Active Directory is a Microsoft technology primarily for managing multiple Windows servers and workstations in a single environment. It was first released in 2000.

learn more… | top users | synonyms (2)

8
votes
2answers
6k views

Domain rename with Exchange 2010

I have taken over all IT responsibilities for a company that is using Active Directory (2008 R2 native level) and Exchange 2010. I have come to find out that their internal Active Directory domain ...
8
votes
4answers
2k views

How to manage hundreds of users (and customized profiles) on individual Windows 7 machines?

We're a small college, where every student is assigned an Active Directory account. We have a couple computer labs where the machines are all joined to the domain and students can log in to any ...
8
votes
3answers
341 views

Join ActiveDirectory (Win 2k8R2) to OpenDirectory(Snow Leopard)

The vast majority of questions and so on regarding the interoperability of Active and Open directories involves getting Mac clients to see an AD and auth against it. What we'd like to do is get a ...
8
votes
2answers
246 views

Rss feed of Active Directory Changes?

Is it possible to setup a RSS feed to view all changes made to an Active Directory database?
7
votes
4answers
6k views

What is the point of creating a computer object in Active Directory when you still have to join the PC?

What is the point of creating a computer object in Active Directory when you still have to join computers to the domain, which then creates the object anyway?
7
votes
13answers
11k views

Windows: Can domain controllers also serve other functions?

This question was a discussion about whether Active Directory is necessary to run Terminal Services. But a chain of answers and comments (mostly by me) brought up a related question around Domain ...
7
votes
3answers
14k views

What happens when a computer joins an Active Directory domain?

What changes are applied to a client when it joins an AD domain? How is a domain member supposed to behave when disconnected to the network? Are users able to login? Will domain user policies still ...
7
votes
4answers
10k views

Fix error determining whether the target environment requires adprep in windows server 2012, during domain controller promotion

I am unable to promote my newly installed Windows Server 2012 machine to a domain controller. I have two existing domain controllers. The primary is at Windows Server 2003 level, and is running ...
7
votes
2answers
2k views

Moving primary domain controller to new server

I have just purchased a new server that will be the new primary domain controller. I was wondering if anyone knew any articles or tutorials on how to do this change over? I would imagine it is just ...
7
votes
6answers
1k views

Securing Active Directory domains on a potentially hostile network

Active Directory is one of the best features of Windows Server, but it's also a big shiny target. If compromised it gives the attacker your Windows network. In an environment with externally facing ...
7
votes
5answers
7k views

Should Windows Web Servers be members of an Active Directory Domain

In terms of security and manageability - What is best practice? Should web servers Be added to and managed from an Active Directory domain or Be part of a 'web server' workgroup that is ...
7
votes
3answers
336 views

Can a Second Domain Controller, with buggy hard drive hardware, cause a corruption to Active Directory?

We have a new Domain Controller that holds all FSMO roles. We also have two old hardware servers, about 4-5 years old each, set up as secondary Domain Controllers (or better described as Domain ...
7
votes
3answers
498 views

Reset Windows user domain password

Is there a way to reset a user domain password remotely without login to a remote desktop to the domain controller? I could not find any MMC plugin in non-server Windows (Window 7 Ultimate in this ...
7
votes
6answers
4k views

Active Directory OU design for <500 users, 4 locations

We are looking to add some logical structure to our (Win 2003) AD hierarchy. We have a single domain and around 500 users. All users and computers are currently organized into one OU. All security ...
7
votes
3answers
3k views

Where do I store sensitive data within Active Directory?

I am essentially storing a private key (Hash) in any of the OctetString attributes within Active Directory. My question is, what attribute is secure by default and makes sense to keep private data ...
7
votes
3answers
1k views

Child Domain vs Trust Relationship

So here is the scenario- We are in the process of centralizing IT to a data center in a single location. I currently have 12 different operating companies that need a shared security and exchange ...
7
votes
6answers
4k views

What's the best wiki to run on Windows?

I want to set up a wiki for my team. I need it to run on Windows/IIS and if it needs a database, against SQL Server. User-authentication must use/integrate with Active Directory, ideally natively ...
7
votes
6answers
315 views

What does a developer need to know about Windows Server?

I am a certified .NET Developer, and I do a lot of Sharepoint development at work. Adding/editing/deleting users requires using AD and of course, anything to do with the site structure in Sharepoint ...
7
votes
3answers
439 views

AD reset user passwords for a security group

I'm not quite sure if this is possible or not, but I need to force a certain security group's users to have their passwords expire so they'll be forced to change them on next login. The reason for ...
7
votes
2answers
6k views

Can you find out when a new user was created in Active Directory on Windows 2003 Server?

As the question title says, I am trying to find out when a user account was created in Active Directory. The operating system is Windows Server 2003.
7
votes
1answer
13k views

What does the downwards arrow symbol on a User mean in Active Directory

I have created a user account called "MyUser" via powershell, and the icon graphic in active directory different to that of the user test that I create via the UI. The scripted one has a circle ...
7
votes
9answers
2k views

Which Version Control Systems support LDAP/AD users and groups

Does anyone know which of the big players (if any) support LDAP/AD users and groups for authentication AND database permissions? Specifically, I'm wondering if SVN, GIT, Mercurial etc. will allow ...
7
votes
4answers
961 views

Giant active directory deployment vs giant Sun LDAP

At work we're in the early phases of an identity management project. This is all in the context of higher ed where we have a couple thousand faculty / staff and about twenty thousand students. Has ...
7
votes
2answers
1k views

Can a Mac with OS X 10.5 (Leopard) authenticate with a Windows 2008 domain?

I would like to have my MacBook Pro authenticate against Active Directory running on Windows 2008. A couple of years ago I tried to set this up between OS X 10.4 and Windows 2003 but I wasn't ...
7
votes
2answers
3k views

Search AD by GUID

How do I search Active Directory for objects by GUID? In other words, what would be a good way to find what objects belong to specified GUIDs?
7
votes
7answers
821 views

Is there a way to audit AD for a particular password?

Is there a way I can audit AD to check for a particular password? We used to use a "standard" password for all new users (e.g. MyPa55word). I want to make sure this is no longer in use anywhere on ...
7
votes
2answers
2k views

Is there a performance impact of direct AD universal groups assignment?

I'm implementing a tool which secures certain shared resources within AD forest (mostly file shares). By some criteria a list of users from different domains is generated, those users are added to a ...
7
votes
4answers
14k views

How can I clear cached domain credentials?

Related: How can I enable domain authentication over wireless in Windows 7/2k8? To test the domain login over wireless connection feature I'm trying to set up in the above question, I need an ...
7
votes
3answers
4k views

Move computer accounts to new OU in bulk

I have an OU with around 2500 computers. I need to move 580 of them to another OU. Is there a way to do this with a batch file? I have a text file with the computernames (not the FQDN).
7
votes
3answers
37k views

What is a domain controller, when is it needed, and how to set it up?

I would like to know what do we mean by Domain controller and how do we make a system a Domain Controller and when do we have to make a system a DC?
7
votes
6answers
28k views

How do you find out if Active Directory is using Kerberos or NTLM?

Is there a command line program you can use?
7
votes
1answer
2k views

Reset users password in Active Directory by Domain Admin account or other service account

In Active Directory you can set and enforce rules where users have to use strong password, can't use last 5+ passwords they already had, enforce password complexity. Is there a way to enforce such ...
7
votes
2answers
2k views

Best practice for decommissioning a Domain Controller that is also a DNS server?

There are two schools of thought for the decommissioning process of Active Directory Domain Controllers that are heavily used as DNS servers. Add the IP address of the outgoing DC to a new DC and ...
7
votes
2answers
315 views

How can I save a domain controller after a USN rollback without rebuilding the whole server?

Today I had (again...) to lobotomize a domain controller which had suffered the dreaded USN rollback; the standard solution to this issue is to demote it and then promote it back again, but the main ...
7
votes
2answers
2k views

Active Directory disaster recovery with DPM

I have a sort of catch-22 question here. Suppose I'm using Microsoft System Center Data Protection Manager (2010 or 2012, it works the same way) to backup, amongst various other things, my Active ...
7
votes
3answers
1k views

Need for another Domain Controller

I have two domain controllers (Windows 2003) in one site where most of the department I support resides. There is another building (at another site) where my department resides as well, but they have ...
7
votes
4answers
8k views

How does SSO using Active Directory works where user is transparently logged in. (intranet webapp)

I'm told that it's possible to make a web application not require a login. The user logs in to Windows, which authenticates via an Active Directory (LDAP) Lookup. Then, they should be able to go to ...
7
votes
3answers
657 views

Delete a windows group in Active Directory

I am doing a cleanup of some AD groups that are no longer used. One of the AD groups I could not delete because it seems that a member has this group set as the primary group (which I assume someone ...
7
votes
1answer
20k views

How can I join a computer to a new domain remotely?

I have a large number of PCs that are joined to domain abc.com and I want to move them over to xyz.com so they are no longer a member of abc.com. Can I do this with a script? Thanks
7
votes
1answer
153 views

How do I remotely issue a CLI command to thousands of Windows domain computers at once?

I need to issue a CLI command (cmd.exe or PowerShell) to all of the thousands of computers on my domain. For obvious reasons, this is not going to involve doing the task manually, or physically ...
7
votes
2answers
722 views

Is there a way of consolidating multiple GPOs into one GPO

I have about 100 GPOs that I would like to merge down to 15-20. Is there a way of merging them together. I found this article: ...
7
votes
1answer
2k views

Best practice for authenticating DMZ against AD in LAN

We have few customer facing servers in DMZ that also have user accounts , all accounts are in shadow password file. I am trying to consolidate user logons and thinking about letting LAN users to ...
7
votes
3answers
9k views

Can Samba support full Windows-ACLs?

I've set up a Samba 3 host with AD integration and an ACL enabled filesystem. Using a windows client I can set users and groups permissions. Up to now, Samba just maps to POSIX ACL's rwx permissions, ...
7
votes
5answers
12k views

How to find the computer name a user logged on to

Is there a tool or script or some other way of knowing what computer name a specific user is currently logged on to? Or even was logged on to? Say the user "HRDrone" is working on his machine whose ...
7
votes
5answers
310 views

Is there a tool that lets an end user manage attributes in Active Directory?

There are attributes in Active Directory such as manager and telephone numbers which can get out of date quickly. Is there an open source or inexpensive tool that can help with management of these ...
7
votes
2answers
1k views

GPO best practices : Security-Group Filtering Versus OU

Good afternoon everyone, I'm quite new to Active Directory stuff. After upgraded Functional level of our AD from 2003 to 2008 R2 (I need it to put fine-grained password policy), I then start to ...
7
votes
3answers
1k views

Advice on Active Directory design for multihomed servers

I've been tasked by a customer to come up with a working Active Directory design for a scenario with the following requirements (simplified, they are actually a lot worse): There is a subnet for ...
7
votes
3answers
4k views

Place a computer object in an OU based on the user who added it

Is there a way to auto place a computer in a specific OU based on of the user who joined it to the domain? For example, I have 5 OUs, and site admins can add PCs to the domain, but can't manage any ...
7
votes
3answers
4k views

Virus that tries to brute force attack Active Directory users (in alphabetical order)?

Users started complaining about slow network speed so I fired up Wireshark. Did some checking and found many PCs sending packets similar to the following: (screenshot) http://imgur.com/45VlI.png I ...
7
votes
2answers
5k views

How many times can a simple user add a computer to windows domain?

In a course about Windows Server administration that I took at the university they told us that a normal user could add 10 computers to a domain. Over the years however I've added and removed way more ...