A Microsoft technology that constitutes an LDAP directory service with centralized management functionality for user accounts, computer accounts, groups, and configuration management across many Windows servers and desktops.

learn more… | top users | synonyms (2)

10
votes
0answers
2k views

Import Powershell AD Module during MDT Task Sequence

I have written this short powershell script to rename a computer as part of an MDT task sequence: Import-Module ActiveDirectory $AdminUsername = 'domain.com\administrator' $AdminPassword = 'password'...
8
votes
0answers
385 views

AD custom attribute of type numerical string crashes MMC when updated

I am using windows server 2008. I have a domain with one domain controller (this is a dev environment). I edited the AD schema and created a custom attribute called TestAttribute2 (the LDAP name is ...
6
votes
0answers
47 views

Is this Kerberos/AD setup possible?

We have a slightly complicated IDAM setup: I.e. the end user's machine and browser sit in one network with the parent AD, and our Jetty-based application and the AD that it can talk to (local AD) ...
6
votes
0answers
839 views

Unable to bind OSX 10.9 to Active Directory 2008

I am struggling to bind OSX 10.9 to a 2008 r2 Active Directory. I can join the domain fine when I boot into Windows from the same machine. From OSX I can find the domain controller successfully and ...
5
votes
0answers
1k views

Unix nslcd login with sAMAccountName and/or userPrincipalName from Active Directory

I'm trying to setup authentication from Active Directory in FreeBSD 10.0 using nslcd (nss-pam-ldapd-sasl package) and would like to allow both sAMAccountName and userPrincipalName as valid login ...
4
votes
0answers
54 views

How to bypass GPO loopback processing for some users?

As you probably know, loopback processing is a feature of Active Directory Group Policies which applies user settings in a GPO to any user who logs on to computers in the GPO's scope (whereas the ...
4
votes
0answers
70 views

Q: RHEL, SSSD, Active Directory

Good afternoon folks. I've been perusing various posts already about getting linux systems to authenticate using AD, but haven't seen anything approaching what I'm beating my head against. There's a ...
4
votes
0answers
90 views

How to configure Windows to trust a network share using a GPO?

I keep getting the following warning whenever I try to open a share from my DFS. How can I configure Windows (10 in this case) to trust anything under the root of my DFS via GP? It seems odd that ...
4
votes
0answers
156 views

Questions about ktpass/kerberos with Active Directory

I got a few questions about Kerberos with Active Directory, specifically about the ktpass tool. The example AD I'm using (everything is on 2012R2 level): Active Directory Domain Name: ad.example....
4
votes
0answers
206 views

How do I fix a non-starting “Microsoft Key Distribution Service”? (not to be confused with Kerberos KDS)

The Microsoft Key Distribution Service is not starting on my DC (kdssvc.dll) and when I look at the event log under Microsoft\Kdssvc, I see the events: Event ID 4001 Group Key Distribution ...
4
votes
0answers
160 views

Installing MSA (Managed Service Accounts) using deployment tools

I have to install several new servers (2012R2) for a project, which will run IIS and MSMQ, I need to script the complete install, so I need to be able to change permissions on IIS Application Pools ...
4
votes
0answers
1k views

LSA SID cache keeps old entry for renamed domain user - why?

I have a question about LSA SID cache on a domain member server. Recently I run into the issue when some users after their name was changed in AD has difficulties accessing application I support, and ...
4
votes
0answers
515 views

Cannot enable GSS-TSIG updates from Active Directory in BIND 9.10

I’m with a problem trying to enable GSS-TSIG with BIND 9.10. Before I start describing what I’ve done, I would like to say that I’ve already done this in in another domain without any problems. So I ...
4
votes
0answers
707 views

My two-way trust with selective auth seems to behave opposite to a one-way trust

I'm not sure why I'm the only one running into this, I think it's a larger problem with Server 2012 and RDS protocols... With 2008 machines, you can use utilize a one way trust to authenticate across ...
4
votes
0answers
1k views

RHEL 6.5 web application PAM AUTH pam_oddjob_mkhomedir

I've got a RHEL 6.5 that authenicates against an AD server, that side is working fine. The machine is also running a web application that uses a PAM module to authenticate. I copied login to make a ...
4
votes
0answers
163 views

Windows 2012 Master & Ubuntu Bind 9 Slave & SOA

I'm kinda like the maid... I don't do Windows. But thanks to new things we're implementing, I'm now attempting replicating a single zone from our AD cluster. We had this working just fine but ...
4
votes
0answers
32k views

Windows 7 there are no logon servers available to service the logon request subdomain

I've read other solutions, but my problem is slighlty different. Problem occurs in domain environment. We work in a subdomain, but we also have some employees coming with notebooks registered in top ...
4
votes
0answers
733 views

Branch office & DNS

We've got a branch office with no on-site services at the moment and we'd like to change that. The biggest goal is to setup some file servers but faster log ons and DNS resolutions will be welcome as ...
4
votes
0answers
56 views

Why is Office 2010 asking me to choose one of only one potential account to open a restricted document

We have implemented an AD Rights Management System in our domain. Occassionally, when I send a protected email to someone in my domain or someone sends one to me, I will be prompted with a dialog box ...
4
votes
0answers
1k views

DSGET escapes hash signs (#) in outputted Distinguished Names (DN)s but expects unescaped hash signs for input

Lets say I want to do the very simple query in AD dsquery user -name "John Smith" | dsget user -memberof -expand This will output the DNs of the AD groups that this user belongs to. I can make it ...
3
votes
0answers
43 views

Kerberos keytab file not working

I have two AD domains and I'm trying to use NFS with Kerberos to both of them. Part of the procedure requires creating keytab files for the host and nfs principals for the client and server ...
3
votes
0answers
93 views

How can I programmatically unbind IPv6 from a network interface on a Windows 7 machine?

I need to unbind the IPv6 services from a number of client workstations running Windows 7. ("Untick" the selected box in the screenclip below.) For what it matters, they currently all have a single,...
3
votes
0answers
46 views

I need help trying to authenticate with AD from my linux machine

I am not experienced in this, so there might be some points that I am missing. Initially I tried to setup Cyrus Mail w/ SASL for AD authentication. After several tries, it failed to work. I switched ...
3
votes
0answers
253 views

Active directory filter to get all users on several AD locations without using groups

I'm required to use AD for authorization to some online tools to ease software development across three countries in a big international company. The tools AD/LDAP section have one line to specify a ...
3
votes
0answers
273 views

LDAP over TLS fails to connect, Schannel Alert 48

I am trying to use PHP to edit users in active directory through LDAP. My test machine is using a simple WAMP setup and is NOT connected to the windows domain. This machine can connect to LDAP on the ...
3
votes
0answers
39 views

Universal Group in domain not behaving as expected in multi-forest environment

I have an environment with 2 forests, F1 and F2 with a full, transitive, bi-directional trust between them. F1 has a single domain that holds an SSRS server. F2 has 2 domains, F2parent and F2child, ...
3
votes
0answers
309 views

Exchange 2013 and AD/GC issues

I have Exchange 2013 (minimal install and all roles are on a single server) on-premises running on a Windows 2012 R2 server (both Windows and Exchange are patched and up-to-date). Basically this ...
3
votes
0answers
38 views

Windows Server - Protect websites with AD user

My question is a bit tricky to explain :) We have ASP.NET websites running on Windows Server 2012. Some websites use SqlServer authentication, others use Windows authentication, some don't have any ...
3
votes
0answers
599 views

Adding multiple users from a group to an Active Directory group using Powershell

I have a powershell script that is supposed to go through a specific ou and store the groups into a variable $groups. Here is the code I use in the script: $Groups = Get-ADGroup -Properties * -...
3
votes
0answers
784 views

Error getting the list of sites from the target environment: An invalid dn syntax has been specified

Trying to add another (second) Domain Controller to an existing Domain. In the second step of "Active Directory Domain Services Configuration Wizard" getting the following error: Error getting the ...
3
votes
0answers
629 views

Is using the AD home directory attribute to map the home drive really no longer a best practice?

I have read some articles that claim that using the Active Directory user home directory attribute to automatically map the home drive is a legacy method, deprecated, or not recommended. The second ...
3
votes
0answers
33 views

Consolidating Domains from 2 UPN's to 1

We currently have 1 domain (no children) at corp.domain.com. We have an alternate UPN so that users can have their UPN as username@domain.com (no corp). Many of our earlier users however have the ...
3
votes
0answers
399 views

Windows Sub CA not issuing certificates

I set up a fresh 2-tier PKI to try and replace an old broken PKI with a CA that was no longer available. Everything seems to be working between the offline root and online issuing CAs, but now I'm ...
3
votes
0answers
574 views

Single Sign On through Citrix

I have a webserver running Windows 2008 R2 with IIS 7. The server is a member of the domain "mydomain.com". What I am trying to achieve is a SSO connection between the AD users and the web server. The ...
2
votes
0answers
19 views

DHCP Server not responding to relayed DHCP DISCOVER

I'm currently segmenting our network in various subnets. We already have a DHCP server as a part of our Active Directory (Server 2012). I want to use this server for all subnets so I need to work with ...
2
votes
0answers
31 views

Internal EV SSL From A Windows Server 2012 R2 Root CA Shows Up As A Normal Certificate

I am trying to setup an internal ev ssl server for all of my internal applications giving ie the little green bar and chrome displaying my company name. It works fine in IE displaying the green bar as ...
2
votes
0answers
39 views

Why can't I see the file version of files in system32 remotely?

Here's the situation: I can RDP into a computer, go to C:\Windows\System32, and check file versions to my heart's content. Such as winlogon.exe, explorer.exe, etc. If I map the drive, and try to ...
2
votes
0answers
29 views

Server 2012 replication error

I have 2 Windows 2012 DCs (DC1 and DC2). From DC2 replication works while from DC1 I keep getting the error "replication error rpc server is unavailable. I'm attempting to do this from Active ...
2
votes
0answers
51 views

2008 R2 RDS, keeps saying user must change password at first logon

We have a 2003 domain with two 2003 domain controllers on 2008 R2 functional level. Over the past week, when a user's password expires, they attempt to change it when logging into a 2008 R2 remote ...
2
votes
0answers
146 views

Why can't I remote manage a domain-joined Windows 10 computer?

I have a Active Directory domain of old Windows 7 computers and introduced a new Windows 10 computer. However, when I right-click the Win10 computer in AD Users & Computers, and select Manage, I ...
2
votes
0answers
59 views

Why do Roaming User Profiles stay at home?

PREFACE: I am a helpdesk operator/student who has volunteered to work on local small business IT problems for experience. I apologize in advance if I have missed an obvious solution! I am attempting ...
2
votes
0answers
55 views

How can I change the default location of the Adobe Premiere Pro (creative cloud) media cache location?

Adobe Premiere Pro on Windows machines stores its 'media cache' files in the %appdata% directory. On our network, this is redirected to a server share, and consumes significant amounts of storage ...
2
votes
0answers
61 views

Is it possible to use Active directory without a trust relationship for FreeIPA passwords?

I am looking to integrate FreeIPA with an Active Directory environment that I do not have full control over and most likely will not be able to get a trust relationship setup with my FreeIPA install. ...
2
votes
0answers
64 views

Group Policy - Not automatically running on all machines

We are facing an issue on one of our domains where machines are not all running group policy refreshes at its default interval. I am not seeing the 1501 events logged in the system log, I occasionally ...
2
votes
0answers
54 views

group policy being applied from offsite Domain Controller: why?

Site 2: I have a small branch with 1 DC and 4 clients. Site 1: Meanwhile my main branch has 2 DCs and lots of clients. I made some GP changes on DC-site2, and I was wondering why they weren't ...
2
votes
0answers
427 views

Samba4 DC cannot enable TLS encryption

I've created my SSL certificate through an intermediate and have attached the certificate, key and (chain) CA to the Samba4 config under [General]. Upon restarting Samba though, the LDAP server is no ...
2
votes
0answers
233 views

Windows - Kerberos SSO from outside the domain

I've tried to figure it out myself, but to no avail. Google offers many tutorials but I couldn't find any for the below case. We have an external cooperating employee with VPN access to our LAN and ...
2
votes
0answers
56 views

Giving users of an OU permission to enable and disable users of their own OU

I want users of an OU to have access to enable and disable user accounts in their own OU. I believe in order to do this I need to grant the Read and Write userAccountControl property to the SELF ...
2
votes
0answers
40 views

Active directory “negative” group membership - group of groups minus some users

I feel like this must be a faq but I've not been able to figure out the right terminology to find the answer. I've got a large active directory group-of-groups that contains 101% of the users I ...
2
votes
0answers
88 views

SVN Edge not authenticating correctly with domain controller

SVN Edge (version 4.0.10-3880.131) not authenticating correctly with domain controller. I have SVN Edge setup and working perfectly when I use LDAP Security Level of NONE.. However when set to SSL, ...