A Microsoft technology for sharing one set of user accounts, security permissions, and management information across many Windows servers and desktops.

learn more… | top users | synonyms (2)

7
votes
4answers
5k views

Move computer accounts to new OU in bulk

I have an OU with around 2500 computers. I need to move 580 of them to another OU. Is there a way to do this with a batch file? I have a text file with the computernames (not the FQDN).
7
votes
5answers
8k views

Linux + Active directory authentication + only letting certain groups login

I have some linux boxes that use Windows Active Directory authentication, that works just fine (Samba + Winbind). What I would like to do now though is only allow certain people or certain groups to ...
7
votes
1answer
21k views

How can I join a computer to a new domain remotely?

I have a large number of PCs that are joined to domain abc.com and I want to move them over to xyz.com so they are no longer a member of abc.com. Can I do this with a script? Thanks
7
votes
7answers
33k views

How do you find out if Active Directory is using Kerberos or NTLM?

Is there a command line program you can use?
7
votes
1answer
4k views

Reset users password in Active Directory by Domain Admin account or other service account

In Active Directory you can set and enforce rules where users have to use strong password, can't use last 5+ passwords they already had, enforce password complexity. Is there a way to enforce such ...
7
votes
2answers
4k views

Best practice for decommissioning a Domain Controller that is also a DNS server?

There are two schools of thought for the decommissioning process of Active Directory Domain Controllers that are heavily used as DNS servers. Add the IP address of the outgoing DC to a new DC and ...
7
votes
2answers
481 views

How can I save a domain controller after a USN rollback without rebuilding the whole server?

Today I had (again...) to lobotomize a domain controller which had suffered the dreaded USN rollback; the standard solution to this issue is to demote it and then promote it back again, but the main ...
7
votes
3answers
2k views

Need for another Domain Controller

I have two domain controllers (Windows 2003) in one site where most of the department I support resides. There is another building (at another site) where my department resides as well, but they have ...
7
votes
3answers
744 views

Delete a windows group in Active Directory

I am doing a cleanup of some AD groups that are no longer used. One of the AD groups I could not delete because it seems that a member has this group set as the primary group (which I assume someone ...
7
votes
1answer
216 views

How do I remotely issue a CLI command to thousands of Windows domain computers at once?

I need to issue a CLI command (cmd.exe or PowerShell) to all of the thousands of computers on my domain. For obvious reasons, this is not going to involve doing the task manually, or physically ...
7
votes
2answers
1k views

Is there a way of consolidating multiple GPOs into one GPO

I have about 100 GPOs that I would like to merge down to 15-20. Is there a way of merging them together. I found this article: ...
7
votes
1answer
3k views

Best practice for authenticating DMZ against AD in LAN

We have few customer facing servers in DMZ that also have user accounts , all accounts are in shadow password file. I am trying to consolidate user logons and thinking about letting LAN users to ...
7
votes
5answers
16k views

How to find the computer name a user logged on to

Is there a tool or script or some other way of knowing what computer name a specific user is currently logged on to? Or even was logged on to? Say the user "HRDrone" is working on his machine whose ...
7
votes
2answers
2k views

GPO best practices : Security-Group Filtering Versus OU

Good afternoon everyone, I'm quite new to Active Directory stuff. After upgraded Functional level of our AD from 2003 to 2008 R2 (I need it to put fine-grained password policy), I then start to ...
7
votes
2answers
1k views

Sudoers file allow sudo on specific file for active directory group

I have active directory sign in working on an Ubuntu 12.04 box. When the user signs in, I have a script that runs that needs sudo permission (since it modifies the samba config file). How would I ...
7
votes
3answers
2k views

Advice on Active Directory design for multihomed servers

I've been tasked by a customer to come up with a working Active Directory design for a scenario with the following requirements (simplified, they are actually a lot worse): There is a subnet for ...
7
votes
3answers
5k views

Place a computer object in an OU based on the user who added it

Is there a way to auto place a computer in a specific OU based on of the user who joined it to the domain? For example, I have 5 OUs, and site admins can add PCs to the domain, but can't manage any ...
7
votes
3answers
4k views

Combined NFS, Samba server w users from Active Directory

I want to build a server that exports user home directories over SMB/CIFS and NFS. This server would be joined to a Win2k3 AD domain controller that holds our user database. As I understand it, ...
7
votes
2answers
4k views

Which AD permission is required to allow impersonation of an account?

I have a Windows service account. I need to grant it permission to impersonate another account within a group on another trusted domain, without delegation. So effectively, my service account says ...
7
votes
3answers
4k views

Virus that tries to brute force attack Active Directory users (in alphabetical order)?

Users started complaining about slow network speed so I fired up Wireshark. Did some checking and found many PCs sending packets similar to the following: (screenshot) http://imgur.com/45VlI.png I ...
7
votes
2answers
6k views

How many times can a simple user add a computer to windows domain?

In a course about Windows Server administration that I took at the university they told us that a normal user could add 10 computers to a domain. Over the years however I've added and removed way more ...
7
votes
2answers
2k views

Windows 2008 R2 gpupdate locks my user account

I built a Windows 2008 R2 server last year, and ever since my elevated account locks 10-12 times a day. After much research and testing I found that the server is locking my account at each failed ...
7
votes
1answer
4k views

Granting Domain Admin privileges to a cross-forest user account?

Does anyone know of a way to [effectively] have a user or group in one forest acquire the privileges of the Domain Admin group in another forest? The obvious approach of adding Domain ...
7
votes
1answer
310 views

one of the single dc per domain DCs has suffered USN rollback

I've inherited an Active Directory forest that is laid out very badly. It has a single forest with a domain tree for each site, each with a single domain controller. No domain is a child of any ...
7
votes
5answers
4k views

Cannot join Win7 workstations to Win2k8 domain

I am trying to connect a Windows 7 Ultimate machine to a Windows 2k8 domain and it's not working. I get this error: Note: This information is intended for a network administrator. If you are not ...
7
votes
5answers
4k views

Debian 6.0 AD integration

Despite multiple questions already about this, e.g. Linux on Windows AD Domain I'd like to know how to get Debian 6.0 Squeeze integrated with AD using open source or otherwise free of charge for ...
7
votes
5answers
2k views

Replacement for NIS/YP

The company that I am working for is embarking on replacing the current locally developed NIS/YP structure with LDAP. We already have AD in house for the Windows stuff and would like to consider ...
7
votes
1answer
311 views

linux 802.1x on a windows wired network

I'm looking to use my linux workstation on our company network, but i've been running into a few issues, specifically 802.1x i believe. I'm root on my machine and a windows domain admin so i should ...
7
votes
1answer
454 views

How do I implement a Fine-grained password policy and expect XP machines to play nice?

I have a 2008 R2 functional level domain and am in the middle of implementing the first actual password policy my organization is going to use. To slowly roll this out to our users, we have chosen to ...
7
votes
1answer
220 views

Exchange Server Using Wrong Active Directory Site

Our Exchange 2013 server suddenly started logging errors about bad replication between sites (there should be no replication as there is no other server) as well as several other issues that appear to ...
7
votes
2answers
2k views

Domain Controller DNS Best Practice/Practical Considerations for Domain Controllers in Child Domains

I'm setting up several child domains in an existing Active Directory forest and I'm looking for some conventional wisdom/best practice guidance for configuring both DNS client settings on the child ...
7
votes
1answer
2k views

ISC Bind support for GSS-TSIG DDNS Updates?

First, has anyone EVER configured ISC bind 9.5.0 OR greater with support for GSS-TSIG Dynamic DNS Updates AND gotten it to work? If so, what is the configuration that was used to make that happen? I ...
7
votes
2answers
9k views

Authenticating Apache HTTPd against multiple LDAP servers with expired accounts

We're using mod_authnz_ldap and mod_authn_alias in Apache 2.2.9 (as shipped in Debian 5.0, 2.2.9-10+lenny7) to authenticate against multiple Active Directory domains for hosting a Subversion ...
7
votes
2answers
873 views

Precached Windows Logins?

I know if a Windows users logs into a machine, and later that machine falls off the network, that the user can log in to the machine with cached credentials. Is there any way to precache those ...
7
votes
3answers
795 views

Ubuntu 12.04, Windows 2012 Active Directory Integration, Kerberos won't resolve service principals

after having checked the whole internet literally, I hope that I might get help here. I am trying to accomplish integration of ubuntu 12.04 servers into a Windows 2012 active directory with nfs and ...
7
votes
2answers
1k views

IIS Digest repeatedly asking for authentication

I have a development copy of an ASP.NET intranet site checked out and running on my local machine. We're using digest authentication to allow users to log in using their active directory accounts. ...
7
votes
0answers
99 views

OS X Lion machines will continually query Active Directory 2008 for every user in the directory [closed]

We are having a problem where our OS X Lion machines will continually query Active Directory 2008 for every user in the directory until a user logs into the machine. When a user logs into the machine, ...
6
votes
3answers
1k views

Does Active Directory support DNS names with spaces?

While looking into how to set up some static DNS-SD services in our network, I came across http://www.dns-sd.org/ServerStaticSetup.html, which states that Active Directory's DNS server does not ...
6
votes
6answers
2k views

Back up and restore Active Directory password per user

For administrative purposes, I sometimes need to log in as another user to diagnose a problem with their account. I'd like to be able to do this without having to change their password so I don't ...
6
votes
3answers
3k views

Number of Domain Controllers needed?

In the process of migrating 7 school site network from Server 2003/XP to Server 2012/7 and wanted to get some feedback on how many domain controllers would be optimal. Currently we have 4 DCs. All 7 ...
6
votes
2answers
2k views

Use Google Apps/Cloud Services as a Domain Controller Replacement

This is a Canonical Question about Cloud Services replacing Active Directory. Is it possible to use Google Apps or another Cloud Service as a replacement for a Windows Domain Controller ...
6
votes
4answers
10k views

A good way to reboot all computers on a Windows domain each night

What is a good way to reboot a list of windows computers on a windows domain? Assuming the windows domain controller does not have a service to do this, please make recomendations for a script. Can ...
6
votes
5answers
2k views

Protect files on NTFS volume from Domain Administrators

We're a small company with a 2008R2 domain on which we have a file server with several shared volumes. We have a number of IT staff in the domain administrators role, because effectively we're all on ...
6
votes
6answers
10k views

Domain Controller time is incorrect

I have a domain controller running in VM on Hyper-V, the time seems to be steadily getting faster, over the X-mas period it's 5 faster, which seems odd! I know how to change the time and I belive we ...
6
votes
2answers
799 views

How do Active Directory domain joined computers (native MS Windows or Linux with winbind) determine the closest password server?

How do Active Directory domain joined computers (native MS Windows or Linux with winbind) determine the closest password server? This question implies a cluster with 2+ Active Directory servers in ...
6
votes
3answers
6k views

What is Location field in Active Directory used for?

Is the Location field in Active Directory used for anything other than listing where objects are physically located? I am interested if this is just a user friendly field to help people find printers ...
6
votes
2answers
283 views

Does the sAMAccountName rename practice based on employment status makes sense?

Where I work there is a practice of adding a t_ prefix to all temporary employees logins (sAMAccountName). When someone switches from temp to perm or the the other way the prefix is add/removed. ...
6
votes
3answers
14k views

How to enable Automatic Logon for a computer in Windows Domain?

I need to setup publicly available computer to perform automatic log on using domain credentials when powering on. When it was not a domain member this option was available on control userpasswords2 ...
6
votes
8answers
4k views

Best practices or experience with company wide Username policies and resolving duplicates

I am a programmer with an application that needs to be integrated into the new company wide Active Directory login scheme. This means changing all the usernames in our system to use the new scheme. ...
6
votes
2answers
8k views

When to raise domain functional level?

We very recently completed a project to retire two old domain controllers running Server 2003 R2. They are now replaced with shiny new 2008 R2 boxes. However, the functional level of the domain has ...