and DynDNS to get me in from outside. ...
- 1
0
votes
1
answer
263
views
How to break Windows Server 2019 in a way which will require an admin to check logs to find the answer [closed]
I am building a lab environment to up-skill admins to windows and have included various troubleshooting tasks. I would like to break DNS or some other service in a way that would require them to look ...
- 918
1
vote
2
answers
1k
views
Will group policy configurations applied locally through `gpedit` override domain GPOs until next GPO refresh interval?
Will group policy configurations applied locally through gpedit override domain GPOs until next GPO refresh interval?
I know that Domain GPOs takes precedence over locally defined GPOs (gpedit), ...
- 429
0
votes
0
answers
250
views
Issues Connecting to DNS on Windows Server 2016 from RSAT on Windows 10 Pro
I will make this as concise as I can.
Background: I am trying to set up a collection of Windows 2016 VMs to test through some labs but I am having issues connecting as my title states.
This is the ...
- 1
0
votes
2
answers
2k
views
mixing external and internal DNS servers for AD joined machines
I have a question. Many of our clients have only one DC. Is it better to use external DNS (ISP,or google) as the secondary DNS server for AD-joined machines or set up a conditional forwarder in the ...
- 31
0
votes
1
answer
598
views
Password Synchronization between two forests or in one forest; using replication or using MIM to synchronize?
So we have got a domain (e.g. contoso.local) which is replicated over 4 DCs. All DCs are in the same Subnet. All users reside in the same OU in this one domain. All Workstations are in their own OU as ...
- 5
0
votes
2
answers
2k
views
Windows 10 in a domain takes forever to login
I have multiple computers using the same account in a domain.
When the users try to log in, the process take very long time (10/15 minutes).
I don't know how to fix that.
- 27
0
votes
0
answers
46
views
Network share accessible on one PC, but not a different PC with same user credentials
I have a very odd issue. I'm trying to access a network share on my organization. Like in the title, it works on one PC, but not another, with the same credentials. The effective access shows me ...
- 101
4
votes
2
answers
4k
views
What's a reasonable max number of users I should put in a mail-enabled security group?
My company uses PowerShell to manage the members of thousands of groups. There are SQL statements and other "rules" that govern who should be a member of a given group. This solution does not really ...
- 224
2
votes
2
answers
8k
views
DNS-over-HTTPS for Windows DNS server forwarding?
Is it possible to configure DNS Forwarding of Windows Server 2019 AD DNS servers using DNS-over-HTTPS, or do I need to use an intermediary server internally to resolve using DoH and return regular ...
- 33
1
vote
1
answer
9k
views
AD FS Not Authenticating SAML Requests
This morning, it was brought to our attention that Active Directory Federation Services has stopped performing SAML authentications for all SAML-based relying party trusts (about 8 of them). Office ...
- 676
3
votes
1
answer
17k
views
Check 'effective permissions', 'effective access' from command-line, Windows/NTFS
How do I mimic Advanced Security Settings 'Effective Access' tab in command line (Win10 notably)? Prefer built-in tools, I'm about to evaluate if sysinternals AccessChk can accomplish this
icacls ...
- 639
1
vote
2
answers
14k
views
Error when a Domain Admin needs a user to change his password at next log on: "configuration information could not be read from the domain controller"
An administrator of a domain network with a single Microsoft Active Directory 2019 Domain Controller needs to reset password for certain domain users. To do so, he selects the user in from the list ...
- 11
0
votes
2
answers
3k
views
Migrate an on-prem AD DL Group to Pure Office 365 DLs
Can anyone advise if there is a way to migrate on-prem AD groups to pure Office 365.
In our environment we have a hybrid configuration which uses AD Sync to synchronize ad objects to Azure. So we ...
- 615
0
votes
1
answer
39
views
DNS server address after migrate the ADDS & DNS?
currently, I'm facing an Windows AD environment that needs to migrate the AD&DNS server to another machine.
Assume that the original AD&DNS server named VM-A(IP:10.1.1.1) is the only one ...
- 75
0
votes
1
answer
231
views
In a linked mailbox scenario, is the master account allowed to have the corresponding email address as proxy address?
I read the documentation on how to create linked mailboxes from microsoft, but this is something that isn't answered there or I just don't find it:
It's clear that the mailbox account has to be ...
- 101
0
votes
1
answer
328
views
Failure to access AD in Linux EC2
I have a EC2 instance called EC2-B and I configured it to use AD Connector.
This is instance is in the VPC B while the AD Connector EC2 is in VPC A.
I have another instance EC2-A in the VPC-A and ...
- 1
-1
votes
1
answer
232
views
Transitivity of trust when adding new domain
Suppose I have a domain trust between domain A(forest A), and domain B(forest B) (bi-directional, FOREST TRANSITIVE).
Assuming I add domain C to forest A. At this point A trusts C, and B should trust ...
- 99
0
votes
0
answers
416
views
Locked our of Windows Server 2012 R2 after AD installation
I have a Windows Server 2012 R2 instance and I just installed Active Directory. After installation, I set up the server as Domain Controller, set up a couple of admin accounts, and went to sleep. The ...
0
votes
2
answers
2k
views
How to add “Authenticated Users” into Security Filtering in GPO settings?
How to add “Authenticated Users” into Security Filtering in GPO settings?
If I press Add and try to search for “Authenticated Users” nothing is found. I revomed “Authenticated Users” and now I want to ...
- 11
0
votes
1
answer
163
views
Use Azure Active Directory as a single sign on service for multiple web applications
Can we use Azure Active Directory as a single sign on service for multiple web applications that support LDAP authentication, but does not support Azure active directory?
Usually such applications ...
- 13
0
votes
1
answer
196
views
Host joined to AD on separate vlan cannot access website with public ip on another vlan
I have 5 vlans.
vlan 1 hosts the website with public ip 67.x.x.x. Hosts are in domain1
vlan 2-4 are able to access the website using via domain name which resolves to external ip 67.x.x.x. Hosts are ...
- 345
0
votes
0
answers
680
views
Unable to renew Certificate on Windows 10 in domain
I'm trying to renew my computer certificates on a in domain laptop but I get "RPC Server is unavailable", error code 1722.
On other laptops the same procedure works.
What can I do?
I've opened mmc and ...
- 101
0
votes
1
answer
152
views
How to confirm that LDAP SSL patches are working
We have applied the LDAP SSL Security Elevation patches on our domain controller, and have set the LdapEnforceChannelBinding entry to 2 (to force a hard fail for insecure connections), but all of my ...
- 103
0
votes
0
answers
335
views
"change password on next logon" remote workarounds?
we have a group of people who work from outside and generally only work using a Terminal Server, and with NLA in place we cannot force password changes as that just sends users into a brick wall and ...
- 123
2
votes
1
answer
2k
views
AD best practice: delete or just disable?
As an IT company that delivers IT systems, servers and everything for our customers. I'm trying to find the best practice when it comes to Active Directory and users leaving the company.
We have ...
0
votes
1
answer
650
views
Central authentication with Samba4 for applications
I have a small problem / doubt about the use of Samba4 as a central authenticator of external applications, I explain, I am instantiating a Samba4 server as a PDC for domain authentication for some ...
5
votes
1
answer
314
views
How to restrict AD DS, DNS, and FS services to internal interfaces on Window Server 2019?
I have a Windows Server 2019 server, which is running some services itself, and Hyper-V virtual machines with Windows and Linux guests.
To centralize user and machine management, I have setup Active ...
- 2,096
0
votes
2
answers
585
views
Set up Developers with separate local admin accounts
At work, our developers are local administrators on their Windows 10 machine. This is risky since we want to somewhat mitigate risks such as drive-by-download, but we also want productivity and some ...
3
votes
1
answer
367
views
Is it possible to configure active directory and VPN on same Server 2019?
I have an Active directory which configured on windows server 2019
could I on the same server configure a VPN?
0
votes
0
answers
26
views
Connections from domain laptop are refused by non-domain laptop
Connections from domain laptop are refused by non-domain laptop. I have a Win10 laptop on a domain. And a Win7 laptop not on the domain. All connections from domain to non-domain are refused. For ...
- 101
1
vote
0
answers
300
views
DOMAIN_JOIN_INTERNAL_SERVICE_ERROR - AWS AppStream 2.0 - Active Directory
This has been driving me insane for two months now.
I am using AppStream 2.0 to stream an application to my users. The application uses Windows Integrated Authentication. And, therefore, is ...
- 11
0
votes
1
answer
1k
views
Listing AD Attributes with powershell using DirectoryServices on Windows Server 2008
I am trying to get a list of user names and their pwdlastset attribute on a Windows Server 2008 DC. I am using directoryservices because there are no adutils installed. The script is working, but I am ...
- 20
2
votes
1
answer
76
views
Impossible to manage Actice Directory users on Google Cloud
I'm trying to setup Active Directory on Google Cloud Platform. I have successfully created a managed AD domain, defined the password for the setupadmin account, created a Windows VM on this domain, ...
