A Microsoft technology for sharing one set of user accounts, security permissions, and management information across many Windows servers and desktops.

learn more… | top users | synonyms (2)

7
votes
8answers
55k views

How to tell what time a domain user logged in?

In the "Security" event log on a Windows 2003 domain controller, I see several entries of event 540 -- "Successful Network Logon" averaging a few minutes apart throughout the day. Is the first one of ...
7
votes
6answers
4k views

Active Directory OU design for <500 users, 4 locations

We are looking to add some logical structure to our (Win 2003) AD hierarchy. We have a single domain and around 500 users. All users and computers are currently organized into one OU. All security ...
7
votes
3answers
354 views

Can a Second Domain Controller, with buggy hard drive hardware, cause a corruption to Active Directory?

We have a new Domain Controller that holds all FSMO roles. We also have two old hardware servers, about 4-5 years old each, set up as secondary Domain Controllers (or better described as Domain ...
7
votes
3answers
629 views

Reset Windows user domain password

Is there a way to reset a user domain password remotely without login to a remote desktop to the domain controller? I could not find any MMC plugin in non-server Windows (Window 7 Ultimate in this ...
7
votes
2answers
6k views

Danger of Scavenging Stale Resource Records In _msdcs Zone?

I just realized that a previous admin turned DNS scavenging on for all zones on one of the DCs, including the _msdcs zone. It's been this way for a while and things are fine, but I can't imagine that ...
7
votes
2answers
9k views

When to raise domain functional level?

We very recently completed a project to retire two old domain controllers running Server 2003 R2. They are now replaced with shiny new 2008 R2 boxes. However, the functional level of the domain has ...
7
votes
2answers
4k views

Migrate Active Directory to new server?

We bought new server and we want to turn our current server off. how can I restore our active directory and DHCP and DNS(current server states) to new one? we got Active Directory, DNS, DHCP. our old ...
7
votes
3answers
3k views

Child Domain vs Trust Relationship

So here is the scenario- We are in the process of centralizing IT to a data center in a single location. I currently have 12 different operating companies that need a shared security and exchange ...
7
votes
3answers
4k views

Where do I store sensitive data within Active Directory?

I am essentially storing a private key (Hash) in any of the OctetString attributes within Active Directory. My question is, what attribute is secure by default and makes sense to keep private data ...
7
votes
6answers
325 views

What does a developer need to know about Windows Server?

I am a certified .NET Developer, and I do a lot of Sharepoint development at work. Adding/editing/deleting users requires using AD and of course, anything to do with the site structure in Sharepoint ...
7
votes
2answers
353 views

Transition away from Domain Admin only account

In our Windows environment, our Domain Admins only have one user account. This single user account is used across the board including running on a day to day workstation. In our transition away from ...
7
votes
3answers
822 views

AD reset user passwords for a security group

I'm not quite sure if this is possible or not, but I need to force a certain security group's users to have their passwords expire so they'll be forced to change them on next login. The reason for ...
7
votes
5answers
11k views

Using Active Directory as an LDAP server for Linux clients

I'm trying to figure out how to use Windows Server 2008 R2 as an LDAP server for Linux clients. Ideally, users should be able to login to their Linux workstations via pam_ldap authenticating against ...
7
votes
2answers
3k views

Server 2012 R2 Active Directory Domain SRV dns records suddenly disappeared

I have a test domain that I recently configured. All of a sudden, no users can log in except those with cached credentials. The domain includes two domain controllers that are both global catalogs ...
7
votes
3answers
4k views

Active Directory disaster recovery with DPM

I have a sort of catch-22 question here. Suppose I'm using Microsoft System Center Data Protection Manager (2010 or 2012, it works the same way) to backup, amongst various other things, my Active ...
7
votes
2answers
7k views

Search AD by GUID

How do I search Active Directory for objects by GUID? In other words, what would be a good way to find what objects belong to specified GUIDs?
7
votes
7answers
903 views

Is there a way to audit AD for a particular password?

Is there a way I can audit AD to check for a particular password? We used to use a "standard" password for all new users (e.g. MyPa55word). I want to make sure this is no longer in use anywhere on ...
7
votes
9answers
2k views

Which Version Control Systems support LDAP/AD users and groups

Does anyone know which of the big players (if any) support LDAP/AD users and groups for authentication AND database permissions? Specifically, I'm wondering if SVN, GIT, Mercurial etc. will allow ...
7
votes
4answers
1k views

Giant active directory deployment vs giant Sun LDAP

At work we're in the early phases of an identity management project. This is all in the context of higher ed where we have a couple thousand faculty / staff and about twenty thousand students. Has ...
7
votes
2answers
1k views

Can a Mac with OS X 10.5 (Leopard) authenticate with a Windows 2008 domain?

I would like to have my MacBook Pro authenticate against Active Directory running on Windows 2008. A couple of years ago I tried to set this up between OS X 10.4 and Windows 2003 but I wasn't ...
7
votes
3answers
37k views

User in domain admin group cannot access directory the group has permission to access

I've run into a rather interesting issue when playing with one of my domain labs. There's a directory on a 2008 R2 fileserver that's being used for folder redirection for all users in the "Staff" OU. ...
7
votes
1answer
342 views

How do I remotely issue a CLI command to thousands of Windows domain computers at once?

I need to issue a CLI command (cmd.exe or PowerShell) to all of the thousands of computers on my domain. For obvious reasons, this is not going to involve doing the task manually, or physically ...
7
votes
2answers
3k views

Is there a performance impact of direct AD universal groups assignment?

I'm implementing a tool which secures certain shared resources within AD forest (mostly file shares). By some criteria a list of users from different domains is generated, those users are added to a ...
7
votes
4answers
6k views

Move computer accounts to new OU in bulk

I have an OU with around 2500 computers. I need to move 580 of them to another OU. Is there a way to do this with a batch file? I have a text file with the computernames (not the FQDN).
7
votes
1answer
23k views

Give Local Admin privileges to AD user group for group of computer

I need to give administrative privileges to a group of user for a group of a PC in an Active Directory Enviroment. For Example i have : HelpDesk_User : Group of user HelpDesk_PC : Group of ...
7
votes
1answer
22k views

How can I join a computer to a new domain remotely?

I have a large number of PCs that are joined to domain abc.com and I want to move them over to xyz.com so they are no longer a member of abc.com. Can I do this with a script? Thanks
7
votes
2answers
184 views

How to recover data from an Exchange 2013 database after a complete Active Directory loss?

Scenario: a single Exchange 2013 server in a Windows Server 2003 AD domain; one DC malfunctioned months ago and was dismissed (without proper demotion, no less); the other DC died yesterday and there ...
7
votes
1answer
289 views

How to edit Active-Directory Site properties via Powershell?

I am having trouble accessing the location property of my Active-Directory's Site via Powershell. (Windows Server 2012 R2) The following command returns no value: > (Get-ADReplicationSite ...
7
votes
1answer
6k views

Reset users password in Active Directory by Domain Admin account or other service account

In Active Directory you can set and enforce rules where users have to use strong password, can't use last 5+ passwords they already had, enforce password complexity. Is there a way to enforce such ...
7
votes
2answers
6k views

Best practice for decommissioning a Domain Controller that is also a DNS server?

There are two schools of thought for the decommissioning process of Active Directory Domain Controllers that are heavily used as DNS servers. Add the IP address of the outgoing DC to a new DC and ...
7
votes
2answers
623 views

How can I save a domain controller after a USN rollback without rebuilding the whole server?

Today I had (again...) to lobotomize a domain controller which had suffered the dreaded USN rollback; the standard solution to this issue is to demote it and then promote it back again, but the main ...
7
votes
3answers
2k views

Need for another Domain Controller

I have two domain controllers (Windows 2003) in one site where most of the department I support resides. There is another building (at another site) where my department resides as well, but they have ...
7
votes
3answers
841 views

Delete a windows group in Active Directory

I am doing a cleanup of some AD groups that are no longer used. One of the AD groups I could not delete because it seems that a member has this group set as the primary group (which I assume someone ...
7
votes
4answers
2k views

Unable to dcpromo new 2008 Server in 2000 domain

I'm trying to replace an old Windows 2000 domain controller with a new Windows 2008 Server. I have the Active Directory Domain Services role installed on the new server and joined it to the domain. ...
7
votes
4answers
4k views

How do I edit “PersonalTitle” field in Active Directory

I want to edit a user's "personalTitle" field in Active Directory, but cannot find where it is stored in "Active Directory Users and Computers". Can anyone point me in the right direction? Thanks, ...
7
votes
2answers
4k views

Why can a user log in via more than one UPN

I've changed the for all users UPN suffix of a company from us.mycompany.local to mycompany.com in order to use claims aware applciations. In testing before the change I discovered that even if I ...
7
votes
2answers
1k views

Is there a way of consolidating multiple GPOs into one GPO

I have about 100 GPOs that I would like to merge down to 15-20. Is there a way of merging them together. I found this article: ...
7
votes
5answers
13k views

Can an LDAP query on AD provide the netbios domain name for a single account when using the Global Catalog?

I am using ADSI Edit to look at LDAP properties of a single user account in AD. I see properties such as userPrincipalName, but I do not see one for the fully qualified domain name (FQDN) or the ...
7
votes
1answer
3k views

Best practice for authenticating DMZ against AD in LAN

We have few customer facing servers in DMZ that also have user accounts , all accounts are in shadow password file. I am trying to consolidate user logons and thinking about letting LAN users to ...
7
votes
2answers
6k views

Reverse DNS records not registered when using DHCP

I've stumbled upon a strange behaviour with Windows machines, which seems to be fairly consistent between all Windows versions from Vista/2008 to 8.1/2012 R2; it doesn't happen instead when using ...
7
votes
2answers
163 views

How to prevent Windows Server from adding external IP addresses for the domain controller into the DNS?

On one of my domain controllers there are two network interfaces - an external with IPv4 and IPv6 addresses and an Internal with 10.x.x.x address. The domain controller has RRAS (VPN site-to-site ...
7
votes
2answers
2k views

GPO best practices : Security-Group Filtering Versus OU

Good afternoon everyone, I'm quite new to Active Directory stuff. After upgraded Functional level of our AD from 2003 to 2008 R2 (I need it to put fine-grained password policy), I then start to ...
7
votes
2answers
1k views

Sudoers file allow sudo on specific file for active directory group

I have active directory sign in working on an Ubuntu 12.04 box. When the user signs in, I have a script that runs that needs sudo permission (since it modifies the samba config file). How would I ...
7
votes
3answers
6k views

Place a computer object in an OU based on the user who added it

Is there a way to auto place a computer in a specific OU based on of the user who joined it to the domain? For example, I have 5 OUs, and site admins can add PCs to the domain, but can't manage any ...
7
votes
3answers
4k views

Combined NFS, Samba server w users from Active Directory

I want to build a server that exports user home directories over SMB/CIFS and NFS. This server would be joined to a Win2k3 AD domain controller that holds our user database. As I understand it, ...
7
votes
2answers
5k views

Which AD permission is required to allow impersonation of an account?

I have a Windows service account. I need to grant it permission to impersonate another account within a group on another trusted domain, without delegation. So effectively, my service account says ...
7
votes
3answers
5k views

Virus that tries to brute force attack Active Directory users (in alphabetical order)?

Users started complaining about slow network speed so I fired up Wireshark. Did some checking and found many PCs sending packets similar to the following: (screenshot) http://imgur.com/45VlI.png I ...
7
votes
2answers
7k views

How many times can a simple user add a computer to windows domain?

In a course about Windows Server administration that I took at the university they told us that a normal user could add 10 computers to a domain. Over the years however I've added and removed way more ...
7
votes
2answers
3k views

Windows 2008 R2 gpupdate locks my user account

I built a Windows 2008 R2 server last year, and ever since my elevated account locks 10-12 times a day. After much research and testing I found that the server is locking my account at each failed ...
7
votes
1answer
6k views

Granting Domain Admin privileges to a cross-forest user account?

Does anyone know of a way to [effectively] have a user or group in one forest acquire the privileges of the Domain Admin group in another forest? The obvious approach of adding Domain ...