The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [active-directory]

A Microsoft technology that constitutes an LDAP directory service with centralized management functionality for user accounts, computer accounts, groups, and configuration management across many Windows servers and desktops.

1,780 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
10
votes
1answer
560 views

AD custom attribute of type numerical string crashes MMC when updated

I am using windows server 2008. I have a domain with one domain controller (this is a dev environment). I edited the AD schema and created a custom attribute called TestAttribute2 (the LDAP name is ...
8
votes
2answers
1k views

Unable to bind OSX 10.9 to Active Directory 2008

I am struggling to bind OSX 10.9 to a 2008 r2 Active Directory. I can join the domain fine when I boot into Windows from the same machine. From OSX I can find the domain controller successfully and ...
8
votes
1answer
1k views

DNS and Active Directory configuration for a branch office

We've got a branch office with no on-site services at the moment, and we'd like to change that. The biggest goal is to setup some file servers but faster logins and DNS resolution will be welcome as ...
8
votes
1answer
23k views

UnKnown can't find <hostname>: Non-existent domain

I have a small network running Windows Server 2012 servers and Windows 7 clients. Right now I'm trying to setup DNS with an AD-Integrated Zone. I've configured my local machine, which is not a domain ...
7
votes
0answers
132 views

Sunsetting Microsoft Identity Management for Unix the right way

I'd like to make sure that we don't have any connections to our AD controllers before sunsetting, but some run Microsoft Identity Management for Unix / Server for NIS. I'm having a dog of a time ...
7
votes
0answers
3k views

Unix nslcd login with sAMAccountName and/or userPrincipalName from Active Directory

I'm trying to setup authentication from Active Directory in FreeBSD 10.0 using nslcd (nss-pam-ldapd-sasl package) and would like to allow both sAMAccountName and userPrincipalName as valid login ...
7
votes
2answers
3k views

A single AD user can't log into a single Mac bound to the domain (DirectoryServices error). How can I resolve this?

On our campus, we have about 60 Macs joined to our Active Directory domain. Most users have no problems logging into Macs, as long as their accounts are configured correctly. However, we have one ...
6
votes
2answers
596 views

Q: RHEL, SSSD, Active Directory

Good afternoon folks. I've been perusing various posts already about getting linux systems to authenticate using AD, but haven't seen anything approaching what I'm beating my head against. There's a ...
6
votes
1answer
613 views

Active Directory Administrative Center - resize membership part

User can be a member of 3 groups at most to be visible in ADAC without scrolling. But in reality, users are members of 5, 10 even 20 groups. We have to scroll the "member of" list to check the ...
5
votes
1answer
1k views

AWS EC2 - Clone Windows Server Machines That Are Domain Joined

Firstly, I am using these as a base guide: http://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/ami-create-standard.html http://reduktor.net/2014/09/autoscale-ec2-instances-ad-aws/ Secondly, our ...
5
votes
0answers
1k views

How do I fix a non-starting “Microsoft Key Distribution Service”? (not to be confused with Kerberos KDS)

The Microsoft Key Distribution Service is not starting on my DC (kdssvc.dll) and when I look at the event log under Microsoft\Kdssvc, I see the events: Event ID 4001 Group Key Distribution ...
5
votes
0answers
504 views

Installing MSA (Managed Service Accounts) using Windows deployment tools

I have to install several new application servers (2012R2) for a project which will run IIS and MSMQ. I need to script the complete install, so I need to be able to change permissions on IIS ...
5
votes
1answer
375 views

Active Directory: Server 2008 and RHEL 5.10

Apologies if this is a re-post. I've been googling and researching the topic for over three weeks now and I've come up against the same problem over and over again and I haven't managed to get around ...
5
votes
1answer
5k views

Cross-Realm trust verify failed with 'netdom' command

Question 1: Am having my ActiveDirectory in Windowsserver 2012 machine - its domain name is AD-DEMO.LOCAL Kerberos admin-server is in another Ubuntu machine - its realm KERBEROS.COM Added trust in '...
5
votes
1answer
5k views

Windows Server 2008 R2 hangs when Editing folder permissions

Background: The server in question is a member of a domain. This is a brand new server, freshly installed. I can log into this server using any domain user (which tells me that on some level it is ...
5
votes
1answer
3k views

Automatically refresh credential after password change

Lets say we have around 300 Windows XP machines on our ActiveDirectory domain that are used for processing something. Each has an account which is patterned on the machines name. As these are ...
5
votes
1answer
337 views

How to prevent browser password prompts when no Active Directory single-sign-on?

We have single-sign-on working on an internal website, with Apache and mod_auth_kerb ... except users without the relevant browser config are getting password prompts instead of an error page. Users ...
4
votes
0answers
63 views

Microsoft RemoteApp via TS Gateway initial connection load very long (over 2 minutes)

The Enviroment We do have a RemoteApp Terminalserver, based on a Windows Server 2016. Latest Updates are installed. We have provisioned multiple apps through this server. There is one Session ...
4
votes
0answers
279 views

Samba and AD - “net ads changetrustpw” fails

I've got a Samba member of a Windows AD. I'm using a combination of sssd and winbind. Samba manages machine password changes, and it's configured also to update the passwords used by sssd. (The ...
4
votes
0answers
48 views

Moved AD Connect to a new server and now end-users are getting errors when replying to internal emails in Outlook

I moved my Microsoft AD Connect install from one server to another today. I installed AD Connect on the new server in staging mode, turned on staging mode on the old server, turned it off on the new ...
4
votes
1answer
52 views

AD migration 2008 r2 to 2012 r2 - must've missed something

I finally went through with this the other day. Got DNS/AD setup, seized FSMO roles on the 2012 server, migrated DHCP etc. I thought I was ready to go so I turned off the 2008 server yesterday. ...
4
votes
0answers
567 views

Intermittent login problems (LDAP timeout?) with ejabberd

We're running ejabberd 17.07 on an Ubuntu 17.10 VM, and authenticating against an Active Directory on Windows Server 2012 R2. This mostly works, but several times a day, logging in fails. It appears ...
4
votes
1answer
2k views

Active Directory - Account exists but cannot find it to remove it

I'm trying to add an AD Managed Service Account and my first attempt was as follows: New-ADServiceAccount -DNSHostName VM-Backup-Service -Name "VM Backup" -samAccountName VM_Backup -Path "OU=...
4
votes
1answer
2k views

Powershell: setting owner for AD DS objects fails

I want to run a Set-ACL on an AD DS object1 with "Domain Admins" set as the owner in my constructed ACL object. The code looks basically like this2: Function SetDSAcl { Param ( [...
4
votes
0answers
965 views

Joining a server to AD via AWS cloudformation

I want to use cloudformation to automatically join new instances to AD. When I googled this it looks like many people just use scripts in there cloudformation templates and pass in credentials- I don'...
4
votes
0answers
2k views

Questions about ktpass/kerberos with Active Directory

I got a few questions about Kerberos with Active Directory, specifically about the ktpass tool. The example AD I'm using (everything is on 2012R2 level): Active Directory Domain Name: ad.example.com ...
4
votes
1answer
486 views

Issues with demoting a DC, remnants of failed SBS2011 DC still in directory

So, an environment I'm new to, is having some problems that I'm trying to correct. Old config: Single SBS2011 server, a second 2008 R2 DC was added at some point. SBS failed, roles were seized and ...
4
votes
1answer
747 views

Fileserver cannot find any DC's for trusted domain

The problem Due to a merger in our organisation, we are migrating to a new common Active Directory domain. Our old legacy domain and the new domain have a two-way trust between them. We have two ...
4
votes
1answer
5k views

Secure channel trust verification fails

Working on an issue with setting up a trust between two domains with several firewalls in between, and a pinhole routing between two servers in them. newdc.newdomain.com is a 2012 server in a brand ...
4
votes
0answers
4k views

LSA SID cache keeps old entry for renamed domain user - why?

I have a question about LSA SID cache on a domain member server. Recently I run into the issue when some users after their name was changed in AD has difficulties accessing application I support, and ...
4
votes
0answers
1k views

Cannot enable GSS-TSIG updates from Active Directory in BIND 9.10

I’m with a problem trying to enable GSS-TSIG with BIND 9.10. Before I start describing what I’ve done, I would like to say that I’ve already done this in in another domain without any problems. So I ...
4
votes
1answer
2k views

My two-way trust with selective auth seems to behave opposite to a one-way trust

I'm not sure why I'm the only one running into this, I think it's a larger problem with Server 2012 and RDS protocols... With 2008 machines, you can use utilize a one way trust to authenticate across ...
4
votes
3answers
1k views

How do I launch a command on a remote computer with an invalid domain trust? (using local creds)

I intend to use WMIC to reset the trust of a machine that is remote, and off the network. All of the following variations result in an "access denied": The following works fine: net use \\patterson-...
4
votes
0answers
36k views

Windows 7 there are no logon servers available to service the logon request subdomain

I've read other solutions, but my problem is slighlty different. Problem occurs in domain environment. We work in a subdomain, but we also have some employees coming with notebooks registered in top ...
4
votes
1answer
654 views

Intranet corporate SSO for webapps against Active Directory

I am trying to plan and implement a SSO solution in a corporate environment that serves intranet web applications running on CentOS: Corporate portal (Drupal backend) Project management (Project.NET) ...
4
votes
1answer
837 views

Kerberos issues after new server of same name joined to domain

Environment: Windows Server 2012, 2 Domain Controllers, 1 domain. A server called Sharepoint1 was joined to the domain (running Sharepoint 2013 using NTLM). The fresh install for Sharepoint1 (OS and ...
4
votes
0answers
62 views

Why is Office 2010 asking me to choose one of only one potential account to open a restricted document

We have implemented an AD Rights Management System in our domain. Occassionally, when I send a protected email to someone in my domain or someone sends one to me, I will be prompted with a dialog box ...
4
votes
0answers
1k views

DSGET escapes hash signs (#) in outputted Distinguished Names (DN)s but expects unescaped hash signs for input

Lets say I want to do the very simple query in AD dsquery user -name "John Smith" | dsget user -memberof -expand This will output the DNs of the AD groups that this user belongs to. I can make it ...
4
votes
0answers
614 views

Single Sign On through Citrix

I have a webserver running Windows 2008 R2 with IIS 7. The server is a member of the domain "mydomain.com". What I am trying to achieve is a SSO connection between the AD users and the web server. The ...
4
votes
1answer
3k views

can't add sharepoint users from trusted domain

I have a very strange problem with our Sharepoint 2007 implementation. I went in today to grant access to a user and was greeted with "The user does not exist or is not unique." Let me start off by ...
4
votes
2answers
2k views

Allowing Domain Users to run winrm commands

Currently i have a AD/Kerberos Configured on one EC2 instance(Windows 2008 R2) and created couple of users. Each of the users has administrator privileges. When We login as a non-domain Administrator, ...
3
votes
0answers
75 views

Old server accounts persist after migration to Windows Server 2019

I went through the process of migrating Active Directory 2012 R2 to Active Directory 2019. Minus a few firewall ports needing to be opened up, I was able to get through the process of promoting the ...
3
votes
0answers
83 views

Stop Google forcing a password change on newly created accounts

I'm in the process of implementing Google's GSuite Password Synch on a Windows Server 2016 AD system. I've installed the Cloud Directory Sync software which successfully creates new users in GSuite ...
3
votes
0answers
240 views

Is there any way to get an AD bound linux system to mount home directories from a Windows server?

We've been experimenting with integrating linux systems into what is largely a Windows domain, with a Windows-based Active Directory server. After considerable trial and error, we have successfully ...
3
votes
0answers
1k views

DNS IPv6 settings on Domain Controllers

Both in my lab testing and on real installation I saw that, after a dcpromo (done via "Server Manager" on Windows 2016), a loopback IPv6 address is automatically added on the interface DNS settings (...
3
votes
0answers
341 views

PKI Authentication in HTTPD using Active Directory (LDAP)

In my environment, an external entity provides a Root CA & Intermediate CA(s). They issue thousands of smartcards with PKI certificates for authentication. They provide the Client Authentication ...
3
votes
0answers
532 views

UNC Path Issues: One Way Only

So I have an interesting issue where I have a stretched Server2012r2 domain (all servers running Server2012R2 and fully up to date) that spans two data centers; let's call them SiteA and SiteB. The ...
3
votes
1answer
551 views

Hosting Active Directory over Azure VM to connect clients without vpn

We(a small organization) are deploying an Azure VM as Active Directory Domain Controller. Now we want to add clients to this active directory and looking at the network/connectivity solutions. Have ...
3
votes
1answer
748 views

Is it possible to have Windows and Linux machines use the same LDAP server?

I'm trying to set up an accept-all environment between linux and windows. This includes LDAP support, as I want all the log-in credentials to stay server-side. My goal is to have a user use the same ...
3
votes
1answer
100 views

Programmatically/remotely remove untrusted but “bound” Windows from Active Directory

Due to some mistakes, I have a lot of machines that seem to be bound to Active Directory (AD) from their side, but not from the side of the AD. The machines thinks they are still in the AD, but the AD ...