A Microsoft technology for sharing one set of user accounts, security permissions, and management information across many Windows servers and desktops.

learn more… | top users | synonyms (2)

0
votes
2answers
62 views

OpenLDAP proxy : caching credentials in case Active Directory master unreachable

I'm setting up a Debian server in my company where users are managed in an Active Directory. I'd like to authenticate users with AD but I'm thinking it would be better, if feasible, to have a local ...
0
votes
1answer
134 views

Migrate from MS Active Directory to Samba4

The target is to replicate a MS AD DC (Windows server 2012) to a new Samba4 AD DC, then migrate users to the new Samba domain. This is our first time, and the various documents on the Internet are not ...
-3
votes
1answer
56 views

Remove crashed SCCM 2012 from Active Directory 2008 R2 (schema version 69) [closed]

Our VM SCCM 2012 as been deleted by other administrator the last years and we haven't backup. I want remove all trace of SCCM from our Active directory and workstation but i don't know how to do this. ...
1
vote
0answers
21 views

Cygwin: Obtain comment field from Active Directory with mkpasswd

Running cygwin on W7x64. Since a generated /etc/passwd file is static, it has to be performed occasionally when new employees are hired. It polls Windows AD, and writes the passwd file. In the past, ...
0
votes
0answers
32 views

Squid proxy unable to use LDAP/S on CentOS 6

I've configured Squid proxy to authenticate against Active Directory. With plain LDAP, everything works as expected. However, when I try to use LDAP/S, I get these error messages: p11-kit: couldn't ...
2
votes
3answers
72 views

Moving DNS and AD DS to their own servers

I have one WINDOWS SERVER 2012 running my DNS and AD DS on the same server. I am trying to move DNS to it's own server and ADDS to it's own server as well. What I have done so far is setup ADDS on ...
1
vote
1answer
29 views

Delegate permission to “Pre-create Read-only domain controller account”

Is it possible to delegate permission to "Pre-create Read-only domain controller account" (found on the context menu of the Domain Controllers' OU) to a non-domain admin account?
1
vote
0answers
26 views

userAccountControl property - delegate permission to set PARTIAL_SECRETS_ACCOUNT

I am needing to set the userAccountControl property of a user account to include TRUSTED_TO_AUTH_FOR_DELEGATION (0x1000000) and PARTIAL_SECRETS_ACCOUNT (0x04000000). To set ...
1
vote
1answer
123 views

How to work around a “logon workstations” restriction to the Domain Controller stopping authentication via LDAP

I am trying to allow users of an external linux based application server to authenticate with the service using their Active Directory credentials via LDAPS. It works well for admin accounts but fails ...
0
votes
1answer
37 views

cannot config LDAP in filenet p8 5.2

i tried to fulfil this form many times and click "test LDAP connection". it's alway return success. but when i click "run task", it's alway return Running the task failed with the following message: ...
0
votes
1answer
62 views

Issues with delegating subdomain to AD server

I have a working authorative BIND 9.8.4-P2 server on freebsd on domain domain.com with IP 192.168.0.3 and name ns.domain.com that I did not set up on my own. It is a hidden server from which a subset ...
3
votes
2answers
61 views

AD | Prevent admins from changing passwords to the same thing

I have an interesting security problem: Admins with ad access have been changing their password to the same thing, and breaching the company security policy. User side, standard AD complicated ...
2
votes
1answer
41 views

Reversible Encryption - Not Defined but Showing as Enabled?

I'm reviewing our complex password policy that was setup by a previous admin and I'm trying to gain some clarification on the setting for Reversible Encryption. In our organization, reversible ...
1
vote
1answer
204 views

Create SCCM device collection based on last logged on users who are members of an AD security group

I'm trying to create a device collection in SCCM 2012 which contains only the devices who are used by the users who are members of a certain User AD Security Group. I tried to accomplish this by first ...
1
vote
1answer
26 views

Active Directory Group Policy - Default Domain Policy CSE GUID [closed]

The active directory attribute: "gPCUserExtensionNames" contain a CSE GUID and a Tool Extension GUID string value in order pass information for GPO behavior. I have found in the Default Domain ...
8
votes
4answers
911 views

When the internet is down, so is Active Directory?

I am setting up a business server for a small office use with 5 users / 5 devices or so. Nothing elaborate here. I've set up a SINGLE Lenovo TS440 server (single NIC) with Windows Server 2012 R2 ...
4
votes
1answer
120 views

Server2k8: Prevent membership in a group based on membership in another group

I'm revamping my company's service accounts, and we've discovered that some need to be able to log on locally, and some are OK with just logging in as a service. I've created two groups, ...
0
votes
0answers
31 views

how to get info on failed authentication to domain - security audit?

Setup: 1 Windows Server 2012 box as Domain Controller, named DC1. 2 Windows Server 2012 R2 boxes, S1 and S2, on the same network, same config, joined to the domain. Issue: At random times, S1, S2 or ...
1
vote
0answers
83 views

AD DC - Error 4625 Status 0x80090308

I recognzie a small amount of Event 4625 entries with a status of 0x80090308 and substatus 0x0; 2% over all 4625's. It is basically a failed logon but without any information I could use to look ...
0
votes
0answers
46 views

Two different IIS applications with different auth methods for the same domain

I have been working on a kind of SSO solution for an intranet application. My approach has been: configure the application within IIS with Windows Security authentication configure IE adding the ...
1
vote
1answer
54 views

Passwordless login: virtual smart card with no pin? [closed]

I would like to set up a domain-joined computer for passwordless login with some low-privileged domain account that is specific to that computer. I've seen some blog posts that store the username and ...
-3
votes
2answers
47 views

Windows 2008 dead server to windows 2012 Active directory move [closed]

Our windows 2008 AD server has failed, but i am able to read the hard drive via a usb cradle. We have got a new server now running windows 2012. Is there anyway I can move the active directory? Any ...
0
votes
1answer
54 views

Is it possible to add permissions to an Active Directory account using PowerShell?

We're deploying Active Directory, and we're using PowerShell scripts for most of it: creating the forest, creating AD elements (users, groups, sites, subnets), etc. We'd like to make some users able ...
0
votes
1answer
26 views

Allow anonymous users to see contents of the Users folder in AD

I have already enabled anonymous access to AD by setting the dSHeuristics property to 0000002 for CN=Directory Service. While this allows anonymous users to bind to the directory successfully, when I ...
2
votes
1answer
86 views

Joining Linux host to Active Directory fails to update Microsoft DNS

I am joining Linux hosts (CentOS 6) to Active Directory using a special bind account. I've granted delegate permissions to this user and when I join on the default Computers OU, a computer object is ...
1
vote
0answers
45 views

Installing Active Directory after finishing installing and deploying Windows Server 2008 [closed]

I have a small business with 5 employees and I am starting to use a Windows Server 2008 R2 to give my employees access to the server with TS RDP . The end of live of Server 2003 is coming soon which i ...
0
votes
0answers
14 views

Cross Domain LDAPS

I have a bit of an issues I am running in to. We have two domains: domain1.com domain2.com Our Enterprise and Subordinate CA Resides on domain1, let's call it subca.domain1.com. I am trying to ...
1
vote
2answers
64 views

Change different domain account without being admin Windows

I have 2 accounts on a domain. I can log into a citrix virtual desktop with the one account fine, but the other won't let me log into anything until I first change my password. I am remote, so I ...
0
votes
1answer
19 views

Adding users to a group in a Forest trusted Domain

I am doing a cross forest migration for DC-A to DC-Z. on DC-A there's a sharepoint 2007 and I would like migrated users on Forest -Z to access Sharepoint on Forest - A. What I have done so far is ...
2
votes
2answers
59 views

Authorization using LDAP OU or Groups

In the below image I have drawn two schema structures for LDAP(Active Directory) I would like to know which one is correct. In my organisation they are using Structure 1 design for PC login and ...
0
votes
0answers
20 views

Jenkins AD Auth with extended User search base

I’m trying to use a fairly large Active Directory instance to authenticate Users with Jenkins. This works quite well with the following settings: ...
3
votes
0answers
29 views

Universal Group in domain not behaving as expected in multi-forest environment

I have an environment with 2 forests, F1 and F2 with a full, transitive, bi-directional trust between them. F1 has a single domain that holds an SSRS server. F2 has 2 domains, F2parent and F2child, ...
1
vote
1answer
35 views

Sync AD thumbnailPhoto with all company computers

I'm perfoming some tests with AD related with thumbnailPhoto and jpegPhoto AD attributes. I uploaded a photo in my AD user in both attributes using following this blog entry. However, the photo is not ...
0
votes
1answer
91 views

Allow access to only certian AD Group users to IIS site

I have created Active Directory Group to allow access to certain user to IIS site (IIS version 8.5). I have installed "URL Authorization" module as shown in below link: ...
1
vote
2answers
53 views

Do I really need an account in domain\administrators for the Web Application Proxy with ADFS 3.0 on a domain controller?

I am trying to move my ADFS / WAP to the cloud to give better resilience after experiencing a recent failure. In part to save on VM costs, I am using just 2 VMs, with ADFS installed on a domain ...
0
votes
0answers
43 views

SSO Linux and AD Trusted Domain

Having successfully built a one-way trust between 2 AD domains, we can't lookup/id the user in the trusted domain. Here's our use case. AD1: dom1.com (Win2k8 R2) - One-way outgoing trust to AD2 ...
0
votes
1answer
50 views

Is it possible to connect with domain, when active directory is not installed?

We have a small server with Win Server 2008 in our office. It is in use for a long time now. I'm new here, and there is no IT guy, but only some IT company that does business for us when we need them. ...
0
votes
1answer
40 views

recover deleted item using LDP

First this is not critical. It is a test environment. I have server 2012r2 as DC with both domain & functional level at 2012r2. I have AD recycle bin enabled. I delete a user. I can see that ...
0
votes
1answer
151 views

The configuration information describing this enterprise is not available - Error I receive

I have Windows Server 2012 R2 installed and when I navigate to 'AD DS' and try to go to 'Active Directory Domains and Trust' the error I receive is "The configuration information describing this ...
1
vote
0answers
27 views

What is the better solution for active directory on mixed Linux and Windows

In my existing infrastructure, we have two domains of Active Directory. First domain is private.com and second is public.com. Public.com has been configured to one-way trust to private.com. All user ...
2
votes
2answers
38 views

What permissions are required for a domain user to login to a domain machine?

I have been under the impression that Domain Users should be able to login to a domain joined machine with their domain credentials out of the box and no special permissions needed. I'm running this ...
0
votes
1answer
75 views

Local group policy not applying (gpresult says its empty, but it's not)

We are running a strange AD constellation here, where the same logon script is defined within the local group policy on each server (don't ask me for the reason, it wasn't my idea). Then an (AD-) ...
0
votes
2answers
78 views

Find if linux machine is domain joined

We're joining our Linux machines to our Active Directory using adcli join. Now we start doing this as part of our saltstack setup, but we cannot figure out how to determine if the machine is already ...
4
votes
1answer
166 views

Bulk License Office 365 Users by OU with PowerShell

I'm trying to do something that I don't think should be too complicated of a fix. My end goal: I have certain users in one AD OU that need to use a certain license in Office 365, and different users ...
0
votes
0answers
36 views

Local User Account Disappeared After Domain Upgrade

I upgraded to server 2012 r2 from 2008 r2 I have all computers in AD The workstations with local logons are losing the local user that i have set up on them... (the admin logon is not disappearing) ...
0
votes
1answer
150 views

Access denied trying to login to Ubuntu 14.04 (Authentication with Active Directory)

I'm trying to set up my Ubuntu 14.04 print server to authenticate users with my Active Directory server, I've followed all of the steps using the following tutorial: ...
0
votes
0answers
61 views

Why can't we directly change a group from global scope to domain local or vice versa?

If we need to change the scope of a group from global to domain local or vice versa we first need to change it to Universal. What is the reason for this?
0
votes
0answers
19 views

Microsoft AD DS group membership verification when authorizing user

Can somebody point out to documentation or explain how verification works in AD DS when it is necessary to authorize user to perform some actions. As far as I remember user's SID or token should ...
0
votes
0answers
27 views

How to export LDAP RootDSE attributes to LDIF file?

How to export LDAP RootDSE attributes to LDIF file? I was able to use Active Directory Explorer to see RootDSE attributes but I can not export them: ...
1
vote
0answers
124 views

enter-pssession : Connecting to remote server failed with the following error message : The user name or password is incorrect

I am unable to connect to domain controller via below script. This script is working for another domain controller so it mean script is correct. While I am connecting i am getting an error: ...