Hot answers tagged

29

You probably already know this, but bear with me. Computers have passwords in AD, just like users. We don't know our computer's password, and it changes regularly via built-in logic. The short answer is that the computer's password is no longer valid, and therefore AD doesn't trust this machine for logins any more. Why? How? Lots of things cause ...


13

The main implication of enabling this feature is that it will increase the size of your DIT. (Your database.) It tends to increase the size because objects that have been deleted hang around longer than they would without the AD Recycle Bin enabled. ...


12

I think the only reason it's not enabled by default is because in order to use it the AD Forest function level needs to be raised (minimum 2008 R2) and it's this particular piece of administration that requires all of the preparation - that is, if the domain was created on NT or 2003 for example, then you won;t be able to enable it until the forest function ...


7

Extending on Katherine's answer: A workstation will lose trust with the domain controller if its account has been overwritten. It is entirely possible (with the right permissions) to add a computer with a name that already exists in the domain, but this will cause the computer that was previously known as that name to lose trust with the Domain Controller.


7

There are two components required for users to log on to a server via RDP: User Rights and Permissions. Rights: Users must have the "Allow logon through Remote Desktop Services" user right. Permissions: Users must have the "User Access" and "Guest Access" permission set to Allow on the RDP-Tcp protocol. By default, users or groups in the local Remote ...


5

Groups are a different kind of object from users, so differentiating them is already possible, even easy. Built-in accounts are usually left in the Users container, while user accounts and service accounts are typically sorted into separate OUs either under the Users container or outside of the Users container. Either way, sorting by OU would be a visual ...


5

Using get-ADServiceAccount there is an attribute for hostComputers: Get-ADServiceAccount -Filter {HostComputers -eq "CN=SQL-Server-1, DC=contoso,DC=com" } Enabled : True Name : service1 UserPrincipalName : SamAccountName : service1$ ObjectClass : msDS-ManagedServiceAccount SID : S-1-5-21-159507390-2980359153-3438059098-29770 ...


5

In ADSIEDIT: Configuration [.contoso.com] ◦CN=Configuration,DC=contoso,DC=com ◦CN=Services ◦CN=Microsoft Exchange ◦CN=OrganizationName ◦CN=Address Lists Container ◦CN=All Global Address Lists Reference


5

You've fallen victim to a bad decision made by whoever set up your AD environment internally. More discussion here. Windows Active Directory naming best practices? But the gist is that internally, your AD owns the name example.com in DNS. That name will always and forever (unless you rename the domain) point to your domain controllers. So the only way to ...


4

This answer falls into your 2nd option of querying the username from AD. If you're open to a powershell solution you have a few options. Your situation feels like you want to do this from each users workstation, and PS AD Module may not always be available across those targets. In that case you can get the same info like this: ...


3

Assuming you have not granted the Everyone object access to any resources, you can just make a local account on the computer(s) that the guest will use. They log on to the computer(s) with that account, and they have not even logged on to the domain, so by default they have no access to any domain resources. If you must use a domain account, create a brand ...


3

You can look at the Event Viewer, if you want to check manually. Under Windows Logs > Security you can see both successful and failed logins and you can see logouts. See the Task Category column in the screen capture. . You could write some PowerShell code or .NET / WMI code to pull relevant "most recent" items across multiple servers if you have WinRM ...


3

BGInfo supports the following for defining custom variables: First thing that comes to mind would be to define a logon script for the user first. Something that finds the expiration date and then writes it to a file on the local computer: $Searcher = New-Object System.DirectoryServices.DirectorySearcher $Searcher.Filter = ...


3

Sure. It's not really reccomended to run anything else on the DC apart from the Domain Controller and DNS/DHCP Roles, but it's certainly doable. Install the AD Doman Controller role first, then Windows Deployment services. Note: As you've tagged this with both Server 2008 and 2012 it's worth mentioning that Windows Deployment Services on Windows Server 2012 ...


3

I have experienced a similar problems two months ago, this thread may be helpful to you. I would first check if this happens for all files or only files that are owned by the user (change the owner to see if it still persists), as suggested by Daniel. I would then try to set the permissions as described in the other thread, but using the detailed ...


2

A reason can be clock drift. If the workstation clock drifts more than 5 minutes away from the server's, it will lose connection to the Domain. This may come from flaky hardware, or when the system is powered off for quite a long time, or sometimes when a laptop is often away from the network, etc.


2

The 'why' is that in Microsoft Windows 2003 they extended their directory implementation to include forcing workstations to reset their passwords every 30 days or so. I know it well, it broke a lot of SAMBA installs I was maintaining at the time. Normally this password reset is all automatic, but I've seen many, many cases when this design just doesnt ...


2

The AD computer password process (documented here) hasn't changed much and is certainly not the root cause of broken schannel issues. (in fact it's the CLIENT that changes the password and the password is exempt from the password expiration policy. Now depending on the client OS is where things get interesting. 1 reason for lockout is XP. If it's XP and ...


2

The other way would be to use ADUC and reset the computer account (if it just got out of sync with the domain) simply right-click the computer name and choose "Reset Account" (about 80% of the time this will fix your issue).


2

@Sentator14 was on the right track, but not quite there. Your problem is that there is no such thing as a local Administrators group on domain controllers. When a DC is promoted, the local SAM database goes away and AD becomes the only source of users and groups. So by configuring a group policy to add a group to the Administrators group on a DC, you are ...


2

Looks like this is a bug with Microsoft AD and Guest Account, fix is disabling the guest account. Guest Accounts on AD Server


2

This is because your CA is Standalone CA type, not Enterprise. In Microsoft terminology, Standalone CA is literally standalone. It doesn't require Active Directory or network connections at all. As the result, Standalone CA requires certificate information to be placed in the request and doesn't offer enhanced enterprise-level features. This CA type is best ...


2

If the guest user account is an Active Directory account, why don't you go to the user account in Active Directory, go to Properties, go to the Account Tab, Click the Log On To... button, and enter the names of the computers you are going to allow the guest user to logon to? Todd's points should also be considered before you decide how to implement this. If ...


2

In addition to @Todd Wilcox's excellent answer, I'd like to add the idea of a naming convention for the objects in AD. Certain aspects of the "attributes" you want to create for the users/groups can be inherently applied by having a very strong naming convention for objects and infrastructure, and not deviating from it. Users Regular user names should be ...


2

Most of the environments I've worked in don't do this with attributes on accounts. They do it via OU organization and/or naming standards. A simplified example might be: (domain root) All Accounts Humans Shared Accounts Service Accounts You can sub-divide the different account types if it makes sense. But most of the time, group memberships are ...


2

For the zone in question run the following command: dnscmd /zoneinfo foobar.com You will get the result like this: Zone query result: Zone info: ptr = 0000000000327C90 zone name = foobar.com ~snip~ zone DN = DC=fopobar.com,cn=MicrosoftDNS,DC=DomainDnsZones,DC=foobar,DC=com ...


2

The domain Remote Desktop Users group is for granting access to your Domain Controllers, not your RDS servers. You need to add your domain users and/or groups to the local Remote Desktop Users group on each of your RDS servers. This article was written for Windows Server 2003 but is applicable as it relates to the usage and purpose of the domain Remote ...


2

There are 2 possibilities, DNS issues or firewall issues. Try changing the domain firewall on the new DC. If that fails make sure the new forest resolves properly from the old PDC emulator.


2

AD Trusts don't have any direct relationship to networks or subnets. Your problem is more than likely due to a lack of Conditional Forwarders or Stub Zones on one side of the proposed Trust. In each domain you need to configure Conditional Forwarders or Stub Zones) for the other domain that directs DNS queries for that domain to the DNS servers for that ...


2

I don't know the details of your application, but it sounds to me like it is not compatible with Active Directory. Read the public documentation for ADS_NAME_TYPE_ENUM. Those are the login name formats that you are allowed to log in with. "EXT123456" is not one of them. I know that you think "EXT123456" is logging in with a sAMAccountName, but it actually ...



Only top voted, non community-wiki answers of a minimum length are eligible