Questions tagged [active-directory]

A Microsoft technology that constitutes an LDAP directory service with centralized management functionality for user accounts, computer accounts, groups, and configuration management across many Windows servers and desktops.

21
votes
1answer
2k views

How to time-bomb a GPO?

I am doing a lot of work in higher education where it is a rather common requirement to reconfigure a number of Windows domain members (e.g. PCs in a classroom) for the duration of a specific course ...
21
votes
7answers
42k views

Windows Appending Domain Suffix To All Lookups

I have a recurring DNS problem that has been plaguing our users occasionally causing their laptops to appended our companies domain to the end of all DNS queries. The problem only occurs when users ...
20
votes
4answers
4k views

Accidentally deleted entire Active Directory [closed]

While re-partitioning a Server 2003 R2 domain controller, we accidentally deleted the partition that held the Active Directory database folder (D:\AD\Data). The D:\ was a partition on a disk shared ...
20
votes
6answers
31k views

Does it make sense to use Windows Active Directory in a small group of say less than six users/ computers?

For a (very) small company would using Windows server with AD be overkill - why not just use it as a file/ print server, administration server from which to access all machines on the network via ...
20
votes
4answers
97k views

Can I override domain group policy with local group policy as a local admin?

I am trying to provision a few special case laptops. I would like to create a local guest account. That's fine but when I try to create it I prompted that my guest password does not meet the ...
20
votes
2answers
43k views

How does a client system in an Active Directory network find in which site it resides?

As I was putting together a presentation for beginning Windows administration, I was struck with a question that I'm amazed I haven't asked sooner. I know that: AD is logically setup in sites to aid ...
20
votes
1answer
28k views

What needs to be done after a Domain Controller crash?

Assuming that at least two domain controllers were present in the domain to start with, what steps need to be taken to make Active Directory healthy after a domain controller crash?
20
votes
5answers
110k views

Active Directory: Viewing “Attribute Editor” after finding an account via ADUC's “Find” option

When I activate the Advanced features (View -> Advanced Features) and open a user's properties by navigating to their OU and right clicking the user object, I see the Attribute Editor tab. However, ...
20
votes
3answers
13k views

How do I delete this orphaned Active Directory computer object (preferably with PowerShell)?

I'm working from a Windows 7 workstation, with PowerShell v2.0, and trying to delete a particular (orphaned?) object from the LostAndFound container in a 2008 R2 FL forest and domain with the Active ...
19
votes
4answers
98k views

How to create Active Directory user account with powershell

I am constantly setting up research and development environments that require active directory accounts. Since we place these environments in isloated networks each environment needs its own active ...
19
votes
1answer
96k views

What permissions are required for enumerating users groups in Active Directory

I have a .net web application which needs to obtain the groups a user is a member of in Active Directory. Todo this I am using the memberOf attribute on the users records. I need to know the ...
19
votes
2answers
355 views

Multiple reverse DNS record internal DNS

A user was having trouble connecting to the internet, some sites worked some sites did not. I do not think it has anything to do with networking gear, but just in case. 2 firewall, Palo-Alto 4 ...
19
votes
2answers
10k views

Setting Mercurial with Active Directory authentication and authorisation

I am evaluating the possibilities of moving my organisation to Mercurial, however I am stumbling on two basic requirements which I can't find proper pointers to. How do I set up Mercurial's central ...
18
votes
1answer
33k views

How to authenticate Linux accounts against an Active Directory and mount a Windows share on login?

I'm using Ubuntu 10.04 Server.
18
votes
8answers
27k views

What's a read-only domain controller actually useful for?

Windows Server 2008 introduced read-only domain controllers, which receive a full replica of the domain database but can't modify it, just like a good old Windows NT BDC. I know all the technical ins ...
18
votes
2answers
76k views

Can I replace my domain controller with Azure Active Directory? [duplicate]

I currently have a small network with a few servers and about 25 client PCs. We are using Office365 and have AD synchronisation setup from our on-premise server. We also have single-sign-on setup ...
17
votes
2answers
2k views

What are the implications of enabling the Recycle Bin feature in Active Directory?

An admin accidentally deleted the wrong OU and it removed several account and computer objects. The recycle bin optional feature was not enabled. We used adrestore from sysinternals to get the ...
17
votes
4answers
14k views

PowerShell Script to find AD users with adminCount > 0

I've recently discovered the "adminSDHolder" feature of Active Directory. I need a quick way to identify all users who will be affected by it, namely a script to dump the user accounts.
17
votes
3answers
99k views

How to find the cause of locked user account in Windows AD domain

After a recent incident with Outlook, I was wondering how I would most efficiently resolve the following problem: Assume a fairly typical small to medium sized AD infrastructure: several DCs, a ...
17
votes
4answers
75k views

What is a domain controller, when is it needed, and how to set it up?

I would like to know what do we mean by Domain controller and how do we make a system a Domain Controller and when do we have to make a system a DC?
17
votes
2answers
6k views

Server 2012R2 DNS server returning SERVFAIL for some AAAA queries

(Rewriting most of this question since a lot of my original tests are irrelevant in light of new information) I'm having issues with Server 2012R2 DNS servers. The biggest side effect of these ...
16
votes
7answers
98k views

Powershell: How do I query pwdLastSet and have it make sense?

I need to get the last password change for a group of account in an Active Directory security group, and I feel like this is something PowerShell should be good at. Right now, I'm already stuck at ...
16
votes
6answers
17k views

Active Directory vs OpenLDAP

This is for a small company (12 developers) who haven't implemented any centralized user database - they've grown organically and just created accounts on computers as they needed. From a management ...
16
votes
3answers
42k views

Moving primary domain controller to new server

I have just purchased a new server that will be the new primary domain controller. I was wondering if anyone knew any articles or tutorials on how to do this change over? I would imagine it is just ...
16
votes
3answers
31k views

Is there a way to refresh computer group membership without rebooting?

I am using Windows Server 2008 R2 and have a windows service running under "network service" account in computer ComputerA. This windows service want to access a share folde (on another computer ...
16
votes
2answers
6k views

Website and Active Directory domain share the same name

In our network the name of the network domain is also the domain of the organization's website (say, example.com). Externally, people can enter example.com to visit our website, but internally, this ...
16
votes
3answers
5k views

How can I verify AD replication between two DCs works

We have a domain with 3 DCs in different networks and we want to decomission one of them. However, I suspect that the two remaining DCs will not replicate properly between each other due to some ...
16
votes
1answer
30k views

GPOs fail to apply; reason: Inaccessible, Empty, or Disabled; Server 2012 R2 and Windows 10

I have a Windows Server 2012 R2 Domain. Yesterday, a computer’s (running Windows 10 Pro) network drive stopped working. After further investigation (gpresult /h) it appears ALL group policy objects ...
16
votes
9answers
76k views

VPN Connection causes DNS to use wrong DNS server

I have a Windows 7 PC on our company network (which is a member of our Active Directory). Everything works fine until I open a VPN connection to a customer's site. When I do connect, I lose network ...
16
votes
2answers
12k views

How to properly remove lingering objects when -strict has been set on a large number of DCs for a long time?

I was recently in an environment where there were 120 domain controllers in over 100 sites around the world. This domain began in the Windows 2000 era and was upgraded over time, so strict replication ...
16
votes
3answers
19k views

How do you manage Java in your Windows/Active Directory environment?

Like I suppose a lot of people, we have a Windows/Active Directory environment and a lot of internal line of business apps that require Java. Our experience is that Java does not play nice in such a ...
15
votes
11answers
110k views

Command line active directory query email address for username

On Windows XP in an Active directory environment - what is the easiest way for me to query a user's email address from AD given their username on the command line. (Assuming I know where it is kept ...
15
votes
3answers
7k views

Why can I login to a box even if the AD Domain controller is down?

Scenario: While my DC is running, I log into an arbitrary machine. I stop the DC I log off the arbitrary machine. Let's bounce it for good measure, too. When the machine comes back up, I can still ...
15
votes
1answer
19k views

What is an open DNS resolver, and how can I protect my server from being misused by hackers?

I don't have the strongest background in computer security, but yesterday one of my company servers was shut down by our host. It's a server assigned a public IP where I host several web-service ...
15
votes
5answers
3k views

Mercurial (hg) with active directory

Can I setup Mercurial to authenticate users on Active Directory? In my case, hg can run on Windows, Linux or FreeBSD, but I need to use AD users. Note: if it is possible, then please point me to a ...
15
votes
3answers
80k views

User in domain admin group cannot access directory the group has permission to access

I've run into a rather interesting issue when playing with one of my domain labs. There's a directory on a 2008 R2 fileserver that's being used for folder redirection for all users in the "Staff" OU. ...
15
votes
3answers
45k views

Getting Squid to authenticate with kerberos and Windows 2008/2003/7/XP

This is something I setup recently and was quite a big pain. My environment was getting squid to authenticate a Windows 7 client against a Windows 2008 Server invisibly. NTLM is not really an option,...
15
votes
8answers
83k views

How do you find out if Active Directory is using Kerberos or NTLM?

Is there a command line program you can use?
15
votes
7answers
11k views

Google Apps, AD and SSO

We're a small shop running Google Apps (Enterprise) for our email needs. Love it. Internally, we're using Windows AD (2003). No complaints there either. I'd like to get some method of SSO going ...
15
votes
5answers
2k views

How can we remotely administer our “fleet” of Windows 7 laptops?

I'm working with a startup that's teaching kids to program. We've just obtained our first "fleet" of laptops - half a dozen refurbished thinkpads running Windows 7 - and I'm looking for the best way ...
15
votes
4answers
7k views

Windows DHCP Server - get notification when a non-AD joined device gets an IP address

SCENARIO To simplify this down to it's easiest example: I have a Windows 2008 R2 standard DC with the DHCP server role. It hands out IPs via various IPv4 scopes, no problem there. WHAT I'D LIKE I ...
15
votes
9answers
70k views

Domain computer cannot resolve internal hostnames, but nslookup can

I have a Windows 7 computer on my domain that is behaving oddly. It is possible to ping www.google.com It can ping internal hosts using their IP address It can ping the local Domain Controller/DNS ...
14
votes
3answers
626 views

Active Directory Virtualization

My company is looking to try and virtualize all our servers, and we are trying to figure out if virtualizing active directory is a good idea. Is it even something that can be done, and if so are ...
14
votes
4answers
98k views

How do I bulk reset passwords for all users in an OU?

I'm a developer at my organization, but I've been tasked with resetting the passwords on 10k e-mail users in an OU in Active Directory. I was given the proper permissions, then sent the following ...
14
votes
5answers
41k views

My public website name and AD domain name are the same. How can I get to my external website from inside my network?

I am using my domain example.orgin my firm. I can use www.example.orgto view my website. If I try http://example.org from outsite my firm there is no problem, but if I try it from inside, my windows ...
14
votes
3answers
2k views

Clean up Active Directory [closed]

Does anybody know of any useful Tools for cleaning out Active Directory on a Server 2003 domain? I want to clean up old computers, etc, and prefer a free tool. I have a lot of devices that I know ...
14
votes
4answers
121k views

Domain Admins vs. Administrators in Windows AD DC [closed]

Having read in the Microsoft Docs article Default groups the description of these two groups: Domain Admins Members of this group have full control of the domain. By default, this group is ...
14
votes
3answers
10k views

Removing old computers on a domain

The Windows Domain I manage has hundreds of computer names which I don't recognise and I'd like to remove old ones which aren't in use before trying to track down the misnamed ones. Is there someway ...
14
votes
4answers
44k views

Is there any difference between Domain controller and Active directory?

If I want to define domain controller then i would say DC is where active directory installed or Acitve Directory simply means: Secure centralized authentication and management and domain controller ...
14
votes
3answers
3k views

What next after a Windows domain account has been compromised?

We're preparing for a scenario when one of the accounts in a domain gets compromised—what to do next? Disabling the account would be my first go-to answer, but we had pentesters here a few weeks ago ...