3
votes
1answer
35 views

recomended order for changing AD groups?

I have a number of domain local resource groups that need: a) to be changed into Universal groups. b) renamed. c) have the users of their member groups collapsed into this group itself. d) remove the ...
1
vote
1answer
53 views

Can I add a local linux user to a supplementary active directory group?

The Linux box in question is a CentOS 6.5 machine that is bound to active directory. I can change a local user's primary group to an active directory group. But i can't add the active directory group ...
5
votes
1answer
59 views

Granting Domain Admin privileges to a cross-forest user account?

Does anyone know of a way to [effectively] have a user or group in one forest acquire the privileges of the Domain Admin group in another forest? The obvious approach of adding Domain ...
4
votes
1answer
95 views

PowerShell DSC Group Resource - “Could not find a principal with the provided name”

I am trying to use PowerShell DSC to add a domain group to the local administrators group. Here is the code: Configuration TestSetup { Node localhost { Group Administrators { ...
0
votes
2answers
26 views

Migrating server local groups (currently workgroup) to domain?

I have about ~30 workstations that I administer, plus a fileserver, all of which I inherited when I took this net admin job. The previous guy had been around forever from when the company was far ...
3
votes
1answer
59 views

How can a set a Security Group's email address using PowerShell?

I need to create many groups with email addresses. I would prefer to use Security Groups to reduce the number of groups we have to maintain, otherwise we'd have an identical Distribution Group for ...
1
vote
0answers
62 views

User's membership in active directory group not showing through powerbroker

We're using Powerbroker open (Version 7.1) to authenticate Active Directory users into our Oracle linux (V6.4) (servers. I have a user "Joe Blow", who was added to the Active Directory group, ...
1
vote
2answers
41 views

Group permissions (seemingly) ignored on Win2k3 fileserver

After 10+ years having our AD setup "one way," I'm looking at the permission structure and realized that our business has in fact changed enough to where we should match our current state rather than ...
2
votes
1answer
4k views

List All Groups and Their Members with PowerShell on Win2008r2

I am new to powershell, but I've been reading manuals and practiced a little bit. My objective is to List all users in all Security Groups under specified path. I have found the way to do it: ...
1
vote
1answer
57 views

Permissions to set on user to read from Active Directory only

I have to setup user accounts for applications to use to get a list of users and group memberships from our domain. As such, I'd like these applications to use credentials for user accounts with bare ...
9
votes
2answers
337 views

Temporary membership to AD group

We restrict the running of exe's across the organization. But based on justifications & approvals we add users to (specific) AD groups for 24 hours. Currently the process of removing the users ...
-1
votes
1answer
60 views

Purpose of primary group [closed]

Why do we need a primary group for users? Why is it mandatory to the users to have a primary group?
0
votes
1answer
63 views

Tips on organizing Active Directory for a global company with different departments [closed]

I have started to read and implement some of the basic domain architecture implementation, one of the question I have is what is the latest trend in organizing the active directory OU's, Groups and ...
2
votes
2answers
81 views

How to make Groups as not readable to Users in AD

We are using taskpads to delegete tasks(such as reset password) to remote admins; the delegation is done at the OU level ; but unfortunately OU contains some special accounts/groups(such as ...
2
votes
3answers
398 views

Automatically add ActiveSync users to AD group?

Is there a way that, upon first successful sync via ActiveSync, a user could be added to an Active Directory group?
1
vote
2answers
277 views

Security Group vs Distribution Group

Within our AD set-up there are a lot of security groups, but only 1 distribution group (that a previous admin created). Both types of group contain lists of domain objects (users in the one I was ...
0
votes
2answers
99 views

Logging into Linux server gives users 'domain users' for default group can it be changed?

I recently attached a RHEL 5 test box to our active directory server to try and get all of our users to not have to remember so many passowrds. I'm using winbind and samba and everything seems to be ...
3
votes
1answer
373 views

Dynamic group membership to work around no nested security group support for Active Directory

My problem is that I have a number of network administration applications like SAN switches that do not support nested groups from Active Directory Domain Services (AD DS). These legacy administration ...
0
votes
2answers
280 views

pam auth via winbind, howto map primary group for users?

I have unix users authenticating to an PDC (via winbind) and want to have the primary group of those users a local unix group (e.g. www-data). users have the group "domain users" with gid 10006 (as ...
0
votes
1answer
397 views

Determine local group membership of an AD user?

I have several local groups on a Server 2008 instance. In this group are several members from our AD domain. Is there a way to determine all of the local groups a given AD domain user belongs to by ...
2
votes
2answers
1k views

How to Lock Down an Active Directory Remote Desktop User

Please advise me on how I can ensure that remote desktop users cannot install software onto the Active Directory Server they are logging into remotely. Some Background: I have a client whose Server ...
3
votes
1answer
175 views

Can active directory GPO's apply to a group object?

I know I can set up an OU, move user objects in to it, and link a GPO to that OU and that GPO will apply to those users. Is it possible to set up an OU, move a group in to the OU, and have a linked ...
1
vote
0answers
243 views

Force AD Security Group Changes to Appear in Exchange

I made changed to security groups within AD, and when I go to the GAL in Outlook I noticed that the changes were not reflected, even after forcing an update by clicking Send Receive | Send Receive ...
0
votes
0answers
221 views

How to grant NetworkService access to a share by placing computers in security groups

I'm trying to configure a file share that will be accessed by ASP.Net applications on a set of computers, all running under the NETWORKSERVICE account on those computers. I can get it to work fine ...
0
votes
1answer
537 views

Inconsistent information in Active Directory Members and Member Of properties

I'm trying to get a list of the members of a group in Active Directory. I'm using LDAP queries, but I think that's not relevant. I've found what I believe to be an inconsistency in Active Directory's ...
0
votes
1answer
194 views

Active Directory / ADAM Group Name Uniqueness

Can I have 2 different groups in Active Directory in different containers that have the same name? For example, can I have an OU=baz that contains a group CN=foo and an OU=bar with a group CN=foo? ...
3
votes
3answers
1k views

What are the consequences of an AD group that has as its member a group, that is already a member (Cyclic references)

I have been looking at an Active Directory that has several thousand groups, where pairs of groups are members of each other. GroupA has GroupB as a Member. GroupB has GroupA as a Member. Oy. I am ...
2
votes
3answers
1k views

Assign log on as local admin to domain account

What I would like to do is grant permission for a domain account to log on to any server/workstation and be a local administrator with having to add this account to domain admin group? This account ...
2
votes
3answers
108 views

Machine/Computer Groups in Active Directory

I was curious when a person should use Machine Groups within Active Directory? What are the common uses cases for them? How does one keep them up to date as machines are shuffled by a multi-tiered ...
0
votes
3answers
257 views

is there a good tool for viewing the permissions in AD?

I want to be able to see a nice picture of nested groups in AD. Are there any products that do that for me?
1
vote
1answer
870 views

Find orphaned foreign security principals and remove them from groups

We have a Windows 2008 R2 Domain with multiple outgoing trusts. In this domain we add the users from the trusted domains to domain local security groups. It seems that some or all deleted accounts ...
5
votes
1answer
2k views

Prevent user “click-expansion” of Exchange distribution group?

I am a Unix guy who recently picked up powershell to help my Exchange admin coworkers implement a challenging project in Exchange 2010. (The requirements we've been given are challenging if not ...
0
votes
1answer
64 views

How to create special groups and give them special process

I have many admins on the network and I want to specify job for them for example I want to create group responsible for install and run yahoo messenger means I don't want to give them full admin ...
1
vote
2answers
5k views

Jenkins/Hudson - LDAP group *lookup* does not work

I'm trying to get Jenkins to authenticate users via our active directory groups. If I insert users they are correctly looked up. If I insert group names, they are not found. Edit: Through trial ...
1
vote
3answers
2k views

Managing Active Directory Group Membership with a Non-Administrator Account In Server 2008

I am running Server 2008 R2 in an Active Directory Domain Environment. I have created a group in Active Directory and I have delegated management authority to that group to a user. I want this user ...
3
votes
3answers
2k views

How do you discover what permissions an AD group has, if you have no documentation?

You just got hired at company A and the old administrator is no longer there. Requests start coming through for adding users to the internet restrict group. When you look at the groups none of the ...
3
votes
3answers
945 views

Active Directory Bulk Group Edit

Is there a way to update the "Managed By" field for every group in Active Directory? I would also need to check "Manager can update membership list" also.
4
votes
1answer
1k views

Linux computer (Debian) in a Windows Active Directory Domain, Administrator of AD should have root permission after login

I managed to join my Debian machine (Squeeze) to an existing Active Directory (MS Windows 2008 R2 Server). Everything works fine, I can login using accounts from the Active Directory (NTP, Kerberos, ...
0
votes
2answers
3k views

How do I enable group enumeration on a Linux server that is using LDAP to connect to an AD server?

I've got a set of servers that I need to authenticate against a central Active Directory forest. The AD admins have kindly installed the UNIX AD extensions and the NIS ones as well, so I've got a lot ...
1
vote
1answer
155 views

Planning sysadmin group permissions in Windows network

I need to set up a plan for organizing permissions for sysadmins in a 200-server Windows 2003/2008 network. The servers exist in 5 separate forests that are connected via 2-way trusts. At the moment, ...
1
vote
1answer
122 views

Would the AdminSDHolder security propegation affect group membership?

I'm having an issue where every time I add users to the Enterprise Admin group in AD they are shortly thereafter removed. I have Domain Admin rights. I'm wondering if this has anything to do with ...
0
votes
1answer
193 views

List Groups Common to a set of Users

I need a way to find the set of groups common to a list of users. I have a list of about 4 users I want to compare and find which groups they are all members of. Is there a quick way to do this in ...
1
vote
4answers
9k views

How to add a domain user to the local admin group remotely?

I need to add a domain user in the local administrator group remotly and I have to the local admin password
2
votes
3answers
638 views

Block Active Directory Group

I have a touch-screen machine available to the public running under a domain account. This domain account is a member of an AD group for which I have denied all access at the folder level for our ...
1
vote
2answers
243 views

Using Active Directory Security Groups as Hierarchical Tags

Because active directory security groups can... hold objects regardless of OU. be used for reporting, documentation, inventory, etc. be referenced by automated processes (Get-QADGroupMember). be ...
3
votes
1answer
1k views

Changing a group name in AD, effects?

If I change an AD security group name from "name1" to "name2". Will that effect foldershares that are shared out to the group "name1"? Will it automatically be updated to "name2", or will I get ...
2
votes
4answers
13k views

Domain Admins vs. Administrators in Windows AD DC [closed]

Having read in [1]: "Domain Admins Members of this group have full control of the domain. By default, this group is a member of the Administrators group on all domain controllers, all domain ...
5
votes
3answers
1k views

How can I restrict Windows AD logon to a certain group?

Our organisation has an AD; all users are in the one OU. I administer a section of the users. We have a bunch of computers that I only want to allow logon by users in a particular AD group (i.e. users ...
0
votes
1answer
314 views

Permissions required to look up a domain user's group memberships

I am writing some code to look up the members of particular domain groups. Does the user that this application runs as need any particular permissions on the domain to get this information? ...
1
vote
1answer
3k views

How do I add a domain user to a group on a non-domain server?

If we are running a server that is not attached to the domain, how would I go about adding a domain user to a local group on that server?