Active Directory is a Microsoft technology primarily for managing multiple Windows servers and workstations in a single environment. It was first released in 2000.
71
votes
16answers
7k views
How do I protect my company from my IT guy? [closed]
I'm going to hire an IT guy to help manage my office's computers and network. We're a small shop, so he'll be the only one doing IT.
Of course, I'll interview carefully, check references, and run a ...
48
votes
5answers
9k views
Active Directory explained
If you had to explain Active Directory to someone how would you explain it?
48
votes
1answer
36k views
What is Active Directory and how does it work?
This is a Canonical Question about Active Directory.
What is Active Directory? What does it do and how does it work?
I find myself explaining some of what I assume is common knowledge about it ...
37
votes
4answers
40k views
How can I find out what AD groups I'm a member of?
I'm running a Windows XP desktop in a corporate environment. How can I find out what AD groups I belong to?
37
votes
6answers
92k views
How can I figure out my LDAP connection string?
We're on a corporate network thats running active directory and we'd like to test out some LDAP stuff (active directory membership provider, actually) and so far, none of us can figure out what our ...
34
votes
8answers
187k views
Command line to list users in a Windows Active Directory group?
Is there a command line way to list all the users in a particular Active Directory group?
I can see who is in the group by going to Manage Computer --> Local User / Groups --> Groups and double ...
33
votes
2answers
861 views
What's the meaning of logging in as “username@mydomain.com:something”
My Windows 2008 R2 machine is joined to a domain.
In the logon screen, if I type in "username@mydomain.com:something" as the username, I can still logon properly, what's the meaning of ":something" ...
31
votes
3answers
36k views
Is there a way to view the members of an Active Directory group if you aren't a domain admin and can't log into to a domain controller?
Is there a way to view the members of an Active Directory group if you aren't a domain admin and can't log into to a domain controller?
26
votes
5answers
46k views
Find name of Active Directory domain controller
How can I find out the name/IP address of the AD domain controller on my network?
24
votes
13answers
8k views
Do I really need MS Active Directory?
I manage a shop of arround 30 machines and 2 terminal servers (one production, one standby.) Should I really deploy Active Directory in our network?
Are there any really benefits, that could ballance ...
22
votes
12answers
15k views
Active Directory: delete vs. disable departed employees
When an employee leaves your organization, do you delete or disable their Active Directory account? Our SOP is to disable, export/purge the Exchange mailbox, and then after "some time" has elapsed ...
22
votes
4answers
695 views
Active Directory Health Checks
I've had some Active Directory troubles lately was was wondering what checks I could do on a regular basis I could do to ensure everything is working optimally?
21
votes
2answers
947 views
What should I name my Active Directory? [duplicate]
Possible Duplicate:
Windows AD Domain naming recommendations
There are a lot of really screwed up configurations out there, because people didn't take a minute to sit down and think about ...
20
votes
6answers
5k views
Can windows domain controller be virtualized?
Just the question on the title. There is any problem? Any experience on this?
19
votes
2answers
3k views
Authenticating OpenBSD against Active Directory
Edit: Reformatted this as Q&A. If anyone can change this from Community Wiki to a typical question, that's probably more appropriate as well.
How can I authenticate OpenBSD against Active ...
18
votes
6answers
22k views
Choosing local versus public domain name for Active Directory
What are the pros and cons of choosing a local domain name such as mycompany.local versus a publicly registered domain name such as mycompany.com (assuming that your org has registered the public ...
17
votes
3answers
1k views
How are cached Windows credentials stored on the local machine?
How are cached Active Directory domain credentials stored on a Windows client? Are they stored in the local SAM database, thus making them susceptible to the same rainbow table attacks that local user ...
17
votes
2answers
6k views
Setting Mercurial with Active Directory authentication and authorisation
I am evaluating the possibilities of moving my organisation to Mercurial, however I am stumbling on two basic requirements which I can't find proper pointers to.
How do I set up Mercurial's central ...
16
votes
2answers
2k views
What is Group Policy and how does it work?
This is a Canonical Question about Active Directory Group Policy Basics
What is Group Policy? How does it work and why should I use it?
Note: This is meant to be a question & answer to ...
16
votes
4answers
5k views
Windows AD Domain naming recommendations
After experimenting with domains and domain controllers in a virtual environment I realized that having an AD domain named identically to a... well, DNS domain is bad idea (I mean, we have foo.com as ...
15
votes
4answers
119k views
How to find time server in a domain?
In a Windows domain PDC isn't necessarily the domain time server. How could I identify the authoritative time server?
15
votes
12answers
9k views
Is there an equivalent of SU for Windows
Is there a way (when logged in as an administrator, or as a member of the administrators group) to masquerade as a non-privileged user? Especially in an AD environment.
e.g., in the Unix world I ...
15
votes
5answers
3k views
Mercurial (hg) with active directory
Can I setup Mercurial to authenticate users on Active Directory? In my case, hg can run on Windows, Linux or FreeBSD, but I need to use AD users.
Note: if it is possible, then please point me to a ...
15
votes
6answers
38k views
last time an AD user has logged in?
I've noticed that we have in Active Directory more users than the company has actual employees. Is there a simple way to check multiple Active Directory accounts and see if there are any accounts that ...
14
votes
3answers
538 views
Active Directory Virtualization
My company is looking to try and virtualize all our servers, and we are trying to figure out if virtualizing active directory is a good idea. Is it even something that can be done, and if so are ...
14
votes
10answers
73k views
Best way to find the computer a user last logged on from?
I am hoping that somewhere in Active Directory the "last logged on from [computer]" is written/stored, or there is a log I can parse out?
The purpose of wanting to know the last PC logged on from is ...
14
votes
3answers
4k views
Removing old computers on a domain
The Windows Domain I manage has hundreds of computer names which I don't recognise and I'd like to remove old ones which aren't in use before trying to track down the misnamed ones.
Is there someway ...
14
votes
5answers
47k views
How to create Active Directory user account with powershell
I am constantly setting up research and development environments that require active directory accounts. Since we place these environments in isloated networks each environment needs its own active ...
14
votes
5answers
631 views
Windows 2008 R2 AD servers on fanless flash based systems
We have a number of branch offices where having an AD/DNS server would make a big difference to user experience. The following characteristics apply:
There is no air conditioned server room, and no ...
14
votes
3answers
27k views
Getting Squid to authenticate with kerberos and Windows 2008/2003/7/XP
This is something I setup recently and was quite a big pain. My environment was getting squid to authenticate a Windows 7 client against a Windows 2008 Server invisibly. NTLM is not really an ...
13
votes
7answers
61k views
Disable password complexity rule in Active Directory
Where do I go to disable the password complexity policy for the domain. I've logged onto the domain controller (Windows Server 2008) and found the option in local policies which is of course locked ...
13
votes
6answers
12k views
Active Directory vs OpenLDAP
This is for a small company (12 developers) who haven't implemented any centralized user database - they've grown organically and just created accounts on computers as they needed.
From a management ...
13
votes
3answers
669 views
Do I Need to Configure Active Directory Sites if We Have a High Speed WAN?
I work at an organization with 15 physical sites. The corporate headquarters has two DC's, which hold all the FSMO roles between them. Each remote site has one DC onsite.
When I started working here, ...
13
votes
5answers
31k views
Finding why a user is locked out in Active Directory
A user's account keeps getting locked out in Active Directory. It's probably caused by an app that's using Windows authentication to connect to SQL Server.
Is there a way to find out which app is ...
13
votes
6answers
7k views
Move Active Directory from 2003 to 2008
Im not a expert admin in Active Directory so I'm in need of some help.
At my work, we have bought a new server with the 2008 server OS. And the old AD domain controller is run on a 2003 server.
The ...
13
votes
2answers
480 views
How does a client system in an Active Directory network find in which site it resides?
As I was putting together a presentation for beginning Windows administration, I was struck with a question that I'm amazed I haven't asked sooner.
I know that:
AD is logically setup in sites to ...
13
votes
1answer
9k views
What needs to be done after a Domain Controller crash?
Assuming that at least two domain controllers were present in the domain to start with, what steps need to be taken to make Active Directory healthy after a domain controller crash?
13
votes
1answer
14k views
How to authenticate Linux accounts against an Active Directory and mount a Windows share on login?
I'm using Ubuntu 10.04 Server.
13
votes
3answers
2k views
PowerShell Script to find AD users with adminCount > 0
I've recently discovered the "adminSDHolder" feature of Active Directory. I need a quick way to identify all users who will be affected by it, namely a script to dump the user accounts.
13
votes
1answer
3k views
How is DNS related to Active Directory and what are some common configurations that I should be aware of?
Please note that I do know the answer to this and have provided one below. I see a lot of newer systems administrators that don't understand the contents of my answer, so I hope that all of the ...
13
votes
7answers
8k views
Google Apps, AD and SSO
We're a small shop running Google Apps (Enterprise) for our email needs. Love it. Internally, we're using Windows AD (2003). No complaints there either.
I'd like to get some method of SSO going ...
13
votes
10answers
6k views
Windows 2008 DHCP service fails - “…failed to see a directory server for authorization.”
I have a small environment running Windows 2008 R2 where the DHCP service on the domain controller fails every two weeks.
The most-visible error is Event ID 1059 and the Event Viewer message is:
...
12
votes
2answers
1k views
How to create an additional domain controller using Windows Server 2008 R2 Server Core?
I'm currently running Windows Server 2008 R2, can anyone tell me how I can replicate the active directory to another server which has been installed using Server Core install.
12
votes
3answers
4k views
Seizing FSMO roles from dead Windows Domain Controller
I've seen other questions and documents about doing this, but there are some things that still confuse me. Here are the documents and questions I've seen:
Retire a Dead Windows 2003 Domain ...
12
votes
1answer
104 views
What does “DEL:” mean in the DistinguishedName of an AD Object?
Sorry -- I'm not really a Windows System Admin, just trying to slam through some LDAP interactions in Java.
I'm finding a ton of objects with "DEL:" in the distinguishedName. Are these orphaned ...
12
votes
3answers
714 views
Server credential management for Linux and Windows
We are a relatively small shop (as far as number of sysadmins) with a mix of RHEL, Solaris, Windows 2003 and Windows 2008 servers; about 200 servers in all.
For our administrator accounts (root in ...
12
votes
1answer
164 views
Windows Server 2003 Domain Controller Replacement
This Saturday evening we're going to be replacing our existing Windows Server 2003 domain controllers/dns servers with Windows Server 2008 R2 domain controllers/dns servers. The current forest and ...
12
votes
2answers
12k views
Any difference between DOMAIN\username and username@domain.local?
I'm trying to troubleshoot an obscure authentication error and need some background information.
Is there any difference between how Windows (and programs like Outlook) process DOMAIN\username and ...
12
votes
4answers
2k views
How can I make WSUS less invasive for our users?
We have WSUS pushing updates out to our user's workstations, and things are going relatively well with one annoying caveat: there seems to be an issue with a pop-up being displayed in front of some ...
12
votes
1answer
157 views
Group Policy Result summary says DC is member of “BUILTIN\Administrators”
Whenever I run the Group Policy Result wizard and select a Domain Controller as the target computer, the summary shows BUILTIN\Administrators in the list of "Security Group Membership when Group ...
