Active Directory is a Microsoft technology primarily for managing multiple Windows servers and workstations in a single environment. It was first released in 2000.

learn more… | top users | synonyms (2)

78
votes
2answers
126k views

What is Active Directory Domain Services and how does it work?

This is a Canonical Question about Active Directory Domain Services (AD DS). What is Active Directory? What does it do and how does it work? How is Active Directory organized: Forest, Child ...
74
votes
16answers
8k views

How do I protect my company from my IT guy? [closed]

I'm going to hire an IT guy to help manage my office's computers and network. We're a small shop, so he'll be the only one doing IT. Of course, I'll interview carefully, check references, and run a ...
71
votes
6answers
87k views

How can I find out what AD groups I'm a member of?

I'm running a Windows XP desktop in a corporate environment. How can I find out what AD groups I belong to?
54
votes
5answers
14k views

Active Directory explained

If you had to explain Active Directory to someone how would you explain it?
51
votes
3answers
62k views

Is there a way to view the members of an Active Directory group if you aren't a domain admin and can't log into to a domain controller?

Is there a way to view the members of an Active Directory group if you aren't a domain admin and can't log into to a domain controller?
49
votes
7answers
166k views

How can I figure out my LDAP connection string?

We're on a corporate network thats running active directory and we'd like to test out some LDAP stuff (active directory membership provider, actually) and so far, none of us can figure out what our ...
47
votes
8answers
286k views

Command line to list users in a Windows Active Directory group?

Is there a command line way to list all the users in a particular Active Directory group? I can see who is in the group by going to Manage Computer --> Local User / Groups --> Groups and double ...
38
votes
5answers
77k views

Find name of Active Directory domain controller

How can I find out the name/IP address of the AD domain controller on my network?
33
votes
2answers
1k views

What's the meaning of logging in as “username@mydomain.com:something”

My Windows 2008 R2 machine is joined to a domain. In the logon screen, if I type in "username@mydomain.com:something" as the username, I can still logon properly, what's the meaning of ":something" ...
27
votes
7answers
4k views

Should I expose my Active Directory to the public Internet for remote users?

I have a client whose workforce is comprised entirely of remote employees using a mix of Apple and Windows 7 PCs/laptops. The users don't authenticate against a domain at the moment, but the ...
26
votes
12answers
12k views

Do I really need MS Active Directory?

I manage a shop of arround 30 machines and 2 terminal servers (one production, one standby.) Should I really deploy Active Directory in our network? Are there any really benefits, that could ballance ...
26
votes
7answers
2k views

If a Windows shop moves “everything” to the cloud, does it still need Active Directory?

Taking a spin off of this question: Do I really need MS Active Directory? in a new direction for 2014. Taking into account a basic Windows infrastructure: domain controllers Exchange 2007/2010/2013 ...
25
votes
5answers
15k views

Windows AD Domain naming recommendations

After experimenting with domains and domain controllers in a virtual environment I realized that having an AD domain named identically to a... well, DNS domain is bad idea (I mean, we have foo.com as ...
25
votes
0answers
1k views

What should I name my Active Directory? [duplicate]

Possible Duplicate: Windows AD Domain naming recommendations There are a lot of really screwed up configurations out there, because people didn't take a minute to sit down and think about ...
24
votes
7answers
3k views

Is it best practices to have separate login for a domain for domain admins?

I typically like to set up separate logins for myself, one with regular user permissions, and a separate one for administrative tasks. For example, if the domain was XXXX, I'd set up a XXXX\bpeikes ...
22
votes
12answers
21k views

Active Directory: delete vs. disable departed employees

When an employee leaves your organization, do you delete or disable their Active Directory account? Our SOP is to disable, export/purge the Exchange mailbox, and then after "some time" has elapsed ...
22
votes
4answers
1k views

Active Directory Health Checks

I've had some Active Directory troubles lately was was wondering what checks I could do on a regular basis I could do to ensure everything is working optimally?
21
votes
6answers
83k views

Disable password complexity rule in Active Directory

Where do I go to disable the password complexity policy for the domain? I've logged onto the domain controller (Windows Server 2008) and found the option in local policies which is of course locked ...
20
votes
6answers
6k views

Can windows domain controller be virtualized?

Just the question on the title. There is any problem? Any experience on this?
20
votes
3answers
4k views

How are cached Windows credentials stored on the local machine?

How are cached Active Directory domain credentials stored on a Windows client? Are they stored in the local SAM database, thus making them susceptible to the same rainbow table attacks that local user ...
20
votes
6answers
27k views

Choosing local versus public domain name for Active Directory [duplicate]

What are the pros and cons of choosing a local domain name such as mycompany.local versus a publicly registered domain name such as mycompany.com (assuming that your org has registered the public ...
19
votes
8answers
71k views

Group Policy installation failed error 1274

I'm trying to deploy an MSI via the Group Policy in Active Directory. But these are the errors I'm getting in the System event log after logging in: The assignment of application XStandard from ...
19
votes
5answers
66k views

Finding why a user is locked out in Active Directory

A user's account keeps getting locked out in Active Directory. It's probably caused by an app that's using Windows authentication to connect to SQL Server. Is there a way to find out which app is ...
19
votes
1answer
4k views

Authenticating OpenBSD against Active Directory

Edit: Reformatted this as Q&A. If anyone can change this from Community Wiki to a typical question, that's probably more appropriate as well. How can I authenticate OpenBSD against Active ...
18
votes
2answers
5k views

What is Group Policy and how does it work?

This is a Canonical Question about Active Directory Group Policy Basics What is Group Policy? How does it work and why should I use it? Note: This is a Question & Answer to new ...
18
votes
2answers
7k views

Setting Mercurial with Active Directory authentication and authorisation

I am evaluating the possibilities of moving my organisation to Mercurial, however I am stumbling on two basic requirements which I can't find proper pointers to. How do I set up Mercurial's central ...
18
votes
3answers
599 views

How do I delete this orphaned Active Directory computer object (preferably with PowerShell)?

I'm working from a Windows 7 workstation, with PowerShell v2.0, and trying to delete a particular (orphaned?) object from the LostAndFound container in a 2008 R2 FL forest and domain with the Active ...
17
votes
6answers
53k views

last time an AD user has logged in?

I've noticed that we have in Active Directory more users than the company has actual employees. Is there a simple way to check multiple Active Directory accounts and see if there are any accounts that ...
17
votes
3answers
27k views

Any difference between DOMAIN\username and username@domain.local?

I'm trying to troubleshoot an obscure authentication error and need some background information. Is there any difference between how Windows (and programs like Outlook) process DOMAIN\username and ...
16
votes
12answers
13k views

Is there an equivalent of SU for Windows

Is there a way (when logged in as an administrator, or as a member of the administrators group) to masquerade as a non-privileged user? Especially in an AD environment. e.g., in the Unix world I ...
16
votes
4answers
59k views

How to create Active Directory user account with powershell

I am constantly setting up research and development environments that require active directory accounts. Since we place these environments in isloated networks each environment needs its own active ...
16
votes
1answer
20k views
16
votes
4answers
3k views

PowerShell Script to find AD users with adminCount > 0

I've recently discovered the "adminSDHolder" feature of Active Directory. I need a quick way to identify all users who will be affected by it, namely a script to dump the user accounts.
16
votes
3answers
12k views

How do you manage Java in your Windows/Active Directory environment?

Like I suppose a lot of people, we have a Windows/Active Directory environment and a lot of internal line of business apps that require Java. Our experience is that Java does not play nice in such a ...
15
votes
11answers
93k views

Best way to find the computer a user last logged on from?

I am hoping that somewhere in Active Directory the "last logged on from [computer]" is written/stored, or there is a log I can parse out? The purpose of wanting to know the last PC logged on from is ...
15
votes
4answers
147k views

How to find time server in a domain?

In a Windows domain PDC isn't necessarily the domain time server. How could I identify the authoritative time server?
15
votes
4answers
20k views

How can I determine my user account's OU in a Windows domain?

Is there any way (short of getting an active directory browser) to view my OU while logged in to the domain?
15
votes
3answers
2k views

Naming a new Active Directory forest - why is split-horizon DNS not recommended?

Hopefully, we all know what the recommendations for naming an Active Directory forest are, and they're pretty simple. Namely, it can be summed up in a single sentence. Use a subdomain of an ...
15
votes
4answers
1k views

Common wisdom about Active Directory authentication for Linux Servers?

What is the common wisdom in 2014 about Active Directory authentication/integration for Linux servers and modern Windows Server operating systems (CentOS/RHEL-focused)? Over the years since my first ...
15
votes
5answers
3k views

Mercurial (hg) with active directory

Can I setup Mercurial to authenticate users on Active Directory? In my case, hg can run on Windows, Linux or FreeBSD, but I need to use AD users. Note: if it is possible, then please point me to a ...
15
votes
2answers
1k views

How to properly remove lingering objects when -strict has been set on a large number of DCs for a long time?

I was recently in an environment where there were 120 domain controllers in over 100 sites around the world. This domain began in the Windows 2000 era and was upgraded over time, so strict replication ...
14
votes
3answers
562 views

Active Directory Virtualization

My company is looking to try and virtualize all our servers, and we are trying to figure out if virtualizing active directory is a good idea. Is it even something that can be done, and if so are ...
14
votes
6answers
13k views

Active Directory vs OpenLDAP

This is for a small company (12 developers) who haven't implemented any centralized user database - they've grown organically and just created accounts on computers as they needed. From a management ...
14
votes
3answers
945 views

Clean up Active Directory [closed]

Does anybody know of any useful Tools for cleaning out Active Directory on a Server 2003 domain? I want to clean up old computers, etc, and prefer a free tool. I have a lot of devices that I know ...
14
votes
2answers
7k views

How does a client system in an Active Directory network find in which site it resides?

As I was putting together a presentation for beginning Windows administration, I was struck with a question that I'm amazed I haven't asked sooner. I know that: AD is logically setup in sites to ...
14
votes
1answer
14k views

What needs to be done after a Domain Controller crash?

Assuming that at least two domain controllers were present in the domain to start with, what steps need to be taken to make Active Directory healthy after a domain controller crash?
14
votes
3answers
5k views

Removing old computers on a domain

The Windows Domain I manage has hundreds of computer names which I don't recognise and I'd like to remove old ones which aren't in use before trying to track down the misnamed ones. Is there someway ...
14
votes
5answers
901 views

Windows 2008 R2 AD servers on fanless flash based systems

We have a number of branch offices where having an AD/DNS server would make a big difference to user experience. The following characteristics apply: There is no air conditioned server room, and no ...
14
votes
1answer
15k views

How is DNS related to Active Directory and what are some common configurations that I should be aware of?

Please note that I do know the answer to this and have provided one below. I see a lot of newer systems administrators that don't understand the contents of my answer, so I hope that all of the ...
14
votes
3answers
32k views

Getting Squid to authenticate with kerberos and Windows 2008/2003/7/XP

This is something I setup recently and was quite a big pain. My environment was getting squid to authenticate a Windows 7 client against a Windows 2008 Server invisibly. NTLM is not really an ...