I have a domain, and a child domain. The child domains domain controller is a Global Catalog server. I know i can use queries to access the partial attribute set inside the global catalog server, and the attributes like bad password count on the PDC using powershell. Is it possible that i can access the attributes of global catalog server and primary domain controller using the GUI of Active directory? If yes, how? If not, what is the reason?

  • Are you talking about accessing the properties of the domain controllers in ADUC or are you talking about accessing properties of user accounts from each domain? You can view nearly all properties you like from a console in either domain. You can set the console to bind to a specific DC if you want to see per-DC attributes (such as LastLogon). You need to use the Advanced Features view to see attributes in ADUC, or use Active Directory Administrative Center
    – LeeM
    Sep 17 '18 at 4:54
  • Thank you for the reply @Trix, I am new to the active directory so maybe you could dumb it down a bit for me? I am trying the access the attributes on the DC, i know the attribute editor shows the individual attributes of the user but how do in view the attributes stored on the GC and PDC? How do i set the console to 'bind to a specific DC? Sep 17 '18 at 5:11
  • You can connect to any Domain or DC by going to Action > Change Domain or Change Domain Controller in the console. By the way, given fast networks today, all your DCs should be GCs, so that avoids any confusion there.
    – LeeM
    Sep 17 '18 at 6:58
  • Thank you! That solves my issue. However, how do I query the PDC for the attributes such as badpwdcount? I mean from the GUI and not from powershell? I can access the GC, by changing the domain controller but how do i access the PDC? Do i access the DC that has the PDCe role? If yes, how do i find the attribute badpwdcount? I am sorry for the confusion here, feel free to ask me to elaborate if you dont understand my question @Trix Sep 17 '18 at 9:32

Active Directory is a multi-master database. As a general rule they will all have the same information. Some attributes are special and not replicated or replicated at very long intervals; badpwdcount is one of those special attributes and you're right to check the PDC.

Open Active Directory User and Computers, right-click the domain and open Operations Masters and go to the PDC tab for the server name. Connect directly to that server then enable Advanced Features from the View menu. After that, you need to find the object in the hierarchy, the Attribute Editor tab will not show if you open the account from the search box. Once you find the object in the hierarchy, go to the Attribute Editor tab and you'll see the badpwdcount attribute.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.