Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [active-directory]

A Microsoft technology that constitutes an LDAP directory service with centralized management functionality for user accounts, computer accounts, groups, and configuration management across many Windows servers and desktops.

8
votes
1answer
93 views

Shutdown script doesn't run if workstation is not connected to the network

I have a requirement to run a batch script every time a system is shut down, no matter if the computer is connected to the network or not. (It shouldn't matter for the question, but the script in ...
0
votes
0answers
12 views

Autofs Windows Active Directory users home directory to rhel that only they can see it

I have a client that has two groups with different users on a Windows Active Directory, they also have a rhel machine with sssd authentication that the users will do the authentication on the AD ...
-1
votes
2answers
67 views

auto moving computer in respective OU, when joined machine in to domain

we want move Computer account automatically in respective Ou when it join Domain i have some Poworshell script but it is use for manual movement "redircmp ou=newcomputerou,dc=domainname,dc=com" so ...
1
vote
0answers
20 views

Is delegating a granular “Modify permission” on a group possible?

A certain user "x" has below permissions on a group "g"; -> Read/Write all the properties on group. -> Delete the group. Need to add "modify permissions" on the group "g" for user "x" ; but the only ...
0
votes
1answer
36 views

How to grant a Service Principal access to AKS API when RBAC and AAD integration are activated?

I need to grant a process (build pipeline) RBAC access to AKS API for deployment purposes. But the target AKS cluster has AAD integration active (as described here) I was expecting to be able to ...
0
votes
0answers
72 views

dcpromo of a windows server 2008 in existing samba based AD resulting in infinite configuration

We want to add a new DC using windows server 2008 in our AD that just have 2 zentyal 5 based DC to replace the second. DCPROMO is able to get all informations but when start to configure the DC , the ...
0
votes
0answers
39 views

CertSrv 401 Loop

Using domain admin credentials, I'm unable to authenticate into my PDC's CertSrv application: http://localhost/certsrv I'm caught in a 401 loop. I've tried this proposed solution: Open IIS Manager ...
1
vote
2answers
24 views

Change DSRM Password - WIN32 Error Code: 0xa90

I'm using Windows 2012 R2 with Active Directory. One of my DC has had hardware failure. I'd like to promote another server as a DC, but reading online it looks like I need the DSRM password to do so. ...
0
votes
1answer
38 views

GPO Security setting Wired Network (IEEE 802.3) Policies

My question is regarding group policy security setting (Wired Network (IEEE 802.3) Policies). When I set this setting I cannot see any file generated to store these settings in SYSVOL\sysvol\...
0
votes
0answers
8 views

Delegated Admin Account Not Able to Access ADUC

I have created a security group to allow users the ability to reset passwords only. However, when I try to log into ADUC with a user from that group I cannot. I've searched for similar issues but can'...
0
votes
0answers
16 views

Oracle Cloud : Windows instance not joining to domain automatically

Let me explain my setup.My VCN has two private subnet. Subnet 1 : Installed domain controller with required AD ports open through security list on Subnet1 . it uses default DHCP options. DNS role ...
2
votes
0answers
51 views

Is a domain joined windows machine's objectGUID or ObjectSID as stored by Active Directory also stored locally?

Working on an inventory project where I need to link a computer to an object in Active Directory. I have an export of all computer objects from Active Directory including some unique identifiers such ...
4
votes
0answers
73 views

Samba and AD - “net ads changetrustpw” fails

I've got a Samba member of a Windows AD. I'm using a combination of sssd and winbind. Samba manages machine password changes, and it's configured also to update the passwords used by sssd. (The ...
1
vote
0answers
43 views

Local groups mapped to AD users via groups.conf working - but only with ssh login

I'm running a Samba Active Directory domain with Ubuntu 18.04 clients. I used the /etc/security/group.conf file to successfully create a mapping for domain users to the "dialout" group. I tested it ...
0
votes
0answers
206 views

Joining Ubuntu 18.04 to Windows Active Directory Domain

I'm currently attempting to join an Ubuntu box to a Windows domain, eventually with the intention of allowing Windows-based domain members to access a Samba network share using their AD credentials. ...
4
votes
3answers
84 views

Active Directory Give users certain permission

I'm trying to find a way for users to change their job title or address in Active Directory. What i've done is pushed them a batch file as shown below so they can search for themselves in the AD @...
0
votes
1answer
105 views

Cheapest way to setup a domain controller with AD-DS for a small business with multiple locations

I work for a small business with little IT infrastructure. We want to be able to join all computers throughout the company to a single domain to push group policies and conduct other management ...
1
vote
0answers
15 views

Azure AADconnect attribute filtering using custom attribute created using Schema extension

We have a string valued attribute which is attached to user class. This attribute is created using schema extension. When i use this custom attribute to implement a inbound AADconnect attribute ...
1
vote
1answer
43 views

Active Directory Admin Denied Access - Why?

Logged in as the domain admin of an Active Directory environment, I'm attempting to run this command to reboot a workstation: @start /b cmd /c shutdown -r -f -t 1 -m \\COMPUTER-NAME I'm getting this ...
2
votes
1answer
36 views

Windows Server 2019 - OpenSSH (AD authentication and permissions)

I just installed OpenSSH Server on a Windows Server 2019, in a domain environment, and I noticed that by default, pretty much every user can connect to the server via SSH. It's as if AD authentication ...
1
vote
0answers
17 views

Allow Guest User in Azure Access to SQL Server (DEV, Read/Write)

I'm a bit new to Azure AD. I have some software development offshored and have already created a guest account in Azure for the developer. I've create an account in SQL Server (Manually via the ...
0
votes
1answer
67 views

Ldap integration to centos phpipam

I have installed phpipam on CentOS 7 and this is currently working fine, and now i am trying to integrate ldap authentication or AD authentication so i can use domain credentials to log on to service. ...
1
vote
1answer
61 views

List all MemberOf rights for all user

I am trying to get a list from active directory, where I only see SamAccountName, and all the information from MemberOf tab. The following code lists all the user, but when it comes to MemberOf ...
0
votes
0answers
39 views

Authentication policy silo failure on Windows Server 2008 R2

We're deploying Active Directory authentication policies and silos to restrict domain admins to domain controllers and server admins to servers which has worked fine on all of our servers from Hyper-V ...
2
votes
1answer
34 views

Domain controller and local computer different timezones for automatic updates

If the Windows domain controller is in PST time zone and the local computer is in the EST time zone and automatic updates are scheduled for 1:00 AM via group policy, will the local computer install ...
-2
votes
1answer
38 views

Windows guest OS systems should work only when joined to domain

This is my first question and I request your patience here, In our production environment, we have predominantly windows based servers and workstations and hosted on vmware. The development team has ...
0
votes
0answers
39 views

Cannot allow local admins via GPO because of “Minimum password length” policy

I need to enable local admin accounts on most of the computers. I have these passwords managed by LAPS, but I can't allow it with GPO when I have "Minimum password length" policy in place. Is there ...
2
votes
0answers
76 views

Enable Windows Active Directory Groups on Sudoers File

We've recently started enabling access to our linux machines using Windows Active Directory users. The chosen method was kerberos+samba+sssd and it's working fine. Our next step is to allow certain ...
1
vote
0answers
26 views

Is my plan for Bitlocker deployment missing anything?

1.) Confirm that TPM is activated in the BIOS of all workstations.  - All of these workstations are using Windows 10 Pro, which I believe automatically activates the TPM chip when the OS is installed ...
2
votes
0answers
15 views

Save Outlook credentials in Active Directory

I have an AD with roaming user profiles. Credentials, for example for Office365, don't seem to be stored in the roaming profile, however. When the user switches to a new computer for the first time, ...
1
vote
1answer
41 views

Migrate user accounts from Azure AD to on-premise AD

I saw a few questions related to the situation we're in but not the answer I needed; So we're mostly a cloud based company (G suite, Azure AD etc.) Azure AD has too many limitations, we're going to ...
0
votes
2answers
30 views

How can I trace the SidHistory to the original and destination domain?

I am seeing groups that either contain the current or prior SidHistory for a user in a large complex AD Forest with many domains. Is it possible to look at the first half of the SidHistory and ...
1
vote
1answer
25 views

Directly select shortest match in Active Directory tools' object picker UI

Let's say I want to make a User account a member of 3 groups through the object picker of the AD tools (the "Select Groups" window), and that I add in the "Enter the object names to select" box/field ...
0
votes
1answer
57 views

Access on-premises Office365/AD from Azure Web app

I'm currently working on a web app that is deployed to a server on our (company) domain. We're looking to migrate to Azure. Migrating our whole AD to Azure is out of our scope at the moment. Now, my ...
0
votes
1answer
50 views

Why would setspn -q return “no such spn found” when setspn -l finds the spn?

I'm attempting to troubleshoot why windows authentication is failing for a website hosted in IIS at a customer site. When executing setspn -l serviceUser to list the spns associated with a service ...
1
vote
1answer
55 views

Kerberos preauth failures between DCs

I'm getting kerberos preauth failures - event 4771 - between my DCs. I think it's normal behavior (it's happened for years, since I enabled the additional logging), but I can't find any explanation as ...
0
votes
1answer
36 views

How to reset user's domain policies

I am testing a AD environment with one Domain Controller and some clients. My user has many problems. I am member of "domain admins, domain users and administrators" groups and in I cannot resolve ...
1
vote
1answer
51 views

Run a Bash Script on New User Creation by SSSD

Users created on AD can login to Linux with a password. I would like to replace this password login with ssh-key. So far, I've made a custom attribute and placed the public key in it and able to fetch ...
0
votes
0answers
15 views

How to make Printers Discoverable by Windows 10

First of all, I should indicate that what's discussed below is in an Active Directory Windows 2008 R2 environment. When you click "Add a Printer" in Windows 10's "Devices and Printers" utility, it ...
1
vote
2answers
88 views

ldapsearch show member entries without CN

I am using ldapsearch on a debian 9 Linux box to query a MS Active Directory. I would like to query/find all users in my group "mygroupname". The command ldapsearch -o ldif-wrap=no -xWLLL -D "...
0
votes
0answers
6 views

Make winbind rfc2307 optional

Back in the samba-winbind 4.4 days, you could set a default template shell and template directory for AD users, but override these defaults by using rfc2307. This was useful because we could allow ...
0
votes
0answers
25 views

Windows 2008R2 DC Ntfrs displayed Event: 13568 JRNL_WRAP_ERROR

I have a Windows 2008R2 DC - Ntfrs service that has displayed Event: 13568 JRNL_WRAP_ERROR. This error has been on this DC for a long time and never been fixed nor any attempts to fix it since around ...
7
votes
2answers
668 views

Unable to disable Microsoft Store in domain environment

In AD, I create a new OU and moved my username into that OU so I can do testing with my own domain user account. I then created a new GPO and enabled the following: Computer Configuration > ...
0
votes
1answer
65 views

mounting DFS filesystem with remote shares in it on Arch Linux

I have laptop joined to domain AAA. Have two DFS namespace servers which are also AD DC with Win Server 2012 R2. NAS is Synology server with CIFS enabled/domain joined. Servers: dc1.domain1.local - ...
0
votes
0answers
18 views

Samba AD shares on other servers

Setup Samba as an Active Directory DC on Ubuntu 18.04. Would like to know how to create a share for my users on a server other than the AD DC server. For example, my AD DC server is adc1 and my ...
2
votes
2answers
59 views

PowerShell: Get Notes of an Exchange Distribution Group

I want to build a One-Liner to Get the Notes of a specific Distribution Group and output it alongside the Name and other information of the Distribution Group. I've googled it and found differed ...
0
votes
0answers
15 views

Can Freeradius integrated with ad CACHE wpa enterprise logins?

There are two offices: main and remote. At the main office, workstations are connected to the corporate wi-fi network in the WPA-Enterprise mode. They use their computer accounts to authenticate ...
0
votes
1answer
115 views

dcdiag DNS test fails, but DNS seems to be working properly

Active Directory setup: Single forest, 3 domains, with 1 domain controller each. All running server 2008 R2, with the same domain/forest functional level. DNS clients are configured as follows: DC1 ...
0
votes
0answers
33 views

Error trying to join Linux server with AD

I'm hoping someone can help me figure out what's wrong. I'm trying to join a server with my AD machine, but I'm getting this error: Failed to join domain: failed to lookup DC info for domain '...
0
votes
3answers
94 views

Windows Domain controller as dns

Im creating my first domain and joining pcs to the domain. Why do I need to specify my dc as the dns to join a pc to that domain?