Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [active-directory]

A Microsoft technology that constitutes an LDAP directory service with centralized management functionality for user accounts, computer accounts, groups, and configuration management across many Windows servers and desktops.

7
votes
0answers
110 views

Sunsetting Microsoft Identity Management for Unix the right way

I'd like to make sure that we don't have any connections to our AD controllers before sunsetting, but some run Microsoft Identity Management for Unix / Server for NIS. I'm having a dog of a time ...
7
votes
0answers
3k views

Unix nslcd login with sAMAccountName and/or userPrincipalName from Active Directory

I'm trying to setup authentication from Active Directory in FreeBSD 10.0 using nslcd (nss-pam-ldapd-sasl package) and would like to allow both sAMAccountName and userPrincipalName as valid login ...
5
votes
0answers
201 views

How to prevent browser password prompts when no Active Directory single-sign-on?

We have single-sign-on working on an internal website, with Apache and mod_auth_kerb ... except users without the relevant browser config are getting password prompts instead of an error page. Users ...
5
votes
0answers
2k views

Questions about ktpass/kerberos with Active Directory

I got a few questions about Kerberos with Active Directory, specifically about the ktpass tool. The example AD I'm using (everything is on 2012R2 level): Active Directory Domain Name: ad.example.com ...
5
votes
0answers
882 views

How do I fix a non-starting “Microsoft Key Distribution Service”? (not to be confused with Kerberos KDS)

The Microsoft Key Distribution Service is not starting on my DC (kdssvc.dll) and when I look at the event log under Microsoft\Kdssvc, I see the events: Event ID 4001 Group Key Distribution ...
5
votes
0answers
422 views

Installing MSA (Managed Service Accounts) using Windows deployment tools

I have to install several new application servers (2012R2) for a project which will run IIS and MSMQ. I need to script the complete install, so I need to be able to change permissions on IIS ...
4
votes
0answers
31 views

Moved AD Connect to a new server and now end-users are getting errors when replying to internal emails in Outlook

I moved my Microsoft AD Connect install from one server to another today. I installed AD Connect on the new server in staging mode, turned on staging mode on the old server, turned it off on the new ...
4
votes
0answers
397 views

Intermittent login problems (LDAP timeout?) with ejabberd

We're running ejabberd 17.07 on an Ubuntu 17.10 VM, and authenticating against an Active Directory on Windows Server 2012 R2. This mostly works, but several times a day, logging in fails. It appears ...
4
votes
0answers
787 views

Joining a server to AD via AWS cloudformation

I want to use cloudformation to automatically join new instances to AD. When I googled this it looks like many people just use scripts in there cloudformation templates and pass in credentials- I don'...
4
votes
0answers
4k views

LSA SID cache keeps old entry for renamed domain user - why?

I have a question about LSA SID cache on a domain member server. Recently I run into the issue when some users after their name was changed in AD has difficulties accessing application I support, and ...
4
votes
0answers
981 views

Cannot enable GSS-TSIG updates from Active Directory in BIND 9.10

I’m with a problem trying to enable GSS-TSIG with BIND 9.10. Before I start describing what I’ve done, I would like to say that I’ve already done this in in another domain without any problems. So I ...
4
votes
0answers
36k views

Windows 7 there are no logon servers available to service the logon request subdomain

I've read other solutions, but my problem is slighlty different. Problem occurs in domain environment. We work in a subdomain, but we also have some employees coming with notebooks registered in top ...
4
votes
0answers
62 views

Why is Office 2010 asking me to choose one of only one potential account to open a restricted document

We have implemented an AD Rights Management System in our domain. Occassionally, when I send a protected email to someone in my domain or someone sends one to me, I will be prompted with a dialog box ...
4
votes
0answers
1k views

DSGET escapes hash signs (#) in outputted Distinguished Names (DN)s but expects unescaped hash signs for input

Lets say I want to do the very simple query in AD dsquery user -name "John Smith" | dsget user -memberof -expand This will output the DNs of the AD groups that this user belongs to. I can make it ...
4
votes
0answers
608 views

Single Sign On through Citrix

I have a webserver running Windows 2008 R2 with IIS 7. The server is a member of the domain "mydomain.com". What I am trying to achieve is a SSO connection between the AD users and the web server. The ...
3
votes
0answers
38 views

Stop Google forcing a password change on newly created accounts

I'm in the process of implementing Google's GSuite Password Synch on a Windows Server 2016 AD system. I've installed the Cloud Directory Sync software which successfully creates new users in GSuite ...
3
votes
0answers
103 views

Is there any way to get an AD bound linux system to mount home directories from a Windows server?

We've been experimenting with integrating linux systems into what is largely a Windows domain, with a Windows-based Active Directory server. After considerable trial and error, we have successfully ...
3
votes
0answers
231 views

PKI Authentication in HTTPD using Active Directory (LDAP)

In my environment, an external entity provides a Root CA & Intermediate CA(s). They issue thousands of smartcards with PKI certificates for authentication. They provide the Client Authentication ...
3
votes
0answers
372 views

UNC Path Issues: One Way Only

So I have an interesting issue where I have a stretched Server2012r2 domain (all servers running Server2012R2 and fully up to date) that spans two data centers; let's call them SiteA and SiteB. The ...
3
votes
0answers
304 views

Enroll on-behalf-of certificate using existing CSR file

Good day, I have a CSR (certificate signing request) file, which was generated on some remote non-domain station. I have created some AD user account. I have Enrollment Agent certificate signed for ...
3
votes
0answers
1k views

Centos 7 SSSD based user access stops working after AD password change

We use SSSD to provide AD authentication, and kerberos TGT acquisition, on Centos 7.3 build 1611. This works correctly for 99% of users most of the time, but we've hit an issue where post-password ...
3
votes
0answers
343 views

Computers lose trust relationship - disappearing from domain controller

This happens very seldom but lately a computer lost the trust relationship with our domain so I wanted to reset the computer credentials. Looking at my main DC (Server 2008 R2) I wasn't able to find ...
3
votes
0answers
1k views

GPO says Version Mismatch on Domain Controller when Versions appear to Match

On my primary domain controller, the AD and Syslog version of each of my GPO policies appears to match correctly: However, when I run a Group Policy Results report, it says that their is an "AD / ...
3
votes
0answers
591 views

Constant Audit Failures in Event Viewer from Users not logged on

Let me start off with some details on my environment: Windows Active Directory Domain Environment Domain Controller: Windows Server 2003 R2 Problem Workstation: Windows 7 Professional 64-bit Lately ...
3
votes
0answers
62 views

Backup, Modify and Restore of Active Directory

Is there an easy way to do a backup, modify and restore of an active directory instance? More specifically, I'm looking to do a backup, then change all references of DC=foo,DC=com to DC=foo,DC=dev so ...
3
votes
0answers
42 views

Workaround for Bloated Security Groups and Login Issue?

For each client, I have set up a main folder and service subfolders. These folders have Access-Based Enumberation (ABE) enabled and users belonging to the correct Security Groups (SGs) are able to ...
3
votes
0answers
1k views

No logon servers available to process your request

Edit: I've added new info in bold I've got a Windows 10 Pro machine fully updated (Anniversary edition + 1607 update) joined to a Windows AD Domain (on Windows Server 2012). This is a new install ...
3
votes
0answers
83 views

Active Directory expired certs causing issues with 802.1x authentication

We are in the process of rolling out 802.1x in our environment. With that said, there are quite a few clients that revert back to an older (expired) certificate which prevents them from ...
3
votes
0answers
26 views

W2K3 CA server gone offline, how to clean my AD?

We have decommissioned an old W2K3 DC server, on which was a CA installed. The CA wasn't really used (no PKI infrastructure), just was here as a test. After the server 's gone offline, I have several ...
3
votes
0answers
785 views

Folder redirection to Samba fails, though mapping drives works [SOLVED]

I'm at a university. We have a campus-wide AD domain that we can use to authenticate our labs. I'm trying to set up a Linux server for mapping drives and folder redirection. The Samba server is an ...
3
votes
0answers
529 views

DHCP Server not responding to relayed DHCP DISCOVER

I'm currently segmenting our network in various subnets. We already have a DHCP server as a part of our Active Directory (Server 2012). I want to use this server for all subnets so I need to work with ...
3
votes
0answers
56 views

Why can't I see the file version of files in system32 remotely?

Here's the situation: I can RDP into a computer, go to C:\Windows\System32, and check file versions to my heart's content. Such as winlogon.exe, explorer.exe, etc. If I map the drive, and try to ...
3
votes
0answers
88 views

Is it possible to use Active directory without a trust relationship for FreeIPA passwords?

I am looking to integrate FreeIPA with an Active Directory environment that I do not have full control over and most likely will not be able to get a trust relationship setup with my FreeIPA install. ...
3
votes
0answers
97 views

Group Policy - Not automatically running on all machines

We are facing an issue on one of our domains where machines are not all running group policy refreshes at its default interval. I am not seeing the 1501 events logged in the system log, I occasionally ...
3
votes
0answers
480 views

Kerberos keytab file not working

I have two AD domains and I'm trying to use NFS with Kerberos to both of them. Part of the procedure requires creating keytab files for the host and nfs principals for the client and server ...
3
votes
0answers
562 views

How can I programmatically unbind IPv6 from a network interface on a Windows 7 machine?

I need to unbind the IPv6 services from a number of client workstations running Windows 7. ("Untick" the selected box in the screenclip below.) For what it matters, they currently all have a single, ...
3
votes
0answers
261 views

Giving users of an OU permission to enable and disable users of their own OU

I want users of an OU to have access to enable and disable user accounts in their own OU. I believe in order to do this I need to grant the Read and Write userAccountControl property to the SELF ...
3
votes
0answers
153 views

I need help trying to authenticate with AD from my linux machine

I am not experienced in this, so there might be some points that I am missing. Initially I tried to setup Cyrus Mail w/ SASL for AD authentication. After several tries, it failed to work. I switched ...
3
votes
0answers
177 views

Use 2008 R2 and 2003 server domain and LDAP with Windows 8.1 and Windows 10?

I have two server domain one with Windows Server 2003 server and other Windows Server 2008 R2. With this can I use Windows 8.1 and 10 clients to connect with domain and apply policies?
3
votes
0answers
908 views

Active directory filter to get all users on several AD locations without using groups

I'm required to use AD for authorization to some online tools to ease software development across three countries in a big international company. The tools AD/LDAP section have one line to specify a ...
3
votes
0answers
608 views

LDAP over TLS fails to connect, Schannel Alert 48

I am trying to use PHP to edit users in active directory through LDAP. My test machine is using a simple WAMP setup and is NOT connected to the windows domain. This machine can connect to LDAP on the ...
3
votes
0answers
56 views

Universal Group in domain not behaving as expected in multi-forest environment

I have an environment with 2 forests, F1 and F2 with a full, transitive, bi-directional trust between them. F1 has a single domain that holds an SSRS server. F2 has 2 domains, F2parent and F2child, ...
3
votes
0answers
1k views

Exchange 2013 and AD/GC issues

I have Exchange 2013 (minimal install and all roles are on a single server) on-premises running on a Windows 2012 R2 server (both Windows and Exchange are patched and up-to-date). Basically this ...
3
votes
0answers
47 views

Windows Server - Protect websites with AD user

My question is a bit tricky to explain :) We have ASP.NET websites running on Windows Server 2012. Some websites use SqlServer authentication, others use Windows authentication, some don't have any ...
3
votes
0answers
1k views

Group Policy - Drive Mapping Preferences - slow login even if only using Computer Config side

We are having some users with very slow login times, up to 20 minutes, but only for a handful of users. I've narrowed it down to a particular GPO that does nothing but Drive Mapping Preferences. I ...
3
votes
0answers
48 views

Consolidating Domains from 2 UPN's to 1

We currently have 1 domain (no children) at corp.domain.com. We have an alternate UPN so that users can have their UPN as username@domain.com (no corp). Many of our earlier users however have the ...
3
votes
0answers
6k views

Allowing LDAP authentication from DMZ to Active Directory. Is my idea secure?

I have a internet-facing application server that I want to use AD authentication. This is my first time doing this for a none MS application or without some sort of proxy. I already have a idea in my ...
3
votes
0answers
217 views

Windows 2012 Master & Ubuntu Bind 9 Slave & SOA

I'm kinda like the maid... I don't do Windows. But thanks to new things we're implementing, I'm now attempting replicating a single zone from our AD cluster. We had this working just fine but ...
3
votes
0answers
955 views

SecErr: DSID-031A1190, 4003 (INSUFF_ACCESS_RIGHTS), data 0

I am trying to change the password of the currently logged in user via ldifde using this command: ldifde -i -f pwd.ldif -t 636 My AD server is running in SSL mode with a self signed certificate. The ...
3
votes
0answers
673 views

Windows Sub CA not issuing certificates

I set up a fresh 2-tier PKI to try and replace an old broken PKI with a CA that was no longer available. Everything seems to be working between the offline root and online issuing CAs, but now I'm ...