A Microsoft technology for sharing one set of user accounts, security permissions, and management information across many Windows servers and desktops.

learn more… | top users | synonyms (2)

9
votes
0answers
1k views

Import Powershell AD Module during MDT Task Sequence

I have written this short powershell script to rename a computer as part of an MDT task sequence: Import-Module ActiveDirectory $AdminUsername = 'domain.com\administrator' $AdminPassword = ...
7
votes
0answers
366 views

AD custom attribute of type numerical string crashes MMC when updated

I am using windows server 2008. I have a domain with one domain controller (this is a dev environment). I edited the AD schema and created a custom attribute called TestAttribute2 (the LDAP name is ...
6
votes
0answers
816 views

Unable to bind OSX 10.9 to Active Directory 2008

I am struggling to bind OSX 10.9 to a 2008 r2 Active Directory. I can join the domain fine when I boot into Windows from the same machine. From OSX I can find the domain controller successfully and ...
5
votes
0answers
1k views

Unix nslcd login with sAMAccountName and/or userPrincipalName from Active Directory

I'm trying to setup authentication from Active Directory in FreeBSD 10.0 using nslcd (nss-pam-ldapd-sasl package) and would like to allow both sAMAccountName and userPrincipalName as valid login ...
4
votes
0answers
194 views

How do I fix a non-starting “Microsoft Key Distribution Service”? (not to be confused with Kerberos KDS)

The Microsoft Key Distribution Service is not starting on my DC (kdssvc.dll) and when I look at the event log under Microsoft\Kdssvc, I see the events: Event ID 4001 Group Key Distribution ...
4
votes
0answers
155 views

Installing MSA (Managed Service Accounts) using deployment tools

I have to install several new servers (2012R2) for a project, which will run IIS and MSMQ, I need to script the complete install, so I need to be able to change permissions on IIS Application Pools ...
4
votes
0answers
153 views

Active Directory Administrative Center - resize membership part

User can be a member of 3 groups at most to be visible in ADAC without scrolling. But in reality, users are members of 5, 10 even 20 groups. We have to scroll the "member of" list to check the ...
4
votes
0answers
1k views

LSA SID cache keeps old entry for renamed domain user - why?

I have a question about LSA SID cache on a domain member server. Recently I run into the issue when some users after their name was changed in AD has difficulties accessing application I support, and ...
4
votes
0answers
481 views

Cannot enable GSS-TSIG updates from Active Directory in BIND 9.10

I’m with a problem trying to enable GSS-TSIG with BIND 9.10. Before I start describing what I’ve done, I would like to say that I’ve already done this in in another domain without any problems. So I ...
4
votes
0answers
655 views

My two-way trust with selective auth seems to behave opposite to a one-way trust

I'm not sure why I'm the only one running into this, I think it's a larger problem with Server 2012 and RDS protocols... With 2008 machines, you can use utilize a one way trust to authenticate across ...
4
votes
0answers
1k views

RHEL 6.5 web application PAM AUTH pam_oddjob_mkhomedir

I've got a RHEL 6.5 that authenicates against an AD server, that side is working fine. The machine is also running a web application that uses a PAM module to authenticate. I copied login to make a ...
4
votes
0answers
162 views

Windows 2012 Master & Ubuntu Bind 9 Slave & SOA

I'm kinda like the maid... I don't do Windows. But thanks to new things we're implementing, I'm now attempting replicating a single zone from our AD cluster. We had this working just fine but ...
4
votes
0answers
31k views

Windows 7 there are no logon servers available to service the logon request subdomain

I've read other solutions, but my problem is slighlty different. Problem occurs in domain environment. We work in a subdomain, but we also have some employees coming with notebooks registered in top ...
4
votes
0answers
713 views

Branch office & DNS

We've got a branch office with no on-site services at the moment and we'd like to change that. The biggest goal is to setup some file servers but faster log ons and DNS resolutions will be welcome as ...
4
votes
0answers
55 views

Why is Office 2010 asking me to choose one of only one potential account to open a restricted document

We have implemented an AD Rights Management System in our domain. Occassionally, when I send a protected email to someone in my domain or someone sends one to me, I will be prompted with a dialog box ...
4
votes
0answers
1k views

DSGET escapes hash signs (#) in outputted Distinguished Names (DN)s but expects unescaped hash signs for input

Lets say I want to do the very simple query in AD dsquery user -name "John Smith" | dsget user -memberof -expand This will output the DNs of the AD groups that this user belongs to. I can make it ...
3
votes
0answers
85 views

How to configure Windows to trust a network share using a GPO?

I keep getting the following warning whenever I try to open a share from my DFS. How can I configure Windows (10 in this case) to trust anything under the root of my DFS via GP? It seems odd that ...
3
votes
0answers
99 views

Questions about ktpass/kerberos with Active Directory

I got a few questions about Kerberos with Active Directory, specifically about the ktpass tool. The example AD I'm using (everything is on 2012R2 level): Active Directory Domain Name: ...
3
votes
0answers
38 views

Kerberos keytab file not working

I have two AD domains and I'm trying to use NFS with Kerberos to both of them. Part of the procedure requires creating keytab files for the host and nfs principals for the client and server ...
3
votes
0answers
79 views

How can I programmatically unbind IPv6 from a network interface on a Windows 7 machine?

I need to unbind the IPv6 services from a number of client workstations running Windows 7. ("Untick" the selected box in the screenclip below.) For what it matters, they currently all have a ...
3
votes
0answers
45 views

I need help trying to authenticate with AD from my linux machine

I am not experienced in this, so there might be some points that I am missing. Initially I tried to setup Cyrus Mail w/ SASL for AD authentication. After several tries, it failed to work. I switched ...
3
votes
0answers
233 views

Active directory filter to get all users on several AD locations without using groups

I'm required to use AD for authorization to some online tools to ease software development across three countries in a big international company. The tools AD/LDAP section have one line to specify a ...
3
votes
0answers
256 views

LDAP over TLS fails to connect, Schannel Alert 48

I am trying to use PHP to edit users in active directory through LDAP. My test machine is using a simple WAMP setup and is NOT connected to the windows domain. This machine can connect to LDAP on the ...
3
votes
0answers
38 views

Universal Group in domain not behaving as expected in multi-forest environment

I have an environment with 2 forests, F1 and F2 with a full, transitive, bi-directional trust between them. F1 has a single domain that holds an SSRS server. F2 has 2 domains, F2parent and F2child, ...
3
votes
0answers
262 views

Exchange 2013 and AD/GC issues

I have Exchange 2013 (minimal install and all roles are on a single server) on-premises running on a Windows 2012 R2 server (both Windows and Exchange are patched and up-to-date). Basically this ...
3
votes
0answers
38 views

Windows Server - Protect websites with AD user

My question is a bit tricky to explain :) We have ASP.NET websites running on Windows Server 2012. Some websites use SqlServer authentication, others use Windows authentication, some don't have any ...
3
votes
0answers
534 views

Adding multiple users from a group to an Active Directory group using Powershell

I have a powershell script that is supposed to go through a specific ou and store the groups into a variable $groups. Here is the code I use in the script: $Groups = Get-ADGroup -Properties * ...
3
votes
0answers
33 views

Consolidating Domains from 2 UPN's to 1

We currently have 1 domain (no children) at corp.domain.com. We have an alternate UPN so that users can have their UPN as username@domain.com (no corp). Many of our earlier users however have the ...
3
votes
0answers
383 views

Windows Sub CA not issuing certificates

I set up a fresh 2-tier PKI to try and replace an old broken PKI with a CA that was no longer available. Everything seems to be working between the offline root and online issuing CAs, but now I'm ...
2
votes
0answers
43 views

Why do Roaming User Profiles stay at home?

PREFACE: I am a helpdesk operator/student who has volunteered to work on local small business IT problems for experience. I apologize in advance if I have missed an obvious solution! I am attempting ...
2
votes
0answers
24 views

How can I change the default location of the Adobe Premiere Pro (creative cloud) media cache location?

Adobe Premiere Pro on Windows machines stores its 'media cache' files in the %appdata% directory. On our network, this is redirected to a server share, and consumes significant amounts of storage ...
2
votes
0answers
61 views

Group Policy - Not automatically running on all machines

We are facing an issue on one of our domains where machines are not all running group policy refreshes at its default interval. I am not seeing the 1501 events logged in the system log, I occasionally ...
2
votes
0answers
41 views

group policy being applied from offsite Domain Controller: why?

Site 2: I have a small branch with 1 DC and 4 clients. Site 1: Meanwhile my main branch has 2 DCs and lots of clients. I made some GP changes on DC-site2, and I was wondering why they weren't ...
2
votes
0answers
171 views

Windows - Kerberos SSO from outside the domain

I've tried to figure it out myself, but to no avail. Google offers many tutorials but I couldn't find any for the below case. We have an external cooperating employee with VPN access to our LAN and ...
2
votes
0answers
52 views

Giving users of an OU permission to enable and disable users of their own OU

I want users of an OU to have access to enable and disable user accounts in their own OU. I believe in order to do this I need to grant the Read and Write userAccountControl property to the SELF ...
2
votes
0answers
32 views

Active directory “negative” group membership - group of groups minus some users

I feel like this must be a faq but I've not been able to figure out the right terminology to find the answer. I've got a large active directory group-of-groups that contains 101% of the users I ...
2
votes
0answers
65 views

SVN Edge not authenticating correctly with domain controller

SVN Edge (version 4.0.10-3880.131) not authenticating correctly with domain controller. I have SVN Edge setup and working perfectly when I use LDAP Security Level of NONE.. However when set to SSL, ...
2
votes
0answers
30 views

Placing AD Administrators in to /etc/sudoers

I've added the following to /etc/sudoers: %DOMAIN\\domain\ admins ALL=(ALL) ALL When I log in to use the administrator account I get this: [administrator@internal.mydomain.com@plex ~]$ sudo ...
2
votes
0answers
128 views

Use 2008 R2 and 2003 server domain and LDAP with Windows 8.1 and Windows 10?

I have two server domain one with Windows Server 2003 server and other Windows Server 2008 R2. With this can I use Windows 8.1 and 10 clients to connect with domain and apply policies?
2
votes
0answers
60 views

Slow response time when using ADUC utility to search a trusted domain

Current Setup: I have child 2 domains, one in America (amer.domain.com) and one in Asia (asia.domain.com) in the same forest. Both domains are connected via MPLS links. In each physical site, there ...
2
votes
0answers
35 views

How to find which templates a GPO are using?

With a Windows 2012 R2 AD domain, we have a Central Store for group policy templates. Over time, a number of unnecessary templates were added to this store (most of them are not used) and it has ...
2
votes
0answers
104 views

Windows 8.1 clients querying wrong ldap SRV record?

I just spotted than my PC, running Windows 8.1 Pro on a Windows 2012 R2 domain has been querying DNS for SRV records that doesn't exist. All of the dcdiag /dnsall tests pass, but I wonder if there's ...
2
votes
0answers
97 views

need to migrate single label domain name

Our company has 8 sites, all on different subnets and connected via (slow) MPLS, and about 250 users in AD, and Exchange 2007. The current infrastructure was put into place prior to me coming on ...
2
votes
0answers
455 views

Group Policy - Drive Mapping Preferences - slow login even if only using Computer Config side

We are having some users with very slow login times, up to 20 minutes, but only for a handful of users. I've narrowed it down to a particular GPO that does nothing but Drive Mapping Preferences. I ...
2
votes
0answers
700 views

Error getting the list of sites from the target environment: An invalid dn syntax has been specified

Trying to add another (second) Domain Controller to an existing Domain. In the second step of "Active Directory Domain Services Configuration Wizard" getting the following error: Error getting the ...
2
votes
0answers
517 views

Is using the AD home directory attribute to map the home drive really no longer a best practice?

I have read some articles that claim that using the Active Directory user home directory attribute to automatically map the home drive is a legacy method, deprecated, or not recommended. The second ...
2
votes
0answers
3k views

Authentication Microsoft AD Users with RSA SecurID

I have an integration problem between RSA SecurID and Microsoft AD described in the picture below: 1.The user needs to connect to private network via VPN and authenticates to the Firewall via its ...
2
votes
0answers
171 views

Samba: Authenticate only local accounts over AD?

I have a samba server where I create all the linux accounts and corresponding SMB accounts via a application I built. I manage all the permissions for all of our shares via ACL's also using the ...
2
votes
0answers
398 views

Apache 500 Internal Server Error when authenticating with authz_svn_module with an empty user name field

My Environment Apache 2.2 Windows Server 2008 R2 (I also had the same problem with Windows 7) Tortoise SVN 1.8.7 Subversion 1.8.9 I have this SVN Server using Apache for authentication with ...
2
votes
0answers
127 views

Mavericks - APN Active Directory Users not being pushed

We have hit a problem with our current AD -> OSX Server integration project. We have our OSX server (mavericks) connected to our AD domain and running open directory/profile manager. AD users can ...