A Microsoft technology for sharing one set of user accounts, security permissions, and management information across many Windows servers and desktops.

learn more… | top users | synonyms (2)

13
votes
0answers
559 views

Server 2012R2 DNS server returning SERVFAIL for some AAAA queries

(Rewriting most of this question since a lot of my original tests are irrelevant in light of new information) I'm having issues with Server 2012R2 DNS servers. The biggest side effect of these ...
7
votes
0answers
1k views

Import Powershell AD Module during MDT Task Sequence

I have written this short powershell script to rename a computer as part of an MDT task sequence: Import-Module ActiveDirectory $AdminUsername = 'domain.com\administrator' $AdminPassword = ...
6
votes
0answers
747 views

Unable to bind OSX 10.9 to Active Directory 2008

I am struggling to bind OSX 10.9 to a 2008 r2 Active Directory. I can join the domain fine when I boot into Windows from the same machine. From OSX I can find the domain controller successfully and ...
6
votes
0answers
344 views

AD custom attribute of type numerical string crashes MMC when updated

I am using windows server 2008. I have a domain with one domain controller (this is a dev environment). I edited the AD schema and created a custom attribute called TestAttribute2 (the LDAP name is ...
5
votes
0answers
798 views

How can the x-frame-options HTTP header of ADFS 3 be manipulated?

By default, ADFS 3 responses contain the "X-Frame-Options: DENY" HTTP header. This prevents ADFS from being run in an iframe, because this presents an opportunity for clickjacking attacks. At the ...
4
votes
0answers
674 views

Windows Server 2003 DC migration to 2 x 2012 R2 DCs - DCDiag error = Advertising: SERVER IS NOT RESPONDING or IS NOT CONSIDERED SUITABLE

We are upgrading our single 2003 domain controller (DC1) to two 2012 R2 controllers (DC2 in Sevenoaks and DC3 in Manchester (different site in Sites and Services for Manchester)). DCpromo (the wizard ...
4
votes
0answers
131 views

Installing MSA (Managed Service Accounts) using deployment tools

I have to install several new servers (2012R2) for a project, which will run IIS and MSMQ, I need to script the complete install, so I need to be able to change permissions on IIS Application Pools ...
4
votes
0answers
126 views

Active Directory Administrative Center - resize membership part

User can be a member of 3 groups at most to be visible in ADAC without scrolling. But in reality, users are members of 5, 10 even 20 groups. We have to scroll the "member of" list to check the ...
4
votes
0answers
805 views

LSA SID cache keeps old entry for renamed domain user - why?

I have a question about LSA SID cache on a domain member server. Recently I run into the issue when some users after their name was changed in AD has difficulties accessing application I support, and ...
4
votes
0answers
403 views

Cannot enable GSS-TSIG updates from Active Directory in BIND 9.10

I’m with a problem trying to enable GSS-TSIG with BIND 9.10. Before I start describing what I’ve done, I would like to say that I’ve already done this in in another domain without any problems. So I ...
4
votes
0answers
540 views

My two-way trust with selective auth seems to behave opposite to a one-way trust

I'm not sure why I'm the only one running into this, I think it's a larger problem with Server 2012 and RDS protocols... With 2008 machines, you can use utilize a one way trust to authenticate across ...
4
votes
0answers
156 views

Windows 2012 Master & Ubuntu Bind 9 Slave & SOA

I'm kinda like the maid... I don't do Windows. But thanks to new things we're implementing, I'm now attempting replicating a single zone from our AD cluster. We had this working just fine but ...
4
votes
0answers
1k views

Unix nslcd login with sAMAccountName and/or userPrincipalName from Active Directory

I'm trying to setup authentication from Active Directory in FreeBSD 10.0 using nslcd (nss-pam-ldapd-sasl package) and would like to allow both sAMAccountName and userPrincipalName as valid login ...
4
votes
0answers
29k views

Windows 7 there are no logon servers available to service the logon request subdomain

I've read other solutions, but my problem is slighlty different. Problem occurs in domain environment. We work in a subdomain, but we also have some employees coming with notebooks registered in top ...
4
votes
0answers
659 views

Branch office & DNS

We've got a branch office with no on-site services at the moment and we'd like to change that. The biggest goal is to setup some file servers but faster log ons and DNS resolutions will be welcome as ...
4
votes
0answers
55 views

Why is Office 2010 asking me to choose one of only one potential account to open a restricted document

We have implemented an AD Rights Management System in our domain. Occassionally, when I send a protected email to someone in my domain or someone sends one to me, I will be prompted with a dialog box ...
4
votes
0answers
995 views

DSGET escapes hash signs (#) in outputted Distinguished Names (DN)s but expects unescaped hash signs for input

Lets say I want to do the very simple query in AD dsquery user -name "John Smith" | dsget user -memberof -expand This will output the DNs of the AD groups that this user belongs to. I can make it ...
3
votes
0answers
43 views

I need help trying to authenticate with AD from my linux machine

I am not experienced in this, so there might be some points that I am missing. Initially I tried to setup Cyrus Mail w/ SASL for AD authentication. After several tries, it failed to work. I switched ...
3
votes
0answers
167 views

Active directory filter to get all users on several AD locations without using groups

I'm required to use AD for authorization to some online tools to ease software development across three countries in a big international company. The tools AD/LDAP section have one line to specify a ...
3
votes
0answers
161 views

How do I fix a non-starting “Microsoft Key Distribution Service”? (not to be confused with Kerberos KDS)

The Microsoft Key Distribution Service is not starting on my DC (kdssvc.dll) and when I look at the event log under Microsoft\Kdssvc, I see the events: Event ID 4001 Group Key Distribution ...
3
votes
0answers
204 views

LDAP over TLS fails to connect, Schannel Alert 48

I am trying to use PHP to edit users in active directory through LDAP. My test machine is using a simple WAMP setup and is NOT connected to the windows domain. This machine can connect to LDAP on the ...
3
votes
0answers
35 views

Universal Group in domain not behaving as expected in multi-forest environment

I have an environment with 2 forests, F1 and F2 with a full, transitive, bi-directional trust between them. F1 has a single domain that holds an SSRS server. F2 has 2 domains, F2parent and F2child, ...
3
votes
0answers
198 views

Exchange 2013 and AD/GC issues

I have Exchange 2013 (minimal install and all roles are on a single server) on-premises running on a Windows 2012 R2 server (both Windows and Exchange are patched and up-to-date). Basically this ...
3
votes
0answers
36 views

Windows Server - Protect websites with AD user

My question is a bit tricky to explain :) We have ASP.NET websites running on Windows Server 2012. Some websites use SqlServer authentication, others use Windows authentication, some don't have any ...
3
votes
0answers
405 views

Adding multiple users from a group to an Active Directory group using Powershell

I have a powershell script that is supposed to go through a specific ou and store the groups into a variable $groups. Here is the code I use in the script: $Groups = Get-ADGroup -Properties * ...
3
votes
0answers
33 views

Consolidating Domains from 2 UPN's to 1

We currently have 1 domain (no children) at corp.domain.com. We have an alternate UPN so that users can have their UPN as username@domain.com (no corp). Many of our earlier users however have the ...
2
votes
0answers
34 views

group policy being applied from offsite Domain Controller: why?

Site 2: I have a small branch with 1 DC and 4 clients. Site 1: Meanwhile my main branch has 2 DCs and lots of clients. I made some GP changes on DC-site2, and I was wondering why they weren't ...
2
votes
0answers
48 views

Giving users of an OU permission to enable and disable users of their own OU

I want users of an OU to have access to enable and disable user accounts in their own OU. I believe in order to do this I need to grant the Read and Write userAccountControl property to the SELF ...
2
votes
0answers
20 views

Active directory “negative” group membership - group of groups minus some users

I feel like this must be a faq but I've not been able to figure out the right terminology to find the answer. I've got a large active directory group-of-groups that contains 101% of the users I ...
2
votes
0answers
41 views

SVN Edge not authenticating correctly with domain controller

SVN Edge (version 4.0.10-3880.131) not authenticating correctly with domain controller. I have SVN Edge setup and working perfectly when I use LDAP Security Level of NONE.. However when set to SSL, ...
2
votes
0answers
20 views

Placing AD Administrators in to /etc/sudoers

I've added the following to /etc/sudoers: %DOMAIN\\domain\ admins ALL=(ALL) ALL When I log in to use the administrator account I get this: [administrator@internal.mydomain.com@plex ~]$ sudo ...
2
votes
0answers
105 views

Use 2008 R2 and 2003 server domain and LDAP with Windows 8.1 and Windows 10?

I have two server domain one with Windows Server 2003 server and other Windows Server 2008 R2. With this can I use Windows 8.1 and 10 clients to connect with domain and apply policies?
2
votes
0answers
44 views

Slow response time when using ADUC utility to search a trusted domain

Current Setup: I have child 2 domains, one in America (amer.domain.com) and one in Asia (asia.domain.com) in the same forest. Both domains are connected via MPLS links. In each physical site, there ...
2
votes
0answers
305 views

Get AD Group Member - Different Domains

I've been tasked with exporting the members of a few AD groups to .csv which I've always done in the past using the Get-ADGroupMember command in powershell, specifying the group name, selecting the ...
2
votes
0answers
31 views

How to find which templates a GPO are using?

With a Windows 2012 R2 AD domain, we have a Central Store for group policy templates. Over time, a number of unnecessary templates were added to this store (most of them are not used) and it has ...
2
votes
0answers
88 views

Windows 8.1 clients querying wrong ldap SRV record?

I just spotted than my PC, running Windows 8.1 Pro on a Windows 2012 R2 domain has been querying DNS for SRV records that doesn't exist. All of the dcdiag /dnsall tests pass, but I wonder if there's ...
2
votes
0answers
71 views

need to migrate single label domain name

Our company has 8 sites, all on different subnets and connected via (slow) MPLS, and about 250 users in AD, and Exchange 2007. The current infrastructure was put into place prior to me coming on ...
2
votes
0answers
373 views

Group Policy - Drive Mapping Preferences - slow login even if only using Computer Config side

We are having some users with very slow login times, up to 20 minutes, but only for a handful of users. I've narrowed it down to a particular GPO that does nothing but Drive Mapping Preferences. I ...
2
votes
0answers
559 views

Error getting the list of sites from the target environment: An invalid dn syntax has been specified

Trying to add another (second) Domain Controller to an existing Domain. In the second step of "Active Directory Domain Services Configuration Wizard" getting the following error: Error getting the ...
2
votes
0answers
389 views

Is using the AD home directory attribute to map the home drive really no longer a best practice?

I have read some articles that claim that using the Active Directory user home directory attribute to automatically map the home drive is a legacy method, deprecated, or not recommended. The second ...
2
votes
0answers
2k views

Authentication Microsoft AD Users with RSA SecurID

I have an integration problem between RSA SecurID and Microsoft AD described in the picture below: 1.The user needs to connect to private network via VPN and authenticates to the Firewall via its ...
2
votes
0answers
158 views

Samba: Authenticate only local accounts over AD?

I have a samba server where I create all the linux accounts and corresponding SMB accounts via a application I built. I manage all the permissions for all of our shares via ACL's also using the ...
2
votes
0answers
365 views

Apache 500 Internal Server Error when authenticating with authz_svn_module with an empty user name field

My Environment Apache 2.2 Windows Server 2008 R2 (I also had the same problem with Windows 7) Tortoise SVN 1.8.7 Subversion 1.8.9 I have this SVN Server using Apache for authentication with ...
2
votes
0answers
1k views

RHEL 6.5 web application PAM AUTH pam_oddjob_mkhomedir

I've got a RHEL 6.5 that authenicates against an AD server, that side is working fine. The machine is also running a web application that uses a PAM module to authenticate. I copied login to make a ...
2
votes
0answers
125 views

Mavericks - APN Active Directory Users not being pushed

We have hit a problem with our current AD -> OSX Server integration project. We have our OSX server (mavericks) connected to our AD domain and running open directory/profile manager. AD users can ...
2
votes
0answers
153 views

Are External LDAP referrals similar to a DNS Recursive or non recursive entry?

I'm very familiar with DNS, but less so with LDAP. In DNS I have the ability to delegate the CPU and IO load of referral chasing a given DNS query... or I can set norecurse and have the client ...
2
votes
0answers
84 views

Forcing not-yet-known SID value in AD LDS userProxy account

We are dealing with a chained provisioning request, the goal being to create successively an AD account and an AD LDS userProxy account associated with the just created AD account. The AD account SID ...
2
votes
0answers
3k views

Allowing LDAP authentication from DMZ to Active Directory. Is my idea secure?

I have a internet-facing application server that I want to use AD authentication. This is my first time doing this for a none MS application or without some sort of proxy. I already have a idea in my ...
2
votes
0answers
347 views

doing ODBC System DSN's from Active Directory

2008R2 Active Directory, workstations are Win7 Ent, Office/Excel 2013, Oracle 11.2. Excel fetches data from Oracle using System DSN's. Where can I put ODBC System DSN's in Active Directory? Do I ...
2
votes
0answers
406 views

configuration CAS with LDAP active Directory

I am using CAS server version 3.5.2 and after I configured it to connect to an LDAP server I got this message. Anyone have a clue about what is happening? My LDAP server is pfeserver.pfe.dz ...