A Microsoft technology for sharing one set of user accounts, security permissions, and management information across many Windows servers and desktops.

learn more… | top users | synonyms (2)

7
votes
5answers
14k views

How to find the computer name a user logged on to

Is there a tool or script or some other way of knowing what computer name a specific user is currently logged on to? Or even was logged on to? Say the user "HRDrone" is working on his machine whose ...
7
votes
2answers
1k views

GPO best practices : Security-Group Filtering Versus OU

Good afternoon everyone, I'm quite new to Active Directory stuff. After upgraded Functional level of our AD from 2003 to 2008 R2 (I need it to put fine-grained password policy), I then start to ...
7
votes
2answers
944 views

Sudoers file allow sudo on specific file for active directory group

I have active directory sign in working on an Ubuntu 12.04 box. When the user signs in, I have a script that runs that needs sudo permission (since it modifies the samba config file). How would I ...
7
votes
3answers
1k views

Advice on Active Directory design for multihomed servers

I've been tasked by a customer to come up with a working Active Directory design for a scenario with the following requirements (simplified, they are actually a lot worse): There is a subnet for ...
7
votes
3answers
4k views

Place a computer object in an OU based on the user who added it

Is there a way to auto place a computer in a specific OU based on of the user who joined it to the domain? For example, I have 5 OUs, and site admins can add PCs to the domain, but can't manage any ...
7
votes
3answers
4k views

Virus that tries to brute force attack Active Directory users (in alphabetical order)?

Users started complaining about slow network speed so I fired up Wireshark. Did some checking and found many PCs sending packets similar to the following: (screenshot) http://imgur.com/45VlI.png I ...
7
votes
2answers
6k views

How many times can a simple user add a computer to windows domain?

In a course about Windows Server administration that I took at the university they told us that a normal user could add 10 computers to a domain. Over the years however I've added and removed way more ...
7
votes
1answer
2k views

Granting Domain Admin privileges to a cross-forest user account?

Does anyone know of a way to [effectively] have a user or group in one forest acquire the privileges of the Domain Admin group in another forest? The obvious approach of adding Domain ...
7
votes
1answer
235 views

one of the single dc per domain DCs has suffered USN rollback

I've inherited an Active Directory forest that is laid out very badly. It has a single forest with a domain tree for each site, each with a single domain controller. No domain is a child of any ...
7
votes
5answers
3k views

Cannot join Win7 workstations to Win2k8 domain

I am trying to connect a Windows 7 Ultimate machine to a Windows 2k8 domain and it's not working. I get this error: Note: This information is intended for a network administrator. If you are not ...
7
votes
5answers
4k views

Debian 6.0 AD integration

Despite multiple questions already about this, e.g. Linux on Windows AD Domain I'd like to know how to get Debian 6.0 Squeeze integrated with AD using open source or otherwise free of charge for ...
7
votes
2answers
3k views

Which AD permission is required to allow impersonation of an account?

I have a Windows service account. I need to grant it permission to impersonate another account within a group on another trusted domain, without delegation. So effectively, my service account says ...
7
votes
5answers
2k views

Replacement for NIS/YP

The company that I am working for is embarking on replacing the current locally developed NIS/YP structure with LDAP. We already have AD in house for the Windows stuff and would like to consider ...
7
votes
1answer
399 views

How do I implement a Fine-grained password policy and expect XP machines to play nice?

I have a 2008 R2 functional level domain and am in the middle of implementing the first actual password policy my organization is going to use. To slowly roll this out to our users, we have chosen to ...
7
votes
2answers
2k views

Domain Controller DNS Best Practice/Practical Considerations for Domain Controllers in Child Domains

I'm setting up several child domains in an existing Active Directory forest and I'm looking for some conventional wisdom/best practice guidance for configuring both DNS client settings on the child ...
7
votes
1answer
2k views

ISC Bind support for GSS-TSIG DDNS Updates?

First, has anyone EVER configured ISC bind 9.5.0 OR greater with support for GSS-TSIG Dynamic DNS Updates AND gotten it to work? If so, what is the configuration that was used to make that happen? I ...
7
votes
2answers
9k views

Authenticating Apache HTTPd against multiple LDAP servers with expired accounts

We're using mod_authnz_ldap and mod_authn_alias in Apache 2.2.9 (as shipped in Debian 5.0, 2.2.9-10+lenny7) to authenticate against multiple Active Directory domains for hosting a Subversion ...
7
votes
2answers
825 views

Precached Windows Logins?

I know if a Windows users logs into a machine, and later that machine falls off the network, that the user can log in to the machine with cached credentials. Is there any way to precache those ...
7
votes
1answer
53 views

Exchange Server Using Wrong Active Directory Site

Our Exchange 2013 server suddenly started logging errors about bad replication between sites (there should be no replication as there is no other server) as well as several other issues that appear to ...
7
votes
3answers
588 views

Ubuntu 12.04, Windows 2012 Active Directory Integration, Kerberos won't resolve service principals

after having checked the whole internet literally, I hope that I might get help here. I am trying to accomplish integration of ubuntu 12.04 servers into a Windows 2012 active directory with nfs and ...
7
votes
2answers
1k views

IIS Digest repeatedly asking for authentication

I have a development copy of an ASP.NET intranet site checked out and running on my local machine. We're using digest authentication to allow users to log in using their active directory accounts. ...
7
votes
0answers
99 views

OS X Lion machines will continually query Active Directory 2008 for every user in the directory [closed]

We are having a problem where our OS X Lion machines will continually query Active Directory 2008 for every user in the directory until a user logs into the machine. When a user logs into the machine, ...
7
votes
5answers
21k views

How to change the current user's domain password without being domain admin?

I've seen plenty of documentation of how to reset a user's password by running net user <username> * /domain or locally net user <username> <new_password> But I am not domain ...
6
votes
3answers
1k views

Does Active Directory support DNS names with spaces?

While looking into how to set up some static DNS-SD services in our network, I came across http://www.dns-sd.org/ServerStaticSetup.html, which states that Active Directory's DNS server does not ...
6
votes
6answers
2k views

Back up and restore Active Directory password per user

For administrative purposes, I sometimes need to log in as another user to diagnose a problem with their account. I'd like to be able to do this without having to change their password so I don't ...
6
votes
3answers
2k views

Number of Domain Controllers needed?

In the process of migrating 7 school site network from Server 2003/XP to Server 2012/7 and wanted to get some feedback on how many domain controllers would be optimal. Currently we have 4 DCs. All 7 ...
6
votes
2answers
1k views

Use Google Apps/Cloud Services as a Domain Controller Replacement

This is a Canonical Question about Cloud Services replacing Active Directory. Is it possible to use Google Apps or another Cloud Service as a replacement for a Windows Domain Controller ...
6
votes
5answers
2k views

Protect files on NTFS volume from Domain Administrators

We're a small company with a 2008R2 domain on which we have a file server with several shared volumes. We have a number of IT staff in the domain administrators role, because effectively we're all on ...
6
votes
6answers
9k views

Domain Controller time is incorrect

I have a domain controller running in VM on Hyper-V, the time seems to be steadily getting faster, over the X-mas period it's 5 faster, which seems odd! I know how to change the time and I belive we ...
6
votes
2answers
758 views

How do Active Directory domain joined computers (native MS Windows or Linux with winbind) determine the closest password server?

How do Active Directory domain joined computers (native MS Windows or Linux with winbind) determine the closest password server? This question implies a cluster with 2+ Active Directory servers in ...
6
votes
3answers
5k views

What is Location field in Active Directory used for?

Is the Location field in Active Directory used for anything other than listing where objects are physically located? I am interested if this is just a user friendly field to help people find printers ...
6
votes
2answers
266 views

Does the sAMAccountName rename practice based on employment status makes sense?

Where I work there is a practice of adding a t_ prefix to all temporary employees logins (sAMAccountName). When someone switches from temp to perm or the the other way the prefix is add/removed. ...
6
votes
3answers
13k views

How to enable Automatic Logon for a computer in Windows Domain?

I need to setup publicly available computer to perform automatic log on using domain credentials when powering on. When it was not a domain member this option was available on control userpasswords2 ...
6
votes
8answers
4k views

Best practices or experience with company wide Username policies and resolving duplicates

I am a programmer with an application that needs to be integrated into the new company wide Active Directory login scheme. This means changing all the usernames in our system to use the new scheme. ...
6
votes
5answers
6k views

Active Directory: Is it required that the “A” record for a domain point to a Domain Controller?

Currently we have an Active Directory setup, and say the name is 'domain.com'. The DNS entries for domain.com has two A records pointing to the two domain controllers. I would like internal users to ...
6
votes
2answers
7k views

When to raise domain functional level?

We very recently completed a project to retire two old domain controllers running Server 2003 R2. They are now replaced with shiny new 2008 R2 boxes. However, the functional level of the domain has ...
6
votes
2answers
4k views

Danger of Scavenging Stale Resource Records In _msdcs Zone?

I just realized that a previous admin turned DNS scavenging on for all zones on one of the DCs, including the _msdcs zone. It's been this way for a while and things are fine, but I can't imagine that ...
6
votes
2answers
3k views

Migrate Active Directory to new server?

We bought new server and we want to turn our current server off. how can I restore our active directory and DHCP and DNS(current server states) to new one? we got Active Directory, DNS, DHCP. our old ...
6
votes
1answer
4k views

Default full name format in Active Directory

When I create a new account in Active Directory, I enter the new user's first name and last name, and it auto-fills the full name in the form "First Last". Can I set AD to use "Last, First" instead? ...
6
votes
2answers
1k views

What's the default hash format / algorithm of Active Directory?

I'm wondering what format I need to put hashes in to write to userPassword via LDAP. Apache Directory Studio gives me several options, but I don't think any of them are it. Can anyone document the ...
6
votes
5answers
10k views

Using Active Directory as an LDAP server for Linux clients

I'm trying to figure out how to use Windows Server 2008 R2 as an LDAP server for Linux clients. Ideally, users should be able to login to their Linux workstations via pam_ldap authenticating against ...
6
votes
1answer
4k views

What needs to be done/added on Apple MacBook Air in order to join domain and be managed?

We are a fully windows active directory company. I now have a MacBook Air (first in company) - that needs to be connected. What are the things I need to install/set in order for me to be able to ...
6
votes
2answers
8k views

Force Windows server to use specific Domain Controller

Is there a way I can set an OWA server in my DMZ to talk to a DC in the local site? The DMZ is located at the same (physical) site as a LAN with DCs on it. (There is no DC in the DMZ.) Can I force ...
6
votes
4answers
586 views

What linux is easy to attach to a windows domain

for a development test bed I need to attach ANY linux machiene to a test AD Domain and do single sign on through it. Is there a Linux Distro that is easy to connect to AD?
6
votes
2answers
942 views

Windows Active Directory - special characters in username

I have an AD user without special characters (Š = S with caron), for example myspecialuser. Why can I log in to windows using special characters in the username, myšpecialuser for example, even when ...
6
votes
3answers
9k views

How to find the cause of locked user account in Windows AD domain

After a recent incident with Outlook, I was wondering how I would most efficiently resolve the following problem: Assume a fairly typical small to medium sized AD infrastructure: several DCs, a ...
6
votes
1answer
3k views

Procedure for rebooting Domain Controllers?

We have several servers running as Domain Controllers, "DC01", "DC02", and "DC03". For some reasons, we need to reboot them. Is there a specific procedure to follow? Additional info: "DC01" ...
6
votes
2answers
1k views

Active Directory: Handle Suffixes in a User's Last Name?

So I've never come across this before. We have two users on our network that are related and share the same first and last names. Our username naming policy dictates the younger user will have his ...
6
votes
7answers
13k views

VPN Connection causes DNS to use wrong DNS server

I have a Windows 7 PC on our company network (which is a member of our Active Directory). Everything works fine until I open a VPN connection to a customer's site. When I do connect, I lose network ...
6
votes
3answers
3k views

Add last user logged in into AD Users and Computers description field

The last place I worked had AD setup in a way that in the Description field of each computer account in the AD users and computers console, it would say who logged in last and when. How do you set it ...