Questions tagged [active-directory]

A Microsoft technology that constitutes an LDAP directory service with centralized management functionality for user accounts, computer accounts, groups, and configuration management across many Windows servers and desktops.

Filter by
Sorted by
Tagged with
1
vote
1answer
591 views

How to issue a windows machine cert for a non-domain joined computer?

I have a Windows Server 2012 AD/CA and domain joined computers automatically receive the CA public cert and also get a computer certificate generated and pushed using GPO auto-enrollment. All of this ...
4
votes
4answers
342 views

AD: OU for system administrator accounts

Just a simple question: Does it make sense create a dedicated OU in Active Directory for system administrators (including domain controller admins)? Are there drawbacks following this approach? Is ...
0
votes
0answers
34 views

How to audit what are the anonymous binds made from my server?

After an audit, I am trying to identify the applications generating anonymous binds on the Domain Controllers before the remediation happens. So far, we only have the DCs logs, and that doesn't ...
0
votes
2answers
36 views

Change requirements for resetting user password via AD Users&Computers

I know we can set password policy for how users can define their passwords. But is it possible to define the required complexity when an admin resets the password via 'AD users and computers' reset ...
2
votes
0answers
33 views

Domain-joined computer doesn't have Domain network profile

One computer in our domain suddenly shows only Private network and Public network profile. It's probably connected to some update, when also network adapter name changed from "Intel Ethernet ...
1
vote
1answer
36 views

Is it possible to choose which objects get synchronized in AWS Managed AD?

In Azure AD Connect Sync, it is possible to configure filtering. This is described as: By using filtering, you can control which objects appear in Azure Active Directory (Azure AD) from your on-...
0
votes
1answer
32 views

How to use Veeam to recover locally-hosted Exchange mailbox alias to implement on Exchange Online

I've inherited an IT department after just 1 year in it, during which the 30-year sole-IT person retired, and his replacement, who hired me, left for a remote position. Shortly before he left, Veeam ...
1
vote
0answers
199 views

failed attempts by guest user

im a part security monitoring team Many guest failed login attempts are triggered in our environment while in my investigation, Eventcode 4625 with a subject AccountName=John account name for ...
4
votes
0answers
58 views

Microsoft RemoteApp via TS Gateway initial connection load very long (over 2 minutes)

The Enviroment We do have a RemoteApp Terminalserver, based on a Windows Server 2016. Latest Updates are installed. We have provisioned multiple apps through this server. There is one Session ...
1
vote
1answer
29 views

Is it possible that AD forest have different versions of AD on different sites?

As I plan upcoming AD upgrade (from 2008R2 to 2019) I face another problem: we're actually have AD Forest that consists of several sites, each of them on 2008R2 AD version. As we upgrade one site AD ...
2
votes
0answers
47 views

Ubuntu 18 inserting leading space to username

We have an Ubuntu 18.04 client authenticating against a Samba 4 Active Directory. On this client (and this client only) when a specific user (and this user only) logs in via ssh, tty, or the GUI (at ...
1
vote
1answer
891 views

AD: Windows 2008R2 to 2019 migration, one leap or step by step

In our company we are planning to do Windows 2008 R2 migration due to End of Support it reached. We're not that fans of living on edge but this time it appear to be wiser target to Windows Server 2019,...
2
votes
1answer
280 views

Guacamole Apache LDAP Assignment

I have managed to setup ldap authentication with my active directory server running server 2016. I can authenticate to guacamole perfectly with AD accounts. Now comes assigning the AD users desktops. ...
5
votes
2answers
226 views

Can't delete OU from AD, IsCriticalSystemObject attribute TRUE - cannot change

I recently took over a contract for a customer where the previous IT apparently did a half-ass job of migrating from SBS Server to Server 2016. In AD there's an OU called MyBusiness which has two ...
1
vote
1answer
113 views

GP and AD group memberships are different

I'm running into an odd situation: domain group membership as reported by Group Policy differs from that of Active Directory. DOMAIN\user.name was already a member of DOMAIN\some_group_1. I added it ...
-1
votes
1answer
29 views

Able to find Active Directory group using directory search but group does not exist in left window panel domain tree

We have a single 2008 R2 DC. We're trying to locate Builtin groups that no longer visually appear in the Builtin group folder in the domain tree in the left panel of the active directory users and ...
0
votes
1answer
37 views

How to remove AD transitive two way trust (ffl and dfl 2016)

How to remove AD transitive two way trust (ffl and dfl 2016) What problems should we anticipate after removing the trust?
0
votes
1answer
42 views

CentOS 7 SSSD LDAP against Windows Server DC fails to authenticate

I'm having an issue for authenticating via LDAP from a CentOS 7 machine to a Windows Server 2012 R2 DC via SSSD. Linux WS100 3.10.0-957.10.1.el7.x86_64 #1 SMP Mon Mar 18 15:06:45 UTC 2019 x86_64 ...
3
votes
1answer
196 views

Applying a GPO to local users except local administrators on Workgroup computers

I have a set of configurations which I need to replicate from my domain joined computers to non-domain (Workgroup) joined computers. I created a GPO, enabled Loopback processing and imported them via ...
1
vote
1answer
80 views

External Azure Active Directory

In Azure, I have invited some external users via their corporate email addresses and they are now visible in our AAD, the source being listed as External Azure Active Directory. I do not know if they ...
0
votes
0answers
39 views

Issue accessing network share via smartcard from different domain

I am currently using Yubikey smartcards to authenticate users within a Domain (Domain B). Login and network shares are working perfectly. However, when accessing Domain B's network share from another ...
0
votes
1answer
44 views

SSH Gateway for accessing remote ssh servers

I am currently have multiple users accessing multiple customer servers with ssh access (which all only allow access from our public office IP). This kind of gets annoying if a new employee enters the ...
0
votes
0answers
53 views

AAD Ldap Sync Times Set-AZ-xxxx?

When when I change a password in Azure AD , this password is reflected in AAD Ldap after 20 minutes, users query Ldap all day and they SSH , I need to lower sync times to 1 minute , something like "...
1
vote
0answers
28 views

map drive automatically using user credentials for server in separate forest

We have two completely separate forests with no trusts between them. I can map a drive on my computer to a server in the other forest by using the 'Connect using different credentials' option in 'Map ...
1
vote
1answer
119 views

Ubuntu 18 ignoring Samba AD user's `loginShell` attribute (set to ZSH, but user receives BASH after login)

We have a samba AD (4.3.11-Ubuntu) attaching to both Windows and Linux clients (Ubuntu 14, and Ubuntu 18) If I examine the LDAP for a user, his loginShell parameter is /bin/zsh. This was working for ...
-1
votes
1answer
98 views

Resolving external address when Active Directory Domain ends in .com

Prior IT support named a customer's Windows 2016 AD domain example.com instead of example.local, as I've always done it. The customer has an external Apache web server hosting www.example.com. When a ...
1
vote
1answer
274 views

OTRS 6 - AD integration - Domain Admin users mapped as Agents, not as OTRS Admins

I am testing OTRS 6 with the ITSM module. Right now I'm only testing it on our DEV environment, so it would not be a problem to ditch everything and start from scratch if it's the easiest way. I ...
1
vote
0answers
26 views

What should I take into consideration when creating AD users in PowerShell?

The current way AD users are created is: The employee determines which department the new hire is assigned A current user from that same OU is copied to create the new user The problem with this ...
0
votes
0answers
184 views

Active Directory Certificate Services ERROR_LOGON_FAILURE

I have found in event log following entries (event id 66): Active Directory Certificate Services could not publish a Base CRL for key 1 to the following location: file://\pki.my.lan/pki/Root CA(1)....
8
votes
1answer
285 views

Shutdown script doesn't run if workstation is not connected to the network

I have a requirement to run a batch script every time a system is shut down, no matter if the computer is connected to the network or not. (It shouldn't matter for the question, but the script in ...
0
votes
0answers
17 views

Autofs Windows Active Directory users home directory to rhel that only they can see it

I have a client that has two groups with different users on a Windows Active Directory, they also have a rhel machine with sssd authentication that the users will do the authentication on the AD ...
-1
votes
3answers
306 views

auto moving computer in respective OU, when joined machine in to domain

we want move Computer account automatically in respective Ou when it join Domain i have some Poworshell script but it is use for manual movement "redircmp ou=newcomputerou,dc=domainname,dc=com" so ...
1
vote
0answers
22 views

Is delegating a granular “Modify permission” on a group possible?

A certain user "x" has below permissions on a group "g"; -> Read/Write all the properties on group. -> Delete the group. Need to add "modify permissions" on the group "g" for user "x" ; but the only ...
0
votes
1answer
310 views

How to grant a Service Principal access to AKS API when RBAC and AAD integration are activated?

I need to grant a process (build pipeline) RBAC access to AKS API for deployment purposes. But the target AKS cluster has AAD integration active (as described here) I was expecting to be able to ...
0
votes
0answers
91 views

dcpromo of a windows server 2008 in existing samba based AD resulting in infinite configuration

We want to add a new DC using windows server 2008 in our AD that just have 2 zentyal 5 based DC to replace the second. DCPROMO is able to get all informations but when start to configure the DC , the ...
0
votes
0answers
48 views

CertSrv 401 Loop

Using domain admin credentials, I'm unable to authenticate into my PDC's CertSrv application: http://localhost/certsrv I'm caught in a 401 loop. I've tried this proposed solution: Open IIS Manager ...
1
vote
2answers
51 views

Change DSRM Password - WIN32 Error Code: 0xa90

I'm using Windows 2012 R2 with Active Directory. One of my DC has had hardware failure. I'd like to promote another server as a DC, but reading online it looks like I need the DSRM password to do so. ...
0
votes
1answer
145 views

GPO Security setting Wired Network (IEEE 802.3) Policies

My question is regarding group policy security setting (Wired Network (IEEE 802.3) Policies). When I set this setting I cannot see any file generated to store these settings in SYSVOL\sysvol\...
0
votes
0answers
9 views

Delegated Admin Account Not Able to Access ADUC

I have created a security group to allow users the ability to reset passwords only. However, when I try to log into ADUC with a user from that group I cannot. I've searched for similar issues but can'...
0
votes
0answers
30 views

Oracle Cloud : Windows instance not joining to domain automatically

Let me explain my setup.My VCN has two private subnet. Subnet 1 : Installed domain controller with required AD ports open through security list on Subnet1 . it uses default DHCP options. DNS role ...
2
votes
0answers
80 views

Is a domain joined windows machine's objectGUID or ObjectSID as stored by Active Directory also stored locally?

Working on an inventory project where I need to link a computer to an object in Active Directory. I have an export of all computer objects from Active Directory including some unique identifiers such ...
4
votes
0answers
231 views

Samba and AD - “net ads changetrustpw” fails

I've got a Samba member of a Windows AD. I'm using a combination of sssd and winbind. Samba manages machine password changes, and it's configured also to update the passwords used by sssd. (The ...
1
vote
0answers
136 views

Local groups mapped to AD users via groups.conf working - but only with ssh login

I'm running a Samba Active Directory domain with Ubuntu 18.04 clients. I used the /etc/security/group.conf file to successfully create a mapping for domain users to the "dialout" group. I tested it ...
4
votes
3answers
93 views

Active Directory Give users certain permission

I'm trying to find a way for users to change their job title or address in Active Directory. What i've done is pushed them a batch file as shown below so they can search for themselves in the AD @...
0
votes
1answer
615 views

Cheapest way to setup a domain controller with AD-DS for a small business with multiple locations

I work for a small business with little IT infrastructure. We want to be able to join all computers throughout the company to a single domain to push group policies and conduct other management ...
1
vote
0answers
19 views

Azure AADconnect attribute filtering using custom attribute created using Schema extension

We have a string valued attribute which is attached to user class. This attribute is created using schema extension. When i use this custom attribute to implement a inbound AADconnect attribute ...
1
vote
1answer
44 views

Active Directory Admin Denied Access - Why?

Logged in as the domain admin of an Active Directory environment, I'm attempting to run this command to reboot a workstation: @start /b cmd /c shutdown -r -f -t 1 -m \\COMPUTER-NAME I'm getting this ...
2
votes
1answer
184 views

Windows Server 2019 - OpenSSH (AD authentication and permissions)

I just installed OpenSSH Server on a Windows Server 2019, in a domain environment, and I noticed that by default, pretty much every user can connect to the server via SSH. It's as if AD authentication ...
1
vote
0answers
20 views

Allow Guest User in Azure Access to SQL Server (DEV, Read/Write)

I'm a bit new to Azure AD. I have some software development offshored and have already created a guest account in Azure for the developer. I've create an account in SQL Server (Manually via the ...
0
votes
1answer
249 views

Ldap integration to centos phpipam

I have installed phpipam on CentOS 7 and this is currently working fine, and now i am trying to integrate ldap authentication or AD authentication so i can use domain credentials to log on to service. ...