Questions tagged [active-directory]
A Microsoft technology that constitutes an LDAP directory service with centralized management functionality for user accounts, computer accounts, groups, and configuration management across many Windows servers and desktops.
2,287
questions with no upvoted or accepted answers
3
votes
1
answer
143
views
Upgrading Active Directory from 2000 to 2008
Our config is currently:
1 Windows 2000 domain controller running ISA2000, dhcp, dns
1 Windows 2003 domain controller as main file server, prob cert server as well, dhcp, dns
1 Windows 2008/...
3
votes
0
answers
14k
views
NERR_DCNotFound when attempting to join Windows Server 2010 domain using PBIS
I have a RHEL 6.3 Amazon Web Service instance I'm trying to join to a Windows Server 2012 AD domain through PowerBroker Identity Services Open (ie: not enterprise).
The Server 2012 instance is in the ...
3
votes
0
answers
1k
views
Group membership erratically lost after user logs in - Ubuntu, winbind, AD
I have a really strange issue where the wbinfo -g command properly indicates the AD domain group I am interested in and shows a particular user in that group - this is always true, so on the linux ...
3
votes
0
answers
862
views
How do I print, identified as an AD user, from an Ubuntu client to a Windows print server?
I know my question may be confusing, so I'll clarify.
I'm an admin at a school and am setting up the labs to use Ubuntu (12.04). Users already can authenticate against Active Directory (currently ...
3
votes
1
answer
3k
views
Samba share, local group, AD users
I have a Debian 6 system running Samba 3.5.6 that has been successfully set up to authenticate against an Active Directory domain (via SSH that is). I have a directory (let's call it /foo) that I want ...
3
votes
1
answer
8k
views
Read Only Domain Controller not replicating after writable domain controller outage
I have a RO domain controller that replicates with a writable DC which is at another site. The other week the writable DC was out for about 2 days because of maintenance at that site. After this ...
3
votes
2
answers
9k
views
windows security log - failure reason startswith %%
Please help - do You have the list with descriptions of failure reasons eg. %%2313, %%2307... I've researched Net and nothing.. :(
Mainly I see it in ID 4625 in Windows security logs.
On http://www....
3
votes
1
answer
915
views
Gotomeeting MSI needs elevated privs?
Typically I can deploy MSIs with no issue, but the Gotomeeting one refuses to install. SCE lists it as pending and AD just attempts to install it, gives up, and never tries again. When I tried running ...
2
votes
0
answers
108
views
Windows Firewall: Cannot establish Network Isolation - Require Inbound Require Outbound for Domain Controller
I have a Domain Controller, and I wish to establish network Isolation with Windows Firewall, Connection Security Rules.
When the DC Authentication is set to Request Inbound, Request Outbound, using ...
2
votes
0
answers
1k
views
How to automatically enable Kerberos delegation to Windows Admin Center on all servers?
We want to use Windows Admin Center to manage our environment; WAC will run on a dedicated server in gateway mode, and administrators will manage servers through WAC.
This requires setting up Kerberos ...
2
votes
0
answers
1k
views
DFS Provider Cache
My organization has multiple mapped drives that target DFS paths such as \\domain\HOME\HomeDrives\username. When trying to access one of the mapped drives after connecting to VPN, the following error ...
2
votes
0
answers
455
views
Using Linux tools to allow a user in a domain to access only certain computers
I ran samba-ad-dc domain controller on Debian Bullseye. No problem to create users and groups, organizational units, etc and to join windows or Linux computers to domain. But there is other task: On ...
2
votes
0
answers
195
views
No logs for DFS Replication on Domain Controller
I was testing monitoring DFSR event logs on my DCs and figured there are no logs after event 1210 (The DFS Replication service successfully set up an RPC listener for incoming replication requests.) ...
2
votes
0
answers
817
views
AD-Joined Samba Share with Windows XACL Access Denied
Overview
I have a file server and domain controller both running Samba 4.15.9.
The DC is the only one in the forest.
The DC, file server, and a Windows 10 client are joined to the same domain.
On the ...
2
votes
1
answer
537
views
Use PowerDNS to update AD Integrated DNS Zone
Before I embark on the experiment, I figured I might ask the community at large.
So I've got an odd situation that I'm trying to remedy. I have Terraform deploying virtual machines (Linux and Windows) ...
2
votes
0
answers
2k
views
Windows client cannot get cross-domain ticket, but a Linux one (from WSL) can
I am trying to and failing to authenticate my Kerberos credentials when doing ssh from a Windows 11 client joined to a Windows Server 2019 domain (let's call it AD.LOCAL) to a Linux host joined to a ...
2
votes
0
answers
258
views
Debugging Active Directory Login with MongoDB
I am trying to log into MongoDB using an active directory username. We're using Percona for MongoDB but I believe this really should be pretty similar to regular MongoDB 5.x authentication.
We've ...
2
votes
1
answer
405
views
Cross realm constrained delegation
I have Red Hat IdM on RHEL8 with a two-way trust to AD on Windows 2019.
What currently works:
Constrained delegation for NFS clients. NFS clients can impersonate users from the IdM realm (gssproxy).
...
2
votes
0
answers
64
views
If I set a policy to deny log on locally for a particular AD user, will it affect existing logged on sessions belonging to that user in any way?
Background
Historically in my organisation we have used a particular shared domain admin account (let's call it SharedDA) for almost everything. It is currently logged on to several dozen servers. ...
2
votes
0
answers
3k
views
Windows authentication (AD) not working when IIS Application pool is running as custom user
I'm using:
Windows 10 x64 Professional (in ad domain)
IIS 10
Web site is running under local user EPM_USER, everything works except Windows authentication
Configuration:
When I try to from another ...
2
votes
1
answer
2k
views
Students can't install Extensions in Visual Studio Code
We are a school and would like to use Visual Studio Code together with the Omnisharp extension.
The students' working environment has the following characteristics
Server-stored home directories
...
2
votes
0
answers
160
views
SBS 2011 DNS server doesn't resolve forward lookup zones
I recently started a new job and inherited an antique in an SBS2011 server (yes, I know all the security risks and have raised this at EVERY management meeting). I have an issue with the DNS not ...
2
votes
2
answers
779
views
Add domain users to a group of security groups via group policy
Is there a way to add domain users to a collection of security groups via group policy? We have some SSO groups that all employees share. Instead of tech support person having to manually add new user ...
2
votes
0
answers
300
views
OpenLDAP Meta backend to return one result
I have configured OpenLDAP to act as a proxy server via meta backend to do remote queries to two different companies' Active Directory servers. Everything works correctly in terms of pulling ...
2
votes
2
answers
3k
views
How to remove AdmPwd Permission from BUILTIN\Users (MS LAPS)
I've deployed MS LAPS to manage local admin passwords and all is working fine, except that non-privileged users are able to access the local admin password, in both Powershell and LAPS UI.
Running the ...
2
votes
0
answers
61
views
Why is programmatically joining to Windows domain failing?
We are facing an issue for a particular customer where programmatically joining a machine to a domain is failing. The machine is cloned from a parent VM and attempted to be joined to the domain using ...
2
votes
0
answers
913
views
Python Flask App on IIS - Updating Active Directory Attributes on Behalf of User
I've posted this on stackoverflow, but posting it here as I want some help from folks that are familiar with kerberos delegation and IIS. I am currently trying to figure out how to get my flask app to ...
2
votes
1
answer
3k
views
Recursive PowerShell script to protect all OUs and Objects from Accidental Deletion
I'm sure there has got to be an easier way that what I hand-jammed....
I'm trying to write and run a PowerShell script that will set the ProtectFromAccidentalDeletion flag to "true" ...
2
votes
0
answers
887
views
Active Directory domain controller fails to load DNS zones on startup
I have a Windows 2019 Standard server that is the sole DC on a small network. Regularly users can't access the networked accounting software on the server. When I try to access the DNS admin on the ...
2
votes
0
answers
140
views
Why is my Samba domain member connecting to domain controllers in a trusting domain?
My problem is logspam. I have 2 Windows AD domains with Windows domain controllers. Domain A has some Ubuntu/Samba domain members. I have no issue using accounts in domain A to log into the servers, ...
2
votes
0
answers
672
views
Network Policy Server rule does not match users from trusted domain when in a nested group
TL;DR: Just look at the image linked below.
User group membership diagram
We have an RD Gateway and Network Policy Server, both running on Windows Server 2012 R2 in an environment with forest ...
2
votes
2
answers
12k
views
Ubuntu 20.10 Active directory integration not working
I've just installed Ubuntu 20.10 and I enabled Active Directory integration during setup. It asked me AD user and password, I provided those and the setup showed green thicks and went on.
After ...
2
votes
0
answers
588
views
Windows authentication doesn't work for around 30 minutes?
I have a site on IIS that uses windows auth for logins and it works 99% of the time. But on some days there will be a period of time where logging in just won't work for around 30 minutes, it keeps ...
2
votes
0
answers
780
views
Flow Errors in AADConnect when moving to a new AD with ms-DS-ConsistencyGUID source anchor
I'm exporting users from one AD to another and as part of the work I need to move AADConnect as well.
The old AADConnect is still running and has ObjectGUID as source anchor and I set up the new one ...
2
votes
0
answers
850
views
Configuring Azure AD Connect for an AD sub domain
I'm trying to configure an Azure AD Connect for a small business hosted in an OU in a sub domain in our AD.
Our AD looks something like this:
domain.local
-ADM.domain.local
-EDU.domain.local
-HST....
2
votes
0
answers
1k
views
Validation Failed On Windows Failover Cluster Access Denied
i have 2 node will be setup windows failover cluster.
every node already connect to Active Directory.
when i validate on windows failover cluster, still failed on List Disk
error message like this
2
votes
0
answers
1k
views
ActiveDirectory Startup/Shutdown PowerShell Script not being executed, failing silently
Environment
Windows Server 2012 domain
Windows 10 version 2004 client
I'm trying to deploy an ActiveDirectory Startup or Shutdown powershell script on a test OU to update VLC Media Player and I can'...
2
votes
0
answers
215
views
What could cause PowerShell Remoting to use high bandwidth?
I do IT work for an organization that is currently setting up (or letting me set up) an Active Directory domain. Right now, it's still in testing with 1 DC and 1 client. A week or two ago, our switch ...
2
votes
0
answers
825
views
Windows 10 updating wrong DNS server when using DirectAccess
Having a problem where a Windows 10 client connected to the domain via DirectAccess isn't updating the client DNS records on the domain's nameserver. Instead, it appears to be trying to update the ...
2
votes
1
answer
638
views
Considerations with creating an additional AD Site and linking it to another Site
Hi fellow technology enthusiasts,
I have some questions regarding the following setup. I hope you guys can help me out 😉.
Topology view
The goal is to link the redundant domain controller at a new ...
2
votes
2
answers
341
views
Error while using template for vm domain join
I'm trying to use below template to add VM to domain in Azure.
https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/201-vm-domain-join-existing/azuredeploy.json (template: ...
2
votes
0
answers
2k
views
Join AD domain failed SPNEGO login failed: {Access Denied} A process has requested access to an object but has not been granted those access rights
I meet a problem when trying to join Active Directory domain with Samba.
The error message is
cli_session_creds_prepare_krb5: Doing kinit for [email protected] to access domaincontroller.hostname
...
2
votes
0
answers
4k
views
Active Directory authentication using format domain.fqdn\username
Assuming an Active Directory domain with FQDN "domain.local" and NetBIOS name "DOMAIN", there are two standard formats to identify user accounts:
DOMAIN\username
[email protected]
(The second ...
2
votes
0
answers
127
views
Migration to O365 using Azure AD Connect with multiple forests: Anticipate AD objects with duplicate attributes
I am planning and preparing to migrate 2x Active Directory forests (example.com and example.net) to Azure Active Directory.
I followed the Microsoft doc to use Idfix to clean up each of the AD forests....
2
votes
0
answers
327
views
Does GlobalNames work on a stand-alone DNS server?
Inspired from this answer.
GlobalNames is a special zone in Windows DNS servers that can resolve single-label names.
The documentation says:
We also recommend that the GlobalNames zone be ...
2
votes
1
answer
269
views
Cannot login to SQL Server instance installed on Debian using domain account
I can login to SQL Server 2019 (installed on Debian Buster) with SA account using SQL Management Studio on Windows Server 2016, but I cannot do this with the domain account using integrated ...
2
votes
0
answers
2k
views
Inactive directory has forgotten itself
I have inherited a Microsoft network with 2 AD hosts running on MS-Windows 2012 core. Up until a week ago it was doing its job, but since then there have been issues with logging in and accessing ...
2
votes
0
answers
3k
views
Windows not collecting logs. Error: The WinRM service is not listening for WS-Management requests
I am getting this error
The WinRM service is not listening for WS-Management requests.
User Action
If you did not intentionally stop the service, use the following command to see the WinRM ...
2
votes
1
answer
683
views
Powershell script for AD Computer Get-ADComputer
Currently I'm using the following script to retrieve the below info from the DC all info is okay but I need to include the user name of the last logged on user name but unfortunately Last logged on ...
2
votes
1
answer
349
views
Samba4 server visible with IP on the network
I have a Samba4 AD setup. I cannot understand why the server is visible on the net only by its IP address and not by hostname.
The configuration looks ok to me, the same as we have in other places ...