Questions tagged [active-directory]
A Microsoft technology that constitutes an LDAP directory service with centralized management functionality for user accounts, computer accounts, groups, and configuration management across many Windows servers and desktops.
10,226
questions
1
vote
0
answers
27
views
Krb5LoginModule accepts ANY password for a valid user
Our jaas.config reads simply:
Our_Kerberos {
com.sun.security.auth.module.Krb5LoginModule REQUIRED
useTicketCache=false
refreshKrb5Config=true;
};
The earlier ...
- 2,387
-1
votes
0
answers
24
views
Change the default download location from C drive to R drive for all apps
We have implemented a policy to lock the C drive for all users. We have created a new partition using a PowerShell script.
The issue is that when the C drive is locked, users are unable to save files ...
- 1
0
votes
1
answer
14
views
How to install Windows LAPS schema extensions on AWS Directory Services AD?
I would like to use Windows LAPS to manage local admin account passwords for Windows servers part of an active directory domain hosted by AWS Directory Services. The Update-LapsADSchema PowerShell ...
- 101
0
votes
0
answers
16
views
Outlook not using profile photo in AD for some users
We recently took new profile pictures of our employees. We uploaded these to Active Directory (using cjwdev's Ad Photo Edit Free Edition tool). This has worked for most users (and we've been using for ...
- 273
0
votes
1
answer
87
views
SYSTEM account of domain controller does not have permissions to change password of domain user
Have some software that runs as the SYSTEM account on the domain controller of an Active Directory. Part of what the software does is change passwords of select accounts at pre-determined intervals ...
0
votes
2
answers
70
views
Group Policy not applied: access denied
I created a new AD security group, added all users i need. Within our GPO "FolderRedirection" in the security filter tab, I removed Authenticated Users and added the new AD security group ...
lkswtf
0
votes
0
answers
53
views
Transfer FSMO roles back to domain controller that the roles were seized from
Our domain controller failed, and we seized the FSMO roles on a new DC.
However, while creating the new DC, it was unable complete replication with another DC, due to issues falling to replicate with ...
1
vote
2
answers
49
views
Why does Active Directory Certificate Services require Remote Registry Service?
I'm setting up a two-tier certificate authority using Active Directory Certificate Services. The offline air-gapped root certificate authority was easy to set up and get going. The intermediate ...
1
vote
1
answer
26
views
How to reenroll certificate on behalf of someone else? Windows Certification Authority
I have Windows Server 2022 CA with a configured Enrollment Agent.
I can enroll new certificate on behalf of another user but I can't do the same with renewing it, while logged on as the Enrollment ...
- 19
0
votes
1
answer
36
views
Adding a 2nd existing domain to active directory?
TLDR, we just purchased another company and we are trying to add their existing (we'll say @apple.com) domain to our active directory (@paper.com), and have users created their and we can then ...
0
votes
0
answers
15
views
AD RMS unable to select existing certificate during configuration
I am having problems configuring AD RMS. I have imported a certificate on the machine, but the wizard cannot locate it.
The certificate I have is not renewed, but I think I should still be able to see ...
-1
votes
1
answer
102
views
Windows Server AD: How can I keep userdata off of the local computer?
I would like to get Roaming Profiles to delete the user profile once they log off. How could I get this working as I don't want any userdata stored on the local pc (i.e. having 20 different AD user ...
0
votes
0
answers
40
views
The Object name has bad syntax when trying to bulk add AD users using Powershell
I'm attempting to add a series of User to AD by importing a csv file and I can't seem to get it to run successfully, the error always reads 'the object name has bad syntax' however no matter what kind ...
0
votes
0
answers
21
views
What determines which server set-aduser connects to?
I was wondering this as I used it to create a user. Get-ADuser could see it straight after. Next I used Get-ADDomainController to presumably see what AD Set-ADuser created it on. However when I went ...
- 213
0
votes
1
answer
71
views
Creating a computer account in AD using PowerShell
I want to create a new computer object in an AD domain.
Below is the script I am using. Can someone tell where should create credential object for SRV1? In domain controller or in computer? If ...
- 1
0
votes
0
answers
70
views
How to create a Service Principal Name (SPN) for an AWS RDS-managed SQL Server instance computer object in AD?
We are using AWS RDS for SQL Server, an AWS managed service. We joined our RDS to our self-managed AD:
We found the Active Directory Service Principal Name (SPN) for the RDS-managed-service database ...
0
votes
0
answers
46
views
Grant permission to user on AD for installing only drivers
I need to grant permission to one user to install only drivers.
Is there such an option? Or another option to grant permission?
0
votes
2
answers
49
views
AD Users sharing a Home Folder/Profile
I'm facing a unique challenge.
As part of our transition to a new Active Directory Domain, we must ensure compliance by assigning each user a unique User Account identified by their name.surname
Given ...
- 113
-2
votes
0
answers
89
views
Domain SRV records in DNS
I am configuring an Active Directory domain in an air-gapped network on Windows Server 2016. I can ping my DC and I am in the same subnet, pulling DHCP from the router, while the DC IPv4 is static.
I ...
-2
votes
1
answer
23
views
Deploy Termius software with Active Directory Group Policy, which includes pre-login settings using a shared account
I want to deploy Termius software with Active Directory's Group Policy.
The software requires pre-login settings using a shared account.
How can we do that?
-1
votes
0
answers
38
views
Same GPOs inside OU
I have two GPO inside the same OU that are target of two different groups (auth users and another group of my choice). The issue is that they do the opposite:
One GPO is set to enabled while the other ...
0
votes
2
answers
117
views
Do Windows domain builtin groups grant the same permissions as the equivalent machine builtin groups? (eg, Performance Monitor Users)
I am developing a Windows service that uses PDH to query some performance counter data.
It is necessary for the service to by run by another user (ie, not the all-powerful SYSTEM).
I am aware that the ...
- 105
0
votes
1
answer
88
views
Windows Kerberos authentication and network protocols/ports
Got the following question. I have a windows forest A with a root domain A. A web server in domain A has a proper setup SPN. A user comes from another forest/domain, where a 2way transitive forest ...
- 21
0
votes
1
answer
50
views
Can I delete parent DNS zone of AD domain
We currently have a single AD domain internal.mycompany.com
There are currently 2 independent authoritative copies of the parent DNS zone mycompany.com. One copy is managed by the domain controller, ...
- 1
0
votes
0
answers
28
views
ADFS Single Logout both OAuth/OpenID and SAML federated clients
I am trying to set up ADFS as a single sign-on identity provider for various apps. Some of these apps work with only SAML identity providers while others only work with OAuth/OpenID.
It seems like I ...
- 113
0
votes
0
answers
99
views
troubleshooting radius auth with okta and AD
I am running Amazon Workspaces, and wish to use RADIUS based MFA for login. MFA would be provided by Okta.
I have an AWS Managed AD with AD Connector connected to it. (I assume this is redundant, but ...
- 103
-1
votes
2
answers
169
views
How to resolve "Unable to obtain DNS hostname of Active Directory domain controller with ntdsa object name...."
It starts as a programming problem:
Domain.GetCurrentDomain().DomainControllers
triggers an exception:
Unable to obtain DNS hostname of Active Directory domain controller
with ntdsa object name &...
- 163
-1
votes
1
answer
103
views
Trusts - Active Directory - 0xc000019b
So I'am getting the follow error when try validate the trust between to active directory (on internal, other external)
The outgoing trust was successfully validated.
The secure channel (SC) reset on ...
- 1
0
votes
1
answer
66
views
Microsoft Active Directory Administrator privileges [closed]
We have a problem:
all our developers have full admin rights on their computers.
I set up a group called "Local administrators" through a GPO policy, which includes all domain users (...
- 7
0
votes
1
answer
263
views
Domain Admin account unable to access AD server both locally and via RDP
I am experiencing an issue with our "Primary" domain admin account whereby I am unable to connect to the AD, using this account. I am aware that this is not best practice as we normally use ...
- 1
0
votes
0
answers
68
views
Unable to logon using RDP after domain migration
We have issues after migrating a DC to a new DC.
When we attempt to RDP to some of our VMs using the DNS name, it fails. Using the IP address works.
This issue only occurs on some VMs.
It seems to be ...
- 1
0
votes
0
answers
152
views
Ubuntu/sssd/Active Directory suddenly broke
Windows Server 2022 domain controller, Ubuntu 22.04, sssd 2.6.3. System joined to AD via 'realm join'.
/etc/sssd/sssd.conf:
[sssd]
domains = dev.domain.com
config_file_version = 2
services = nss, pam, ...
0
votes
0
answers
115
views
Error demoting Server 2008 R2 domain controller
I have a domain that is at functional level 2008 R2 running on a 2008 R2 DC.
joined a new 2019 server to the domain
added AD services role to the 2019 server
migrated FRS to DFSR on 2008 R2
promoted ...
- 143
0
votes
2
answers
387
views
Test-ComputerSecureChannel - Logon failure: unknown user name or bad password
I restored a Win7 image that I know will be out of date. I then run as administrator powershell from an account that is a member of the local machine administrator group.
All I get is:
Test-...
- 101
0
votes
2
answers
113
views
Computer can't join AD over point-to-site VPN to domain controller VM in Azure
Error indicates DNS problem but all diagnostics indicate it is working fine.
The following error occurred when DNS was queried for the service
location (SRV) resource record used to locate an Active ...
- 1
1
vote
2
answers
126
views
Windows external domain trust Kerberos authentication on Power BI and external data sources, how?
Power BI Reporting Services in Forest1-DomainA (location F1-A).
User accounts are in Forest2-DomainA (location F2-A).
F1-A trusts F2-A. The VDI/RDS where the users login are in F1-A, the service is in ...
- 21
1
vote
2
answers
268
views
Upgrading single Domain Controller server from 2008R2 to server 2019
We have a client with a very old active directory environment on Windows Server 2008 R2. We are going to replace it with a new server and would like to upgrade the existing server to keep all of the ...
- 143
0
votes
0
answers
95
views
Trust Relationship between this Workstation and the Primary Domain failed, but 4624 events are present
User got this error when user tried to login to his workstation.
Usually this means that computer account password in AD and on the actual workstation is out of sync for some reason. According to ...
- 301
1
vote
1
answer
287
views
How to enable Kerberos authentication with a specific user when disabling RC4_HMAC_MD5 encryption type?
I have a problem and I hope some of you stumbled on the same problem and solved it.
I have two accounts on a specific domain (let's say account A and account B).
When I have RC4_HMAC_MD5 encryption ...
- 13
0
votes
1
answer
103
views
Active Directory Account Operator Modifying Groups Which Inherit Privileged Groups
In Active Directory, if a member of the Account Operators group, by default, is possible to add myself to a group which is a member of the Domain Admins group?
For instance, I have a group named Tier ...
sunflower
0
votes
1
answer
178
views
Cross-realm Kerberos/SPNEGO configuration with multiple domain controllers and multiple application servers
I am currently struggling to scale my one-to-one simple Kerberos/SPNEGO configuration for multi-server environment and looking for some help.
Let's say
I have two Active Directory domains and two ...
- 1
-1
votes
1
answer
164
views
How to stop/break replication between 2 domain controllers that are in same domain? [closed]
So I was attempting to break replication between 2 domain controllers by editing objects in AD, since I cant just go to powershell and stop it with command, but it was unsuccessfully. I have to stop ...
0
votes
0
answers
26
views
Unbind from unknown Active Directory domain
Please let me preface, I have no experience with Active Directory.
I am attempting to unbind my Mac devices from and I’m not 100% clear if their both bound to directory services through Mac as well as ...
-1
votes
1
answer
118
views
Only Administrators can logon through Remote Desktop Services
I have a domain with 3 VM's: domain controller, workstation and application server. RDP connections to the workstation were working fine until I installed license server (we need more CALs) and remote ...
- 1
0
votes
0
answers
76
views
Add a new Subordinate CA on a single ROOT CA environment
I'll have an ROOT CA that is already joined to an Active Directory, this one has been serving certificates to the Joined Computers.
Now we want to add a subordinate/intermediate CA to deploy new ...
- 105
0
votes
2
answers
331
views
How to export Microsoft 365 group owners from local PowerShell script
My company uses Microsoft 365. When I go to admin.microsoft.com, I can see "Teams & groups > Active teams & groups" as navigation item.
Opening one of the groups in the side panel,...
- 111
0
votes
0
answers
45
views
FreeRadius EAP-TLS Auth using Email Address
We have a requirement to authenticate devices to WIFI using the user's email address stored in AD. The devices are enrolled into InTune and the only shared piece of information is the email address.
...
1
vote
1
answer
149
views
Combining OpenLDAP and Active Directory via OpenLDAP meta backend
We have an application that used to authenticate via our Atlassian Crowd instance, but after a major rewrite that authentication source is not available anymore. Now I need a solution to authenticate ...
- 25.1k
-1
votes
1
answer
322
views
Members of "Remote Desktop Users" group cannot logon to Windows Server 2019 domain controller
I installed a Windows 2019 domain controller. I added a user to the Remote Desktop Users group. The user cannot logon to the server, unless I add them to the Administrators group.
All I see in other ...
- 129
0
votes
0
answers
48
views
Roaming profiles: synchronization at logon mixing up timestamps?
In our Active Directory with roaming profiles I see frequent Events with Id 69 in log "Microsoft-Windows-User Profile Service/Operational".
These events warn about NTUSER.DAT not being ...
- 1