A Microsoft technology for sharing one set of user accounts, security permissions, and management information across many Windows servers and desktops.

learn more… | top users | synonyms (2)

3
votes
1answer
589 views

What's the downtime limit of a domain controller (DC)?

On my VMware ESXi environment there are 10 VMs running. One of the VMs is the domain controller (Windows Server 2008 R2). The other VMs are configured with a static DHCP and DNS IP address in their ...
3
votes
2answers
25k views

How can I find out why specific AD accounts are being locked daily?

I am facing a problem, every day around 17:00 4-5 domain user accounts get locked out. I think that the problem is from a script that is running ... somewhere... the problem is that I cannot pinpoint ...
3
votes
3answers
1k views

Active Directory Design - Domains per site or Organisational Units per site

I work for an educational establishment that currently has three geograpically seperate schools, and about to open a fourth. Each school has 600+ computers and 1000+ users. At the moment our Active ...
2
votes
3answers
1k views

When should I create a new Primary DNS Zone?

In an Active Directory domain with a single primary DNS zone and integrated DHCP, every DHCP client will register themselves with the server holding the primary DNS zone when their lease is renewed. ...
2
votes
2answers
8k views

How to add computer to domains with Active Directory

I have successfully installed AD DS on one computer and added some users. Now i want that my another computer with window XP should use the acounts which are in AD not the window XP build in Accounts....
2
votes
3answers
2k views

Stop Active Directory from updating computer time and date

This office runs an active directory on windows servers. Some 2003 DCs some 2008 R2 DCs A user (The QA analyst) requested that he is able to change his time and it not be changed back after 5-10 ...
2
votes
1answer
3k views

Remove printers from directory that were on an old server

I had a standalone Windows 2012 box that was acting as the printer server in my domain. Since then I've removed it and moved printer hosting elsewhere. However, when I open up the directory (through "...
2
votes
3answers
2k views

running Samba Active Directory Server on Windows desktop (for developing)

Huh, I completely confused by others editing my post... breaking all system of referencing and linking into a mess... Bifurcating the question (1) Can anybody share experience and/or links on ...
1
vote
4answers
7k views

There are currently no logon servers available

I am running a Windows 7 laptop that is joined to my company's domain. When I installed Windows 7, I created an account for myself, joined to the domain, and it had been working quite well even though ...
1
vote
1answer
42 views

what are the implications of running a FQDN as internal AD domain and point A-record for website to different host?

The MSP for a law firm office that has just joined our company is using a FQDN as an internal AD Domain and has been doing so for sometime apparently. They have this issue in that they have a website ...
1
vote
2answers
13k views

Local user accounts have disappeared after installing Active Directory and running dcpromo

I'm kinda newbie in this Windows 2008 Server R2 configuration stuff, so I would appreciate any help regards the issue I'm facing. After a Windows 2008 Server R2 clean install I created a couple of ...
1
vote
2answers
5k views

Server 2008 DC rejecting replication requests

Have a DC that has recently been part of a business continuity test. From what I understand the server (which is virtual) was snapshotted, test carried out while the link between the two sites was ...
1
vote
3answers
4k views

Unable to login to a domain computer using a Local Administrator account

I have a server running on windows server 2008. Recently we created a domain and added it to the domain. Also it is promoted as an additional domain controller on the network. A domain user account ...
1
vote
1answer
2k views

Change list of allowed logon computers from batch file

How can I change this setting from a batch file? For any given user, how can I make it so they can only log onto the computer named abc? A vbs or powershell script would be my second choice.
1
vote
2answers
56 views

Block Administrators authentication attemps from workstations

My Administrator user once in a while is getting locked-out by the workstations in our lab, due to failed logon attempts. (While this is a problem that should be addressed, because this means there is ...
0
votes
1answer
964 views

Control panel items access for active directory users

Active directory group policy have options to disable different things. My question is that how can i enable control panel items for certain users i.e. printer access / date time properties access. I'...
81
votes
9answers
513k views

Command line to list users in a Windows Active Directory group?

Is there a command line way to list all the users in a particular Active Directory group? I can see who is in the group by going to Manage Computer --> Local User / Groups --> Groups and double ...
72
votes
6answers
157k views

Find name of Active Directory domain controller

How can I find out the name/IP address of the AD domain controller on my network?
16
votes
1answer
26k views
15
votes
3answers
40k views

Getting Squid to authenticate with kerberos and Windows 2008/2003/7/XP

This is something I setup recently and was quite a big pain. My environment was getting squid to authenticate a Windows 7 client against a Windows 2008 Server invisibly. NTLM is not really an option,...
26
votes
12answers
45k views

Active Directory: delete vs. disable departed employees [closed]

When an employee leaves your organization, do you delete or disable their Active Directory account? Our SOP is to disable, export/purge the Exchange mailbox, and then after "some time" has elapsed (...
7
votes
1answer
4k views

Best practice for authenticating DMZ against AD in LAN

We have few customer facing servers in DMZ that also have user accounts , all accounts are in shadow password file. I am trying to consolidate user logons and thinking about letting LAN users to ...
15
votes
7answers
68k views

Powershell: How do I query pwdLastSet and have it make sense?

I need to get the last password change for a group of account in an Active Directory security group, and I feel like this is something PowerShell should be good at. Right now, I'm already stuck at ...
14
votes
7answers
10k views

Google Apps, AD and SSO

We're a small shop running Google Apps (Enterprise) for our email needs. Love it. Internally, we're using Windows AD (2003). No complaints there either. I'd like to get some method of SSO going ...
5
votes
5answers
19k views

How to use Active Directory to authenticate linux users

What are the best-practices for using Active Directory to authenticate users on linux (Debian) boxes? The way I would like it to work would be to add AD users to a group - say linux administrators or ...
2
votes
13answers
84k views

Can I get all active directory passwords in clear text using reversible encryption? [closed]

EDIT: Can anybody actually answer the question? Thanks, I don't need no audit trail, I WILL know all the passwords and users can't change them and I will continue to do so. This is not for hacking! ...
30
votes
7answers
14k views

Is it best practices to have separate login for a domain for domain admins?

I typically like to set up separate logins for myself, one with regular user permissions, and a separate one for administrative tasks. For example, if the domain was XXXX, I'd set up a XXXX\bpeikes ...
18
votes
2answers
23k views

How does a client system in an Active Directory network find in which site it resides?

As I was putting together a presentation for beginning Windows administration, I was struck with a question that I'm amazed I haven't asked sooner. I know that: AD is logically setup in sites to ...
7
votes
7answers
53k views

How can I quickly create 100 users on my Active Directory for testing purposes?

I'd like to create 100 users just for test purposes of my Exchange Server. Is there a way to batch do this using random names, etc?
25
votes
3answers
2k views

What features of Windows 8/8.1 Pro will not work without a Microsoft Account?

With respect to domain-joined Windows 8/8.1 Pro machines, what features of Windows will not work unless a Microsoft Account is used? Also, aside from "feature loss," are their any gotchas of not ...
14
votes
4answers
4k views

Windows DHCP Server - get notification when a non-AD joined device gets an IP address

SCENARIO To simplify this down to it's easiest example: I have a Windows 2008 R2 standard DC with the DHCP server role. It hands out IPs via various IPv4 scopes, no problem there. WHAT I'D LIKE I ...
6
votes
1answer
8k views

Login user picture on domain

How can I change the "user picture" for each indivudal user that is displayed during the logon for Windows Vista, 7, 2008, 2008R2 machines throughout a domain?
28
votes
4answers
5k views

Should I still have a physical DC, even post-Server 2012?

Back in the pre-Windows Server 2012 days, the recommendation seemed to be to have at least one physical domain controller sat along-side your virtualised DCs. One justification for this was because ...
13
votes
1answer
41k views

What permissions are required for enumerating users groups in Active Directory

I have a .net web application which needs to obtain the groups a user is a member of in Active Directory. Todo this I am using the memberOf attribute on the users records. I need to know the ...
13
votes
2answers
24k views

What is ADFS (Active Directory Federation Services)?

So I've been told that our PHP application may need to support authentication using ADFS. For a non-Microsoft person, what is ADFS? How does it differ to things like LDAP? How does it work? What ...
13
votes
2answers
19k views

Windows Appending Domain Suffix To All Lookups

I have a reoccurring DNS problem that has been plaguing our users occasionally causing their laptops to appended our companies domain to the end of all DNS queries. The problem only occurs when users ...
13
votes
6answers
9k views

Move Active Directory from 2003 to 2008

Im not a expert admin in Active Directory so I'm in need of some help. At my work, we have bought a new server with the 2008 server OS. And the old AD domain controller is run on a 2003 server. The ...
10
votes
6answers
13k views

Group Policy: Administrator Rights for Specific Users on Specific Computers

I'm a programmer stuck trying to administer an Active Directory setup for a small company. The Domain Controller is running Windows Small Business Server 2008. We have a staff of field workers using ...
5
votes
8answers
2k views

What would it take to get an Active Directory like system in a Linux environment?

I know there isn't anything standard like Active Directory in the Linux world, but I'm assuming there's some way (or multiple ways) to implement a similar type of system. What options are out there? I'...
24
votes
3answers
13k views

How are cached Windows credentials stored on the local machine?

How are cached Active Directory domain credentials stored on a Windows client? Are they stored in the local SAM database, thus making them susceptible to the same rainbow table attacks that local user ...
17
votes
5answers
60k views

Active Directory: Viewing “Attribute Editor” after finding an account via ADUC's “Find” option

When I activate the Advanced features (View -> Advanced Features) and open a user's properties by navigating to their OU and right clicking the user object, I see the Attribute Editor tab. However, ...
11
votes
3answers
44k views

How do you trace/debug LDAP connections against Active Directory?

I am spoiled, and have been doing most of my LDAP work with eDirectory, which has a utility called DSTrace which is lovely, and for LDAP specifically, will show you all the bind attempts, the source ...
10
votes
4answers
662 views

Terminology for Windows domain

I am a system administrator in a Linux shop. We are in the initial steps of inheriting a Windows Domain. I have some terminology questions: The usernames are WORKPAC\johndoe. What is the bolded ...
8
votes
4answers
9k views

What is the point of creating a computer object in Active Directory when you still have to join the PC?

What is the point of creating a computer object in Active Directory when you still have to join computers to the domain, which then creates the object anyway?
8
votes
3answers
3k views

How is software deployed via Active Directory?

What are the steps required for deploying a software package via Active Directory / GPO?
7
votes
1answer
598 views

How do I remotely issue a CLI command to thousands of Windows domain computers at once?

I need to issue a CLI command (cmd.exe or PowerShell) to all of the thousands of computers on my domain. For obvious reasons, this is not going to involve doing the task manually, or physically ...
7
votes
1answer
12k views

Authenticating Apache HTTPd against multiple LDAP servers with expired accounts

We're using mod_authnz_ldap and mod_authn_alias in Apache 2.2.9 (as shipped in Debian 5.0, 2.2.9-10+lenny7) to authenticate against multiple Active Directory domains for hosting a Subversion ...
7
votes
1answer
7k views

How to remotely generate Windows AD Kerberos keytab from a Unix machine?

I would like to know if it’s possible to create a keytab file direct from a client machine without using the ktpass utility in the Windows Server side. The main reason I would want this, is to ...
7
votes
4answers
46k views

Kinit Won't Connect to a Domain Server : Realm not local to KDC while getting initial credentials

I am setting up a testbed environment where Linux (Ubuntu 10.04) clients will authenticate to a Windows Server 2008 R2 Domain Server. I am following the official Ubuntu guide to set up a Kerberos ...
6
votes
3answers
3k views

Add last user logged in into AD Users and Computers description field

The last place I worked had AD setup in a way that in the Description field of each computer account in the AD users and computers console, it would say who logged in last and when. How do you set it ...