A Microsoft technology for sharing one set of user accounts, security permissions, and management information across many Windows servers and desktops.

learn more… | top users | synonyms (2)

10
votes
4answers
506 views

Simulate printers on AD network

I need to create an Active Directory lab that contains printers and test out various printer-related functionality (adding printers in AD, clients attaching to printers, printers, etc) Is there a ...
10
votes
4answers
21k views

How can I set up Redmine => Active Directory authentication?

First, I'm not an AD admin on site, but my manager has asked me to try to get my personal Redmine installation to integrate with ActiveDirectory in order to test-drive it for a larger-scale rollout. ...
10
votes
5answers
18k views

Applying a GPO to one user on one computer only

I have a GPO that I need to apply to the user DOMAIN\DumbGuy, but only when he logs on to DOMAIN\DumbGuysComputer$. When DOMAIN\NiceReceptionist logs on to DOMAIN\DumbGuysComputer$ it should not ...
10
votes
4answers
571 views

Terminology for Windows domain

I am a system administrator in a Linux shop. We are in the initial steps of inheriting a Windows Domain. I have some terminology questions: The usernames are WORKPAC\johndoe. What is the bolded ...
10
votes
2answers
1k views

Can I completely remove the Windows DNS in favour of BIND9 in an AD network?

I would like to remove the DNS feature of Windows Domain Controllers and point the DNS servers to our BIND9 servers. I know it's possible to setup coexistence but this requires a number of extra ...
10
votes
7answers
31k views

Web interface to allow users to change their Active Directory password

I have a few web applications that use Active Directory to authenticate. What I would like to be able to do is provide a simple web page that would allow users to update their AD password. This ...
10
votes
4answers
32k views

Account to read AD, join machine to domain, delete computer accounts and move computers to OUs

I want to create an account that will perform the following: Join computers to a domain (not restricted to 10, like a normal user) Check for computer accounts in AD Delete computers from AD Move ...
10
votes
8answers
4k views

Is this a recommended/valid approach for file server permissions?

File servers are a fact of life in IT and I'm curious if there are any generally accepted practices (I hesitate to use the word "best" here) for how you create groups and apply permissions for ...
10
votes
3answers
2k views

Deploying Printers via GPO/GPP - is there a programmatic option?

For reasons beyond my control, I've been tasked with setting up GPO/GPPs to deploy our 100+ printers to our 1000+ clients. The good news is that we have over a dozen sites, and for the most part, I'm ...
10
votes
3answers
17k views

Restrict access to IIS site to an AD Group

Is it possible in IIS to set up a site in IIS and only let users of a certain AD Group get access to it?
10
votes
6answers
17k views

How to join domain and still maintain settings from unjoined user profile?

I have some Vista x64 workstatons configured for software development that have never been joined to our AD domain. The users have lots of custom settings in their local unjoined user profiles that ...
10
votes
2answers
15k views

Why does removing the EVERYONE group prevent domain admins from accessing a drive?

This is related to this question: Domain Admins group denied access to d: drive I have a member server in a brand new AD lab environment. I have an Active Directory user ADMIN01 who is a ...
10
votes
3answers
4k views

Active Directory user names: why does the canonical name vary? Can I do something to make them uniform?

I am a self-taught administrator of a work Active Directory network used for Windows logins on ~30 PCs. I inherited the system from someone else who also didn't have any direct Microsoft training and ...
10
votes
1answer
513 views

In a multi-domain forest, what EXACTLY happens when some, but not all, of the Infrastructure Masters are on Global Catalogs?

There are plenty of TechNet articles, like this one that say that phantom object don't get updated if an Infrastructure Master is also a Global Catalog, but other than that there isn't a lot of in ...
10
votes
3answers
2k views

How to deny access to disabled AD accounts via kerberos in pam_krb5?

I have a working AD/Linux/LDAP/KRB5 directory and authentication setup, with one small problem. When an account is disabled, SSH publickey authentication still allows user login. It's clear that ...
10
votes
2answers
8k views

Is there a way to refresh computer group membership without rebooting?

I am using Windows Server 2008 R2 and have a windows service running under "network service" account in computer ComputerA. This windows service want to access a share folde (on another computer ...
10
votes
1answer
570 views

Active Directory forest with same name as root DNS zone and browsing to site with same name

Related to this previous question of mine about why it's a bad idea to use the root domain name as your Active Directory forest's name... I have an employer, whom I will refer to as ITcluelessinc, ...
10
votes
1answer
5k views

Configure WinRM using a .bat file without yes/no prompt

I want to configure winrm in all my clients using a bat file. after running bat file winrm quickconfig command there's a prompt for a yes/no answer. I don't know how to answer "yes" in the batch file. ...
10
votes
1answer
2k views

Active Directory: How does the computer logon process and the user logon process differ?

I believe it is correct to say that users and computers are treated as equal principals with respect to Active Directory. Both users and computers have passwords, and both users and computers are ...
10
votes
1answer
1k views

AD Cross-forest authentication - groups missing from PAC

I have an Active Directory setup consisting of 2 forests: 1 multi-domain forest with 1 forest root domain, and 2 direct child domains 1 single-domain forest for DMZ publishing purposes I have ...
10
votes
2answers
7k views

Cloud hosting for windows domain controller, possible?

We currently host our own domain controller (small company) locally on dedicated h/w. However to mitigate disaster we're considering the use of virtualisation and cloud hosting. One thought is ...
10
votes
1answer
630 views

Active Directory and Exchange Architecture Questions and Issues

Here's the background on our situation... Right now, we are setup as three distinct companies with three complete Active Directory and Exchange systems. The three offices (One in the US, two in ...
10
votes
1answer
255 views

What effect does setting the manager field for a computer object in Active Directory have?

If you set the Manager for a User object in Active directory, it creates a clear relationship between the user and their manager. This is reported in Exchange's Global Address List amongst other ...
10
votes
1answer
289 views

Can I “merge” two groups using SID history?

I have two AD groups which were erroneously created while there should instead have been only one group; they contain the exact same users. However, these groups have been assigned various permissions ...
10
votes
8answers
18k views

ActiveSync devices causing accounts to lockout

When a user changes his account password for whatever reason (read: expired), and the old password is stored in his mobile device connected through EAS. This will cause his account almost immediately ...
10
votes
3answers
7k views

Domain rename with Exchange 2010

I have taken over all IT responsibilities for a company that is using Active Directory (2008 R2 native level) and Exchange 2010. I have come to find out that their internal Active Directory domain ...
10
votes
2answers
673 views

How to enable BitLocker with no prompts to the end user

I have configured BitLocker and TPM settings in Group Policy such that all the options are set and the recovery keys stored in Active Directory. All our machines are running Windows 7 with a standard ...
9
votes
9answers
67k views

Get list of AD groups a user is a member of

Suppose I have the user id of a user in Active Directory. I'd like to get a list of all AD groups in which that user is currently a member of. How can I do this from the Windows command line? I've ...
9
votes
6answers
11k views

Group Policy: Administrator Rights for Specific Users on Specific Computers

I'm a programmer stuck trying to administer an Active Directory setup for a small company. The Domain Controller is running Windows Small Business Server 2008. We have a staff of field workers using ...
9
votes
1answer
328 views

Is there any reason to backup Active Directory if you have more than one domain controller?

In one site there are 3 domain controllers. There are an additional 3 domain controllers for 3 remote sites. My question: Is there any reason why you should still backup Active Directory? If one of ...
9
votes
4answers
19k views

How to create a limited “domain admin” that does not have access to domain controllers?

I'm looking to create an account similar to a Domain Admin, but without access to domain controllers. In other words, this account will have full Administrator rights to any client machine in the ...
9
votes
2answers
10k views

Can you find out when a new user was created in Active Directory on Windows 2003 Server?

As the question title says, I am trying to find out when a user account was created in Active Directory. The operating system is Windows Server 2003.
9
votes
5answers
29k views

How can I clear cached domain credentials?

Related: How can I enable domain authentication over wireless in Windows 7/2k8? To test the domain login over wireless connection feature I'm trying to set up in the above question, I need an ...
9
votes
3answers
30k views

How to find the cause of locked user account in Windows AD domain

After a recent incident with Outlook, I was wondering how I would most efficiently resolve the following problem: Assume a fairly typical small to medium sized AD infrastructure: several DCs, a ...
9
votes
4answers
7k views

How do I find orphaned computer objects in Active Directory using PowerShell?

How can I find all computer accounts in my Active Directory domain that have been inactive for x days using PowerShell? Note that I do actually know how to do this. This is a self-answered ...
9
votes
3answers
1k views

What good Active Directory + Exchange competition is there?

Based on this question regarding enhanced permission support in filesystems, what is the best permissions + directory and mail stack to compare against Active Directory on NTFS with Exchange? I'm ...
9
votes
2answers
7k views

Running Windows domain on Amazon EC2

It is possible to run Windows Server 2003 instances on Amazon EC2. I was wondering is it possible for one or more of these machines to be a domain controller and the other machines you run to be a ...
9
votes
2answers
1k views

Demoted domain controller still authenticating users

Why is a demoted domain controller still authenticating users? Whenever users log onto workstations with domain accounts, this demoted DC authenticates them. Its security log shows their logons, ...
9
votes
7answers
25k views

VPN Connection causes DNS to use wrong DNS server

I have a Windows 7 PC on our company network (which is a member of our Active Directory). Everything works fine until I open a VPN connection to a customer's site. When I do connect, I lose network ...
9
votes
2answers
2k views

Active Directory - Bulk Company Update

I was wondering if there is a way to update the 'Company' field for a large group of users within Active Directory? I would like to match all users with a company ending in a certain string. It would ...
9
votes
1answer
1k views

Can a user account that is disabled in Active Directory still receive email?

I'm reading Learning Exchange Server 2003 by Boswell, and there's a section in there that mentions that a disabled account in AD cannot receive email and that it will be bounced back. Currently, what ...
9
votes
1answer
531 views

Kerberos authentication, service host and access to KDC

I have a web application (hostname: service.domain.com) and I wish to use Kerberos authentication to identify users that are logged into a Windows domain. Microsoft AD (Windows Server 2008 R2) is ...
9
votes
1answer
513 views

What are the best practices for service accounts?

We're running several services in our company using a shared domain account. Unfortunately, the credentials for this account are widely distributed and being used frequently for both service and ...
9
votes
4answers
6k views

Domain computer cannot resolve internal hostnames, but nslookup can

I have a Windows 7 computer on my domain that is behaving oddly. It is possible to ping www.google.com It can ping internal hosts using their IP address It can ping the local Domain Controller/DNS ...
9
votes
3answers
31k views

How do you trace/debug LDAP connections against Active Directory?

I am spoiled, and have been doing most of my LDAP work with eDirectory, which has a utility called DSTrace which is lovely, and for LDAP specifically, will show you all the bind attempts, the source ...
9
votes
2answers
570 views

LDAP authentication: Windows Server2k3 vs. 2k8

We have around 70% linux users, all of which are configured to authenticate against Active Directory through LDAP. In order for this to work, we used the "Windows Services for Unix" under Windows ...
9
votes
2answers
1k views

Win7 clients failing with cached credentials on samba4 RODC

I'm setting up a test environment for a customer about to deploy samba4 into 1400 remote sites and I'm running into a problem. It's my job, after all, to run into problems and then solve them. Active ...
9
votes
4answers
21k views

How to disable Tcp/Ip settings in windows 7 via GPO?

I have enabled following policies, "Prohibit TCP/IP advanced connection" "Prohibit access to properties of components of a LAN connection" "Enable Windows 2000 Network Connections setings for ...
9
votes
1answer
501 views

“The zone can be scavenged after” keeps incrementing

What are you trying to do? I'm trying to enable DNS scavenging on a DNS zone that has about a hundred stale DNS records. What have you tried in order to make it happen? I setup DNS Scavenging per ...
8
votes
3answers
2k views

Should I have multiple domain administrator accounts?

I work in a small organization with 2 servers and 30 clients. We are completely Windows Server 2003/XP. Besides me, the Director of Operations and our IT consulting company need access to a domain ...