Questions tagged [active-directory]

A Microsoft technology that constitutes an LDAP directory service with centralized management functionality for user accounts, computer accounts, groups, and configuration management across many Windows servers and desktops.

Filter by
Sorted by
Tagged with
0
votes
1answer
7 views

Translating HEX ACLs into permissions

I'm trying to write a script to scrape Samba share ACLs from my Ubuntu server machine. I've been using smbcacls to read permissions per file/folder. When a user only has RX or WX permissions, it's ...
0
votes
0answers
9 views

Configured VPN access, what incoming traffic do I need to block to be safe?

I am not a server guy at all so forgive me if my questions seem somewhat odd. So I've set up a few Windows Server 2016's with internet access and I've created a VPN solution to be able to RDP to them....
0
votes
0answers
17 views

Change DNS suffix by user using GPO

I have some questions about using group policy on a windows server It is possible to change DNS suffix by user using GPO ? for clarification, having a list of user AD whose the dns of here latop is ...
0
votes
0answers
11 views

AD replication stops

i have a domain controller located in a distance site which has a replication problem. Replication stops after a small period of time (about half an hour). The only way to resolve it is to change the ...
0
votes
0answers
9 views

Old SCCM schema extension

I am working on a SCCM CB implementation, where there was an old SCCM 2012 site. That old SCCM 2012 site had extended the AD schema. AFAIK, is not correct re extend the schema. My question - How can I ...
0
votes
0answers
29 views

How to add extensions to whitelist on firefox GPO

So I have tried all of the things that I could think of, I have used the suggested json that firefox have on their git hub found here: https://github.com/mozilla/policy-templates/blob/v1.9_release/...
1
vote
1answer
50 views

Restricting RDP users to certain machines on Windows AD

We need to add specific users to our on-prem part of production that uses traditional Windows Server AD. The users should be able to RDP into one machine (MachineX) and only that. I thought this ...
0
votes
1answer
22 views

user login from another domain (Transitive Trust Established)

I have setup a two way transitive forest trust between two domains (Domain A & Domain B) successfully. Now when I try to RDP as a user in domain A (admin@domainA.com) into domain B it is ...
0
votes
0answers
25 views

Primary Domain Controller not syncing with secondary

Firstly, this was setup by a previous tech guy, so please forgive me if im not using the correct terms or if the setup is not best practice (trying to change that!) We have 2 domain controllers, a ...
0
votes
0answers
18 views

Using Vbscript/PowerShell How to check if an AD user account has permissions to modify AD group membership?

I have a custom Operating System deployment solution (OSD Upgrade) which as part of the process has to first modify a few associated AD group memberships using the user account of the person who ...
0
votes
2answers
11 views

Active Directory LDAPS not working

I have a test domain with one domain controller. On it I have imported the root and issuing CA certificates to the appropriate certificate stores for the entire computer and have done that for every ...
0
votes
2answers
59 views

Finding Host Name / Computer Name over IP

I'm trying to find out how to lookup the HostName of a computer over IP using Command Prompt, however I don't need the registered DNS name. I'm attempting to do an IP/DNS Database Cleanup so finding ...
0
votes
0answers
20 views

Can MS AD Certificate Services maintain both public and private keys in active directory?

Is there enough control over AD user properties to have custom fields (one with only SELF having read permissions) and with Certificate Services to automatically maintain/auto-renew certificates and ...
0
votes
1answer
20 views

Group rights to manage Group Policy?

Consider the following scenario: The Client Engineering department is responsible for the administration of all systems that users interactively log into, including most corporate desktop and laptop ...
0
votes
0answers
24 views

DNS-Server-Service event ID 4011

I’ve been trying to figure out the cause of or DNS event ID 4011 errors for some time now but have had no luck and I figured I’d post about it here before I open up a Microsoft case. The error is not ...
0
votes
1answer
21 views

Azure-only banned password list in a hybrid AD environment

I'm currently researching how to set up a banned password list in Active Directory. I'm doing this in a hybrid environment. Unfortunately, right now we're only licensed for Azure AD Free, which is ...
0
votes
1answer
29 views

Active directory group scope - Domain local or Global?

CONTOSO has offices in the UK and in the US. each country has its own domain, but the domains trust each other. I have created a group in the AD in UK but if the group is set to global I cannot add ...
1
vote
0answers
15 views

Reconnect disconnected Windows work/school account

My Windows 10 account on my work machine is part of my work domain. We use Office365, and since being forced to change my Windows password, Outlook stopped working. A Google suggested to disconnect ...
0
votes
1answer
39 views

How to setup DNS registration on CentOS 7 for IPv6

I have CentOS7 box and would like to setup static IPv4 and dynamic IPv6. It joined to Windows domain via realmd & sssd; In the network we have radvd that adv prefixes and routes. Everything works ...
3
votes
0answers
72 views

Old server accounts persist after migration to Windows Server 2019

I went through the process of migrating Active Directory 2012 R2 to Active Directory 2019. Minus a few firewall ports needing to be opened up, I was able to get through the process of promoting the ...
0
votes
0answers
19 views

Kerberos authentication on an iPad

I cannot get Kerberos authentication to work to a website with an Ipad where a child domain is involved. Here is my setup: (1) Windows 2012 R2 domain controller with a parent domain "example.com" (...
0
votes
0answers
30 views

Which DNS Server gets updated when a Multi Subnet Failover Cluster performs a failover

We have a 2 node multi subnet cluster. When we execute a failover of one of the cluster resource groups we find the DNS update behaviour to be unexpected. NodeA and NodeB are each located in ...
1
vote
0answers
57 views

DFS Namespace Resolution without netbios - Why does it work

So, my problem is not that something does not work. But that it works, and I cannot figure out why. Short version: I am able to access \\mydomain\MyDFSRoot even though netbios/LLMNR is off, and DNS-...
0
votes
1answer
74 views

Active Directory Issue

I have an old environment. We have an Active Directory with a Forest Functional Level of Windows 2000. We have 4 Servers that are part of this environment. My question is, when we raise one of the ...
0
votes
1answer
921 views

Active Directory Removal Created new user folder for administrator. How to revert?

I set up Active Directory Domain Service a couple of days ago thinking it would be neat to toy around with, upon realizing that I have no need for it I removed it from my roles and features. Upon ...
0
votes
0answers
39 views

Restrict the Computers an Azure AD DS User can log onto

I have added a user to our Azure AD and it has synced with Azure AD DS. I can see the user in the Active Directory Administrative Center. This user can logon to any of our domain-joined PCs locally ...
0
votes
1answer
20 views

Replication from Clients to Hyperv cluster offsite

I want to replicate virtual machines that are at client sites to our cluster. Our cluster is 3 hyper-v's clustered together with san as storage. The cluster is in the domain. The replica broker is ...
0
votes
1answer
29 views

Need to copy ACE from one user to another

Currently I need to allow all users to have read access to two computer objects. I can accomplish this manually in the GUI but it's not practical. I have a user that is working when I manually add ...
0
votes
0answers
10 views

AD Access for MacOS Managed User cron job

I have a python3 script I am running on MacOS 10.14 that connects to a a SQL Server database using pyodbc. When I run it manually, it works fine, but when I schedule it with crontab, this error is ...
0
votes
1answer
31 views

Limit Remote Assistance to domain administrators only

I'm an IT administrator in my company. Currently we use Active Directory managed by Windows Server 2012R2 and most workstations use Windows 10. We are looking into using Microsoft's built-in Remote ...
0
votes
2answers
29 views

Netlogon and DNS entries (and specifically _VLMCS entry in this case)

I'm having issues with MS Volume Activation. In our AD DNS configuration, an entry keeps re-adding itself: _VLMCS._tcp.domain.com SRV 0 0 1688 server45.domain.com. Server45 doesn't have KMS ...
0
votes
0answers
24 views

Looking for a directory service/SSO solution that integrates well with AWS and G Suite

Today my organisation uses an Active Directory server which we sync to G Suite with GCDS. The AD server is basically just a directory with all users and some groups as we don't use any other features ...
0
votes
0answers
39 views

Rollover Kerberos Decryption Keys - Azure AD Connect

Our site has been running Azure AD Connect/Hybrid Azure for over a year now. I'm attempting to rollover the decryption keys this month and have been receiving this error: I've attempted to complete ...
0
votes
0answers
23 views

AWS RDS Cannot Connect Using Endpoint

We recently set up a new infrastructure at AWS with a VPC, Windows Directory, Site-to-site VPN, One Way Domain Trust, EC2 Windows instances and RDS SQL Server instances. Assume these two domains: ...
0
votes
1answer
26 views

configure nsscache with samba4 active directory

I have a problem caching the users from samba4 AD with nsscache, since there is no uid, rather samAccountName or cn in AD. When I use the uid-like attribute: # Default uid-like attribute ldap_uidattr ...
0
votes
1answer
45 views

Windows Server DHCP not working

I have an Active Directory network consisting of a Windows server 2019 domain controller with DHCP and DNS on it too. New clients on our network are failing to obtain IP Addresses from the DHCP server,...
1
vote
2answers
75 views

Why should I choose a subdomain of my registered domain for AD (besides having to type “www” to access the comapny website?)

Best practice all over the internet would have you believe that the sky will fall on your head if you register company.com as your public domain name and then use that same domain name in Active ...
0
votes
0answers
15 views

Samba user can't access directory even though he is in owning group

We are running a Samba 4 Active Directory (AD) with a file server running Ubuntu 14.04 On the server is a directory, group owned by MyGroup ... drwxrws--- 16 sauser MyGroup 25 Aug 15 17:38 /share/...
0
votes
0answers
21 views

How to to change Remote Desktop Services connection settings for an Active Directory user with Powershell?

I've found it very easy to automate Active Directory account creation with Set-ADUser as in this script. However, I'm struggling to automate the following part of the task. In a user's Properties ...
-1
votes
1answer
34 views

Windows Domain URL

Our laptops are connected to a windows server 2019 with the domain name company.int Everything works find and when I ping company.int it points to the windows server. The server is also responsible ...
0
votes
1answer
21 views

Removing default Claims Providers Trust - ADFS 2016

I want to know whether it is possible to remove/disable (or even hide) the default claims providers trust in the ADFS page. I have setup ADFS to point to my AzureAD so I wouldn't require the on-prem ...
0
votes
2answers
34 views

How to check if “Split Permissions” are set for an Exchange Server?

I need to administrate an Exchange Server where some powershell commands don't work (like New-Mailbox). It seems that "Split Permissions" are active on that installation but I'm not sure. How can I ...
0
votes
1answer
54 views

Set Adobe as default program via Group Policy?

My question is about default program via Group Policy. Basically what i need is - set Adobe as default windows PDF reader via Group Policy. I have been trying to do this for a while now, but haven't ...
1
vote
0answers
22 views

GPO vs attributes for users exctracting using CSVDE

I am currently in doubt about how the GPO is changing the attributes of the users registered in the AD. I have a Windows Server 2019 Datacenter and I have a few active users that have the flag "...
0
votes
0answers
12 views

apache directory and active directory server range attribute

I have to work with an active directory I can only communicate with by ldap connection so no mmc snap-ins. I'm using apache directory server but have a problem editing groups with large member counts. ...
0
votes
0answers
15 views

getent doesn't show full name for AD users

I had an Ubuntu 16.04 server connected to the Active Directory domain via samba. I was used to retrieving the domain users' details with: $ getent passwd DOMAIN+jdoe:*:17340:10513:John Doe:/home/...
1
vote
1answer
28 views

Added DFSR to Domain controller, non domain admins can not create shares

My situation is I deployed a couple of domain controllers at some locations. My boss didn't want to spend money on servers, so I reused some servers we were not using. I installed them as domain ...
0
votes
1answer
58 views

Authenticate with SSSD in multiple domains in Ubuntu 18.04

I was able to successfully follow this document to get sssd to work with my Active Directory domain, but I was sad to learn that sssd does not support authenticating with external trusts. I read that ...
2
votes
2answers
171 views

Set user home folder to local path doesn't seem to actually set the profile location for domain or local users

I have created a folder D:\Users with the same permissions as the default C:\Users and enabled the "Set user home folder." I have verified that the GPO is applied to the computer on which I am testing....
-1
votes
1answer
89 views

Can one GMSA ( Group managed service account) be applied to multiple computers? [closed]

I read that MSA cannot be applied to more than one computer, Can gMSA be linked to more than one computer?