A Microsoft technology that constitutes an LDAP directory service with centralized management functionality for user accounts, computer accounts, groups, and configuration management across many Windows servers and desktops.

learn more… | top users | synonyms (2)

3
votes
2answers
2k views

Domain controller not advertising as time server / PDC role is down

In one of our domains, we have two Server 2003 servers (JUDY and ASTRO). We recently switched all the FSMO roles over to JUDY, from ASTRO. That seemed to work fine, and running "netdom query fsmo" ...
2
votes
1answer
505 views

Apache, SVN and Active Directory: how to avoid duplicate configuration?

I'm trying to linking the SVN hosted on Apache on a Windows Server 2008 to the Active Directory. I understood what do I need to do to manage the groups of users on repository level: <Location "/...
2
votes
4answers
773 views

Windows AD dcpromo /demote, who gets the roles?

I've got three Windows servers running Active Directory: Two Win2000 Servers and a Win2003 Server. For a long time there was only one Win2000 AD server, so it probably has all the roles (although I ...
2
votes
1answer
3k views

How to integrate request tracker 4.0.8 with active directory 2008 server

I have installed request tracker v 4.0.8 and everything is working. Now I'm trying to integrate it with Active Directory 2008. I used this DOC: http://requesttracker.wikia.com/wiki/...
2
votes
3answers
14k views

SVN Authentication with LDAP and Active Directory

I am having a few problems getting SVN authentication to work with LDAP / Active Directory. My SVN installation works fine, but after enabling LDAP in my apache vhost, I just can't get my users to ...
1
vote
2answers
6k views

Linux nested groups with winbind

We have several RHEL6 servers connected to Active Directory using winbind. All servers are configured identically using a configuration management tool. Servers however produce different results when ...
1
vote
3answers
16k views

How to massively create “home” folder for users in active directory?

I have 100 users in my forest. We never used 'home' folder capabilities of Active Directory, now i would like to use. The problem is that is less efficient to create manually 100 folders and assign ...
1
vote
2answers
4k views

How to Force domain users to change password now

How can I force all domain users to change their password now? I want to do so before users next logon. Thanks
1
vote
4answers
346 views

Active Directory management tools for medium sized forest (less than 1000 users) [closed]

What are good AD management tools for AD forests with less than 1000 users and 3 domains across three locations? Specifically looking for: -Bulk users creation -Security groups management -...
14
votes
3answers
4k views

Windows 2008 R2 CA and auto-enrollment: how to get rid of >100,000 issued certificates?

The basic problem I'm having is that I have >100,000 useless machine certificates cluttering up my CA, and I'd like to delete them, without deleting all certs, or time jumping the server ahead, and ...
12
votes
3answers
10k views

What is Location field in Active Directory used for?

Is the Location field in Active Directory used for anything other than listing where objects are physically located? I am interested if this is just a user friendly field to help people find printers ...
11
votes
2answers
45k views

Can I replace my domain controller with Azure Active Directory? [duplicate]

I currently have a small network with a few servers and about 25 client PCs. We are using Office365 and have AD synchronisation setup from our on-premise server. We also have single-sign-on setup ...
7
votes
2answers
31k views

Can I override domain group policy with local group policy as a local admin?

I am trying to provision a few special case laptops. I would like to create a local guest account. That's fine but when I try to create it I prompted that my guest password does not meet the ...
7
votes
2answers
2k views

ServicePrincipleName setup for Web Service on IIS 7

I'm so confused. Consider the following: Active Directory environment with a domain called DOM An IIS 7 box with a NetBIOS name VS1 A DNS record providing an alias for VS1 as pineapple.london.uk....
6
votes
1answer
2k views

How can I generate a list of the security groups a set of users belong to?

I have been asked to generate a list of the security groups (so specifically not the distribution groups) that a list of approximately 50 users belong to. I have a list of users, users.txt that ...
6
votes
2answers
1k views

Correct way to update Google Chrome MSI through Group Policy

I am deploying Chrome through group policy. This is working fine. Obviously Chrome has a pretty regular update cycle. I am not allowing Domain Users to install Chrome updates. Having subscribed to ...
6
votes
2answers
732 views

Does Active Directory on Server 2003 R2 support IPv6 subnets in Sites and Services?

I've been experimenting with IPv6 at our organization. The domain controllers (all 2003 R2) and most of the servers (2003 R2 / 2008 / 2008 R2) have IPv6 configured. We have a subnet assigned through ...
6
votes
8answers
5k views

Best practices or experience with company wide Username policies and resolving duplicates

I am a programmer with an application that needs to be integrated into the new company wide Active Directory login scheme. This means changing all the usernames in our system to use the new scheme. ...
6
votes
3answers
4k views

Number of Domain Controllers needed?

In the process of migrating 7 school site network from Server 2003/XP to Server 2012/7 and wanted to get some feedback on how many domain controllers would be optimal. Currently we have 4 DCs. All 7 ...
6
votes
2answers
2k views

What's the default hash format / algorithm of Active Directory?

I'm wondering what format I need to put hashes in to write to userPassword via LDAP. Apache Directory Studio gives me several options, but I don't think any of them are it. Can anyone document the ...
5
votes
2answers
5k views

How can I make my AD DNS server resolve requests for an internet DNS record to an internal IP address for internal clients?

I have the following situation: A web server that lives in our company intranet has an address in a private range. Certain license restrictions prevent us from changing the private address. Port 443 ...
5
votes
2answers
1k views

Windows Active Directory - Implement a password policy. What will happen to current passwords?

I want to implement a stronger password policy for our Windows 2003 domain. My question is, what will happen to the currently existing passwords that do not match the new policy: will the users be ...
5
votes
4answers
3k views

Blocking EXE from executing in XP Domain environment

I was wondering if anyone could point me in the right direction on how to block specific exe files from executing on XP machines in a domain environment. I have active directory setup and working so ...
5
votes
5answers
15k views

Domain Admins group denied access to d: drive

I have a brand new Active Directory (CORP-AD) installation running on Windows 2008R2. I have a domain controller (PDC01) and a member server (ME01). The member server has a C: and a D: drive. Part ...
5
votes
2answers
2k views

2003 DC AD upgrade to 2008 on second server migration plan

SUMMARY Writing a plan to prepare for a 2003 to 2008 active dir upgrade. 2003 AD exists on a single domain controller and has been upgraded to 2003 functionality. I have add a new 2008 Standard R2 ...
5
votes
2answers
1k views

What are the advantages of adding a Mac to Active Directory?

I was surprised to learn (from this question: http://serverfault.com/questions/8006/how-to-add-a-mac-to-windows-active-directory) that you could add a Mac to AD. What are the advantages of doing so?...
5
votes
4answers
17k views

Can I prevent an Active Directory account from locking out?

Is there an ADUC setting that can prevent certain user accounts from locking out, particularly after x number of failed logon attempts? Oh and our DC is on Server 2003 at the moment, but we also use ...
5
votes
3answers
5k views

Are there alternatives to Sysinternals ADInsight?

I had been using ADInsight from Sysinternals to trace Active Directory calls from my workstation, but the application has failed. Where previously the Active Directory events were traced and logged, ...
5
votes
2answers
22k views

Log LDAP access of the Active directory

I am looking for a method to log ldap access of a Active Directory domain controller. I want to be able to log the username and source IP address access to both 389, and 636(encrypted). A simple ...
4
votes
1answer
199 views

Samba capabilities & functionality

The company that I work for wishes to replace its windows servers with new linux servers but wants to keep Windows on employee desktops. The requirements are: The employee desktops should be able to ...
4
votes
2answers
2k views

Migrating Mailstore from Exchange 2003 to Exchange 2010 in a new domain

Proposed project ahead, and a whole lot of documentation and options out there, so I was looking for opinions or advice. I'm creating a brand new domain and installing Exchange 2010 in the ...
4
votes
2answers
5k views

How do I migrate a Windows 2008 Domain Controller to another computer?

I have single server acting as a domain controller. It is running Windows 2008 Standard edition. What steps are required to migrate this domain to another computer running Windows 2008? I'd like a ...
4
votes
2answers
194 views

Active Directory, control to users

I'm responsible by Active Directory (AD) where I'm working, and I'm trying to figure out, how can I allow, that sector managers of the company, may add and delete users from its departments respective,...
4
votes
1answer
6k views

How do I add a domain user to a group on a non-domain server?

If we are running a server that is not attached to the domain, how would I go about adding a domain user to a local group on that server?
4
votes
5answers
3k views

How to bring another DC up with all roles when first DC is no longer available

I am so upset of this as i am not getting a proper answer anywhere. Let me make it clear the same scenario again. I have a DC named DC-1 & another DC named DC-2. both DC-1 and DC-2 are the name ...
4
votes
6answers
2k views

Powershell assistance for Active Directory Cleanup

I just started a contract to clean up an Active Directory system for a large company. I was told it would be quite the busy work but after reviewing the system and seeing how disorganized and messy it ...
4
votes
3answers
626 views

One AD user Multiple Logins

I have a department of 20 users or so, which basically work in shifts but access the same desktop and settings, I am thinking to join these computers (15 computers) to AD and create only ONE account ...
4
votes
4answers
5k views

Can you have multiple writable, authoritative BIND DNS servers for the same zone, like AD-integrated DNS?

In an AD-integrated DNS system, there really isn't a concept of one "Master" DNS server; all AD-integrated zones are authoritative and updatable across all DNS servers, and send updates to each other ...
4
votes
1answer
1k views

AD strategy for users in multiple departments

I work for a college with almost a thousand users (faculty and staff). Many staff members also teach part-time, and many faculty members teach in different departments. Knowing that a user and/or ...
4
votes
2answers
12k views

How can i verify the trust between 2 domains in Windows Server 2008R2 Active Directory?

How can i verify the trust between 2 domains in Windows Server 2008 R2 Active Directory? Is there a tool for it? Maby a snap-in or something.
3
votes
5answers
4k views

Restore “lost” user after Active Directory removal?

Is it possible to restore lost users after Active Directory unistallation ? (I forgot to switch users to local users) The computer run Windows Server 2008 R2 Entreprise, and all the registry linked to ...
3
votes
3answers
8k views

Nesting Distribution Group within Security Group

Quick sanity check - If I nest an Active Directory distribution group within an Active Directory Security group, will permissions assigned to the AD Security group cascade to the members of the ...
3
votes
2answers
5k views

How can I check access of a Group/User in AD before I delete it?

I'm cleaning up an inherited domain that is not well documented. How can I check that a particular group or user has no ACEs across the AD? Things like searching DACL/SACL for AD objects and file ...
3
votes
2answers
12k views

“Send As” Permission and “You do not have permission to send to this recipient” Error

I have an account on Windows Small Business Server 2003, for which several users have "send as" permission (not "send on behalf" but "send as"). Each of those users has "send as" enabled in active ...
3
votes
1answer
2k views

Site-specific folder redirection through group policy

Suppose I have two sites - A and B - both with 5/5 Mbps WAN links that are connected via L2L VPN. Each Site is defined in AD Sites 'n Services with its own domain controllers, etc. The problem is that ...
3
votes
9answers
888 views

active directory or workgroup for production machines

The old school of thought was that application and database servers should not be part of the domain. I have my network setup such that only the app servers can communicate with the db servers. The ...
3
votes
1answer
1k views

Avoiding shared accounts on an Active Directory environment

Is it possible to somehow force that one and only one account (in the case the account is shared) is logged to an Active Directory environment at any moment? What we want to do is to discourage the ...
3
votes
2answers
8k views

Exact extent / meaning of “Log on as a service” permission (W2K, W2K3)?

Let's say you have an active directory domain, and you want to have a service account run a certain windows service on multiple machines on the domain. The service account needs to be the same account ...
3
votes
3answers
928 views

Multi-Role Domain Controllers for Small Offices (< 50 clients)

Warning: I'm a Linux/*NIX admin so this is all new to me. I understand that it's not considered a good idea to have only a single domain controller, and that it is also probably a good idea for a ...
3
votes
3answers
689 views

Suggestions for transitioning to new GW/private network

I am replacing a private T1 link with a new firewall device with an ipsec tunnel for a branch office. I am trying to figure out the right way to transition folks at the new site over to the new ...