A Microsoft technology for sharing one set of user accounts, security permissions, and management information across many Windows servers and desktops.

learn more… | top users | synonyms (2)

10
votes
3answers
2k views

How to deny access to disabled AD accounts via kerberos in pam_krb5?

I have a working AD/Linux/LDAP/KRB5 directory and authentication setup, with one small problem. When an account is disabled, SSH publickey authentication still allows user login. It's clear that ...
10
votes
1answer
176 views

Active Directory forest with same name as root DNS zone and browsing to site with same name

Related to this previous question of mine about why it's a bad idea to use the root domain name as your Active Directory forest's name... I have an employer, whom I will refer to as ITcluelessinc, ...
10
votes
1answer
3k views

Configure WinRM using a .bat file without yes/no prompt

I want to configure winrm in all my clients using a bat file. after running bat file winrm quickconfig command there's a prompt for a yes/no answer. I don't know how to answer "yes" in the batch file. ...
10
votes
1answer
1k views

Active Directory: How does the computer logon process and the user logon process differ?

I believe it is correct to say that users and computers are treated as equal principals with respect to Active Directory. Both users and computers have passwords, and both users and computers are ...
10
votes
1answer
899 views

AD Cross-forest authentication - groups missing from PAC

I have an Active Directory setup consisting of 2 forests: 1 multi-domain forest with 1 forest root domain, and 2 direct child domains 1 single-domain forest for DMZ publishing purposes I have ...
10
votes
1answer
226 views

What effect does setting the manager field for a computer object in Active Directory have?

If you set the Manager for a User object in Active directory, it creates a clear relationship between the user and their manager. This is reported in Exchange's Global Address List amongst other ...
10
votes
1answer
186 views

Can I “merge” two groups using SID history?

I have two AD groups which were erroneously created while there should instead have been only one group; they contain the exact same users. However, these groups have been assigned various permissions ...
10
votes
8answers
14k views

ActiveSync devices causing accounts to lockout

When a user changes his account password for whatever reason (read: expired), and the old password is stored in his mobile device connected through EAS. This will cause his account almost immediately ...
10
votes
2answers
211 views

How to enable BitLocker with no prompts to the end user

I have configured BitLocker and TPM settings in Group Policy such that all the options are set and the recovery keys stored in Active Directory. All our machines are running Windows 7 with a standard ...
9
votes
4answers
18k views

How can I set up Redmine => Active Directory authentication?

First, I'm not an AD admin on site, but my manager has asked me to try to get my personal Redmine installation to integrate with ActiveDirectory in order to test-drive it for a larger-scale rollout. ...
9
votes
1answer
321 views

Is there any reason to backup Active Directory if you have more than one domain controller?

In one site there are 3 domain controllers. There are an additional 3 domain controllers for 3 remote sites. My question: Is there any reason why you should still backup Active Directory? If one of ...
9
votes
4answers
14k views

How to create a limited “domain admin” that does not have access to domain controllers?

I'm looking to create an account similar to a Domain Admin, but without access to domain controllers. In other words, this account will have full Administrator rights to any client machine in the ...
9
votes
3answers
5k views

How do I find orphaned computer objects in Active Directory using PowerShell?

How can I find all computer accounts in my Active Directory domain that have been inactive for x days using PowerShell? Note that I do actually know how to do this. This is a self-answered ...
9
votes
4answers
27k views

Account to read AD, join machine to domain, delete computer accounts and move computers to OUs

I want to create an account that will perform the following: Join computers to a domain (not restricted to 10, like a normal user) Check for computer accounts in AD Delete computers from AD Move ...
9
votes
2answers
7k views

Running Windows domain on Amazon EC2

It is possible to run Windows Server 2003 instances on Amazon EC2. I was wondering is it possible for one or more of these machines to be a domain controller and the other machines you run to be a ...
9
votes
2answers
699 views

Demoted domain controller still authenticating users

Why is a demoted domain controller still authenticating users? Whenever users log onto workstations with domain accounts, this demoted DC authenticates them. Its security log shows their logons, ...
9
votes
2answers
1k views

Active Directory - Bulk Company Update

I was wondering if there is a way to update the 'Company' field for a large group of users within Active Directory? I would like to match all users with a company ending in a certain string. It would ...
9
votes
1answer
921 views

Can a user account that is disabled in Active Directory still receive email?

I'm reading Learning Exchange Server 2003 by Boswell, and there's a section in there that mentions that a disabled account in AD cannot receive email and that it will be bounced back. Currently, what ...
9
votes
1answer
392 views

Kerberos authentication, service host and access to KDC

I have a web application (hostname: service.domain.com) and I wish to use Kerberos authentication to identify users that are logged into a Windows domain. Microsoft AD (Windows Server 2008 R2) is ...
9
votes
1answer
363 views

What are the best practices for service accounts?

We're running several services in our company using a shared domain account. Unfortunately, the credentials for this account are widely distributed and being used frequently for both service and ...
9
votes
2answers
7k views

Is there a way to refresh computer group membership without rebooting?

I am using Windows Server 2008 R2 and have a windows service running under "network service" account in computer ComputerA. This windows service want to access a share folde (on another computer ...
9
votes
2answers
7k views

Cloud hosting for windows domain controller, possible?

We currently host our own domain controller (small company) locally on dedicated h/w. However to mitigate disaster we're considering the use of virtualisation and cloud hosting. One thought is ...
9
votes
1answer
601 views

Active Directory and Exchange Architecture Questions and Issues

Here's the background on our situation... Right now, we are setup as three distinct companies with three complete Active Directory and Exchange systems. The three offices (One in the US, two in ...
9
votes
2answers
547 views

LDAP authentication: Windows Server2k3 vs. 2k8

We have around 70% linux users, all of which are configured to authenticate against Active Directory through LDAP. In order for this to work, we used the "Windows Services for Unix" under Windows ...
9
votes
2answers
887 views

Win7 clients failing with cached credentials on samba4 RODC

I'm setting up a test environment for a customer about to deploy samba4 into 1400 remote sites and I'm running into a problem. It's my job, after all, to run into problems and then solve them. Active ...
9
votes
4answers
18k views

How to disable Tcp/Ip settings in windows 7 via GPO?

I have enabled following policies, "Prohibit TCP/IP advanced connection" "Prohibit access to properties of components of a LAN connection" "Enable Windows 2000 Network Connections setings for ...
8
votes
3answers
63k views

How to delete domain user profile from a computer?

I'm wondering how to safely remove a domain user profile from a computer that is a part of a domain. I don't want to delete the account from the domain itself, I just need to remove the profile from ...
8
votes
3answers
2k views

Should I have multiple domain administrator accounts?

I work in a small organization with 2 servers and 30 clients. We are completely Windows Server 2003/XP. Besides me, the Director of Operations and our IT consulting company need access to a domain ...
8
votes
3answers
2k views

How is software deployed via Active Directory?

What are the steps required for deploying a software package via Active Directory / GPO?
8
votes
5answers
10k views

Group Policy: Administrator Rights for Specific Users on Specific Computers

I'm a programmer stuck trying to administer an Active Directory setup for a small company. The Domain Controller is running Windows Small Business Server 2008. We have a staff of field workers using ...
8
votes
2answers
3k views

Moving primary domain controller to new server

I have just purchased a new server that will be the new primary domain controller. I was wondering if anyone knew any articles or tutorials on how to do this change over? I would imagine it is just ...
8
votes
2answers
819 views

Detecting AD Site options using PowerShell

How can I use PowerShell to find AD site options like +IS_INTER_SITE_AUTO_TOPOLOGY_DISABLED in PowerShell? I've been playing around with the following command, but can't get it to spit out anything ...
8
votes
2answers
179 views

Entering people's email addresses in AD

We've got a Windows 2003 Server Active Directory environment. In AD you can enter a person's email address. Back when we used to have Exchange, when creating a new user it would also create an entry ...
8
votes
1answer
263 views

In Active Directory, does a user account get locked out domain-wide or at the server level?

Right now I have a user who is able to use his domain credentials to log in to any server on our network, except one. The server that he cannot log in to allows other domain users to connect, but when ...
8
votes
6answers
5k views

What's the best wiki to run on Windows?

I want to set up a wiki for my team. I need it to run on Windows/IIS and if it needs a database, against SQL Server. User-authentication must use/integrate with Active Directory, ideally natively ...
8
votes
1answer
385 views

Can I create the active directory forest corp.domain.com without creating domain.com first?

Is there any way which I can create the active directory domain corp.domain.com without first creating domain.com AD DCs? Or to put another way, can corp.domain.com be the root of the forest?
8
votes
2answers
279 views

Issues related to storing photos in Active Directory?

Are their any known issues with storing employee photos in AD provided you store them in the compliant sizes and formats? Is there a critical mass that you break or could corrupt AD databases? I'm ...
8
votes
4answers
13k views

Will Active Directory Allow You to Add Two Computers of the Same Name?

I'm hoping someone can confirm my observations because I'm questioning my memory... The title kind of says it all. While working rapidly on deploying a number of similar systems, it appeared that we ...
8
votes
8answers
9k views

Should I install an AV product on my domain controllers?

Should I run a server-specific antivirus, regular antivirus, or no antivirus at all on my servers, particularly my Domain Controllers? Here's some background about why I'm asking this question: ...
8
votes
4answers
6k views

What is important to document in an active directory server?

Later this year I will be handing over support of my church’s active directory servers to someone else and would like to know what kind of information is important to document and share. Are there any ...
8
votes
2answers
311 views

Outline the quirks of Windows Small Business Servers (SBS)

I'm not much of a Microsoft administrator. However, I do work extensively with new and existing Microsoft Exchange deployments. That's just how the career-arc went. I'm working with a small customer ...
8
votes
2answers
360 views

How do I block inheritance/application of a single GPO?

Due to the workload generated by recent ransomware outbreaks (Cryptolocker/Cryptowall/etc.), I was recently tasked with implementing Software Restriction policies to block program execution from ...
8
votes
3answers
1k views

What good Active Directory + Exchange competition is there?

Based on this question regarding enhanced permission support in filesystems, what is the best permissions + directory and mail stack to compare against Active Directory on NTFS with Exchange? I'm ...
8
votes
1answer
2k views

Find locked out accounts in Active Directory (a way that actually works!)

I have googled how to list locked out accounts and found two methods so far, both of which don't work... Saved query - ...
8
votes
1answer
3k views

Two ways of deploying printers via group policy

I've noticed two options for deploying printers via group policy: Create and link Group Policy in GP Management, add printer(s) via User Configuration > Preferences > Control Panel Settings > ...
8
votes
6answers
13k views

How to join domain and still maintain settings from unjoined user profile?

I have some Vista x64 workstatons configured for software development that have never been joined to our AD domain. The users have lots of custom settings in their local unjoined user profiles that ...
8
votes
7answers
4k views

How do I keep the local admin password consistent across an OU?

We have a number of PCs running XP SP2 (and a couple running SP1) already in production, and we're looking to keep the local administrator's password consistent across the OU. The only solutions I can ...
8
votes
1answer
209 views

Is there a version of the AD tools that provide the PowerShell output, similar to the Exchange tools?

The Exchange administration tools output the exact PS commands they will (or just did) execute. Is there a different version of the AD tools (primarily AD Users & Computers) that have similar ...
8
votes
2answers
11k views

Why does removing the EVERYONE group prevent domain admins from accessing a drive?

This is related to this question: Domain Admins group denied access to d: drive I have a member server in a brand new AD lab environment. I have an Active Directory user ADMIN01 who is a ...
8
votes
3answers
2k views

Automatically mounting a network share as Shared Resource

we're running an ActiveDirectory environment (Windows 2008 Server, XP Clients) and want to have some shares listed as Shared Resources under the Network Neighbourhood. I do not want to map it to a ...