A Microsoft technology for sharing one set of user accounts, security permissions, and management information across many Windows servers and desktops.

learn more… | top users | synonyms (2)

12
votes
7answers
4k views

How do you document/track your permissions

I'm a Windows Admin so those that integrate with Windows will likely be most helpful. My main challenge at this point is just with file shares but as SharePoint use increases it will only make this ...
11
votes
2answers
2k views

How can I log into a Domain controller that doesn't trust itself

I have a windows 2008 R2 standalone Domain Controller that I restored from backup. The original DC is offline. When I log in with valid user credentials I get the error: "The security database ...
11
votes
4answers
26k views

How to create a limited “domain admin” that does not have access to domain controllers?

I'm looking to create an account similar to a Domain Admin, but without access to domain controllers. In other words, this account will have full Administrator rights to any client machine in the ...
11
votes
1answer
37k views

What permissions are required for enumerating users groups in Active Directory

I have a .net web application which needs to obtain the groups a user is a member of in Active Directory. Todo this I am using the memberOf attribute on the users records. I need to know the ...
11
votes
2answers
17k views

What is ADFS (Active Directory Federation Services)?

So I've been told that our PHP application may need to support authentication using ADFS. For a non-Microsoft person, what is ADFS? How does it differ to things like LDAP? How does it work? What ...
11
votes
4answers
52k views

What is a domain controller, when is it needed, and how to set it up?

I would like to know what do we mean by Domain controller and how do we make a system a Domain Controller and when do we have to make a system a DC?
11
votes
3answers
9k views

How safe are Windows Active Directory Schema Updates?

I'm trying to get a better understanding about how Active Directory handles Schema updates, specifically how safe the procedure actually is given how critical AD is and given the range of situations ...
11
votes
3answers
49k views

User in domain admin group cannot access directory the group has permission to access

I've run into a rather interesting issue when playing with one of my domain labs. There's a directory on a 2008 R2 fileserver that's being used for folder redirection for all users in the "Staff" OU. ...
11
votes
5answers
42k views

How can I clear cached domain credentials?

Related: How can I enable domain authentication over wireless in Windows 7/2k8? To test the domain login over wireless connection feature I'm trying to set up in the above question, I need an ...
11
votes
6answers
23k views

How to join domain and still maintain settings from unjoined user profile?

I have some Vista x64 workstatons configured for software development that have never been joined to our AD domain. The users have lots of custom settings in their local unjoined user profiles that ...
11
votes
5answers
18k views

Linux + Active directory authentication + only letting certain groups login

I have some linux boxes that use Windows Active Directory authentication, that works just fine (Samba + Winbind). What I would like to do now though is only allow certain people or certain groups to ...
11
votes
2answers
725 views

Why is my domain controller causing my router to send advertisements for Unique Local Addresses?

I'm currently evaluating Server 2012 to serve as a domain controller in a small heterogeneous network of Linux and Windows workstations and servers, all of which would eventually be joined to the ...
11
votes
4answers
2k views

Windows Domain replication monitoring tool

I am looking for web-based interface GUI, or some kind of monitoring tool that will show replication status for a domain. I know I can use repadmin with various options on the command line to query ...
11
votes
2answers
9k views

Is there a way to refresh computer group membership without rebooting?

I am using Windows Server 2008 R2 and have a windows service running under "network service" account in computer ComputerA. This windows service want to access a share folde (on another computer ...
11
votes
3answers
42k views

How do you trace/debug LDAP connections against Active Directory?

I am spoiled, and have been doing most of my LDAP work with eDirectory, which has a utility called DSTrace which is lovely, and for LDAP specifically, will show you all the bind attempts, the source ...
11
votes
3answers
3k views

How can I switch an existing set of Subversion repositories to use ActiveDirectory? (svnserve/windows)

I have a set of private Subversion repositories on a Windows Server 2003 box which developers access via SVNServe over the svn:// protocol. Currently we have been using the authz and passwd files for ...
11
votes
3answers
3k views

Using Firefox in Windows Domain Environment?

Is anyone successfully using Firefox 3 in a Windows domain? By "successfully" I mean deploying via AD, configuring via GPO (especially setting network.automatic-ntlm-auth.trusted-uris), default ...
11
votes
4answers
2k views

Has anyone ever used SMTP site links?

A simple real-life question, inspired by a comment here: Active Directory has supported inter-site replication using SMTP instead of direct RPC since its first introduction in Windows 2000. But did ...
10
votes
4answers
679 views

Simulate printers on AD network

I need to create an Active Directory lab that contains printers and test out various printer-related functionality (adding printers in AD, clients attaching to printers, printers, etc) Is there a ...
10
votes
3answers
13k views

Your system administrator does not allow the user of saved credentials to log on to the remote computer

At our office, any of our Windows 7 Clients get this error message when we try and RDP to a remote W2K8 Server outside of the office :- Your system administrator does not allow the user of saved ...
10
votes
5answers
24k views

How can I set up Redmine => Active Directory authentication?

First, I'm not an AD admin on site, but my manager has asked me to try to get my personal Redmine installation to integrate with ActiveDirectory in order to test-drive it for a larger-scale rollout. ...
10
votes
6answers
13k views

Group Policy: Administrator Rights for Specific Users on Specific Computers

I'm a programmer stuck trying to administer an Active Directory setup for a small company. The Domain Controller is running Windows Small Business Server 2008. We have a staff of field workers using ...
10
votes
5answers
24k views

Applying a GPO to one user on one computer only

I have a GPO that I need to apply to the user DOMAIN\DumbGuy, but only when he logs on to DOMAIN\DumbGuysComputer$. When DOMAIN\NiceReceptionist logs on to DOMAIN\DumbGuysComputer$ it should not ...
10
votes
4answers
648 views

Terminology for Windows domain

I am a system administrator in a Linux shop. We are in the initial steps of inheriting a Windows Domain. I have some terminology questions: The usernames are WORKPAC\johndoe. What is the bolded ...
10
votes
8answers
36k views

Web interface to allow users to change their Active Directory password

I have a few web applications that use Active Directory to authenticate. What I would like to be able to do is provide a simple web page that would allow users to update their AD password. This ...
10
votes
2answers
1k views

Can I completely remove the Windows DNS in favour of BIND9 in an AD network?

I would like to remove the DNS feature of Windows Domain Controllers and point the DNS servers to our BIND9 servers. I know it's possible to setup coexistence but this requires a number of extra ...
10
votes
3answers
14k views

Can you find out when a new user was created in Active Directory on Windows 2003 Server?

As the question title says, I am trying to find out when a user account was created in Active Directory. The operating system is Windows Server 2003.
10
votes
4answers
37k views

Account to read AD, join machine to domain, delete computer accounts and move computers to OUs

I want to create an account that will perform the following: Join computers to a domain (not restricted to 10, like a normal user) Check for computer accounts in AD Delete computers from AD Move ...
10
votes
8answers
5k views

Is this a recommended/valid approach for file server permissions?

File servers are a fact of life in IT and I'm curious if there are any generally accepted practices (I hesitate to use the word "best" here) for how you create groups and apply permissions for ...
10
votes
3answers
4k views

Deploying Printers via GPO/GPP - is there a programmatic option?

For reasons beyond my control, I've been tasked with setting up GPO/GPPs to deploy our 100+ printers to our 1000+ clients. The good news is that we have over a dozen sites, and for the most part, I'm ...
10
votes
2answers
7k views

Running Windows domain on Amazon EC2

It is possible to run Windows Server 2003 instances on Amazon EC2. I was wondering is it possible for one or more of these machines to be a domain controller and the other machines you run to be a ...
10
votes
4answers
9k views

How do I find orphaned computer objects in Active Directory using PowerShell?

How can I find all computer accounts in my Active Directory domain that have been inactive for x days using PowerShell? Note that I do actually know how to do this. This is a self-answered ...
10
votes
2answers
18k views

Why does removing the EVERYONE group prevent domain admins from accessing a drive?

This is related to this question: Domain Admins group denied access to d: drive I have a member server in a brand new AD lab environment. I have an Active Directory user ADMIN01 who is a ...
10
votes
3answers
6k views

Active Directory user names: why does the canonical name vary? Can I do something to make them uniform?

I am a self-taught administrator of a work Active Directory network used for Windows logins on ~30 PCs. I inherited the system from someone else who also didn't have any direct Microsoft training and ...
10
votes
1answer
570 views

In a multi-domain forest, what EXACTLY happens when some, but not all, of the Infrastructure Masters are on Global Catalogs?

There are plenty of TechNet articles, like this one that say that phantom object don't get updated if an Infrastructure Master is also a Global Catalog, but other than that there isn't a lot of in ...
10
votes
3answers
2k views

How to deny access to disabled AD accounts via kerberos in pam_krb5?

I have a working AD/Linux/LDAP/KRB5 directory and authentication setup, with one small problem. When an account is disabled, SSH publickey authentication still allows user login. It's clear that ...
10
votes
1answer
7k views

Configure WinRM using a .bat file without yes/no prompt

I want to configure winrm in all my clients using a bat file. after running bat file winrm quickconfig command there's a prompt for a yes/no answer. I don't know how to answer "yes" in the batch file. ...
10
votes
1answer
845 views

Active Directory forest with same name as root DNS zone and browsing to site with same name

Related to this previous question of mine about why it's a bad idea to use the root domain name as your Active Directory forest's name... I have an employer, whom I will refer to as ITcluelessinc, ...
10
votes
1answer
2k views

Active Directory: How does the computer logon process and the user logon process differ?

I believe it is correct to say that users and computers are treated as equal principals with respect to Active Directory. Both users and computers have passwords, and both users and computers are ...
10
votes
1answer
1k views

AD Cross-forest authentication - groups missing from PAC

I have an Active Directory setup consisting of 2 forests: 1 multi-domain forest with 1 forest root domain, and 2 direct child domains 1 single-domain forest for DMZ publishing purposes I have ...
10
votes
2answers
8k views

Cloud hosting for windows domain controller, possible?

We currently host our own domain controller (small company) locally on dedicated h/w. However to mitigate disaster we're considering the use of virtualisation and cloud hosting. One thought is ...
10
votes
1answer
661 views

Active Directory and Exchange Architecture Questions and Issues

Here's the background on our situation... Right now, we are setup as three distinct companies with three complete Active Directory and Exchange systems. The three offices (One in the US, two in ...
10
votes
1answer
334 views

What effect does setting the manager field for a computer object in Active Directory have?

If you set the Manager for a User object in Active directory, it creates a clear relationship between the user and their manager. This is reported in Exchange's Global Address List amongst other ...
10
votes
1answer
379 views

Can I “merge” two groups using SID history?

I have two AD groups which were erroneously created while there should instead have been only one group; they contain the exact same users. However, these groups have been assigned various permissions ...
10
votes
8answers
22k views

ActiveSync devices causing accounts to lockout

When a user changes his account password for whatever reason (read: expired), and the old password is stored in his mobile device connected through EAS. This will cause his account to lockout almost ...
10
votes
3answers
8k views

Domain rename with Exchange 2010

I have taken over all IT responsibilities for a company that is using Active Directory (2008 R2 native level) and Exchange 2010. I have come to find out that their internal Active Directory domain ...
10
votes
6answers
35k views

How to change the current user's domain password without being domain admin?

I've seen plenty of documentation of how to reset a user's password by running net user <username> * /domain or locally net user <username> <new_password> But I am not domain ...
10
votes
2answers
2k views

How to enable BitLocker with no prompts to the end user

I have configured BitLocker and TPM settings in Group Policy such that all the options are set and the recovery keys stored in Active Directory. All our machines are running Windows 7 with a standard ...
10
votes
2answers
989 views

“The zone can be scavenged after” keeps incrementing

What are you trying to do? I'm trying to enable DNS scavenging on a DNS zone that has about a hundred stale DNS records. What have you tried in order to make it happen? I setup DNS Scavenging per ...
9
votes
3answers
2k views

Should I have multiple domain administrator accounts?

I work in a small organization with 2 servers and 30 clients. We are completely Windows Server 2003/XP. Besides me, the Director of Operations and our IT consulting company need access to a domain ...