1
vote
0answers
17 views

Domain Controller's DNS NIC configuration [duplicate]

I've seen conflicting information on this online, but say you have an environment with two domain controllers: one Forest, one Site, one Domain; simple as it gets. How should each domain controller's ...
24
votes
7answers
2k views

Is it best practices to have separate login for a domain for domain admins?

I typically like to set up separate logins for myself, one with regular user permissions, and a separate one for administrative tasks. For example, if the domain was XXXX, I'd set up a XXXX\bpeikes ...
26
votes
7answers
3k views

Should I expose my Active Directory to the public Internet for remote users?

I have a client whose workforce is comprised entirely of remote employees using a mix of Apple and Windows 7 PCs/laptops. The users don't authenticate against a domain at the moment, but the ...
1
vote
5answers
168 views

Windows network shares organization

I would like to have some feedback about the best practices you use to publish your network share. Now, we have on our file server : one named directory for each of our user, which is backed up ...
15
votes
3answers
631 views

Naming a new Active Directory forest - why is split-horizon DNS not recommended?

Hopefully, we all know what the recommendations for naming an Active Directory forest are, and they're pretty simple. Namely, it can be summed up in a single sentence. Use a subdomain of an ...
1
vote
1answer
76 views

Pre-Staging Computer Accounts

I hear that you can create the computer account in AD before you join the computer to the domain so that the computer immediately gets the right groups and such. I created the account by running ...
3
votes
2answers
106 views

Should i put all my servers into my domain?

I am setting up a lab/mock-up network and i'm wondering if is considered bad practice to add all my servers to my Windows Domain. Of course the DC must be part of the domain, and any server that users ...
1
vote
1answer
120 views

Minimum level of access required for service account to run a scheduled task on server?

We have 2 domain administrator accounts in Active Directory: "Administrator" and "Robocopy". Robocopy is a service account associated with a scheduled task which executes a batch file- which runs ...
3
votes
1answer
166 views

Current Best Practice for using AD to auth Linux (2013)

As far as I'm aware, there are 3 (common) ways to use Active Directory as the Authentication and Authorization for Linux hosts: LDAP Kerberos Samba/Winbind Is there a (current) consensus on which ...
4
votes
3answers
204 views

Keeping Track of Enterprise Desktops [closed]

Part of my job is to make sure that for computers in a specific OU, whats Actually in use = whats listed in AD = whats listed in SCCM. This is for an environment with 250k PCs, but i specifically ...
2
votes
1answer
807 views

Active Directory Domain Controller in Multiple Sites - Server 2012

So I'm not used to setting up DCs in multiple subnets/locations, I was hoping to get some guidance. I'm just messing with virtual servers at the time being. DC1 = Apollo DC2 = Cronos Pre-AD Config ...
7
votes
2answers
759 views

GPO best practices : Security-Group Filtering Versus OU

Good afternoon everyone, I'm quite new to Active Directory stuff. After upgraded Functional level of our AD from 2003 to 2008 R2 (I need it to put fine-grained password policy), I then start to ...
0
votes
0answers
153 views

NTFS Permission Structure to allow Traversal but no Modification except in Leaf Nodes?

Assume there's this folder structure: D:\ --+-- Acctg --+-- Payable | +-- Receivable | +-- Fin --+-- Inv | +-- Tax | +-- Treas | ...
3
votes
2answers
105 views

One active directory server for one geographical site?

we have an 2008 R2 active directory server on our main site. Recently we opened a small secondary site. My question is pretty simple : our 2 sites are connected with a VPN, is it mandatory for us to ...
1
vote
1answer
150 views

Best practice for replacing failing drive in a TWO Domain Controller domain

Hi I have a two domain controller domain and i will refer to them as DC1 and DC2, here is some info on them. DC1 is or has all FMSO roles DC2 serves as another Domain Controller for replication DC1 ...
9
votes
1answer
198 views

What are the best practices for service accounts?

We're running several services in our company using a shared domain account. Unfortunately, the credentials for this account are widely distributed and being used frequently for both service and ...
3
votes
1answer
698 views

Active Directory Split-Zone vs SubDomain Domain Name

Note - I know there are a ton of questions around AD Naming. I do not believe though that this is a duplicate question. If it is please link me to a relevant one :). We are implementing AD. Our big ...
2
votes
1answer
267 views

How should I configure my Active Directory servers so that if one goes down, users are not kicked off SQL?

Today, we shut down one of our Active Directory servers during office hours to check the loading on a UPS. Since all the server did was provide Active Directory in a separate building incase the main ...
1
vote
1answer
78 views

How to avoid namespace conflicts in Active Directory

We are having issues with namespace conflicts. An example: AD security group Network Admins is used by AD-aware applications for access control AD user Network Admins was going to be used for the ...
0
votes
4answers
416 views

Active Directory Design

Please assist me in how I design my active directory hierarchy based on the following. We have a corporate office where there 8-10 departments and 200+ <250 users are present. We have two ...
0
votes
2answers
291 views

EDB repair in SBS exchange 2003

One week before in our HP PROLIANT ML370 G5 server with RAID5 one hard disk turned amber and we removed and it is working under degraded state until now. Yesterday morning our users in the domain ...
1
vote
1answer
207 views

dns settings for SERVER 2003 domain controllers for a new client of mine

I have recently taken over a new client in a windows server 2003 domain environment. The only issue i see with the setup is that the second domain controller's dns entries might be wrong, hence why i ...
3
votes
2answers
971 views

things to check prior to moving all FSMO roles to a new domain controller before decommission original old domain controller

need to move a domain controller, the first in the forest that holds all the fsmo roles, to another location in a clients building. it will require turning off this dc, call it dc1 for this question. ...
1
vote
1answer
513 views

How to rename a mail-enabled security group?

I work in an organization that is prone to frequently renaming teams. What is the best way to manage name changes to mail-enabled security groups? So far, I have just been using the ADUC GUI on our ...
3
votes
2answers
2k views

How can I check access of a Group/User in AD before I delete it?

I'm cleaning up an inherited domain that is not well documented. How can I check that a particular group or user has no ACEs across the AD? Things like searching DACL/SACL for AD objects and file ...
0
votes
3answers
154 views

Top Infected Machines - Dealing with Threats?

I printed out a list of the top 25 infected machines (associate machines only) a bit of detail. Associate machines are only for sales associate. The domain login is the same for every machine, ...
6
votes
4answers
322 views

Is it better to map drives and printers to users or computers?

I've posted a few "best practices" questions like this. Question says it all. Current practice is to map the drives and install the printers on the computer for each user/computer combination. I'd ...