A Microsoft technology for sharing one set of user accounts, security permissions, and management information across many Windows servers and desktops.

learn more… | top users | synonyms (2)

3
votes
2answers
7k views

What firewall ports need to be open for Active Directory?

I want to run DFS replication between a couple of servers. It's my understanding that the servers need to be part of a domain for this. Being able to give people a username and password that works on ...
3
votes
4answers
15k views

Diagnosing why a Group Policy Object is inaccessible

I have a Windows Server 2003 domain. One of the Group Policy Objects appears as a linked item in an OU but all I can see if the Unique ID and that the Link Status is Enabled. There is a red minus icon ...
2
votes
2answers
1k views

Windows XP cant join Server 2008 Domain

I've setup a new Server 2008 box with a new domain. I've done all my testing with a Windows 7 laptop which is being deployed with the network. It joined the domain fine, and worked as expected. Now ...
2
votes
2answers
231 views

How to reduce our AD account creation and maintenance requests and work load

Where I work, almost 40% of our support requests are for account management tasks : Create new account and assign in groups Unlock an account Reset a password Change an account's groups following a ...
1
vote
2answers
1k views

Convert local users to AD domain users Windows Server 2008 R2

I created a bunch of local accounts on machines at work before we had AD set up. Now I'd like to consolidate all the local accounts into domain accounts. For instance, I've got user "Fred Jones" on ...
1
vote
3answers
4k views

Auto-mounting a windows share on Linux AD login

I've managed to configure my test Ubuntu 10.04 Beta 2 Server VM to accept logins (via ssh) from users who have domain accounts in active directory via Kerberos, nsswitch.conf and PAM configurations. ...
-1
votes
4answers
450 views

What do I do when I've locked my self out of a newly created Active Directory server?

I've just setup a Windows 2003 server as the DNS/AD for a replace of an old server. However, it appears that I don't know the password for the Administrator account. I entered the Restore Mode ...
9
votes
2answers
7k views

Running Windows domain on Amazon EC2

It is possible to run Windows Server 2003 instances on Amazon EC2. I was wondering is it possible for one or more of these machines to be a domain controller and the other machines you run to be a ...
8
votes
2answers
6k views

Domain rename with Exchange 2010

I have taken over all IT responsibilities for a company that is using Active Directory (2008 R2 native level) and Exchange 2010. I have come to find out that their internal Active Directory domain ...
7
votes
13answers
12k views

Windows: Can domain controllers also serve other functions?

This question was a discussion about whether Active Directory is necessary to run Terminal Services. But a chain of answers and comments (mostly by me) brought up a related question around Domain ...
6
votes
4answers
268 views

Using AD as a general purpose directory [closed]

Is there anyone using AD as a general purpose directory (meaning for uses other than domain authentication / authorisation and stuff) ?
6
votes
4answers
2k views

Unable to dcpromo new 2008 Server in 2000 domain

I'm trying to replace an old Windows 2000 domain controller with a new Windows 2008 Server. I have the Active Directory Domain Services role installed on the new server and joined it to the domain. ...
5
votes
1answer
732 views

How to do exceptions in Group Policy?

We're implementing Group Policy for the first time at our organization and have some questions about best practices and capabilities. We've already done some work and want to see if there is a better ...
5
votes
1answer
11k views

What permissions are required for enumerating users groups in Active Directory

I have a .net web application which needs to obtain the groups a user is a member of in Active Directory. Todo this I am using the memberOf attribute on the users records. I need to know the ...
5
votes
5answers
6k views

OpenVPN with Active Directory integration

Is anyone successfully running OpenVPN with Active Directory integration? Are you using the openvpn.net or the openvpn.net/opensource version of OpenVPN? Any tips, tricks or gotchas or did it "just ...
5
votes
3answers
13k views

Primary Domain Controller slow?

I seem to be experiencing a problem with a virtualized Windows 2008 domain controller. We are running Hyper-V on a powerful server (dual quad core Nehalem Xeon, 48 GB of ram), and all of the VMs are ...
5
votes
2answers
1k views

Migrate local profiles to roaming profiles

What are "things to think about" and best practices to migrate a large number of users from using local profiles to roaming ones?
4
votes
5answers
4k views

Central Authentication For Windows, Linux, Network Devices

I'm trying to find a way to centralize user management & authentication for a large collection of Windows & Linux Servers, including network devices (Cisco, HP, Juniper). Options include ...
4
votes
2answers
2k views

Keep AD Group Synced in OpenLDAP with POSIX Account Augmentation

What's the most obvious way of achieving the following: The site has an working AD infrastructure and certain parts of the infrastructure are tightly coupled GNU/Linux machines where people from the ...
4
votes
6answers
43k views

How can I export all group policies to a easily-parseable format?

I need to dump all the Group Policies within Active Directory to review offline at a later date. Is there a way I can easily export all the Group Policies to text or some other easily-parseable ...
3
votes
1answer
905 views

Active Directory / DNS naming design, multiple sites, single domain,

The network I currently manage will shortly be expanding to cover two sites, and due to the organisation of the company, I have already determined that a site-to-site hardware VPN will be implemented ...
3
votes
5answers
33k views

How to speed up AD integrated DNS zone replication? Server 2008 r2

I have about a hundred DNS zones that I need to convert from being not AD integrated to be AD integrated. I want to do this with minimal downtime. So far, my process is: Change DNS zone on one DNS ...
3
votes
2answers
126 views

How can I correlate a wall jack to a user/machine on the domain?

After reading Valve's new employee handbook, I was really interested in setting up a company map like they described on page 6: "The fact that everyone is always moving around within the company ...
3
votes
2answers
544 views

Active Directory Domain with SAMBA or Other Tool

Can I create a domain using SAMBA and set up Active Directory with SAMBA on it? And by this I mean no windows servers involved. I would also like to be able to log in from a Windows machine. ...
3
votes
2answers
542 views

Connecting to Exchange PowerShell from a Linux machine

We currently have a Python script that automates user creation tasks on our servers. This script provisions users in OpenLDAP and ActiveDirectory by using python-ldap. Now, I want to modify some ...
3
votes
2answers
2k views

Domain controller not advertising as time server / PDC role is down

In one of our domains, we have two Server 2003 servers (JUDY and ASTRO). We recently switched all the FSMO roles over to JUDY, from ASTRO. That seemed to work fine, and running "netdom query fsmo" ...
3
votes
3answers
2k views

Is Active Directory Unreliable or is there Another Issue Here?

We have an organization of approximately 1200 Windows PC clients on an Active Directory network. We have noticed that there seems to be random systems that don't get policies set. For example, we ...
3
votes
7answers
35k views

What's the AD query syntax to enumerate all users for a particular group?

Here's what does not work so far; (&(objectCategory=Person)(objectClass=Group)(CN=group_in_question)) (&(objectClass=Group)(objectCategory=Group)(member=CN=group_in_question)) ...
2
votes
2answers
165 views

Migrate user accounts from Azure AD to on-premise AD?

My company uses Office 365 for Exchange, SharePoint, Lync etc. including the build-in user administration via Azure Active Directory. Now we want to switch to a local AD on a Windows Server. It shall ...
2
votes
0answers
114 views

Strange Folder Redirection

I've recently inherited a client who has a folder redirection policy GPO and home paths specified through user attributes in AD. Now the strange thing is, I have literally no idea how it is working. ...
2
votes
1answer
2k views

How to integrate request tracker 4.0.8 with active directory 2008 server

I have installed request tracker v 4.0.8 and everything is working. Now I'm trying to integrate it with Active Directory 2008. I used this DOC: ...
2
votes
1answer
466 views

Apache, SVN and Active Directory: how to avoid duplicate configuration?

I'm trying to linking the SVN hosted on Apache on a Windows Server 2008 to the Active Directory. I understood what do I need to do to manage the groups of users on repository level: <Location ...
2
votes
3answers
14k views

Kinit Won't Connect to a Domain Server : Realm not local to KDC while getting initial credentials

I am setting up a testbed environment where Linux (Ubuntu 10.04) clients will authenticate to a Windows Server 2008 R2 Domain Server. I am following the official Ubuntu guide to set up a Kerberos ...
1
vote
2answers
2k views

How to Force domain users to change password now

How can I force all domain users to change their password now? I want to do so before users next logon. Thanks
1
vote
5answers
331 views

Active Directory management tools for medium sized forest (less than 1000 users) [closed]

What are good AD management tools for AD forests with less than 1000 users and 3 domains across three locations? Specifically looking for: -Bulk users creation -Security groups management ...
18
votes
3answers
2k views

How do I delete this orphaned Active Directory computer object (preferably with PowerShell)?

I'm working from a Windows 7 workstation, with PowerShell v2.0, and trying to delete a particular (orphaned?) object from the LostAndFound container in a 2008 R2 FL forest and domain with the Active ...
13
votes
3answers
3k views

Windows 2008 R2 CA and auto-enrollment: how to get rid of >100,000 issued certificates?

The basic problem I'm having is that I have >100,000 useless machine certificates cluttering up my CA, and I'd like to delete them, without deleting all certs, or time jumping the server ahead, and ...
9
votes
2answers
7k views

Is there a way to refresh computer group membership without rebooting?

I am using Windows Server 2008 R2 and have a windows service running under "network service" account in computer ComputerA. This windows service want to access a share folde (on another computer ...
9
votes
4answers
18k views

How to disable Tcp/Ip settings in windows 7 via GPO?

I have enabled following policies, "Prohibit TCP/IP advanced connection" "Prohibit access to properties of components of a LAN connection" "Enable Windows 2000 Network Connections setings for ...
8
votes
3answers
1k views

What good Active Directory + Exchange competition is there?

Based on this question regarding enhanced permission support in filesystems, what is the best permissions + directory and mail stack to compare against Active Directory on NTFS with Exchange? I'm ...
6
votes
2answers
306 views

Correct way to update Google Chrome MSI through Group Policy

I am deploying Chrome through group policy. This is working fine. Obviously Chrome has a pretty regular update cycle. I am not allowing Domain Users to install Chrome updates. Having subscribed to ...
6
votes
1answer
4k views

Default full name format in Active Directory

When I create a new account in Active Directory, I enter the new user's first name and last name, and it auto-fills the full name in the form "First Last". Can I set AD to use "Last, First" instead? ...
6
votes
2answers
1k views

What's the default hash format / algorithm of Active Directory?

I'm wondering what format I need to put hashes in to write to userPassword via LDAP. Apache Directory Studio gives me several options, but I don't think any of them are it. Can anyone document the ...
5
votes
4answers
2k views

Blocking EXE from executing in XP Domain environment

I was wondering if anyone could point me in the right direction on how to block specific exe files from executing on XP machines in a domain environment. I have active directory setup and working so ...
5
votes
3answers
20k views

User in domain admin group cannot access directory the group has permission to access

I've run into a rather interesting issue when playing with one of my domain labs. There's a directory on a 2008 R2 fileserver that's being used for folder redirection for all users in the "Staff" OU. ...
5
votes
2answers
544 views

Does Active Directory on Server 2003 R2 support IPv6 subnets in Sites and Services?

I've been experimenting with IPv6 at our organization. The domain controllers (all 2003 R2) and most of the servers (2003 R2 / 2008 / 2008 R2) have IPv6 configured. We have a subnet assigned through ...
5
votes
2answers
3k views

How can I make my AD DNS server resolve requests for an internet DNS record to an internal IP address for internal clients?

I have the following situation: A web server that lives in our company intranet has an address in a private range. Certain license restrictions prevent us from changing the private address. Port 443 ...
5
votes
2answers
978 views

Windows Active Directory - Implement a password policy. What will happen to current passwords?

I want to implement a stronger password policy for our Windows 2003 domain. My question is, what will happen to the currently existing passwords that do not match the new policy: will the users be ...
5
votes
2answers
1k views

What are the advantages of adding a Mac to Active Directory?

I was surprised to learn (from this question: http://serverfault.com/questions/8006/how-to-add-a-mac-to-windows-active-directory) that you could add a Mac to AD. What are the advantages of doing ...
5
votes
3answers
472 views

Account lockout

I have an an account which is being periodically locked out on our network (once a day roughly). We use active directory, with multiple domains, spread across hundreds of servers. How can I find out ...