A Microsoft technology for sharing one set of user accounts, security permissions, and management information across many Windows servers and desktops.

learn more… | top users | synonyms (2)

3
votes
2answers
598 views

How do I plan for a new Active Directory structure?

I'm planing a new Active Directory structure for a multi-national company that consists for six very different business units and need some help, advice, or pointers in making this implementation ...
2
votes
4answers
3k views

If a machine is removed from Active Directory does it create a log file?

If a machine is removed from AD (but not properly disjoined from the domain) is a log file/entry of some kind created? If so where would it be located and how can we access it?
2
votes
1answer
2k views

Unable to restore a backup GPO in Active Directory

I have only recently downloaded the Microsoft Security Compliance Manager and created several "profiles" and exported them as "GPO Backup (folder). No problems there.. Now I have copied the folders ...
2
votes
1answer
3k views

Active Directory GPO for Password Policy Not Applying from Default Domain Policy

Ok. I have implemented a Password Policy. I know from previous posts that it cannot be applied from within an OU so I have configured it from the Default Domain Policy. I run RSOP.msc from a client ...
2
votes
3answers
1k views

Stop Active Directory from updating computer time and date

This office runs an active directory on windows servers. Some 2003 DCs some 2008 R2 DCs A user (The QA analyst) requested that he is able to change his time and it not be changed back after 5-10 ...
2
votes
3answers
4k views

How does someone restrict read rights to certain user attributes on Active Directory?

We use this code to query an ADAM instance. DirectoryEntry adRoot = new DirectoryEntry(ConfigurationManager.AppSettings["LdapConnectionString"].ToString()); DirectorySearcher adSearch = new ...
2
votes
3answers
1k views

When should I create a new Primary DNS Zone?

In an Active Directory domain with a single primary DNS zone and integrated DHCP, every DHCP client will register themselves with the server holding the primary DNS zone when their lease is renewed. ...
2
votes
2answers
7k views

How to add computer to domains with Active Directory

I have successfully installed AD DS on one computer and added some users. Now i want that my another computer with window XP should use the acounts which are in AD not the window XP build in ...
2
votes
3answers
1k views

Active Directory Design - Domains per site or Organisational Units per site

I work for an educational establishment that currently has three geograpically seperate schools, and about to open a fourth. Each school has 600+ computers and 1000+ users. At the moment our Active ...
1
vote
2answers
52 views

Block Administrators authentication attemps from workstations

My Administrator user once in a while is getting locked-out by the workstations in our lab, due to failed logon attempts. (While this is a problem that should be addressed, because this means there is ...
1
vote
2answers
3k views

Server 2008 DC rejecting replication requests

Have a DC that has recently been part of a business continuity test. From what I understand the server (which is virtual) was snapshotted, test carried out while the link between the two sites was ...
1
vote
1answer
2k views

Change list of allowed logon computers from batch file

How can I change this setting from a batch file? For any given user, how can I make it so they can only log onto the computer named abc? A vbs or powershell script would be my second choice.
1
vote
2answers
8k views

Local user accounts have disappeared after installing Active Directory and running dcpromo

I'm kinda newbie in this Windows 2008 Server R2 configuration stuff, so I would appreciate any help regards the issue I'm facing. After a Windows 2008 Server R2 clean install I created a couple of ...
1
vote
4answers
8k views

Share folder and access this folder on different domain

the following situations: i have two pc's. My work desktop with XP prof and logged on in domain mywork.com. This desktop also has two network card. one for logging on the mywork.com domain and using ...
0
votes
1answer
621 views

Control panel items access for active directory users

Active directory group policy have options to disable different things. My question is that how can i enable control panel items for certain users i.e. printer access / date time properties access. ...
0
votes
1answer
2k views

Is it possible to switch to Kerberos only Windows domain

Is it possible to configure both Windows servers and workstations (Windows 7) to use only Kerberos for authentication and not use NTLM for authentication within the Domain? I was told that Kerberos ...
0
votes
1answer
1k views

Adding a user in Active Directory using dsadd

Here's a screenshot of my topology: I'd like to use the dsadd command to add a user to Mercotel A> Administracion> Usuarios OU, but I can't figure out the syntax for nested OU's. What would the ...
0
votes
3answers
5k views

TFS 2010 - Adding users to a Team Project

Tried searching the archives, but nothing showed up and now I'm totally messed up in my head. I'm running my own little domain setup on a virtual server: Server 1, PDC, Exchange Server 2, SQL ...
0
votes
3answers
14k views

accessing workgroup computer (without manually creating user accounts)

The (common) question: How can one access network share on workgroup computer? usually has the (common) answer: One should add ("the same") local account with the same username and password on ...
-1
votes
1answer
562 views

Purpose of primary group [closed]

Why do we need a primary group for users? Why is it mandatory to the users to have a primary group?
-1
votes
2answers
847 views

how to deal with users who have locked their desktop while resetting password with must change password on next logon bit ON [closed]

If a user has locked his desktop, and asks for reset password. If mustchangepassword is enabled, the user cannot unlock his computer. This is the error message he gets: 'Your password has expired. ...
-1
votes
3answers
2k views

how to share the same domain machine account with multi-boot workgroup Windows setup?

Having read in http://support.microsoft.com/kb/154501/EN-US/ (How to disable automatic machine account password changes): "You have two separate installations of Windows NT or Windows 2000 on ...
62
votes
9answers
358k views

Command line to list users in a Windows Active Directory group?

Is there a command line way to list all the users in a particular Active Directory group? I can see who is in the group by going to Manage Computer --> Local User / Groups --> Groups and double ...
53
votes
5answers
101k views

Find name of Active Directory domain controller

How can I find out the name/IP address of the AD domain controller on my network?
16
votes
1answer
22k views
19
votes
1answer
5k views

Authenticating OpenBSD against Active Directory

Edit: Reformatted this as Q&A. If anyone can change this from Community Wiki to a typical question, that's probably more appropriate as well. How can I authenticate OpenBSD against Active ...
25
votes
12answers
28k views

Active Directory: delete vs. disable departed employees [closed]

When an employee leaves your organization, do you delete or disable their Active Directory account? Our SOP is to disable, export/purge the Exchange mailbox, and then after "some time" has elapsed ...
7
votes
1answer
3k views

Best practice for authenticating DMZ against AD in LAN

We have few customer facing servers in DMZ that also have user accounts , all accounts are in shadow password file. I am trying to consolidate user logons and thinking about letting LAN users to ...
13
votes
7answers
52k views

Powershell: How do I query pwdLastSet and have it make sense?

I need to get the last password change for a group of account in an Active Directory security group, and I feel like this is something PowerShell should be good at. Right now, I'm already stuck at ...
13
votes
7answers
10k views

Google Apps, AD and SSO

We're a small shop running Google Apps (Enterprise) for our email needs. Love it. Internally, we're using Windows AD (2003). No complaints there either. I'd like to get some method of SSO going ...
4
votes
13answers
63k views

Can I get all active directory passwords in clear text using reversible encryption?

EDIT: Can anybody actually answer the question? Thanks, I don't need no audit trail, I WILL know all the passwords and users can't change them and I will continue to do so. This is not for hacking! ...
3
votes
5answers
12k views

How to use Active Directory to authenticate linux users

What are the best-practices for using Active Directory to authenticate users on linux (Debian) boxes? The way I would like it to work would be to add AD users to a group - say linux administrators or ...
3
votes
1answer
5k views

Login user picture on domain

How can I change the "user picture" for each indivudal user that is displayed during the logon for Windows Vista, 7, 2008, 2008R2 machines throughout a domain?
13
votes
6answers
8k views

Move Active Directory from 2003 to 2008

Im not a expert admin in Active Directory so I'm in need of some help. At my work, we have bought a new server with the 2008 server OS. And the old AD domain controller is run on a 2003 server. The ...
5
votes
8answers
2k views

What would it take to get an Active Directory like system in a Linux environment?

I know there isn't anything standard like Active Directory in the Linux world, but I'm assuming there's some way (or multiple ways) to implement a similar type of system. What options are out there? ...
5
votes
3answers
5k views

Active Directory in a DMZ

What is the best way to manage user accounts for Windows servers in a DMZ? We are expanding our web presence and adding several IIS servers to our DMZ. I would prefer not to manage a bunch of local ...
4
votes
7answers
35k views

How can I quickly create 100 users on my Active Directory for testing purposes?

I'd like to create 100 users just for test purposes of my Exchange Server. Is there a way to batch do this using random names, etc?
7
votes
2answers
10k views

Authenticating Apache HTTPd against multiple LDAP servers with expired accounts

We're using mod_authnz_ldap and mod_authn_alias in Apache 2.2.9 (as shipped in Debian 5.0, 2.2.9-10+lenny7) to authenticate against multiple Active Directory domains for hosting a Subversion ...
6
votes
1answer
4k views

What needs to be done/added on Apple MacBook Air in order to join domain and be managed?

We are a fully windows active directory company. I now have a MacBook Air (first in company) - that needs to be connected. What are the things I need to install/set in order for me to be able to ...
6
votes
3answers
3k views

Add last user logged in into AD Users and Computers description field

The last place I worked had AD setup in a way that in the Description field of each computer account in the AD users and computers console, it would say who logged in last and when. How do you set it ...
4
votes
2answers
8k views

Migrate user profiles to new Active Directory Accounts

I have a few users in a very old workgroup that log directly into their local machines (Windows XP Pro). This week they're finally moving to active directory and will need to log into domain accounts ...
3
votes
3answers
11k views

Configuring OpenLDAP as a Active Directory Proxy

We try to set up an Active Directory server for company-wide authentication. Some of the servers that should authenticate against the AD are placed in a DMZ, so we thought of using a LDAP-server as ...
3
votes
1answer
2k views

Single Sign On for intranet with Apache and Linux MIT Kerberos

EDIT: SOLVED! See my answer below. Greetings, I am looking for a way to do a single sign on to an intranet in the following manner: A Linux user logs on via a graphical frontend (for example, ...
3
votes
2answers
1k views

active directory + squid planning for a large network with over than 7000 users

We have about 1600 active nodes and 6000 students in our network and we have a great Cisco backbone, we have 8 faculties (they have sites and wireless access points) and 10 centers like hospital. We ...
1
vote
3answers
2k views

Integration of Active Directory, Squid and traffic shaper (like MikroTik)

We have a large network in our university with about 10000 users. We have an AD and wants to use a Squid server for caching and NTLM authentication. We have 40 Mbit/s Internet too, we are going to ...
13
votes
4answers
25k views

Active Directory: Viewing “Attribute Editor” after finding an account via ADUC's “Find” option

When I activate the Advanced features (View -> Advanced Features) and open a user's properties by navigating to their OU and right clicking the user object, I see the Attribute Editor tab. However, ...
10
votes
3answers
2k views

Deploying Printers via GPO/GPP - is there a programmatic option?

For reasons beyond my control, I've been tasked with setting up GPO/GPPs to deploy our 100+ printers to our 1000+ clients. The good news is that we have over a dozen sites, and for the most part, I'm ...
10
votes
2answers
13k views

Windows Appending Domain Suffix To All Lookups

I have a reoccurring DNS problem that has been plaguing our users occasionally causing their laptops to appended our companies domain to the end of all DNS queries. The problem only occurs when users ...
9
votes
2answers
7k views

Running Windows domain on Amazon EC2

It is possible to run Windows Server 2003 instances on Amazon EC2. I was wondering is it possible for one or more of these machines to be a domain controller and the other machines you run to be a ...
8
votes
1answer
16k views

What permissions are required for enumerating users groups in Active Directory

I have a .net web application which needs to obtain the groups a user is a member of in Active Directory. Todo this I am using the memberOf attribute on the users records. I need to know the ...