Questions tagged [active-directory]

A Microsoft technology that constitutes an LDAP directory service with centralized management functionality for user accounts, computer accounts, groups, and configuration management across many Windows servers and desktops.

10
votes
3answers
10k views

Active Directory user names: why does the canonical name vary? Can I do something to make them uniform?

I am a self-taught administrator of a work Active Directory network used for Windows logins on ~30 PCs. I inherited the system from someone else who also didn't have any direct Microsoft training and ...
10
votes
1answer
1k views

Kerberos authentication, service host and access to KDC

I have a web application (hostname: service.domain.com) and I wish to use Kerberos authentication to identify users that are logged into a Windows domain. Microsoft AD (Windows Server 2008 R2) is ...
10
votes
1answer
2k views

Can a user account that is disabled in Active Directory still receive email?

I'm reading Learning Exchange Server 2003 by Boswell, and there's a section in there that mentions that a disabled account in AD cannot receive email and that it will be bounced back. Currently, what ...
10
votes
1answer
143 views

Best way to monitor Windows server? [closed]

I'm working at a company that provides our small business clients with IT support. One of my tasks is to perform service checks which includes checking the event viewer for critical errors/warnings as ...
10
votes
1answer
716 views

In a multi-domain forest, what EXACTLY happens when some, but not all, of the Infrastructure Masters are on Global Catalogs?

There are plenty of TechNet articles, like this one that say that phantom object don't get updated if an Infrastructure Master is also a Global Catalog, but other than that there isn't a lot of in ...
10
votes
3answers
4k views

How to deny access to disabled AD accounts via kerberos in pam_krb5?

I have a working AD/Linux/LDAP/KRB5 directory and authentication setup, with one small problem. When an account is disabled, SSH publickey authentication still allows user login. It's clear that ...
10
votes
3answers
3k views

Advice on Active Directory design for multihomed servers

I've been tasked by a customer to come up with a working Active Directory design for a scenario with the following requirements (simplified, they are actually a lot worse): There is a subnet for ...
10
votes
2answers
14k views

Active Directory Authentication with LDAP proxy

We have a services in a isolated network. These services need to authenticate users against the Active Directory server. However the Active Directory server is not directly available so I have to ...
10
votes
1answer
1k views

Active Directory forest with same name as root DNS zone and browsing to site with same name

Related to this previous question of mine about why it's a bad idea to use the root domain name as your Active Directory forest's name... I have an employer, whom I will refer to as ITcluelessinc, ...
10
votes
1answer
2k views

AD Cross-forest authentication - groups missing from PAC

I have an Active Directory setup consisting of 2 forests: 1 multi-domain forest with 1 forest root domain, and 2 direct child domains 1 single-domain forest for DMZ publishing purposes I have ...
10
votes
1answer
4k views

Active Directory: How does the computer logon process and the user logon process differ?

I believe it is correct to say that users and computers are treated as equal principals with respect to Active Directory. Both users and computers have passwords, and both users and computers are ...
10
votes
1answer
1k views

Are Windows 2016 DNS Policies / Split DNS possible on AD integrated zones with older DCs?

Windows Server 2016 supports DNS Policies, which provide support for split-brain DNS among other scenarios: You can configure DNS policies to specify how a DNS server responds to DNS queries. DNS ...
10
votes
1answer
722 views

Can I “merge” two groups using SID history?

I have two AD groups which were erroneously created while there should instead have been only one group; they contain the exact same users. However, these groups have been assigned various permissions ...
10
votes
3answers
10k views

Domain rename with Exchange 2010

I have taken over all IT responsibilities for a company that is using Active Directory (2008 R2 native level) and Exchange 2010. I have come to find out that their internal Active Directory domain ...
10
votes
6answers
41k views

How to change the current user's domain password without being domain admin?

I've seen plenty of documentation of how to reset a user's password by running net user <username> * /domain or locally net user <username> <new_password> But I am not domain ...
10
votes
4answers
30k views

How to disable Tcp/Ip settings in windows 7 via GPO?

I have enabled following policies, "Prohibit TCP/IP advanced connection" "Prohibit access to properties of components of a LAN connection" "Enable Windows 2000 Network Connections setings for ...
10
votes
2answers
14k views

How to enable BitLocker with no prompts to the end user

I have configured BitLocker and TPM settings in Group Policy such that all the options are set and the recovery keys stored in Active Directory. All our machines are running Windows 7 with a standard ...
10
votes
2answers
2k views

“The zone can be scavenged after” keeps incrementing

What are you trying to do? I'm trying to enable DNS scavenging on a DNS zone that has about a hundred stale DNS records. What have you tried in order to make it happen? I setup DNS Scavenging per ...
10
votes
1answer
551 views

AD custom attribute of type numerical string crashes MMC when updated

I am using windows server 2008. I have a domain with one domain controller (this is a dev environment). I edited the AD schema and created a custom attribute called TestAttribute2 (the LDAP name is ...
9
votes
2answers
6k views

Is it OK to use local. in an active directory domain name

I have read that it's not OK to use .local in a domain especially with Microsoft Windows servers. I have also read the Windows Active Directory naming best practices article on ServerFault which was ...
9
votes
3answers
30k views

What is LSASS.exe? And why does it take a lot of memory and CPU time?

I'm taking care of a windows servers in my company. AFAIK, the server is a member of active directory. I notice from task manager that the process LSASS.exe is taking a lot of memory and cpu time. Via ...
9
votes
4answers
37k views

A good way to reboot all computers on a Windows domain each night

What is a good way to reboot a list of windows computers on a windows domain? Assuming the windows domain controller does not have a service to do this, please make recomendations for a script. Can ...
9
votes
5answers
32k views

How can I set up Redmine => Active Directory authentication?

First, I'm not an AD admin on site, but my manager has asked me to try to get my personal Redmine installation to integrate with ActiveDirectory in order to test-drive it for a larger-scale rollout. ...
9
votes
4answers
32k views

Active Directory Licensing [duplicate]

Possible Duplicate: Can you help me with my software licensing question? I can't seem to find a clear answer to this question. What type of licenses do I need to buy ensure that everyone in my ...
9
votes
3answers
3k views

Should I have multiple domain administrator accounts?

I work in a small organization with 2 servers and 30 clients. We are completely Windows Server 2003/XP. Besides me, the Director of Operations and our IT consulting company need access to a domain ...
9
votes
7answers
38k views

Fix error determining whether the target environment requires adprep in windows server 2012, during domain controller promotion

I am unable to promote my newly installed Windows Server 2012 machine to a domain controller. I have two existing domain controllers. The primary is at Windows Server 2003 level, and is running ...
9
votes
2answers
51k views

How do Windows domain clients behave if the domain controller is offline?

If I have Windows PCs that are joined to a domain and the domain controller goes offline, what kind of behavior can I expect on the clients (assuming there is no second DC?) Will users be able log on?...
9
votes
1answer
364 views

Is there any reason to backup Active Directory if you have more than one domain controller?

In one site there are 3 domain controllers. There are an additional 3 domain controllers for 3 remote sites. My question: Is there any reason why you should still backup Active Directory? If one of ...
9
votes
2answers
4k views

Detecting AD Site options using PowerShell

How can I use PowerShell to find AD site options like +IS_INTER_SITE_AUTO_TOPOLOGY_DISABLED in PowerShell? I've been playing around with the following command, but can't get it to spit out anything ...
9
votes
2answers
23k views

Security Group vs Distribution Group

Within our AD set-up there are a lot of security groups, but only 1 distribution group (that a previous admin created). Both types of group contain lists of domain objects (users in the one I was ...
9
votes
1answer
17k views

How can I override group policy using a local administrator account?

I have local administrator access on my machine but somehow still can't change the screensaver setting. I believe it is being disabled by group policy somehow, is there a way to override this?
9
votes
5answers
23k views

How to integrate Active Directory with FreeBSD 10.0 using security/sssd?

What are the required steps to authenticate users from an Active Directory running on Windows Server 2012 R2 in FreeBSD 10.0 using sssd with the AD backend with Kerberos TGT working?
9
votes
2answers
8k views

Migrate Active Directory to new server?

We bought new server and we want to turn our current server off. how can I restore our active directory and DHCP and DNS(current server states) to new one? we got Active Directory, DNS, DHCP. our old ...
9
votes
3answers
648 views

In the Windows / Active Directory world what is a privilege, and how does that differ from permissions?

I just realized there's a difference between these two after I had to change a privilege to change permissions on a folder (and then set them back again). P.S. If this is a stupid question, I ...
9
votes
5answers
10k views

What is important to document in an active directory server?

Later this year I will be handing over support of my church’s active directory servers to someone else and would like to know what kind of information is important to document and share. Are there any ...
9
votes
3answers
26k views

Windows 10: AD Domain Admin with missing rights?

Maybe my title is not correct but I wouldn't know how else to name it at this point. If I log into a Windows 10 machine with the main AD Domain Admin Account, I get an error message when entering ...
9
votes
1answer
19k views

Default full name format in Active Directory

When I create a new account in Active Directory, I enter the new user's first name and last name, and it auto-fills the full name in the form "First Last". Can I set AD to use "Last, First" instead? ...
9
votes
3answers
78k views

Is my AD already an LDAP server?

I have installed an LDAP browser, to try and browse my AD information (this is part of enabling Google Directory Sync process). however, I keep getting a connection error (using port: 19389). the ...
9
votes
9answers
18k views

Should I install an AV product on my domain controllers?

Should I run a server-specific antivirus, regular antivirus, or no antivirus at all on my servers, particularly my Domain Controllers? Here's some background about why I'm asking this question: I'...
9
votes
4answers
17k views

Two Different Domains & Domain Controllers on Single Network

I'm attempting to determine whether it is possible to have two Active Directory domain controllers running on the same network, within the same subnet, with two separate domains. I do not want these ...
9
votes
3answers
8k views

Where do I store sensitive data within Active Directory?

I am essentially storing a private key (Hash) in any of the OctetString attributes within Active Directory. My question is, what attribute is secure by default and makes sense to keep private data ...
9
votes
2answers
18k views

Using Azure AD to push Group Policy settings

I am trying to use Azure Active Directory instead of using a traditional domain controller. I would like to use Azure AD to authenticate users and to push GPO settings, such as folder redirection, ...
9
votes
3answers
22k views

Putty Kerberos/GSSAPI authentication

I configured a few Linux servers to authenticate with Active Directory Kerberos using sssd on RHEL6. I also enabled GSSAPI authentication in hopes of passwordless logins. But I can't seem to get ...
9
votes
2answers
12k views

How do I block inheritance/application of a single GPO?

Due to the workload generated by recent ransomware outbreaks (Cryptolocker/Cryptowall/etc.), I was recently tasked with implementing Software Restriction policies to block program execution from ...
9
votes
2answers
29k views

How to use realmd in Ubuntu 14.04 LTS to join an Active Directory domain?

I want to use realmd to join an Active Directory domain from Ubuntu 14.04 LTS. To do that I just installed realmd and some dependencies with this command: aptitude install realmd sssd sssd-tools ...
9
votes
6answers
58k views

How to find the computer name a user logged on to

Is there a tool or script or some other way of knowing what computer name a specific user is currently logged on to? Or even was logged on to? Say the user "HRDrone" is working on his machine whose ...
9
votes
3answers
1k views

What good Active Directory + Exchange competition is there?

Based on this question regarding enhanced permission support in filesystems, what is the best permissions + directory and mail stack to compare against Active Directory on NTFS with Exchange? I'm ...
9
votes
2answers
2k views

Outline the quirks of Windows Small Business Servers (SBS)

I'm not much of a Microsoft administrator. However, I do work extensively with new and existing Microsoft Exchange deployments. That's just how the career-arc went. I'm working with a small customer ...
9
votes
2answers
2k views

Active Directory - Bulk Company Update

I was wondering if there is a way to update the 'Company' field for a large group of users within Active Directory? I would like to match all users with a company ending in a certain string. It would ...
9
votes
2answers
4k views

Best Way to Track Brute-Force Username Enumeration / Failed Username Attempts AD

We have a Windows Server which has an application that resides on it, which uses domain credentials on login to the application. During a recent pen test, the testers were able to use the application ...