Tag Info

Hot answers tagged

5

It adds support for the new ms-DS-Member-Transitive (LDAP display name msds-memberTransitive) schema attribute. This attribute contains the contents of the Member attribute for the object and all the Member attributes of those objects in the Member attribute (and objects specified in their Member attribute). Basically, it contains the fully-expanded group ...


4

As you've already found and stated in your question, the attribute is limited to 20 characters (MSDN article). This is for backwards compatibility. Active Directory itself is imposing this restriction therefore you can't override it programmatically.


4

I bumped into this (old) question while looking for something else, but I will add an answer for anyone that ends up here actually looking for an answer... An option you can use (assuming you have a least a 2008 level AD domain) is to apply a password policy with your required "lighter" settings specifically against the server(s) you have hosting ADLDS. ...


4

No - it is not achievable The premise for "running" Active Directory Domain Services is a Domain Controller - a server role only available in Windows Server, not in the client editions of Windows


3

The 'container' class is for AD folders that aren't OUs, e.g. the automatically created 'Users' folder. the 'group' class is for Security or Distribution groups that can have users, computers, or other groups as members. An object being inside a container affects it's DN. If I put a user with a CN of 'jdoe' in the 'Users' folder, it's DN will be ...


3

I think you're in for a world of pain trying to get LDS working in place of AD when dealing with SharePoint. It's not really a lightweight version of AD even though its name implies so. Think of it this way: AD LDS is like SQL server with no databases or tables defined. AD itself is like SQL server with a full schema, databases, set of tables, triggers and ...


3

I had a similar problem at a previous job. We ended up doing what Jscott did, which was to create specific groups just for those special apps. These groups were created in batch-mode once a day (that was as often as we needed) based on what the nested-groups had in them. Unfortunately, I no longer have the source for that, but we leveraged a combination of ...


3

As Rajeev has pointed out in comments, Active Directory IS an LDAP server and more, and the AD LDS service is a "free" Windows Server role that is provided to do specifically what he is looking for. AD provides many extras (replication, Kerberos, federation, etc.) that you would have to build on your own with a Free/OSS solution like ...


3

No, AD LDS does not have the concept of member servers or computers joining a domain. It's just an LDAP front-end. You need Active Directory Domain Services.


3

20 characters is the limit for the "Pre-Windows 2000" name, also known as the samAccountName. Refer to this previous answer for more information: http://serverfault.com/a/335565/20701


3

The AD LDS for windows 7 installation adds three components to your Administrator Tools which are: Active Directory Lightweight Directory Service setup wizard Active Directory Sites and Services ADSI Edit Use the last one to create a local instance of an Active Directory for your dev :)


3

To answer the original question, you can install ADLDS for W7 without a domain present. A workgroup W7 machine will suffice. It need not be a domain member. The http://technet.microsoft.com/en-us/library/cc731246(WS.10).aspx step by step guide might be useful to you. ADLDS is a LDAP server and if your requirements are to test code for reading/writing LDAP ...


3

My suggestion is to install a domain controller virtual machine. That's what the vSphere appliance works best with, and it's the native solution for your Windows RDS server. vSphere/vCenter is using Likewise to provide AD/LDAP integration. It expects either pure LDAP or Microsoft Active Directory. Think about the target market for paid vSphere; shops with ...


2

If you're looking to develop against something that looks and smells like Active Directory, then AD LDS is no substitute - contrary to what you'd intuitively think from the name, it does not provide just a "slimmed down" AD. Create a development domain with a real AD Domain Services install.


2

By default, AD LDS supports and enforces the password policy settings and account lockout settings that are provided by Windows Server 2008, including the following: Minimum age Maximum age Complexity History Too many failed logon attempts Disabling and enabling of accounts If the server on which AD LDS is ...


2

Is there a way to set a limit in ADSIEdit so that it will not hang the computer when retreving a very large multi-value object ? Not that I'm aware of. LDAP is perfectly fine giving a small set of values for a multi-value attribute, but to my knowledge ADSIEDIT does not take advantage of that. Another tool will be better for managing such objects. For ...


2

Keep in mind that AD LDS is not the same thing as an Active Directory domain; it's only a LDAP database and server, and you're the one which will need to populate it, at a much lower level than the one you're used with when dealing with AD. If your app requires SharePoint, which in turn requires AD, I don't think AD LDS will be enough; and, even if it will, ...


2

Your best bet is to follow this technet article: http://technet.microsoft.com/en-us/library/cc730701%28WS.10%29.aspx


2

The Active Directory Schema documentation should have everything you need. The container object has the following definition: This class is used to hold other classes. The group object has the following definition: Stores a list of user names. Used to apply security principals on resources.


2

What I believe you want to do is AD LDS Replication: See the following article: http://technet.microsoft.com/en-us/library/9d4b4004-9f26-4545-a1e4-8e527102f0a7


1

You need Active Directory, not LDS. To be able to perform an interactive logon to a domain with a user account from a computer, there needs to be a domain, and that computer must be a member of the domain or a member of a domain that is trusted by the account domain. In LDS, there isn't a domain or any domain controllers. Your computer will be unable to ...


1

(Answering my own question with the result of a support call to Microsoft) It is a bug in AD-LDS (bugcheck ID 354126). It affects Windows Server 2008, I don't know about Server 2012. The problem is that no notification is sent to the replicas (neither urgent nor normal). When the account lockout is stored in the DB, LDS does not don't update the global ...


1

I did not find a valid, clear answer, so wrote some code to create 1 milion users, and add them to a single group. On a 1vCPU, 2G RAM virtual machine running Windows Server 2008 R2, we found that : AD-LDS has no problem holding that much data. Adding a user to the directory or to the group is done in constant time, regardless of group membership size ...


1

To understand the difference between dc= and o= in Active Directory you need to remember that Active Directory is an LDAP implementation at its core. DC= in LDAP parlance specifies a Domain Component. It should be used if and only if you are defining something that exists within the DNS space. If your organization is foobarco.example.com in DNS it is ...


1

I usually use only DC tags for the root DN. For example: DC=something,DC=example,DC=COM I also match part of the root with the domain (in this case, it would be example.com). It is just a habit, it will not help or hinder your ability to use proxy accounts, for example. Every LDAP enabled product I can think of allows you to specify the full DN of the ...


1

NLB is your best option here. With DNS or an SCP clients can choose a random server to connect to. LBS can be configured to fail-over when required. While you can configure multiple AD LDS instances to be a single configuration set, sometimes (more often than I'd like) applications will use the "random server" to make multiple updates to attributes in a ...


1

The objectSID on the user proxy is looked up using MS-LSAT. http://msdn.microsoft.com/en-us/library/cc234496(v=prot.10).aspx has details. Take a netmon (https://www.microsoft.com/download/en/details.aspx?displaylang=en&id=4865) trace on LDS server while doing BIND to see what happens. Once the domain of the user is identified, then it will try and use ...


1

According to Microsoft "Overview of Failover Clustering with Windows Server 2008 - White Papaer" (http://www.microsoft.com/download/en/details.aspx?id=13153) document, you still need a working Active Directory for failover clustering, and not ADAM is not useful here as it doesn't have all the security features it needs. Extract from the document mentioned ...


1

The servers have to be in a domain and the cluster services account has to be a domain account.


1

MS recommends using ADAMsync to sync data with ADLDS. But in the past ADAMsync has had problems with aging see KB927053. So I ended up writing a custom script to do the syncing for me. I have no idea if the aging issues have been fixed with the switch to ADLDS. Update: These where written for ADAM but I assume they still apply. Synchronizing only the ...



Only top voted, non community-wiki answers of a minimum length are eligible