A Microsoft technology for sharing one set of user accounts, security permissions, and management information across many Windows servers and desktops.

learn more… | top users | synonyms (2)

8
votes
1answer
601 views

Can I create the active directory forest corp.domain.com without creating domain.com first?

Is there any way which I can create the active directory domain corp.domain.com without first creating domain.com AD DCs? Or to put another way, can corp.domain.com be the root of the forest?
8
votes
2answers
619 views

Issues related to storing photos in Active Directory?

Are their any known issues with storing employee photos in AD provided you store them in the compliant sizes and formats? Is there a critical mass that you break or could corrupt AD databases? I'm ...
8
votes
2answers
1k views

Outline the quirks of Windows Small Business Servers (SBS)

I'm not much of a Microsoft administrator. However, I do work extensively with new and existing Microsoft Exchange deployments. That's just how the career-arc went. I'm working with a small customer ...
8
votes
2answers
5k views

How do I block inheritance/application of a single GPO?

Due to the workload generated by recent ransomware outbreaks (Cryptolocker/Cryptowall/etc.), I was recently tasked with implementing Software Restriction policies to block program execution from ...
8
votes
3answers
10k views

What is the rationale for a minimum password age?

I just had a user unable to change his password on a Windows 2008 domain. It was giving him a cryptic message about complexity requirements even though he was certain his chosen password was meeting ...
8
votes
3answers
5k views

Active Directory disaster recovery with DPM

I have a sort of catch-22 question here. Suppose I'm using Microsoft System Center Data Protection Manager (2010 or 2012, it works the same way) to backup, amongst various other things, my Active ...
8
votes
3answers
12k views

Search AD by GUID

How do I search Active Directory for objects by GUID? In other words, what would be a good way to find what objects belong to specified GUIDs?
8
votes
1answer
4k views

Find locked out accounts in Active Directory (a way that actually works!)

I have googled how to list locked out accounts and found two methods so far, both of which don't work... Saved query - (&(&(&(objectCategory=Person)(objectClass=User)(lockoutTime>=1)))...
8
votes
3answers
4k views

What are the consequences of an AD group that has as its member a group, that is already a member (Cyclic references)

I have been looking at an Active Directory that has several thousand groups, where pairs of groups are members of each other. GroupA has GroupB as a Member. GroupB has GroupA as a Member. Oy. I am ...
8
votes
7answers
981 views

Is there a way to audit AD for a particular password?

Is there a way I can audit AD to check for a particular password? We used to use a "standard" password for all new users (e.g. MyPa55word). I want to make sure this is no longer in use anywhere on ...
8
votes
7answers
5k views

How do I keep the local admin password consistent across an OU?

We have a number of PCs running XP SP2 (and a couple running SP1) already in production, and we're looking to keep the local administrator's password consistent across the OU. The only solutions I can ...
8
votes
7answers
50k views

How do you find out if Active Directory is using Kerberos or NTLM?

Is there a command line program you can use?
8
votes
1answer
288 views

Is there a version of the AD tools that provide the PowerShell output, similar to the Exchange tools?

The Exchange administration tools output the exact PS commands they will (or just did) execute. Is there a different version of the AD tools (primarily AD Users & Computers) that have similar ...
8
votes
5answers
16k views

Can an LDAP query on AD provide the netbios domain name for a single account when using the Global Catalog?

I am using ADSI Edit to look at LDAP properties of a single user account in AD. I see properties such as userPrincipalName, but I do not see one for the fully qualified domain name (FQDN) or the ...
8
votes
3answers
2k views

Automatically mounting a network share as Shared Resource

we're running an ActiveDirectory environment (Windows 2008 Server, XP Clients) and want to have some shares listed as Shared Resources under the Network Neighbourhood. I do not want to map it to a ...
8
votes
6answers
32k views

How to find the computer name a user logged on to

Is there a tool or script or some other way of knowing what computer name a specific user is currently logged on to? Or even was logged on to? Say the user "HRDrone" is working on his machine whose ...
8
votes
2answers
102 views

Is there a difference in bandwidth consumption between a RODC and RWDC?

My organization has deployed 2008 RODCs on multiple seagoing platforms. The idea was to extend our shore-based domain onto our ships to better control security policies. RODCs were selected with the ...
8
votes
1answer
5k views

Unable to move OU in Active Directory (Access is denied)

Background I tried moving an OU in Active Directory today and received an Access is denied error. Upon further inspection of my AD user account I had the necessary permission to move the object (I ...
8
votes
3answers
748 views

PowerShell: Get-ADUser Properties with åäö

I'm trying to extract select sets of users with Get-ADUser. The users belong to companies whose names include non-ASCII characters, e.g. "Gåäördet". Unfortunately, we do have to use the company ...
8
votes
2answers
9k views

Best practice for decommissioning a Domain Controller that is also a DNS server?

There are two schools of thought for the decommissioning process of Active Directory Domain Controllers that are heavily used as DNS servers. Add the IP address of the outgoing DC to a new DC and ...
8
votes
3answers
3k views

Advice on Active Directory design for multihomed servers

I've been tasked by a customer to come up with a working Active Directory design for a scenario with the following requirements (simplified, they are actually a lot worse): There is a subnet for ...
8
votes
2answers
173 views

Best Way to Track Brute-Force Username Enumeration / Failed Username Attempts AD

We have a Windows Server which has an application that resides on it, which uses domain credentials on login to the application. During a recent pen test, the testers were able to use the application ...
8
votes
1answer
37k views

Command to remove computer from non-existant domain

I lost my domain controller machine, and then add new domain controller but with a new domain. How do I remove network machines from old domain using command line and add to new domain? Machines ...
8
votes
6answers
21k views

How can I have a Linux machine join a Windows Domain?

Sorry if I am misusing terms here; I actually don't know much about Active Directory and the related technologies. Basically I have a Linux computer and I'd like it (or my user on that computer) to ...
8
votes
1answer
11k views

How to add a Mac to Windows Active Directory

I've gone into the Directory Utility on the mac, clicked on the services tab, entered the Active Directory Domain and Computer ID, clicked the Bind button and it showed a little status label which ...
8
votes
2answers
3k views

What is the best way to allow a domain user to start and stop services on the machine?

What is the best way to allow a domain user to start and stop services on the machine? The domains user cannot be made admin.
8
votes
1answer
2k views

Active Directory 2012 LDAP Integration Service Principal Name Entry is Disappearing?

Creating Python Service to Query AD Attributes I'm integrating our AD with web services running Python on linux using Python-LDAP over SASL(DIGEST-MD5) to query AD 2012 user attributes (division, ...
8
votes
1answer
563 views

Why would a domain controller encouter a USN rollback after an unclean shutdown?

I have this Windows Server 2008 R2 domain controller running on a physical Dell server, model PowerEdge R510. There are some electrical problems around here, thus a black-out is, unfortunately, quite ...
8
votes
2answers
4k views

Upgrade software package installed with GPO

Since recently I have been using AD policies to deploy software packages through GPO on a small domain. This had been working well, but I am not sure what is the correct procedure for upgrading a ...
8
votes
1answer
127 views

Does the Read-Only configuration of a DC apply only to Active Directory?

Firstly, I'm not sure how friendly the users of this site are to students but my question seems to be well suited. I am configuring a domain with multiple Windows Server 2008 machines and am curious ...
8
votes
5answers
4k views

Cannot join Win7 workstations to Win2k8 domain

I am trying to connect a Windows 7 Ultimate machine to a Windows 2k8 domain and it's not working. I get this error: Note: This information is intended for a network administrator. If you are not ...
8
votes
4answers
2k views

How to manage hundreds of users (and customized profiles) on individual Windows 7 machines?

We're a small college, where every student is assigned an Active Directory account. We have a couple computer labs where the machines are all joined to the domain and students can log in to any ...
8
votes
2answers
1k views

Precached Windows Logins?

I know if a Windows users logs into a machine, and later that machine falls off the network, that the user can log in to the machine with cached credentials. Is there any way to precache those ...
8
votes
3answers
365 views

Join ActiveDirectory (Win 2k8R2) to OpenDirectory(Snow Leopard)

The vast majority of questions and so on regarding the interoperability of Active and Open directories involves getting Mac clients to see an AD and auth against it. What we'd like to do is get a ...
8
votes
1answer
519 views

AD Replica DC Promotion Stall

I recently inherited infrastructure duties for a small startup I am working with. My traditional role has been development, so bear with me... I was hoping to start off on the right foot, and get ...
8
votes
1answer
88 views

What does SBS 2011 do “under the hood” when you give a user admin access?

I have been using Windows Server for many years now and when I have someone who needs local admin access over their machine, I apply it through group policy in a similar way to this answer. One of my ...
8
votes
2answers
271 views

Rss feed of Active Directory Changes?

Is it possible to setup a RSS feed to view all changes made to an Active Directory database?
8
votes
0answers
375 views

AD custom attribute of type numerical string crashes MMC when updated

I am using windows server 2008. I have a domain with one domain controller (this is a dev environment). I edited the AD schema and created a custom attribute called TestAttribute2 (the LDAP name is ...
7
votes
13answers
20k views

Windows: Can domain controllers also serve other functions?

This question was a discussion about whether Active Directory is necessary to run Terminal Services. But a chain of answers and comments (mostly by me) brought up a related question around Domain ...
7
votes
2answers
2k views

Use Google Apps/Cloud Services as a Domain Controller Replacement

This is a Canonical Question about Cloud Services replacing Active Directory. Is it possible to use Google Apps or another Cloud Service as a replacement for a Windows Domain Controller (replacing ...
7
votes
7answers
53k views

How can I quickly create 100 users on my Active Directory for testing purposes?

I'd like to create 100 users just for test purposes of my Exchange Server. Is there a way to batch do this using random names, etc?
7
votes
4answers
26k views

Active Directory Licensing [duplicate]

Possible Duplicate: Can you help me with my software licensing question? I can't seem to find a clear answer to this question. What type of licenses do I need to buy ensure that everyone in ...
7
votes
4answers
38k views

Is my AD already an LDAP server?

I have installed an LDAP browser, to try and browse my AD information (this is part of enabling Google Directory Sync process). however, I keep getting a connection error (using port: 19389). the ...
7
votes
4answers
60k views

Retrieve user details from Active Directory using SID

How can I find a user in my AD when I have his/her SID. I don't want to rely on other attributes, since I am trying to detect changes to these. Example: I get a message about a change to user record ...
7
votes
6answers
1k views

Securing Active Directory domains on a potentially hostile network

Active Directory is one of the best features of Windows Server, but it's also a big shiny target. If compromised it gives the attacker your Windows network. In an environment with externally facing ...
7
votes
8answers
66k views

How to tell what time a domain user logged in?

In the "Security" event log on a Windows 2003 domain controller, I see several entries of event 540 -- "Successful Network Logon" averaging a few minutes apart throughout the day. Is the first one of ...
7
votes
6answers
4k views

Active Directory OU design for <500 users, 4 locations

We are looking to add some logical structure to our (Win 2003) AD hierarchy. We have a single domain and around 500 users. All users and computers are currently organized into one OU. All security ...
7
votes
3answers
362 views

Can a Second Domain Controller, with buggy hard drive hardware, cause a corruption to Active Directory?

We have a new Domain Controller that holds all FSMO roles. We also have two old hardware servers, about 4-5 years old each, set up as secondary Domain Controllers (or better described as Domain ...
7
votes
2answers
7k views

Danger of Scavenging Stale Resource Records In _msdcs Zone?

I just realized that a previous admin turned DNS scavenging on for all zones on one of the DCs, including the _msdcs zone. It's been this way for a while and things are fine, but I can't imagine that ...
7
votes
3answers
679 views

Reset Windows user domain password

Is there a way to reset a user domain password remotely without login to a remote desktop to the domain controller? I could not find any MMC plugin in non-server Windows (Window 7 Ultimate in this ...