A Microsoft technology for sharing one set of user accounts, security permissions, and management information across many Windows servers and desktops.

learn more… | top users | synonyms (2)

10
votes
3answers
2k views

Deploying Printers via GPO/GPP - is there a programmatic option?

For reasons beyond my control, I've been tasked with setting up GPO/GPPs to deploy our 100+ printers to our 1000+ clients. The good news is that we have over a dozen sites, and for the most part, I'm ...
10
votes
2answers
3k views

Website and Active Directory domain share the same name

In our network the name of the network domain is also the domain of the organization's website (say, example.com). Externally, people can enter example.com to visit our website, but internally, this ...
10
votes
6answers
15k views

How to join domain and still maintain settings from unjoined user profile?

I have some Vista x64 workstatons configured for software development that have never been joined to our AD domain. The users have lots of custom settings in their local unjoined user profiles that ...
10
votes
3answers
3k views

Active Directory user names: why does the canonical name vary? Can I do something to make them uniform?

I am a self-taught administrator of a work Active Directory network used for Windows logins on ~30 PCs. I inherited the system from someone else who also didn't have any direct Microsoft training and ...
10
votes
4answers
12k views

How does SSO using Active Directory works where user is transparently logged in. (intranet webapp)

I'm told that it's possible to make a web application not require a login. The user logs in to Windows, which authenticates via an Active Directory (LDAP) Lookup. Then, they should be able to go to ...
10
votes
1answer
456 views

In a multi-domain forest, what EXACTLY happens when some, but not all, of the Infrastructure Masters are on Global Catalogs?

There are plenty of TechNet articles, like this one that say that phantom object don't get updated if an Infrastructure Master is also a Global Catalog, but other than that there isn't a lot of in ...
10
votes
3answers
2k views

How to deny access to disabled AD accounts via kerberos in pam_krb5?

I have a working AD/Linux/LDAP/KRB5 directory and authentication setup, with one small problem. When an account is disabled, SSH publickey authentication still allows user login. It's clear that ...
10
votes
2answers
7k views

Is there a way to refresh computer group membership without rebooting?

I am using Windows Server 2008 R2 and have a windows service running under "network service" account in computer ComputerA. This windows service want to access a share folde (on another computer ...
10
votes
1answer
320 views

Active Directory forest with same name as root DNS zone and browsing to site with same name

Related to this previous question of mine about why it's a bad idea to use the root domain name as your Active Directory forest's name... I have an employer, whom I will refer to as ITcluelessinc, ...
10
votes
1answer
4k views

Configure WinRM using a .bat file without yes/no prompt

I want to configure winrm in all my clients using a bat file. after running bat file winrm quickconfig command there's a prompt for a yes/no answer. I don't know how to answer "yes" in the batch file. ...
10
votes
4answers
40k views

How to allow active directory users to remote desktop in?

This is my first time setting up or even using active directory. I set it up, and added the computers(Actually VMs in Hyper V) to the active directory, and if if I use hyper-V to connect to the VMs, ...
10
votes
1answer
2k views

Active Directory: How does the computer logon process and the user logon process differ?

I believe it is correct to say that users and computers are treated as equal principals with respect to Active Directory. Both users and computers have passwords, and both users and computers are ...
10
votes
1answer
1k views

AD Cross-forest authentication - groups missing from PAC

I have an Active Directory setup consisting of 2 forests: 1 multi-domain forest with 1 forest root domain, and 2 direct child domains 1 single-domain forest for DMZ publishing purposes I have ...
10
votes
1answer
612 views

Active Directory and Exchange Architecture Questions and Issues

Here's the background on our situation... Right now, we are setup as three distinct companies with three complete Active Directory and Exchange systems. The three offices (One in the US, two in ...
10
votes
1answer
234 views

What effect does setting the manager field for a computer object in Active Directory have?

If you set the Manager for a User object in Active directory, it creates a clear relationship between the user and their manager. This is reported in Exchange's Global Address List amongst other ...
10
votes
1answer
245 views

Can I “merge” two groups using SID history?

I have two AD groups which were erroneously created while there should instead have been only one group; they contain the exact same users. However, these groups have been assigned various permissions ...
10
votes
8answers
16k views

ActiveSync devices causing accounts to lockout

When a user changes his account password for whatever reason (read: expired), and the old password is stored in his mobile device connected through EAS. This will cause his account almost immediately ...
10
votes
3answers
7k views

Domain rename with Exchange 2010

I have taken over all IT responsibilities for a company that is using Active Directory (2008 R2 native level) and Exchange 2010. I have come to find out that their internal Active Directory domain ...
10
votes
2answers
425 views

How to enable BitLocker with no prompts to the end user

I have configured BitLocker and TPM settings in Group Policy such that all the options are set and the recovery keys stored in Active Directory. All our machines are running Windows 7 with a standard ...
9
votes
4answers
19k views

How can I set up Redmine => Active Directory authentication?

First, I'm not an AD admin on site, but my manager has asked me to try to get my personal Redmine installation to integrate with ActiveDirectory in order to test-drive it for a larger-scale rollout. ...
9
votes
1answer
323 views

Is there any reason to backup Active Directory if you have more than one domain controller?

In one site there are 3 domain controllers. There are an additional 3 domain controllers for 3 remote sites. My question: Is there any reason why you should still backup Active Directory? If one of ...
9
votes
4answers
16k views

How to create a limited “domain admin” that does not have access to domain controllers?

I'm looking to create an account similar to a Domain Admin, but without access to domain controllers. In other words, this account will have full Administrator rights to any client machine in the ...
9
votes
4answers
6k views

How do I find orphaned computer objects in Active Directory using PowerShell?

How can I find all computer accounts in my Active Directory domain that have been inactive for x days using PowerShell? Note that I do actually know how to do this. This is a self-answered ...
9
votes
4answers
29k views

Account to read AD, join machine to domain, delete computer accounts and move computers to OUs

I want to create an account that will perform the following: Join computers to a domain (not restricted to 10, like a normal user) Check for computer accounts in AD Delete computers from AD Move ...
9
votes
2answers
7k views

Running Windows domain on Amazon EC2

It is possible to run Windows Server 2003 instances on Amazon EC2. I was wondering is it possible for one or more of these machines to be a domain controller and the other machines you run to be a ...
9
votes
2answers
845 views

Demoted domain controller still authenticating users

Why is a demoted domain controller still authenticating users? Whenever users log onto workstations with domain accounts, this demoted DC authenticates them. Its security log shows their logons, ...
9
votes
2answers
1k views

Active Directory - Bulk Company Update

I was wondering if there is a way to update the 'Company' field for a large group of users within Active Directory? I would like to match all users with a company ending in a certain string. It would ...
9
votes
1answer
1k views

Can a user account that is disabled in Active Directory still receive email?

I'm reading Learning Exchange Server 2003 by Boswell, and there's a section in there that mentions that a disabled account in AD cannot receive email and that it will be bounced back. Currently, what ...
9
votes
1answer
461 views

Kerberos authentication, service host and access to KDC

I have a web application (hostname: service.domain.com) and I wish to use Kerberos authentication to identify users that are logged into a Windows domain. Microsoft AD (Windows Server 2008 R2) is ...
9
votes
1answer
418 views

What are the best practices for service accounts?

We're running several services in our company using a shared domain account. Unfortunately, the credentials for this account are widely distributed and being used frequently for both service and ...
9
votes
2answers
7k views

Cloud hosting for windows domain controller, possible?

We currently host our own domain controller (small company) locally on dedicated h/w. However to mitigate disaster we're considering the use of virtualisation and cloud hosting. One thought is ...
9
votes
3answers
3k views

Domain computer cannot resolve internal hostnames, but nslookup can

I have a Windows 7 computer on my domain that is behaving oddly. It is possible to ping www.google.com It can ping internal hosts using their IP address It can ping the local Domain Controller/DNS ...
9
votes
3answers
26k views

How do you trace/debug LDAP connections against Active Directory?

I am spoiled, and have been doing most of my LDAP work with eDirectory, which has a utility called DSTrace which is lovely, and for LDAP specifically, will show you all the bind attempts, the source ...
9
votes
2answers
559 views

LDAP authentication: Windows Server2k3 vs. 2k8

We have around 70% linux users, all of which are configured to authenticate against Active Directory through LDAP. In order for this to work, we used the "Windows Services for Unix" under Windows ...
9
votes
2answers
1k views

Win7 clients failing with cached credentials on samba4 RODC

I'm setting up a test environment for a customer about to deploy samba4 into 1400 remote sites and I'm running into a problem. It's my job, after all, to run into problems and then solve them. Active ...
9
votes
4answers
20k views

How to disable Tcp/Ip settings in windows 7 via GPO?

I have enabled following policies, "Prohibit TCP/IP advanced connection" "Prohibit access to properties of components of a LAN connection" "Enable Windows 2000 Network Connections setings for ...
8
votes
8answers
48k views

Get list of AD groups a user is a member of

Suppose I have the user id of a user in Active Directory. I'd like to get a list of all AD groups in which that user is currently a member of. How can I do this from the Windows command line? I've ...
8
votes
3answers
2k views

Should I have multiple domain administrator accounts?

I work in a small organization with 2 servers and 30 clients. We are completely Windows Server 2003/XP. Besides me, the Director of Operations and our IT consulting company need access to a domain ...
8
votes
5answers
10k views

Group Policy: Administrator Rights for Specific Users on Specific Computers

I'm a programmer stuck trying to administer an Active Directory setup for a small company. The Domain Controller is running Windows Small Business Server 2008. We have a staff of field workers using ...
8
votes
3answers
2k views

How is software deployed via Active Directory?

What are the steps required for deploying a software package via Active Directory / GPO?
8
votes
2answers
5k views

Moving primary domain controller to new server

I have just purchased a new server that will be the new primary domain controller. I was wondering if anyone knew any articles or tutorials on how to do this change over? I would imagine it is just ...
8
votes
4answers
14k views

Fix error determining whether the target environment requires adprep in windows server 2012, during domain controller promotion

I am unable to promote my newly installed Windows Server 2012 machine to a domain controller. I have two existing domain controllers. The primary is at Windows Server 2003 level, and is running ...
8
votes
5answers
6k views

Active Directory: Is it required that the “A” record for a domain point to a Domain Controller?

Currently we have an Active Directory setup, and say the name is 'domain.com'. The DNS entries for domain.com has two A records pointing to the two domain controllers. I would like internal users to ...
8
votes
2answers
1k views

Detecting AD Site options using PowerShell

How can I use PowerShell to find AD site options like +IS_INTER_SITE_AUTO_TOPOLOGY_DISABLED in PowerShell? I've been playing around with the following command, but can't get it to spit out anything ...
8
votes
2answers
179 views

Entering people's email addresses in AD

We've got a Windows 2003 Server Active Directory environment. In AD you can enter a person's email address. Back when we used to have Exchange, when creating a new user it would also create an entry ...
8
votes
1answer
269 views

In Active Directory, does a user account get locked out domain-wide or at the server level?

Right now I have a user who is able to use his domain credentials to log in to any server on our network, except one. The server that he cannot log in to allows other domain users to connect, but when ...
8
votes
2answers
8k views

Can you find out when a new user was created in Active Directory on Windows 2003 Server?

As the question title says, I am trying to find out when a user account was created in Active Directory. The operating system is Windows Server 2003.
8
votes
6answers
5k views

What's the best wiki to run on Windows?

I want to set up a wiki for my team. I need it to run on Windows/IIS and if it needs a database, against SQL Server. User-authentication must use/integrate with Active Directory, ideally natively ...
8
votes
1answer
417 views

Can I create the active directory forest corp.domain.com without creating domain.com first?

Is there any way which I can create the active directory domain corp.domain.com without first creating domain.com AD DCs? Or to put another way, can corp.domain.com be the root of the forest?
8
votes
2answers
390 views

Issues related to storing photos in Active Directory?

Are their any known issues with storing employee photos in AD provided you store them in the compliant sizes and formats? Is there a critical mass that you break or could corrupt AD databases? I'm ...