A Microsoft technology that constitutes an LDAP directory service with centralized management functionality for user accounts, computer accounts, groups, and configuration management across many Windows servers and desktops.

learn more… | top users | synonyms (2)

12
votes
2answers
3k views

How to create an additional domain controller using Windows Server 2008 R2 Server Core?

I'm currently running Windows Server 2008 R2, can anyone tell me how I can replicate the active directory to another server which has been installed using Server Core install.
12
votes
2answers
2k views

Temporary membership to AD group

We restrict the running of exe's across the organization. But based on justifications & approvals we add users to (specific) AD groups for 24 hours. Currently the process of removing the users ...
12
votes
1answer
2k views

For how long can a client be shutdown in AD?

We are setting up a training environment to be used after summer holiday. Management wants us to set up clients now before the vacation. Since the clients are to be shipped away, they will be off line ...
12
votes
1answer
16k views

Where does Active Directory-integrated DNS store its data?

This has been bugging me for a while. We all know Active Directory is a LDAP database. We also know that the Windows DNS service, when running on a domain controller, can store its data in AD ...
12
votes
3answers
2k views

Server credential management for Linux and Windows

We are a relatively small shop (as far as number of sysadmins) with a mix of RHEL, Solaris, Windows 2003 and Windows 2008 servers; about 200 servers in all. For our administrator accounts (root in ...
12
votes
1answer
212 views

Windows Server 2003 Domain Controller Replacement

This Saturday evening we're going to be replacing our existing Windows Server 2003 domain controllers/dns servers with Windows Server 2008 R2 domain controllers/dns servers. The current forest and ...
12
votes
5answers
20k views

Linux + Active directory authentication + only letting certain groups login

I have some linux boxes that use Windows Active Directory authentication, that works just fine (Samba + Winbind). What I would like to do now though is only allow certain people or certain groups to ...
12
votes
7answers
4k views

How do you document/track your permissions

I'm a Windows Admin so those that integrate with Windows will likely be most helpful. My main challenge at this point is just with file shares but as SharePoint use increases it will only make this ...
11
votes
2answers
2k views

How can I log into a Domain controller that doesn't trust itself

I have a windows 2008 R2 standalone Domain Controller that I restored from backup. The original DC is offline. When I log in with valid user credentials I get the error: "The security database ...
11
votes
4answers
29k views

How to create a limited “domain admin” that does not have access to domain controllers?

I'm looking to create an account similar to a Domain Admin, but without access to domain controllers. In other words, this account will have full Administrator rights to any client machine in the ...
11
votes
2answers
2k views

Can I completely remove the Windows DNS in favour of BIND9 in an AD network?

I would like to remove the DNS feature of Windows Domain Controllers and point the DNS servers to our BIND9 servers. I know it's possible to setup coexistence but this requires a number of extra ...
11
votes
13answers
47k views

What Are Some Good Open Source Alternatives to Active Directory?

I'm looking for a good open-source alternative to active directory that can handle: Authorization/Authentication Group Policy Replication and Trust Monitoring In addition, are there any ...
11
votes
4answers
54k views

What is a domain controller, when is it needed, and how to set it up?

I would like to know what do we mean by Domain controller and how do we make a system a Domain Controller and when do we have to make a system a DC?
11
votes
3answers
9k views

How safe are Windows Active Directory Schema Updates?

I'm trying to get a better understanding about how Active Directory handles Schema updates, specifically how safe the procedure actually is given how critical AD is and given the range of situations ...
11
votes
3answers
53k views

User in domain admin group cannot access directory the group has permission to access

I've run into a rather interesting issue when playing with one of my domain labs. There's a directory on a 2008 R2 fileserver that's being used for folder redirection for all users in the "Staff" OU. ...
11
votes
6answers
24k views

How to join domain and still maintain settings from unjoined user profile?

I have some Vista x64 workstatons configured for software development that have never been joined to our AD domain. The users have lots of custom settings in their local unjoined user profiles that ...
11
votes
5answers
45k views

How can I clear cached domain credentials?

Related: How can I enable domain authentication over wireless in Windows 7/2k8? To test the domain login over wireless connection feature I'm trying to set up in the above question, I need an ...
11
votes
2answers
744 views

Why is my domain controller causing my router to send advertisements for Unique Local Addresses?

I'm currently evaluating Server 2012 to serve as a domain controller in a small heterogeneous network of Linux and Windows workstations and servers, all of which would eventually be joined to the ...
11
votes
4answers
2k views

Windows Domain replication monitoring tool

I am looking for web-based interface GUI, or some kind of monitoring tool that will show replication status for a domain. I know I can use repadmin with various options on the command line to query ...
11
votes
2answers
45k views

Can I replace my domain controller with Azure Active Directory? [duplicate]

I currently have a small network with a few servers and about 25 client PCs. We are using Office365 and have AD synchronisation setup from our on-premise server. We also have single-sign-on setup ...
11
votes
2answers
10k views

Is there a way to refresh computer group membership without rebooting?

I am using Windows Server 2008 R2 and have a windows service running under "network service" account in computer ComputerA. This windows service want to access a share folde (on another computer ...
11
votes
3answers
45k views

How do you trace/debug LDAP connections against Active Directory?

I am spoiled, and have been doing most of my LDAP work with eDirectory, which has a utility called DSTrace which is lovely, and for LDAP specifically, will show you all the bind attempts, the source ...
11
votes
3answers
3k views

How can I switch an existing set of Subversion repositories to use ActiveDirectory? (svnserve/windows)

I have a set of private Subversion repositories on a Windows Server 2003 box which developers access via SVNServe over the svn:// protocol. Currently we have been using the authz and passwd files for ...
11
votes
3answers
3k views

Using Firefox in Windows Domain Environment?

Is anyone successfully using Firefox 3 in a Windows domain? By "successfully" I mean deploying via AD, configuring via GPO (especially setting network.automatic-ntlm-auth.trusted-uris), default ...
11
votes
4answers
2k views

Has anyone ever used SMTP site links?

A simple real-life question, inspired by a comment here: Active Directory has supported inter-site replication using SMTP instead of direct RPC since its first introduction in Windows 2000. But did ...
10
votes
4answers
733 views

Simulate printers on AD network

I need to create an Active Directory lab that contains printers and test out various printer-related functionality (adding printers in AD, clients attaching to printers, printers, etc) Is there a ...
10
votes
5answers
25k views

How can I set up Redmine => Active Directory authentication?

First, I'm not an AD admin on site, but my manager has asked me to try to get my personal Redmine installation to integrate with ActiveDirectory in order to test-drive it for a larger-scale rollout. ...
10
votes
6answers
13k views

Group Policy: Administrator Rights for Specific Users on Specific Computers

I'm a programmer stuck trying to administer an Active Directory setup for a small company. The Domain Controller is running Windows Small Business Server 2008. We have a staff of field workers using ...
10
votes
5answers
26k views

Applying a GPO to one user on one computer only

I have a GPO that I need to apply to the user DOMAIN\DumbGuy, but only when he logs on to DOMAIN\DumbGuysComputer$. When DOMAIN\NiceReceptionist logs on to DOMAIN\DumbGuysComputer$ it should not apply....
10
votes
4answers
668 views

Terminology for Windows domain

I am a system administrator in a Linux shop. We are in the initial steps of inheriting a Windows Domain. I have some terminology questions: The usernames are WORKPAC\johndoe. What is the bolded ...
10
votes
5answers
12k views

Should Windows Web Servers be members of an Active Directory Domain

In terms of security and manageability - What is best practice? Should web servers Be added to and managed from an Active Directory domain or Be part of a 'web server' workgroup that is ...
10
votes
8answers
37k views

Web interface to allow users to change their Active Directory password

I have a few web applications that use Active Directory to authenticate. What I would like to be able to do is provide a simple web page that would allow users to update their AD password. This wasn'...
10
votes
4answers
38k views

Account to read AD, join machine to domain, delete computer accounts and move computers to OUs

I want to create an account that will perform the following: Join computers to a domain (not restricted to 10, like a normal user) Check for computer accounts in AD Delete computers from AD Move ...
10
votes
3answers
15k views

Can you find out when a new user was created in Active Directory on Windows 2003 Server?

As the question title says, I am trying to find out when a user account was created in Active Directory. The operating system is Windows Server 2003.
10
votes
8answers
5k views

Is this a recommended/valid approach for file server permissions?

File servers are a fact of life in IT and I'm curious if there are any generally accepted practices (I hesitate to use the word "best" here) for how you create groups and apply permissions for ...
10
votes
3answers
4k views

Deploying Printers via GPO/GPP - is there a programmatic option?

For reasons beyond my control, I've been tasked with setting up GPO/GPPs to deploy our 100+ printers to our 1000+ clients. The good news is that we have over a dozen sites, and for the most part, I'm ...
10
votes
2answers
7k views

Running Windows domain on Amazon EC2

It is possible to run Windows Server 2003 instances on Amazon EC2. I was wondering is it possible for one or more of these machines to be a domain controller and the other machines you run to be a ...
10
votes
3answers
3k views

At what point does a domain suit a network better than a workgroup?

At what point does a domain suit a network better than a workgroup? Is there a threshold below which a domain is simply too much work for benefits gained? Is there a point after which a workgroup is ...
10
votes
4answers
10k views

How do I find orphaned computer objects in Active Directory using PowerShell?

How can I find all computer accounts in my Active Directory domain that have been inactive for x days using PowerShell? Note that I do actually know how to do this. This is a self-answered ...
10
votes
2answers
19k views

Why does removing the EVERYONE group prevent domain admins from accessing a drive?

This is related to this question: Domain Admins group denied access to d: drive I have a member server in a brand new AD lab environment. I have an Active Directory user ADMIN01 who is a ...
10
votes
2answers
413 views

What are the implications of converting all my groups to universal groups?

In Exchange 2010 distribution groups must be universal. This is supported by documentation You can create or mail-enable only universal distribution groups. I am trying to create a role based ...
10
votes
3answers
7k views

Active Directory user names: why does the canonical name vary? Can I do something to make them uniform?

I am a self-taught administrator of a work Active Directory network used for Windows logins on ~30 PCs. I inherited the system from someone else who also didn't have any direct Microsoft training and ...
10
votes
1answer
108 views

How many FSMO roles are there?

I've always understood that there are five FSMO roles, but sometimes I see something that says there are seven. How many are there, really?
10
votes
1answer
586 views

In a multi-domain forest, what EXACTLY happens when some, but not all, of the Infrastructure Masters are on Global Catalogs?

There are plenty of TechNet articles, like this one that say that phantom object don't get updated if an Infrastructure Master is also a Global Catalog, but other than that there isn't a lot of in ...
10
votes
3answers
3k views

How to deny access to disabled AD accounts via kerberos in pam_krb5?

I have a working AD/Linux/LDAP/KRB5 directory and authentication setup, with one small problem. When an account is disabled, SSH publickey authentication still allows user login. It's clear that ...
10
votes
1answer
8k views

Configure WinRM using a .bat file without yes/no prompt

I want to configure winrm in all my clients using a bat file. after running bat file winrm quickconfig command there's a prompt for a yes/no answer. I don't know how to answer "yes" in the batch file.
10
votes
1answer
896 views

Active Directory forest with same name as root DNS zone and browsing to site with same name

Related to this previous question of mine about why it's a bad idea to use the root domain name as your Active Directory forest's name... I have an employer, whom I will refer to as ITcluelessinc, ...
10
votes
1answer
2k views

Active Directory: How does the computer logon process and the user logon process differ?

I believe it is correct to say that users and computers are treated as equal principals with respect to Active Directory. Both users and computers have passwords, and both users and computers are ...
10
votes
1answer
1k views

AD Cross-forest authentication - groups missing from PAC

I have an Active Directory setup consisting of 2 forests: 1 multi-domain forest with 1 forest root domain, and 2 direct child domains 1 single-domain forest for DMZ publishing purposes I have ...
10
votes
2answers
8k views

Cloud hosting for windows domain controller, possible?

We currently host our own domain controller (small company) locally on dedicated h/w. However to mitigate disaster we're considering the use of virtualisation and cloud hosting. One thought is ...