A Microsoft technology for sharing one set of user accounts, security permissions, and management information across many Windows servers and desktops.

learn more… | top users | synonyms (2)

56
votes
4answers
59k views

Windows Active Directory naming best practices?

After experimenting with Windows domains and domain controllers in a virtual environment, I've realized that having an active directory domain named identically to a DNS domain is bad idea (Meaning ...
107
votes
2answers
195k views

What is Active Directory Domain Services and how does it work?

This is a Canonical Question about Active Directory Domain Services (AD DS). What is Active Directory? What does it do and how does it work? How is Active Directory organized: Forest, Child Domain, ...
24
votes
3answers
45k views

What should the order of DNS servers be for an AD Domain Controller and Why?

This is a Canonical Question about Active Directory DNS Settings. Related: What is Active Directory and how does it work? Assuming an environment with multiple domain controllers (...
13
votes
2answers
5k views

Website and Active Directory domain share the same name

In our network the name of the network domain is also the domain of the organization's website (say, example.com). Externally, people can enter example.com to visit our website, but internally, this ...
62
votes
5answers
19k views

Active Directory explained

If you had to explain Active Directory to someone how would you explain it?
21
votes
6answers
6k views

Can windows domain controller be virtualized?

Just the question on the title. There is any problem? Any experience on this?
21
votes
6answers
36k views

Choosing local versus public domain name for Active Directory [duplicate]

What are the pros and cons of choosing a local domain name such as mycompany.local versus a publicly registered domain name such as mycompany.com (assuming that your org has registered the public name)...
38
votes
6answers
10k views

If a Windows shop moves “everything” to the cloud, does it still need Active Directory?

Taking a spin off of this question: Do I really need MS Active Directory? in a new direction for 2014. Taking into account a basic Windows infrastructure: domain controllers Exchange 2007/2010/2013 ...
18
votes
3answers
8k views

Naming a new Active Directory forest - why is split-horizon DNS not recommended?

Hopefully, we all know what the recommendations for naming an Active Directory forest are, and they're pretty simple. Namely, it can be summed up in a single sentence. Use a subdomain of an existing,...
13
votes
1answer
1k views

GPOs fail to apply; reason: Inaccessible, Empty, or Disabled; Server 2012 R2 and Windows 10

I have a Windows Server 2012 R2 Domain. Yesterday, a computer’s (running Windows 10 Pro) network drive stopped working. After further investigation (gpresult /h) it appears ALL group policy objects ...
25
votes
0answers
1k views

What should I name my Active Directory? [duplicate]

Possible Duplicate: Windows AD Domain naming recommendations There are a lot of really screwed up configurations out there, because people didn't take a minute to sit down and think about ...
29
votes
6answers
151k views

Finding why a user is locked out in Active Directory

A user's account keeps getting locked out in Active Directory. It's probably caused by an app that's using Windows authentication to connect to SQL Server. Is there a way to find out which app is ...
15
votes
5answers
3k views

Mercurial (hg) with active directory

Can I setup Mercurial to authenticate users on Active Directory? In my case, hg can run on Windows, Linux or FreeBSD, but I need to use AD users. Note: if it is possible, then please point me to a ...
35
votes
8answers
26k views

Should I expose my Active Directory to the public Internet for remote users?

I have a client whose workforce is comprised entirely of remote employees using a mix of Apple and Windows 7 PCs/laptops. The users don't authenticate against a domain at the moment, but the ...
14
votes
3answers
8k views

Removing old computers on a domain

The Windows Domain I manage has hundreds of computer names which I don't recognise and I'd like to remove old ones which aren't in use before trying to track down the misnamed ones. Is there someway ...
28
votes
13answers
21k views

Do I really need MS Active Directory? [closed]

I manage a shop of arround 30 machines and 2 terminal servers (one production, one standby.) Should I really deploy Active Directory in our network? Are there any really benefits, that could ballance ...
16
votes
1answer
22k views

What needs to be done after a Domain Controller crash?

Assuming that at least two domain controllers were present in the domain to start with, what steps need to be taken to make Active Directory healthy after a domain controller crash?
4
votes
4answers
14k views

My public website name and AD domain name are the same. How can I get to my external website from inside my network?

I am using my domain example.orgin my firm. I can use www.example.orgto view my website. If I try http://example.org from outsite my firm there is no problem, but if I try it from inside, my windows ...
3
votes
2answers
3k views

things to check prior to moving all FSMO roles to a new domain controller before decommission original old domain controller

need to move a domain controller, the first in the forest that holds all the fsmo roles, to another location in a clients building. it will require turning off this dc, call it dc1 for this question. ...
23
votes
3answers
17k views

What is Group Policy and how does it work?

This is a Canonical Question about Active Directory Group Policy Basics What is Group Policy? How does it work and why should I use it? Note: This is a Question & Answer to new administrator ...
31
votes
10answers
124k views

Group Policy installation failed error 1274

I'm trying to deploy an MSI via the Group Policy in Active Directory. But these are the errors I'm getting in the System event log after logging in: The assignment of application XStandard from ...
24
votes
5answers
16k views

Common wisdom about Active Directory authentication for Linux Servers?

What is the common wisdom in 2014 about Active Directory authentication/integration for Linux servers and modern Windows Server operating systems (CentOS/RHEL-focused)? Over the years since my first ...
23
votes
7answers
22k views

Is there an equivalent of SU for Windows

Is there a way (when logged in as an administrator, or as a member of the administrators group) to masquerade as a non-privileged user? Especially in an AD environment. e.g., in the Unix world I ...
18
votes
3answers
49k views

Force authenticated user immediate logoff (emergency case)

In Active Directory if you want to prevent a user from logging in you can either disable their account or simply reset their password. However, if you have a user who is already logged in to a ...
17
votes
4answers
77k views

How to create Active Directory user account with powershell

I am constantly setting up research and development environments that require active directory accounts. Since we place these environments in isloated networks each environment needs its own active ...
9
votes
5answers
8k views

Active Directory: Is it required that the “A” record for a domain point to a Domain Controller?

Currently we have an Active Directory setup, and say the name is 'domain.com'. The DNS entries for domain.com has two A records pointing to the two domain controllers. I would like internal users to ...
6
votes
2answers
6k views

Migrate user accounts from Azure AD to on-premise AD?

My company uses Office 365 for Exchange, SharePoint, Lync etc. including the build-in user administration via Azure Active Directory. Now we want to switch to a local AD on a Windows Server. It shall ...
3
votes
3answers
4k views

Issues with using real domain for Active Directory domain?

Is there any reason why I shouldn't use example.com as my AD domain versus example.local or some other non-existant variant?
21
votes
2answers
5k views

Authenticating OpenBSD against Active Directory

Edit: Reformatted this as Q&A. If anyone can change this from Community Wiki to a typical question, that's probably more appropriate as well. How can I authenticate OpenBSD against Active ...
16
votes
10answers
144k views

Best way to find the computer a user last logged on from?

I am hoping that somewhere in Active Directory the "last logged on from [computer]" is written/stored, or there is a log I can parse out? The purpose of wanting to know the last PC logged on from is ...
4
votes
2answers
19k views

Active Directory Time Synchronisation - Time-Service Event ID 50

I have an Active Directory domain with two DCs. The first DC in the forest/domain is Server 2012, the second is 2008 R2. The first DC holds the PDC Emulator role. I sporadically receive a warning ...
8
votes
6answers
21k views

How can I have a Linux machine join a Windows Domain?

Sorry if I am misusing terms here; I actually don't know much about Active Directory and the related technologies. Basically I have a Linux computer and I'd like it (or my user on that computer) to ...
5
votes
3answers
6k views

Active Directory in a DMZ

What is the best way to manage user accounts for Windows servers in a DMZ? We are expanding our web presence and adding several IIS servers to our DMZ. I would prefer not to manage a bunch of local ...
11
votes
4answers
2k views

Windows Domain replication monitoring tool

I am looking for web-based interface GUI, or some kind of monitoring tool that will show replication status for a domain. I know I can use repadmin with various options on the command line to query ...
4
votes
8answers
6k views

Suggestions for using Active Directory credentials (user name/password) with Google Apps?

I run a small college network with approximately 150 user accounts both in my Active Directory and in Google Apps. I'm looking to link AD with G-Apps. Currently my users are required to maintain ...
11
votes
5answers
44k views

How can I clear cached domain credentials?

Related: How can I enable domain authentication over wireless in Windows 7/2k8? To test the domain login over wireless connection feature I'm trying to set up in the above question, I need an ...
7
votes
3answers
5k views

Combined NFS, Samba server w users from Active Directory

I want to build a server that exports user home directories over SMB/CIFS and NFS. This server would be joined to a Win2k3 AD domain controller that holds our user database. As I understand it, ...
4
votes
1answer
2k views

Mounting windows shares with Active Directory permissions

I've managed to get my Ubuntu (server 10.04 beta 2) box to accept logins from users with Active Directory credentials, now I'd like those users to access their permissible windows shares on a W2003 R2 ...
14
votes
4answers
34k views

Restrict access to IIS site to an AD Group

Is it possible in IIS to set up a site in IIS and only let users of a certain AD Group get access to it?
11
votes
2answers
10k views

Is there a way to refresh computer group membership without rebooting?

I am using Windows Server 2008 R2 and have a windows service running under "network service" account in computer ComputerA. This windows service want to access a share folde (on another computer ...
7
votes
6answers
4k views

Active Directory OU design for <500 users, 4 locations

We are looking to add some logical structure to our (Win 2003) AD hierarchy. We have a single domain and around 500 users. All users and computers are currently organized into one OU. All security ...
7
votes
13answers
20k views

Windows: Can domain controllers also serve other functions?

This question was a discussion about whether Active Directory is necessary to run Terminal Services. But a chain of answers and comments (mostly by me) brought up a related question around Domain ...
7
votes
3answers
6k views

How to clean up orphaned SID's in ACEs in AD?

As a follow up to my question Do backlinks clear in AD for deleted users I have another related but different question. Since I am informed in the answers there that a deleted object's SID (Group or ...
9
votes
3answers
21k views

What happens when a computer joins an Active Directory domain?

What changes are applied to a client when it joins an AD domain? How is a domain member supposed to behave when disconnected to the network? Are users able to login? Will domain user policies still ...
4
votes
4answers
14k views

Microsoft DNS - Access is Denied. Event log: The DNS server was unable to open Active Directory

I've just had an issue arrise that I cannot seem to solve. I recently set up a Windows Server 2008 DC with DNS and DHCP and all has been working fine, but I discovered today that when I go into the ...
4
votes
1answer
726 views

Demoting a DC which also runs Exchange 2010

Initially when setting up Exchange 2010 CAS I ran into problems with permissions. I got around them by promoting the server to be a DC with a GC. The Server was initially installed with 2008 R2 ...
3
votes
2answers
8k views

Domain Controller time is 7 minutes fast

I have a Server 2008 R2 domain controller running in VM on Hyper-V that is 7 minutes fast which I need to fix. I understand that this maybe down to the DC running in VM's. What I would like to know ...
1
vote
2answers
8k views

Is it possible to add a local user to the admins group through group policy?

I'd like to have a local user in the admins group for when the computer isn't connected to the domain. Currently I use a start up script to create the user and add it to the admins group. Is there a ...
72
votes
6answers
316k views

How can I figure out my LDAP connection string?

We're on a corporate network thats running active directory and we'd like to test out some LDAP stuff (active directory membership provider, actually) and so far, none of us can figure out what our ...
14
votes
3answers
1k views

Clean up Active Directory [closed]

Does anybody know of any useful Tools for cleaning out Active Directory on a Server 2003 domain? I want to clean up old computers, etc, and prefer a free tool. I have a lot of devices that I know ...