Active Directory is a Microsoft technology primarily for managing multiple Windows servers and workstations in a single environment. It was first released in 2000.

learn more… | top users | synonyms (2)

3
votes
2answers
445 views

Active Directory Domain with SAMBA or Other Tool

Can I create a domain using SAMBA and set up Active Directory with SAMBA on it? And by this I mean no windows servers involved. I would also like to be able to log in from a Windows machine. ...
3
votes
2answers
485 views

Connecting to Exchange PowerShell from a Linux machine

We currently have a Python script that automates user creation tasks on our servers. This script provisions users in OpenLDAP and ActiveDirectory by using python-ldap. Now, I want to modify some ...
3
votes
2answers
2k views

Domain controller not advertising as time server / PDC role is down

In one of our domains, we have two Server 2003 servers (JUDY and ASTRO). We recently switched all the FSMO roles over to JUDY, from ASTRO. That seemed to work fine, and running "netdom query fsmo" ...
3
votes
3answers
2k views

Is Active Directory Unreliable or is there Another Issue Here?

We have an organization of approximately 1200 Windows PC clients on an Active Directory network. We have noticed that there seems to be random systems that don't get policies set. For example, we ...
3
votes
7answers
33k views

What's the AD query syntax to enumerate all users for a particular group?

Here's what does not work so far; (&(objectCategory=Person)(objectClass=Group)(CN=group_in_question)) (&(objectClass=Group)(objectCategory=Group)(member=CN=group_in_question)) ...
2
votes
0answers
97 views

Strange Folder Redirection

I've recently inherited a client who has a folder redirection policy GPO and home paths specified through user attributes in AD. Now the strange thing is, I have literally no idea how it is working. ...
2
votes
1answer
1k views

How to integrate request tracker 4.0.8 with active directory 2008 server

I have installed request tracker v 4.0.8 and everything is working. Now I'm trying to integrate it with Active Directory 2008. I used this DOC: ...
2
votes
1answer
447 views

Apache, SVN and Active Directory: how to avoid duplicate configuration?

I'm trying to linking the SVN hosted on Apache on a Windows Server 2008 to the Active Directory. I understood what do I need to do to manage the groups of users on repository level: <Location ...
1
vote
2answers
922 views

How to Force domain users to change password now

How can I force all domain users to change their password now? I want to do so before users next logon. Thanks
1
vote
3answers
10k views

Kinit Won't Connect to a Domain Server : Realm not local to KDC while getting initial credentials

I am setting up a testbed environment where Linux (Ubuntu 10.04) clients will authenticate to a Windows Server 2008 R2 Domain Server. I am following the official Ubuntu guide to set up a Kerberos ...
1
vote
5answers
325 views

Active Directory management tools for medium sized forest (less than 1000 users) [closed]

What are good AD management tools for AD forests with less than 1000 users and 3 domains across three locations? Specifically looking for: -Bulk users creation -Security groups management ...
18
votes
3answers
339 views

How do I delete this orphaned Active Directory computer object (preferably with PowerShell)?

I'm working from a Windows 7 workstation, with PowerShell v2.0, and trying to delete a particular (orphaned?) object from the LostAndFound container in a 2008 R2 FL forest and domain with the Active ...
13
votes
3answers
2k views

Windows 2008 R2 CA and auto-enrollment: how to get rid of >100,000 issued certificates?

The basic problem I'm having is that I have >100,000 useless machine certificates cluttering up my CA, and I'd like to delete them, without deleting all certs, or time jumping the server ahead, and ...
9
votes
4answers
16k views

How to disable Tcp/Ip settings in windows 7 via GPO?

I have enabled following policies, "Prohibit TCP/IP advanced connection" "Prohibit access to properties of components of a LAN connection" "Enable Windows 2000 Network Connections setings for ...
8
votes
3answers
998 views

What good Active Directory + Exchange competition is there?

Based on this question regarding enhanced permission support in filesystems, what is the best permissions + directory and mail stack to compare against Active Directory on NTFS with Exchange? I'm ...
6
votes
2answers
211 views

Correct way to update Google Chrome MSI through Group Policy

I am deploying Chrome through group policy. This is working fine. Obviously Chrome has a pretty regular update cycle. I am not allowing Domain Users to install Chrome updates. Having subscribed to ...
6
votes
2answers
2k views

Active Directory disaster recovery with DPM

I have a sort of catch-22 question here. Suppose I'm using Microsoft System Center Data Protection Manager (2010 or 2012, it works the same way) to backup, amongst various other things, my Active ...
6
votes
1answer
3k views

Default full name format in Active Directory

When I create a new account in Active Directory, I enter the new user's first name and last name, and it auto-fills the full name in the form "First Last". Can I set AD to use "Last, First" instead? ...
6
votes
2answers
1k views

What's the default hash format / algorithm of Active Directory?

I'm wondering what format I need to put hashes in to write to userPassword via LDAP. Apache Directory Studio gives me several options, but I don't think any of them are it. Can anyone document the ...
5
votes
5answers
1k views

Protect files on NTFS volume from Domain Administrators

We're a small company with a 2008R2 domain on which we have a file server with several shared volumes. We have a number of IT staff in the domain administrators role, because effectively we're all on ...
5
votes
2answers
2k views

How can I make my AD DNS server resolve requests for an internet DNS record to an internal IP address for internal clients?

I have the following situation: A web server that lives in our company intranet has an address in a private range. Certain license restrictions prevent us from changing the private address. Port 443 ...
5
votes
2answers
881 views

Windows Active Directory - Implement a password policy. What will happen to current passwords?

I want to implement a stronger password policy for our Windows 2003 domain. My question is, what will happen to the currently existing passwords that do not match the new policy: will the users be ...
5
votes
2answers
978 views

What are the advantages of adding a Mac to Active Directory?

I was surprised to learn (from this question: http://serverfault.com/questions/8006/how-to-add-a-mac-to-windows-active-directory) that you could add a Mac to AD. What are the advantages of doing ...
5
votes
3answers
451 views

Account lockout

I have an an account which is being periodically locked out on our network (once a day roughly). We use active directory, with multiple domains, spread across hundreds of servers. How can I find out ...
4
votes
1answer
136 views

Samba capabilities & functionality

The company that I work for wishes to replace its windows servers with new linux servers but wants to keep Windows on employee desktops. The requirements are: The employee desktops should be able to ...
4
votes
3answers
14k views

User in domain admin group cannot access directory the group has permission to access

I've run into a rather interesting issue when playing with one of my domain labs. There's a directory on a 2008 R2 fileserver that's being used for folder redirection for all users in the "Staff" OU. ...
4
votes
2answers
449 views

Does Active Directory on Server 2003 R2 support IPv6 subnets in Sites and Services?

I've been experimenting with IPv6 at our organization. The domain controllers (all 2003 R2) and most of the servers (2003 R2 / 2008 / 2008 R2) have IPv6 configured. We have a subnet assigned through ...
4
votes
5answers
3k views

Domain Admins group denied access to d: drive

I have a brand new Active Directory (CORP-AD) installation running on Windows 2008R2. I have a domain controller (PDC01) and a member server (ME01). The member server has a C: and a D: drive. Part ...
4
votes
3answers
241 views

One AD user Multiple Logins

I have a department of 20 users or so, which basically work in shifts but access the same desktop and settings, I am thinking to join these computers (15 computers) to AD and create only ONE account ...
4
votes
2answers
1k views

Migrating Mailstore from Exchange 2003 to Exchange 2010 in a new domain

Proposed project ahead, and a whole lot of documentation and options out there, so I was looking for opinions or advice. I'm creating a brand new domain and installing Exchange 2010 in the ...
4
votes
5answers
2k views

How to bring another DC up with all roles when first DC is no longer available

I am so upset of this as i am not getting a proper answer anywhere. Let me make it clear the same scenario again. I have a DC named DC-1 & another DC named DC-2. both DC-1 and DC-2 are the name ...
4
votes
2answers
4k views

How do I migrate a Windows 2008 Domain Controller to another computer?

I have single server acting as a domain controller. It is running Windows 2008 Standard edition. What steps are required to migrate this domain to another computer running Windows 2008? I'd like a ...
3
votes
1answer
140 views

How to do exceptions in Group Policy?

We're implementing Group Policy for the first time at our organization and have some questions about best practices and capabilities. We've already done some work and want to see if there is a better ...
3
votes
5answers
2k views

Restore “lost” user after Active Directory removal?

Is it possible to restore lost users after Active Directory unistallation ? (I forgot to switch users to local users) The computer run Windows Server 2008 R2 Entreprise, and all the registry linked to ...
3
votes
3answers
462 views

Suggestions for transitioning to new GW/private network

I am replacing a private T1 link with a new firewall device with an ipsec tunnel for a branch office. I am trying to figure out the right way to transition folks at the new site over to the new ...
3
votes
2answers
2k views

How can I check access of a Group/User in AD before I delete it?

I'm cleaning up an inherited domain that is not well documented. How can I check that a particular group or user has no ACEs across the AD? Things like searching DACL/SACL for AD objects and file ...
3
votes
2answers
4k views

Need to force security inheritence in active directory on users

So I have a bunch of users in AD that for some reason, don't inherit permissions from the security applied to the OU they are in. This is problematic, because account operators can't unlock, change ...
3
votes
3answers
609 views

Multi-Role Domain Controllers for Small Offices (< 50 clients)

Warning: I'm a Linux/*NIX admin so this is all new to me. I understand that it's not considered a good idea to have only a single domain controller, and that it is also probably a good idea for a ...
3
votes
1answer
7k views

What permissions are required for enumerating users groups in Active Directory

I have a .net web application which needs to obtain the groups a user is a member of in Active Directory. Todo this I am using the memberOf attribute on the users records. I need to know the ...
3
votes
2answers
3k views

AD DS or AD LDS

I need a suggestion about having AD DS or AD LDS for my infrastructure. I have a website which as of now do not have any log in facility for the visitors, now we are developing a new application so ...
3
votes
2answers
946 views

Retire a Dead Windows 2003 Domain Controller

I have a Windows 2003 Domain Controller that died (totally gone). We have decided not to replace it at this time (it was just a backup at a particular office). What do I need to do to remove the ...
3
votes
2answers
11k views

“Send As” Permission and “You do not have permission to send to this recipient” Error

I have an account on Windows Small Business Server 2003, for which several users have "send as" permission (not "send on behalf" but "send as"). Each of those users has "send as" enabled in active ...
3
votes
5answers
5k views

Multiple network connections on a Windows 2008 domain controller (private network for NAS)

I have a Windows 2008 server connecting to an iSCSI target on an OpenSolaris box (yay ZFS!). I'd like to create a private network between the 2 boxes that is totally separate of my Windows domain. ...
2
votes
2answers
3k views

Using Powershell to bulk change the Home folder path of AD objects - %username"?

I have done a lot of searching on this, and still cannot find the answer. I have created a script which will bulk move all user objects in one OU to another OU. This works fine. Now I am trying to ...
2
votes
1answer
574 views

Using PowerShell to create user accounts from a CSV

How can I create a domain user account and set the default password in PowerShell from a CSV? Note that I know how to do this, I'm writing this as a self-answered question to share this knowledge. ...
2
votes
1answer
2k views

Outlook 2010 exchange setup prompts for username@domain.local rather than email@domain.com

We use a hosted exchange service. When users want to set up Outlook 2010 to access their account, they open Outlook and run through the configuration steps. Autodiscover is enabled, and in the ...
2
votes
3answers
3k views

Broken trust relationship not corrected even after leaving and joining domain with new computer name

I am having a problem with a recently reinstalled laptop with Win 7 Enterprise. The computer is complaining about a broken trust relationship when I try to grant domain users local access on the ...
2
votes
1answer
467 views

Error importing sudoers ldif schema to Active Directory

As per this question, we are on the process of migrating our sudoers file to Active Directory. As per the documentation, this requires importing the schema.ActiveDirectory LDIF which comes with the ...
2
votes
2answers
2k views

Child Domain Migration to Parent Domain

Our company is planning on moving from a single forest with multiple domains to a single forest with a single domain. This is my infrastructure: Forest Root ROOT-DC.techtunes.lan ...
2
votes
4answers
8k views

Can I prevent an Active Directory account from locking out?

Is there an ADUC setting that can prevent certain user accounts from locking out, particularly after x number of failed logon attempts? Oh and our DC is on Server 2003 at the moment, but we also use ...