Questions tagged [active-directory]
A Microsoft technology that constitutes an LDAP directory service with centralized management functionality for user accounts, computer accounts, groups, and configuration management across many Windows servers and desktops.
10,222
questions
0
votes
2
answers
1k
views
Windows Update Service gets stuck at Stopping state whenever I check for update on the domain controller
On my domain controller which is Running Windows Server 2016, whenever I check for updates, the updates start downloading and get stuck at 7% or sometimes stuck at checking for updates. I see that the ...
- 116
0
votes
0
answers
70
views
Can I use a group in a root domain to filter application of a group policy object from this root domain for a computer in a child domain?
I have a root domain (root.local) with a child domain (child.root.local).
I have a Group Policy Object in the root domain, e.g. GPO_root
In the child domain I have a computer, computer_child. Is is ...
- 1
-2
votes
1
answer
872
views
What is the ILS_ANONYMOUS_USER account?
On a Microsoft Windows domain, on a public IP server, I found a login using the account ILS_ANONYMOUS_USER.
This is Microsoft created domain wide account, not specific to one server.
Is this right?
...
- 452
0
votes
1
answer
4k
views
Best method for enabling bitlocker via GPO/scripting
I'm working on getting bitlocker deployed across an organization and am getting hung up on how I'm expected to actually enable it. We're using on-site AD on Server2012 (will be moving to 2022 this ...
- 229
0
votes
0
answers
38
views
I am unable to edit user information on 365 AAD in a Hybrid Environment
Let me start off with, I know that in a Hybrid environment AD edits need to be done on-prem. However, I have a special case that I can't for the life of me figure out.
I have a user that somehow ...
0
votes
1
answer
93
views
Grant local impersonation user permission to share
We have a domain connected server (Windows Server 2016) named STORAGE. The server has a local "impersonation" user created by our Autodesk software called AutodeskVault. This user is only a ...
- 103
0
votes
1
answer
101
views
AD Security by OU?
In our AD environment we maintain the Description field to help identify our computers.
I found that I and others on my team can update some system in certain OUs but cannot update them in others.
I ...
1
vote
2
answers
503
views
Add member to kerberos domain programatically
I want to have an embedded device join a Linux based AD/DC domain. I have kerberos libraries (no executables) on the embedded device. I have an application on the embedded device that can ...
0
votes
1
answer
461
views
LDAP users to share a single SFTP folder on Linux
I need to setup a file transfer linux server. All users login via sftp using active directory credentials.
I want all users to when logged into see a single directory /ftp-storage
In the /ftp-storage ...
- 235
1
vote
0
answers
80
views
Microsoft Active Directory Admin - Discriminate usable USB Disk devices
good morning, I have been trying for a while through policy management or other microsoft media to restrict the use of USB removable disks. I know that through Active Direcory I can enable and disable ...
- 11
1
vote
0
answers
211
views
OpenLDAP gidNumber and group membership inconsistency
I encountered an interesting problem while examining a specific AD/OpenLDAP interop case. On the OpenLDAP server, there is a user1, whose gidNumber corresponds to a group1. There is another user2, ...
- 11
0
votes
1
answer
216
views
Have List of user but I want to find out if they are added to specific ADGroupMember
I have been trying to understand how to import my csv file and export of specific adgroup they are added or even they are not added
Import-CSV " C:\Users\user.csv" | ForEach-Object { Get-...
- 11
0
votes
1
answer
112
views
convert local machines to MS 365/Intune managed
Currently we have a 365 account - 50 users, and 50 local machines with local logins.
According to my reading, 365 can manage configs on these machines and allow to specify which 365 users can log into ...
- 3
0
votes
0
answers
56
views
Shared drive for Windows EC2 intances launched within an autoscaling group
I am looking to be able to share a single network storage between my fleet of Windows EC2 instances that are used as application webservers running IIS. These instances need to be able to access the ...
- 1
6
votes
2
answers
1k
views
How NTFS folder access is checked in a Active Directory domain?
I understand that both NTFS folders and AD objects use security descriptors and DACL’s to check user/process access
MS Learn - How access check works
However, how does the access check resolves ACE’s ...
- 163
0
votes
1
answer
441
views
Convert AD-integrated DNS zones to Primary DNS zones
We have inherited a domain with 2008 R2 domain controllers running DNS on them. We want to add Windows Server 2019 to the domain then demote the 2008 R2 domain controllers to just DNS servers. We are ...
0
votes
0
answers
147
views
OpenLDAP meta backend with different directory structure
I am working on a project and we need to "combine" two completely different Active Directory (AD) servers to one. I have found that OpenLDAP might provide a solution by providing a reverse ...
- 1
0
votes
2
answers
253
views
With multiple RDP certificates, do all get checked?
If a Windows host has multiple RDP certificates. Do all get checked while connecting or only the first found?
I have a RDP certificates deployed from an Root CA with now invalid OCSP location in the ...
- 83
0
votes
1
answer
254
views
Linux, Basic password authentication against 2 different AD without joining domain
We have AIX and Linux servers running with basic password authentication against a Windows AD using Kerberos, so it are local users with a username identical to their sAMAccountName in the AD and all ...
- 1
0
votes
1
answer
868
views
Could not establish WMI connection access is denied
I set up a lab to test domain joining multiple computers with a script from Microsoft.
After I ran the script it came back with could not establish a WMI connection with the computer with the ...
- 1
0
votes
0
answers
30
views
Exchanging AD user groups with an external -not trusted- server for authentication and authorization
I'm not really sure how to short and precisely describe my problem. Thus, I was unable to find a solution or at least a hint via google.
We have a Microsoft AD domain and are currently planning to use ...
- 1
0
votes
1
answer
376
views
RRAS VPN using Wrong Server Authentication Cert
I've got a RRAS VPN setup using IKEv2 and certs issued by the domain's CA. It has a cert for the public domain and I know this is getting presented to the client.
How ever it seems that either the ...
- 523
1
vote
1
answer
982
views
Windows AD cert renewal implementation vs cert copying
Windows PKI policy has a setting for what I think is automated renewal of AD template issued certificates when they expire.
It must be also enabled on the certificate authority (CA) side. Question - ...
- 207
0
votes
1
answer
153
views
Is Azure AD (only) enough for simple identity requirements
I'm looking at helping out a small business, who currently operates four very small branch offices (ranging from 4 - 10 windows PCs). Currently, shared accounts are used on these machines - obviously ...
- 3
0
votes
1
answer
95
views
WWW A-record Hack for Internal Users No Longer Works on my Server 2022 AD Domain
I have one of those notorious public websites for my company running on a third-party host that has the same domain name as our internal Active Directory domain network. So that our internal users can ...
0
votes
1
answer
579
views
Ever since changing to Windows 11 we have some workstations that now and then try to connect via smart card, but we don't use smart cards
Ever since changing to Windows 11 we have some workstations that now and then try to connect via smart card, but we don't use smart cards.
The event occurs with the computer's account, not a user's ...
- 1
0
votes
2
answers
2k
views
How to disable AD account without deleting user's mailbox in Office365?
One of our users recently switched roles to a new position where they will not need computer access anymore, except for checking emails. I need to disable their AD account while not removing their ...
- 103
0
votes
1
answer
14k
views
Active Directory Replication Issue
I have 2 DCs in my lab environment. So I just wanted to check the replication status using repadmin /replsummary but it throwed me an error : 1722 The RPC server is unavailable. I forced replication ...
0
votes
0
answers
235
views
I want to create active directory groups for all domain joined servers via group policy.Is that possible?
I want to create active directory groups via group policy for every server I join to the domain so that I don't need to create groups manually. Is that possible ?
0
votes
1
answer
757
views
Filter groups that SSSD receives from AD server
We've got two Ubuntu 22.04 servers that use Kerberos and SSSD to authenticate users against an AD server. This works great.
The servers also have a GlusterFS volume that holds the user's home ...
- 1
0
votes
3
answers
254
views
Can I use one FQDN for all DCs for server authentication and one FQDN for NTP synchronisation?
I'm struggling in regards of a proper practice for server setup for LDAP/AD authentication and NTP. I was thinking if asking two separate questions will be better but I think being a common problem ...
- 188
-1
votes
1
answer
374
views
Powershell 5.1 - Get-ADUser fails to find user unless running as Administrator
I just ran into an issue I cannot explain and need help. I'm on a domain controller (as a domain admin) running Powershell 5.1.
I'm searching for a specific user that I simply cannot find, but I know ...
- 131
0
votes
1
answer
893
views
Can I add multiple users in the Managedby attribute in active directory?
I am trying to use the active directory structure to keep the workers information of our company (names, phones, etc..).
Our layout is based on departments (each department is an OU) and within that ...
- 717
0
votes
1
answer
32
views
Exch 2019 - Change display name for the stored mails
We have the policy to create AD users in format of FAMILY NAME Given name, so my name appeared as BARANYI Peter (btw: this is the standard Hungarian format :) ).
Now the management asked us to change ...
2
votes
3
answers
1k
views
Enabling Protected Users on Windows 2019 AD prevents users from logging in
Our Windows Server 2019 AD is setup and working well.
Due to the Outlook exploit (CVE-2023-23397), we implemented one of the recommendations - move users to the Protected Users group.
Since then, ...
- 121
-1
votes
1
answer
401
views
Split DNS Issue - Configuring a new domain controller with an existing Apache web HTTP services using the same domain name "example.com"
We have a problem configuring a new domain controller with an existing Linux server hosting an Apache web HTTP services using the same domain name "example.com".
The Ip address for the first ...
- 1
1
vote
1
answer
701
views
Get the SID of a Linux computer joined to a windows AD domain
With realmd you can integrate Linux servers into AD much easier. It sets up SSSD and Kerberos locally, and it creates all of the necessary objects in AD.
Now I search for a command I can run on the ...
2
votes
1
answer
1k
views
How to enable Kerberos delegation from SQL Server to DFS File Share
I am trying to enable my MSSQL database users to BULK INSERT / OPENROWSET() a CSV file that is stored on our DFS/cifs/smb network shares.
Initial Setup
I have the MSSQL service set to run as a domain ...
- 175
1
vote
1
answer
1k
views
How to use AD CS to auto-renew certs for securing IIS websites that use SNI?
I have AD CS which automatically provisions and renews machine certificates for servers bound to the directory. (There is a certificate template which controls this auto-issuance.)
I have an IIS ...
- 484
0
votes
1
answer
80
views
Backtracking from a folder to AD groups
Good morning! I'm looking for a powershell script that will let me obtain a list of Active Directory groups with access to a particular folder on my server, but these groups are twice-removed from ...
-1
votes
1
answer
1k
views
why active directory computer object has machine password?
The active directory computer object (ie machine object) also have password , as far as i know only the user's logon name and users password is used when logging into the domain joined computer ? But ...
0
votes
1
answer
664
views
Trouble debugging user access to Windows SMB shares
I am having trouble with 2 PC of my domain, both on Windows 10 1909, which I'll call "01" and "02", using a domain service account (called "s_automate" to connect to a ...
- 1
-1
votes
1
answer
1k
views
Windows Server 2019, Hide or Disable file history (Shadow Copy) for users in active directory that accessing a network share
tl;dr; We need to disable or hide the file history for active directory users who access a network shared folder, so that only the IT team can restore files to previous versions.
We have a small ...
- 51
0
votes
1
answer
1k
views
Kerberos auth from non-domain joined machines using custom UPN suffix
I am trying to access resources inside an Active Directory domain from a non-domain joined Windows 10 machine. The domain is ad.example.com, but there is also the alternative UPN suffix example.com.
...
- 1
1
vote
2
answers
3k
views
How to configure DNS for internal domain resolution on Windows Server?
I have a Windows server with a private DNS server for the AD system named office.example.com. The public domain name example.com is managed by a hosting service and points to a public IP address. When ...
- 111
1
vote
1
answer
202
views
Why is Windows Restarting my Service which I've Manually Stopped?
We have three servers - Windows 2012 R2 - in Azure, running a variety of our own custom developed services. These services are configured to start automatically, so naturally, on startup or after a ...
- 139
0
votes
1
answer
967
views
Powershell - get name and mobile from group with more than 5000 members
I need to extract the name and mobile of all users in an AD group that consists of more than 5000 members.
When I previously did this I only had to extract the name, and this code solved my problem
...
- 3
1
vote
0
answers
322
views
Problems with netdom trust
First, I want to create a one way forest trust with this command on the "main.adds" domain :
netdom trust main.adds /Domain:second.adds /Add /UserD:SECOND\administrator /PasswordD:* /UserO:...
- 61
0
votes
1
answer
3k
views
What to do with DNS if IP address is changed?
I'm working with Windows Server 2016 Essentials. Someone in the organization installed a Linksys mesh network into the router that our server was once plugged into. The Linksys parent node's DHCP is ...
- 31
3
votes
2
answers
2k
views
Active Directory: Account Operators can delete Domain Admin accounts
Scenario
Active Directory has a scheduled background process called SDProp that periodically checks for and applies a specific security descriptor (permissions) of certain groups (and its members) ...
- 131