A Microsoft technology for sharing one set of user accounts, security permissions, and management information across many Windows servers and desktops.

learn more… | top users | synonyms (2)

8
votes
2answers
402 views

Issues related to storing photos in Active Directory?

Are their any known issues with storing employee photos in AD provided you store them in the compliant sizes and formats? Is there a critical mass that you break or could corrupt AD databases? I'm ...
8
votes
4answers
42k views

What is a domain controller, when is it needed, and how to set it up?

I would like to know what do we mean by Domain controller and how do we make a system a Domain Controller and when do we have to make a system a DC?
8
votes
8answers
10k views

Should I install an AV product on my domain controllers?

Should I run a server-specific antivirus, regular antivirus, or no antivirus at all on my servers, particularly my Domain Controllers? Here's some background about why I'm asking this question: ...
8
votes
2answers
840 views

Outline the quirks of Windows Small Business Servers (SBS)

I'm not much of a Microsoft administrator. However, I do work extensively with new and existing Microsoft Exchange deployments. That's just how the career-arc went. I'm working with a small customer ...
8
votes
2answers
1k views

How do I block inheritance/application of a single GPO?

Due to the workload generated by recent ransomware outbreaks (Cryptolocker/Cryptowall/etc.), I was recently tasked with implementing Software Restriction policies to block program execution from ...
8
votes
3answers
20k views

How to find the cause of locked user account in Windows AD domain

After a recent incident with Outlook, I was wondering how I would most efficiently resolve the following problem: Assume a fairly typical small to medium sized AD infrastructure: several DCs, a ...
8
votes
4answers
24k views

How can I clear cached domain credentials?

Related: How can I enable domain authentication over wireless in Windows 7/2k8? To test the domain login over wireless connection feature I'm trying to set up in the above question, I need an ...
8
votes
3answers
13k views

Restrict access to IIS site to an AD Group

Is it possible in IIS to set up a site in IIS and only let users of a certain AD Group get access to it?
8
votes
3answers
1k views

What good Active Directory + Exchange competition is there?

Based on this question regarding enhanced permission support in filesystems, what is the best permissions + directory and mail stack to compare against Active Directory on NTFS with Exchange? I'm ...
8
votes
4answers
15k views

Will Active Directory Allow You to Add Two Computers of the Same Name?

I'm hoping someone can confirm my observations because I'm questioning my memory... The title kind of says it all. While working rapidly on deploying a number of similar systems, it appeared that we ...
8
votes
1answer
3k views

Find locked out accounts in Active Directory (a way that actually works!)

I have googled how to list locked out accounts and found two methods so far, both of which don't work... Saved query - ...
8
votes
1answer
4k views

Two ways of deploying printers via group policy

I've noticed two options for deploying printers via group policy: Create and link Group Policy in GP Management, add printer(s) via User Configuration > Preferences > Control Panel Settings > ...
8
votes
1answer
17k views

What permissions are required for enumerating users groups in Active Directory

I have a .net web application which needs to obtain the groups a user is a member of in Active Directory. Todo this I am using the memberOf attribute on the users records. I need to know the ...
8
votes
5answers
9k views

Linux + Active directory authentication + only letting certain groups login

I have some linux boxes that use Windows Active Directory authentication, that works just fine (Samba + Winbind). What I would like to do now though is only allow certain people or certain groups to ...
8
votes
7answers
4k views

How do I keep the local admin password consistent across an OU?

We have a number of PCs running XP SP2 (and a couple running SP1) already in production, and we're looking to keep the local administrator's password consistent across the OU. The only solutions I can ...
8
votes
1answer
228 views

Is there a version of the AD tools that provide the PowerShell output, similar to the Exchange tools?

The Exchange administration tools output the exact PS commands they will (or just did) execute. Is there a different version of the AD tools (primarily AD Users & Computers) that have similar ...
8
votes
2answers
13k views

Why does removing the EVERYONE group prevent domain admins from accessing a drive?

This is related to this question: Domain Admins group denied access to d: drive I have a member server in a brand new AD lab environment. I have an Active Directory user ADMIN01 who is a ...
8
votes
3answers
2k views

Automatically mounting a network share as Shared Resource

we're running an ActiveDirectory environment (Windows 2008 Server, XP Clients) and want to have some shares listed as Shared Resources under the Network Neighbourhood. I do not want to map it to a ...
8
votes
3answers
11k views

Can Samba support full Windows-ACLs?

I've set up a Samba 3 host with AD integration and an ACL enabled filesystem. Using a windows client I can set users and groups permissions. Up to now, Samba just maps to POSIX ACL's rwx permissions, ...
8
votes
4answers
6k views

How do you manage service account credentials (passwords)?

In a Windows environment how do you address the following issues with service accounts? Regular Password changes - with single service accounts used on multiple machines how do you regularly change ...
8
votes
1answer
11k views

How to add a Mac to Windows Active Directory

I've gone into the Directory Utility on the mac, clicked on the services tab, entered the Active Directory Domain and Computer ID, clicked the Bind button and it showed a little status label which ...
8
votes
2answers
2k views

What is the best way to allow a domain user to start and stop services on the machine?

What is the best way to allow a domain user to start and stop services on the machine? The domains user cannot be made admin.
8
votes
1answer
372 views

Why would a domain controller encouter a USN rollback after an unclean shutdown?

I have this Windows Server 2008 R2 domain controller running on a physical Dell server, model PowerEdge R510. There are some electrical problems around here, thus a black-out is, unfortunately, quite ...
8
votes
2answers
2k views

Upgrade software package installed with GPO

Since recently I have been using AD policies to deploy software packages through GPO on a small domain. This had been working well, but I am not sure what is the correct procedure for upgrading a ...
8
votes
1answer
118 views

Does the Read-Only configuration of a DC apply only to Active Directory?

Firstly, I'm not sure how friendly the users of this site are to students but my question seems to be well suited. I am configuring a domain with multiple Windows Server 2008 machines and am curious ...
8
votes
5answers
4k views

Cannot join Win7 workstations to Win2k8 domain

I am trying to connect a Windows 7 Ultimate machine to a Windows 2k8 domain and it's not working. I get this error: Note: This information is intended for a network administrator. If you are not ...
8
votes
4answers
2k views

How to manage hundreds of users (and customized profiles) on individual Windows 7 machines?

We're a small college, where every student is assigned an Active Directory account. We have a couple computer labs where the machines are all joined to the domain and students can log in to any ...
8
votes
3answers
356 views

Join ActiveDirectory (Win 2k8R2) to OpenDirectory(Snow Leopard)

The vast majority of questions and so on regarding the interoperability of Active and Open directories involves getting Mac clients to see an AD and auth against it. What we'd like to do is get a ...
8
votes
2answers
257 views

Rss feed of Active Directory Changes?

Is it possible to setup a RSS feed to view all changes made to an Active Directory database?
8
votes
1answer
353 views

“The zone can be scavenged after” keeps incrementing

What are you trying to do? I'm trying to enable DNS scavenging on a DNS zone that has about a hundred stale DNS records. What have you tried in order to make it happen? I setup DNS Scavenging per ...
8
votes
5answers
25k views

How to change the current user's domain password without being domain admin?

I've seen plenty of documentation of how to reset a user's password by running net user <username> * /domain or locally net user <username> <new_password> But I am not domain ...
7
votes
4answers
7k views

What is the point of creating a computer object in Active Directory when you still have to join the PC?

What is the point of creating a computer object in Active Directory when you still have to join computers to the domain, which then creates the object anyway?
7
votes
13answers
14k views

Windows: Can domain controllers also serve other functions?

This question was a discussion about whether Active Directory is necessary to run Terminal Services. But a chain of answers and comments (mostly by me) brought up a related question around Domain ...
7
votes
3answers
16k views

What happens when a computer joins an Active Directory domain?

What changes are applied to a client when it joins an AD domain? How is a domain member supposed to behave when disconnected to the network? Are users able to login? Will domain user policies still ...
7
votes
6answers
1k views

Securing Active Directory domains on a potentially hostile network

Active Directory is one of the best features of Windows Server, but it's also a big shiny target. If compromised it gives the attacker your Windows network. In an environment with externally facing ...
7
votes
6answers
4k views

Active Directory OU design for <500 users, 4 locations

We are looking to add some logical structure to our (Win 2003) AD hierarchy. We have a single domain and around 500 users. All users and computers are currently organized into one OU. All security ...
7
votes
5answers
9k views

Should Windows Web Servers be members of an Active Directory Domain

In terms of security and manageability - What is best practice? Should web servers Be added to and managed from an Active Directory domain or Be part of a 'web server' workgroup that is ...
7
votes
3answers
350 views

Can a Second Domain Controller, with buggy hard drive hardware, cause a corruption to Active Directory?

We have a new Domain Controller that holds all FSMO roles. We also have two old hardware servers, about 4-5 years old each, set up as secondary Domain Controllers (or better described as Domain ...
7
votes
3answers
609 views

Reset Windows user domain password

Is there a way to reset a user domain password remotely without login to a remote desktop to the domain controller? I could not find any MMC plugin in non-server Windows (Window 7 Ultimate in this ...
7
votes
2answers
5k views

Danger of Scavenging Stale Resource Records In _msdcs Zone?

I just realized that a previous admin turned DNS scavenging on for all zones on one of the DCs, including the _msdcs zone. It's been this way for a while and things are fine, but I can't imagine that ...
7
votes
3answers
4k views

Where do I store sensitive data within Active Directory?

I am essentially storing a private key (Hash) in any of the OctetString attributes within Active Directory. My question is, what attribute is secure by default and makes sense to keep private data ...
7
votes
3answers
2k views

Child Domain vs Trust Relationship

So here is the scenario- We are in the process of centralizing IT to a data center in a single location. I currently have 12 different operating companies that need a shared security and exchange ...
7
votes
6answers
320 views

What does a developer need to know about Windows Server?

I am a certified .NET Developer, and I do a lot of Sharepoint development at work. Adding/editing/deleting users requires using AD and of course, anything to do with the site structure in Sharepoint ...
7
votes
2answers
317 views

Transition away from Domain Admin only account

In our Windows environment, our Domain Admins only have one user account. This single user account is used across the board including running on a day to day workstation. In our transition away from ...
7
votes
3answers
678 views

AD reset user passwords for a security group

I'm not quite sure if this is possible or not, but I need to force a certain security group's users to have their passwords expire so they'll be forced to change them on next login. The reason for ...
7
votes
2answers
922 views

Server 2012 R2 Active Directory Domain SRV dns records suddenly disappeared

I have a test domain that I recently configured. All of a sudden, no users can log in except those with cached credentials. The domain includes two domain controllers that are both global catalogs ...
7
votes
3answers
3k views

Active Directory disaster recovery with DPM

I have a sort of catch-22 question here. Suppose I'm using Microsoft System Center Data Protection Manager (2010 or 2012, it works the same way) to backup, amongst various other things, my Active ...
7
votes
7answers
19k views

VPN Connection causes DNS to use wrong DNS server

I have a Windows 7 PC on our company network (which is a member of our Active Directory). Everything works fine until I open a VPN connection to a customer's site. When I do connect, I lose network ...
7
votes
2answers
6k views

Search AD by GUID

How do I search Active Directory for objects by GUID? In other words, what would be a good way to find what objects belong to specified GUIDs?
7
votes
7answers
885 views

Is there a way to audit AD for a particular password?

Is there a way I can audit AD to check for a particular password? We used to use a "standard" password for all new users (e.g. MyPa55word). I want to make sure this is no longer in use anywhere on ...