A Microsoft technology for sharing one set of user accounts, security permissions, and management information across many Windows servers and desktops.

learn more… | top users | synonyms (2)

8
votes
1answer
531 views

Why would a domain controller encouter a USN rollback after an unclean shutdown?

I have this Windows Server 2008 R2 domain controller running on a physical Dell server, model PowerEdge R510. There are some electrical problems around here, thus a black-out is, unfortunately, quite ...
8
votes
1answer
33k views

Command to remove computer from non-existant domain

I lost my domain controller machine, and then add new domain controller but with a new domain. How do I remove network machines from old domain using command line and add to new domain? Machines ...
8
votes
2answers
4k views

Upgrade software package installed with GPO

Since recently I have been using AD policies to deploy software packages through GPO on a small domain. This had been working well, but I am not sure what is the correct procedure for upgrading a ...
8
votes
1answer
123 views

Does the Read-Only configuration of a DC apply only to Active Directory?

Firstly, I'm not sure how friendly the users of this site are to students but my question seems to be well suited. I am configuring a domain with multiple Windows Server 2008 machines and am curious ...
8
votes
5answers
4k views

Cannot join Win7 workstations to Win2k8 domain

I am trying to connect a Windows 7 Ultimate machine to a Windows 2k8 domain and it's not working. I get this error: Note: This information is intended for a network administrator. If you are not ...
8
votes
4answers
2k views

How to manage hundreds of users (and customized profiles) on individual Windows 7 machines?

We're a small college, where every student is assigned an Active Directory account. We have a couple computer labs where the machines are all joined to the domain and students can log in to any ...
8
votes
2answers
1k views

Precached Windows Logins?

I know if a Windows users logs into a machine, and later that machine falls off the network, that the user can log in to the machine with cached credentials. Is there any way to precache those ...
8
votes
3answers
364 views

Join ActiveDirectory (Win 2k8R2) to OpenDirectory(Snow Leopard)

The vast majority of questions and so on regarding the interoperability of Active and Open directories involves getting Mac clients to see an AD and auth against it. What we'd like to do is get a ...
8
votes
1answer
84 views

What does SBS 2011 do “under the hood” when you give a user admin access?

I have been using Windows Server for many years now and when I have someone who needs local admin access over their machine, I apply it through group policy in a similar way to this answer. One of my ...
8
votes
2answers
269 views

Rss feed of Active Directory Changes?

Is it possible to setup a RSS feed to view all changes made to an Active Directory database?
7
votes
4answers
8k views

What is the point of creating a computer object in Active Directory when you still have to join the PC?

What is the point of creating a computer object in Active Directory when you still have to join computers to the domain, which then creates the object anyway?
7
votes
13answers
18k views

Windows: Can domain controllers also serve other functions?

This question was a discussion about whether Active Directory is necessary to run Terminal Services. But a chain of answers and comments (mostly by me) brought up a related question around Domain ...
7
votes
4answers
33k views

Is my AD already an LDAP server?

I have installed an LDAP browser, to try and browse my AD information (this is part of enabling Google Directory Sync process). however, I keep getting a connection error (using port: 19389). the ...
7
votes
3answers
12k views

Your system administrator does not allow the user of saved credentials to log on to the remote computer

At our office, any of our Windows 7 Clients get this error message when we try and RDP to a remote W2K8 Server outside of the office :- Your system administrator does not allow the user of saved ...
7
votes
3answers
20k views

What happens when a computer joins an Active Directory domain?

What changes are applied to a client when it joins an AD domain? How is a domain member supposed to behave when disconnected to the network? Are users able to login? Will domain user policies still ...
7
votes
6answers
1k views

Securing Active Directory domains on a potentially hostile network

Active Directory is one of the best features of Windows Server, but it's also a big shiny target. If compromised it gives the attacker your Windows network. In an environment with externally facing ...
7
votes
8answers
62k views

How to tell what time a domain user logged in?

In the "Security" event log on a Windows 2003 domain controller, I see several entries of event 540 -- "Successful Network Logon" averaging a few minutes apart throughout the day. Is the first one of ...
7
votes
2answers
64k views

List All Groups and Their Members with PowerShell on Win2008r2

I am new to powershell, but I've been reading manuals and practiced a little bit. My objective is to List all users in all Security Groups under specified path. I have found the way to do it: ...
7
votes
6answers
4k views

Active Directory OU design for <500 users, 4 locations

We are looking to add some logical structure to our (Win 2003) AD hierarchy. We have a single domain and around 500 users. All users and computers are currently organized into one OU. All security ...
7
votes
3answers
358 views

Can a Second Domain Controller, with buggy hard drive hardware, cause a corruption to Active Directory?

We have a new Domain Controller that holds all FSMO roles. We also have two old hardware servers, about 4-5 years old each, set up as secondary Domain Controllers (or better described as Domain ...
7
votes
2answers
6k views

Danger of Scavenging Stale Resource Records In _msdcs Zone?

I just realized that a previous admin turned DNS scavenging on for all zones on one of the DCs, including the _msdcs zone. It's been this way for a while and things are fine, but I can't imagine that ...
7
votes
3answers
663 views

Reset Windows user domain password

Is there a way to reset a user domain password remotely without login to a remote desktop to the domain controller? I could not find any MMC plugin in non-server Windows (Window 7 Ultimate in this ...
7
votes
4answers
35k views

Kinit Won't Connect to a Domain Server : Realm not local to KDC while getting initial credentials

I am setting up a testbed environment where Linux (Ubuntu 10.04) clients will authenticate to a Windows Server 2008 R2 Domain Server. I am following the official Ubuntu guide to set up a Kerberos ...
7
votes
2answers
10k views

When to raise domain functional level?

We very recently completed a project to retire two old domain controllers running Server 2003 R2. They are now replaced with shiny new 2008 R2 boxes. However, the functional level of the domain has ...
7
votes
2answers
4k views

Migrate Active Directory to new server?

We bought new server and we want to turn our current server off. how can I restore our active directory and DHCP and DNS(current server states) to new one? we got Active Directory, DNS, DHCP. our old ...
7
votes
3answers
3k views

Child Domain vs Trust Relationship

So here is the scenario- We are in the process of centralizing IT to a data center in a single location. I currently have 12 different operating companies that need a shared security and exchange ...
7
votes
2answers
14k views

Force Windows server to use specific Domain Controller

Is there a way I can set an OWA server in my DMZ to talk to a DC in the local site? The DMZ is located at the same (physical) site as a LAN with DCs on it. (There is no DC in the DMZ.) Can I force ...
7
votes
3answers
5k views

Where do I store sensitive data within Active Directory?

I am essentially storing a private key (Hash) in any of the OctetString attributes within Active Directory. My question is, what attribute is secure by default and makes sense to keep private data ...
7
votes
6answers
328 views

What does a developer need to know about Windows Server?

I am a certified .NET Developer, and I do a lot of Sharepoint development at work. Adding/editing/deleting users requires using AD and of course, anything to do with the site structure in Sharepoint ...
7
votes
2answers
229 views

Why should you disable network login for local accounts?

This question is in reference to @SwiftOnSecurity's Twitter thread: https://twitter.com/SwiftOnSecurity/status/655208224572882944 After reading through the thread, I still don't quite get why you ...
7
votes
2answers
5k views

Server 2012 R2 Active Directory Domain SRV dns records suddenly disappeared

I have a test domain that I recently configured. All of a sudden, no users can log in except those with cached credentials. The domain includes two domain controllers that are both global catalogs ...
7
votes
2answers
380 views

Transition away from Domain Admin only account

In our Windows environment, our Domain Admins only have one user account. This single user account is used across the board including running on a day to day workstation. In our transition away from ...
7
votes
3answers
1k views

AD reset user passwords for a security group

I'm not quite sure if this is possible or not, but I need to force a certain security group's users to have their passwords expire so they'll be forced to change them on next login. The reason for ...
7
votes
5answers
12k views

Using Active Directory as an LDAP server for Linux clients

I'm trying to figure out how to use Windows Server 2008 R2 as an LDAP server for Linux clients. Ideally, users should be able to login to their Linux workstations via pam_ldap authenticating against ...
7
votes
2answers
10k views

Search AD by GUID

How do I search Active Directory for objects by GUID? In other words, what would be a good way to find what objects belong to specified GUIDs?
7
votes
9answers
3k views

Which Version Control Systems support LDAP/AD users and groups

Does anyone know which of the big players (if any) support LDAP/AD users and groups for authentication AND database permissions? Specifically, I'm wondering if SVN, GIT, Mercurial etc. will allow ...
7
votes
4answers
1k views

Giant active directory deployment vs giant Sun LDAP

At work we're in the early phases of an identity management project. This is all in the context of higher ed where we have a couple thousand faculty / staff and about twenty thousand students. Has ...
7
votes
2answers
1k views

Can a Mac with OS X 10.5 (Leopard) authenticate with a Windows 2008 domain?

I would like to have my MacBook Pro authenticate against Active Directory running on Windows 2008. A couple of years ago I tried to set this up between OS X 10.4 and Windows 2003 but I wasn't ...
7
votes
1answer
73 views

Error promoting 2012 R2 server to domain controller on 2003 domain

When attempting to promote a 2012 R2 machine as a domain controller on a 2003 forest\domain level domain I get the following error when it goes through it's adprep and forestprep procedures: ...
7
votes
1answer
511 views

How do I remotely issue a CLI command to thousands of Windows domain computers at once?

I need to issue a CLI command (cmd.exe or PowerShell) to all of the thousands of computers on my domain. For obvious reasons, this is not going to involve doing the task manually, or physically ...
7
votes
2answers
4k views

Is there a performance impact of direct AD universal groups assignment?

I'm implementing a tool which secures certain shared resources within AD forest (mostly file shares). By some criteria a list of users from different domains is generated, those users are added to a ...
7
votes
2answers
770 views

How can I save a domain controller after a USN rollback without rebuilding the whole server?

Today I had (again...) to lobotomize a domain controller which had suffered the dreaded USN rollback; the standard solution to this issue is to demote it and then promote it back again, but the main ...
7
votes
3answers
8k views

What is the rationale for a minimum password age?

I just had a user unable to change his password on a Windows 2008 domain. It was giving him a cryptic message about complexity requirements even though he was certain his chosen password was meeting ...
7
votes
1answer
24k views

Give Local Admin privileges to AD user group for group of computer

I need to give administrative privileges to a group of user for a group of a PC in an Active Directory Enviroment. For Example i have : HelpDesk_User : Group of user HelpDesk_PC : Group of ...
7
votes
1answer
23k views

How can I join a computer to a new domain remotely?

I have a large number of PCs that are joined to domain abc.com and I want to move them over to xyz.com so they are no longer a member of abc.com. Can I do this with a script? Thanks
7
votes
2answers
2k views

Is there a way to get Kerberos credentials to delegate twice? Why not?

All my nerdly life, I've dealt with this limitation of Windows Domains Login - console Integrated auth to something (usually web app) My credentials can't move to another server (e.g. database or ...
7
votes
2answers
505 views

How to recover data from an Exchange 2013 database after a complete Active Directory loss?

Scenario: a single Exchange 2013 server in a Windows Server 2003 AD domain; one DC malfunctioned months ago and was dismissed (without proper demotion, no less); the other DC died yesterday and there ...
7
votes
1answer
411 views

How to edit Active-Directory Site properties via Powershell?

I am having trouble accessing the location property of my Active-Directory's Site via Powershell. (Windows Server 2012 R2) The following command returns no value: > (Get-ADReplicationSite ...
7
votes
1answer
7k views

Reset users password in Active Directory by Domain Admin account or other service account

In Active Directory you can set and enforce rules where users have to use strong password, can't use last 5+ passwords they already had, enforce password complexity. Is there a way to enforce such ...
7
votes
3answers
2k views

Need for another Domain Controller

I have two domain controllers (Windows 2003) in one site where most of the department I support resides. There is another building (at another site) where my department resides as well, but they have ...