Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [active-directory]

A Microsoft technology that constitutes an LDAP directory service with centralized management functionality for user accounts, computer accounts, groups, and configuration management across many Windows servers and desktops.

83
votes
5answers
95k views

Windows Active Directory naming best practices?

This is a Canonical Question about Active Directory domain naming. After experimenting with Windows domains and domain controllers in a virtual environment, I've realized that having an active ...
139
votes
2answers
289k views

What is Active Directory Domain Services and how does it work?

This is a Canonical Question about Active Directory Domain Services (AD DS). What is Active Directory? What does it do and how does it work? How is Active Directory organized: Forest, Child Domain, ...
16
votes
2answers
6k views

Website and Active Directory domain share the same name

In our network the name of the network domain is also the domain of the organization's website (say, example.com). Externally, people can enter example.com to visit our website, but internally, this ...
39
votes
3answers
73k views

What should the order of DNS servers be for an AD Domain Controller and Why?

This is a Canonical Question about Active Directory DNS Settings. Related: What is Active Directory Domain Services and how does it work? Assuming an environment with multiple domain ...
46
votes
8answers
52k views

Should I expose my Active Directory to the public Internet for remote users?

I have a client whose workforce is comprised entirely of remote employees using a mix of Apple and Windows 7 PCs/laptops. The users don't authenticate against a domain at the moment, but the ...
24
votes
6answers
43k views

Choosing local versus public domain name for Active Directory [duplicate]

What are the pros and cons of choosing a local domain name such as mycompany.local versus a publicly registered domain name such as mycompany.com (assuming that your org has registered the public name)...
70
votes
5answers
24k views

Active Directory explained

If you had to explain Active Directory to someone how would you explain it?
23
votes
6answers
6k views

Can windows domain controller be virtualized?

Just the question on the title. There is any problem? Any experience on this?
49
votes
7answers
18k views

If a Windows shop moves “everything” to the cloud, does it still need Active Directory?

Taking a spin off of this question: Do I really need MS Active Directory? in a new direction for 2014. Taking into account a basic Windows infrastructure: domain controllers Exchange 2007/2010/2013 ...
22
votes
3answers
10k views

Naming a new Active Directory forest - why is split-horizon DNS not recommended?

Hopefully, we all know what the recommendations for naming an Active Directory forest are, and they're pretty simple. Namely, it can be summed up in a single sentence. Use a subdomain of an existing,...
16
votes
1answer
28k views

GPOs fail to apply; reason: Inaccessible, Empty, or Disabled; Server 2012 R2 and Windows 10

I have a Windows Server 2012 R2 Domain. Yesterday, a computer’s (running Windows 10 Pro) network drive stopped working. After further investigation (gpresult /h) it appears ALL group policy objects ...
25
votes
0answers
1k views

What should I name my Active Directory? [duplicate]

Possible Duplicate: Windows AD Domain naming recommendations There are a lot of really screwed up configurations out there, because people didn't take a minute to sit down and think about ...
3
votes
2answers
3k views

things to check prior to moving all FSMO roles to a new domain controller before decommission original old domain controller

need to move a domain controller, the first in the forest that holds all the fsmo roles, to another location in a clients building. it will require turning off this dc, call it dc1 for this question. ...
38
votes
5answers
238k views

Finding why a user is locked out in Active Directory

A user's account keeps getting locked out in Active Directory. It's probably caused by an app that's using Windows authentication to connect to SQL Server. Is there a way to find out which app is ...
15
votes
5answers
3k views

Mercurial (hg) with active directory

Can I setup Mercurial to authenticate users on Active Directory? In my case, hg can run on Windows, Linux or FreeBSD, but I need to use AD users. Note: if it is possible, then please point me to a ...
13
votes
5answers
38k views

My public website name and AD domain name are the same. How can I get to my external website from inside my network?

I am using my domain example.orgin my firm. I can use www.example.orgto view my website. If I try http://example.org from outsite my firm there is no problem, but if I try it from inside, my windows ...
40
votes
12answers
199k views

Group Policy installation failed error 1274

I'm trying to deploy an MSI via the Group Policy in Active Directory. But these are the errors I'm getting in the System event log after logging in: The assignment of application XStandard from ...
14
votes
3answers
10k views

Removing old computers on a domain

The Windows Domain I manage has hundreds of computer names which I don't recognise and I'd like to remove old ones which aren't in use before trying to track down the misnamed ones. Is there someway ...
28
votes
13answers
25k views

Do I really need MS Active Directory? [closed]

I manage a shop of arround 30 machines and 2 terminal servers (one production, one standby.) Should I really deploy Active Directory in our network? Are there any really benefits, that could ballance ...
19
votes
1answer
28k views

What needs to be done after a Domain Controller crash?

Assuming that at least two domain controllers were present in the domain to start with, what steps need to be taken to make Active Directory healthy after a domain controller crash?
16
votes
3answers
28k views

Is there a way to refresh computer group membership without rebooting?

I am using Windows Server 2008 R2 and have a windows service running under "network service" account in computer ComputerA. This windows service want to access a share folde (on another computer ...
10
votes
5answers
12k views

Active Directory: Is it required that the “A” record for a domain point to a Domain Controller?

Currently we have an Active Directory setup, and say the name is 'example.com'. The DNS entries for example.com has two A records pointing to the two domain controllers. I would like internal users to ...
31
votes
5answers
27k views

Common wisdom about Active Directory authentication for Linux Servers?

What is the common wisdom in 2014 about Active Directory authentication/integration for Linux servers and modern Windows Server operating systems (CentOS/RHEL-focused)? Over the years since my first ...
30
votes
3answers
28k views

What is Group Policy and how does it work?

This is a Canonical Question about Active Directory Group Policy Basics What is Group Policy? How does it work and why should I use it? Note: This is a Question & Answer to new administrator ...
20
votes
11answers
244k views

Best way to find the computer a user last logged on from?

I am hoping that somewhere in Active Directory the "last logged on from [computer]" is written/stored, or there is a log I can parse out? The purpose of wanting to know the last PC logged on from is ...
30
votes
7answers
36k views

Is there an equivalent of SU for Windows

Is there a way (when logged in as an administrator, or as a member of the administrators group) to masquerade as a non-privileged user? Especially in an AD environment. e.g., in the Unix world I ...
6
votes
2answers
34k views

Active Directory Time Synchronisation - Time-Service Event ID 50

I have an Active Directory domain with two DCs. The first DC in the forest/domain is Server 2012, the second is 2008 R2. The first DC holds the PDC Emulator role. I sporadically receive a warning ...
8
votes
2answers
15k views

Migrate user accounts from Azure AD to on-premise AD?

My company uses Office 365 for Exchange, SharePoint, Lync etc. including the build-in user administration via Azure Active Directory. Now we want to switch to a local AD on a Windows Server. It shall ...
19
votes
4answers
97k views

How to create Active Directory user account with powershell

I am constantly setting up research and development environments that require active directory accounts. Since we place these environments in isloated networks each environment needs its own active ...
12
votes
1answer
70k views

Command to remove computer from non-existant domain

I lost my domain controller machine, and then add new domain controller but with a new domain. How do I remove network machines from old domain using command line and add to new domain? Machines ...
11
votes
5answers
60k views

How can I clear cached domain credentials?

Related: How can I enable domain authentication over wireless in Windows 7/2k8? To test the domain login over wireless connection feature I'm trying to set up in the above question, I need an ...
3
votes
3answers
5k views

Issues with using real domain for Active Directory domain?

Is there any reason why I shouldn't use example.com as my AD domain versus example.local or some other non-existant variant?
3
votes
2answers
10k views

Domain Controller time is 7 minutes fast

I have a Server 2008 R2 domain controller running in VM on Hyper-V that is 7 minutes fast which I need to fix. I understand that this maybe down to the DC running in VM's. What I would like to know ...
24
votes
2answers
7k views

Authenticating OpenBSD against Active Directory

Edit: Reformatted this as Q&A. If anyone can change this from Community Wiki to a typical question, that's probably more appropriate as well. How can I authenticate OpenBSD against Active ...
22
votes
6answers
82k views

Restrict access to IIS site to an AD Group

Is it possible in IIS to set up a site in IIS and only let users of a certain AD Group get access to it?
11
votes
6answers
51k views

How can I have a Linux machine join a Windows Domain?

Sorry if I am misusing terms here; I actually don't know much about Active Directory and the related technologies. Basically I have a Linux computer and I'd like it (or my user on that computer) to ...
10
votes
13answers
24k views

Windows: Can domain controllers also serve other functions?

This question was a discussion about whether Active Directory is necessary to run Terminal Services. But a chain of answers and comments (mostly by me) brought up a related question around Domain ...
8
votes
3answers
8k views

Combined NFS, Samba server w users from Active Directory

I want to build a server that exports user home directories over SMB/CIFS and NFS. This server would be joined to a Win2k3 AD domain controller that holds our user database. As I understand it, ...
6
votes
3answers
7k views

Active Directory in a DMZ

What is the best way to manage user accounts for Windows servers in a DMZ? We are expanding our web presence and adding several IIS servers to our DMZ. I would prefer not to manage a bunch of local ...
5
votes
8answers
7k views

Suggestions for using Active Directory credentials (user name/password) with Google Apps?

I run a small college network with approximately 150 user accounts both in my Active Directory and in Google Apps. I'm looking to link AD with G-Apps. Currently my users are required to maintain ...
12
votes
4answers
3k views

Windows Domain replication monitoring tool

I am looking for web-based interface GUI, or some kind of monitoring tool that will show replication status for a domain. I know I can use repadmin with various options on the command line to query ...
12
votes
3answers
33k views

What happens when a computer joins an Active Directory domain?

What changes are applied to a client when it joins an AD domain? How is a domain member supposed to behave when disconnected to the network? Are users able to login? Will domain user policies still ...
4
votes
1answer
4k views

Mounting windows shares with Active Directory permissions

I've managed to get my Ubuntu (server 10.04 beta 2) box to accept logins from users with Active Directory credentials, now I'd like those users to access their permissible windows shares on a W2003 R2 ...
9
votes
4answers
9k views

How to clean up orphaned SID's in ACEs in AD?

As a follow up to my question Do backlinks clear in AD for deleted users I have another related but different question. Since I am informed in the answers there that a deleted object's SID (Group or ...
7
votes
6answers
5k views

Active Directory OU design for <500 users, 4 locations

We are looking to add some logical structure to our (Win 2003) AD hierarchy. We have a single domain and around 500 users. All users and computers are currently organized into one OU. All security ...
7
votes
6answers
85k views

How to enable Audit Failure logs in Active Directory?

I have a user account that keeps on getting locked out. I am trying to find out what caused it. So I want to enabled failure audits in event viewer as a start. But, I don't know how! How do I enable ...
4
votes
4answers
25k views

Microsoft DNS - Access is Denied. Event log: The DNS server was unable to open Active Directory

I've just had an issue arrise that I cannot seem to solve. I recently set up a Windows Server 2008 DC with DNS and DHCP and all has been working fine, but I discovered today that when I go into the ...
4
votes
1answer
956 views

Demoting a DC which also runs Exchange 2010

Initially when setting up Exchange 2010 CAS I ran into problems with permissions. I got around them by promoting the server to be a DC with a GC. The Server was initially installed with 2008 R2 ...
2
votes
2answers
12k views

Is it possible to add a local user to the admins group through group policy?

I'd like to have a local user in the admins group for when the computer isn't connected to the domain. Currently I use a start up script to create the user and add it to the admins group. Is there a ...
103
votes
8answers
523k views

How can I figure out my LDAP connection string?

We're on a corporate network thats running active directory and we'd like to test out some LDAP stuff (active directory membership provider, actually) and so far, none of us can figure out what our ...