The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [active-directory]

A Microsoft technology that constitutes an LDAP directory service with centralized management functionality for user accounts, computer accounts, groups, and configuration management across many Windows servers and desktops.

Filter by
Sorted by
Tagged with
231
votes
7answers
379k views

How can I find out what AD groups I'm a member of?

I'm running a Windows XP desktop in a corporate environment. How can I find out what AD groups I belong to?
144
votes
2answers
308k views

What is Active Directory Domain Services and how does it work?

This is a Canonical Question about Active Directory Domain Services (AD DS). What is Active Directory? What does it do and how does it work? How is Active Directory organized: Forest, Child Domain, ...
136
votes
9answers
934k views

Command line to list users in a Windows Active Directory group?

Is there a command line way to list all the users in a particular Active Directory group? I can see who is in the group by going to Manage Computer --> Local User / Groups --> Groups and double ...
127
votes
7answers
327k views

Find name of Active Directory domain controller

How can I find out the name/IP address of the AD domain controller on my network?
114
votes
3answers
199k views

Is there a way to view the members of an Active Directory group if you aren't a domain admin and can't log into to a domain controller?

Is there a way to view the members of an Active Directory group if you aren't a domain admin and can't log into to a domain controller?
108
votes
8answers
553k views

How can I figure out my LDAP connection string?

We're on a corporate network thats running active directory and we'd like to test out some LDAP stuff (active directory membership provider, actually) and so far, none of us can figure out what our ...
89
votes
5answers
98k views

Windows Active Directory naming best practices?

This is a Canonical Question about Active Directory domain naming. After experimenting with Windows domains and domain controllers in a virtual environment, I've realized that having an active ...
77
votes
1answer
207k views

What is ADFS (Active Directory Federation Services)?

So I've been told that our PHP application may need to support authentication using ADFS. For a non-Microsoft person, what is ADFS? How does it differ to things like LDAP? How does it work? What ...
72
votes
5answers
25k views

Active Directory explained

If you had to explain Active Directory to someone how would you explain it?
54
votes
4answers
385k views

How to delete domain user profile from a computer?

I'm wondering how to safely remove a domain user profile from a computer that is a part of a domain. I don't want to delete the account from the domain itself, I just need to remove the profile from ...
52
votes
14answers
381k views

Get list of AD groups a user is a member of

Suppose I have the user id of a user in Active Directory. I'd like to get a list of all AD groups in which that user is currently a member of. How can I do this from the Windows command line? I've ...
49
votes
7answers
18k views

If a Windows shop moves “everything” to the cloud, does it still need Active Directory?

Taking a spin off of this question: Do I really need MS Active Directory? in a new direction for 2014. Taking into account a basic Windows infrastructure: domain controllers Exchange 2007/2010/2013 ...
46
votes
7answers
258k views

Disable password complexity rule in Active Directory

Where do I go to disable the password complexity policy for the domain? I've logged onto the domain controller (Windows Server 2008) and found the option in local policies which is of course locked ...
46
votes
8answers
56k views

Should I expose my Active Directory to the public Internet for remote users?

I have a client whose workforce is comprised entirely of remote employees using a mix of Apple and Windows 7 PCs/laptops. The users don't authenticate against a domain at the moment, but the ...
45
votes
4answers
171k views

Any difference between DOMAIN\username and username@domain.local?

I'm trying to troubleshoot an obscure authentication error and need some background information. Is there any difference between how Windows (and programs like Outlook) process DOMAIN\username and ...
40
votes
12answers
216k views

Group Policy installation failed error 1274

I'm trying to deploy an MSI via the Group Policy in Active Directory. But these are the errors I'm getting in the System event log after logging in: The assignment of application XStandard from ...
40
votes
7answers
263k views

How to allow active directory users to remote desktop in?

This is my first time setting up or even using active directory. I set it up, and added the computers(Actually VMs in Hyper V) to the active directory, and if if I use hyper-V to connect to the VMs, ...
40
votes
3answers
76k views

What should the order of DNS servers be for an AD Domain Controller and Why?

This is a Canonical Question about Active Directory DNS Settings. Related: What is Active Directory Domain Services and how does it work? Assuming an environment with multiple domain ...
40
votes
4answers
75k views

How does SSO with Active Directory work whereby users are transparently logged in to an intranet web app?

I'm told that it's possible to make a web application that does not require a login. The user logs in to Windows, which authenticates via an Active Directory (LDAP) Lookup. Then, they should be able ...
38
votes
2answers
39k views

Your system administrator does not allow the use of saved credentials to log on to the remote computer

At our office, all of our Windows 7 Clients get this error message when we try and RDP to a remote Windows 2008 Server outside of the office: Your system administrator does not allow the user of ...
38
votes
5answers
243k views

Finding why a user is locked out in Active Directory

A user's account keeps getting locked out in Active Directory. It's probably caused by an app that's using Windows authentication to connect to SQL Server. Is there a way to find out which app is ...
35
votes
1answer
1k views

What's the meaning of logging in as “username@mydomain.com:something”

My Windows 2008 R2 machine is joined to a domain. In the logon screen, if I type in "username@mydomain.com:something" as the username, I can still logon properly, what's the meaning of ":something" ...
33
votes
8answers
29k views

Is it best practices to have separate login for a domain for domain admins?

I typically like to set up separate logins for myself, one with regular user permissions, and a separate one for administrative tasks. For example, if the domain was XXXX, I'd set up a XXXX\bpeikes ...
32
votes
12answers
70k views

Active Directory: delete vs. disable departed employees [closed]

When an employee leaves your organization, do you delete or disable their Active Directory account? Our SOP is to disable, export/purge the Exchange mailbox, and then after "some time" has elapsed (...
32
votes
4answers
300k views

How to find time server in a domain?

In a Windows domain PDC isn't necessarily the domain time server. How could I identify the authoritative time server?
32
votes
7answers
38k views

Is there an equivalent of SU for Windows

Is there a way (when logged in as an administrator, or as a member of the administrators group) to masquerade as a non-privileged user? Especially in an AD environment. e.g., in the Unix world I ...
31
votes
5answers
27k views

Common wisdom about Active Directory authentication for Linux Servers?

What is the common wisdom in 2014 about Active Directory authentication/integration for Linux servers and modern Windows Server operating systems (CentOS/RHEL-focused)? Over the years since my first ...
30
votes
5answers
12k views

Should I still have a physical DC, even post-Server 2012?

Back in the pre-Windows Server 2012 days, the recommendation seemed to be to have at least one physical domain controller sat along-side your virtualised DCs. One justification for this was because ...
30
votes
3answers
31k views

What is Group Policy and how does it work?

This is a Canonical Question about Active Directory Group Policy Basics What is Group Policy? How does it work and why should I use it? Note: This is a Question & Answer to new administrator ...
29
votes
5answers
33k views

How to use Google Apps as an OD/AD/LDAP Provider

I see tons of solutions for allowing Google Apps to use external AD and LDAP services for login. However, I already have a ton of users setup in Google Apps already, and I'm trying to go the other ...
28
votes
13answers
25k views

Do I really need MS Active Directory? [closed]

I manage a shop of arround 30 machines and 2 terminal servers (one production, one standby.) Should I really deploy Active Directory in our network? Are there any really benefits, that could ballance ...
28
votes
7answers
79k views

How can I determine my user account's OU in a Windows domain?

Is there any way (short of getting an active directory browser) to view my OU while logged in to the domain?
28
votes
2answers
38k views

Can someone please explain Windows Service Principle Names (SPNs) without oversimplifying?

I have wrestled with service principle names a few times now and the Microsoft explanation is just not sufficient. I am configuring an IIS application to work on our domain and it looks like some of ...
27
votes
2answers
2k views

Why can a and o in samAccountName be replaced with danish å and ø?

A coworker just demonstrated to me that accounts in our test AD was able to authenticate when replacing every a character in their samAccountName with Danish character å (ASCII 134 / å). E.g. ...
26
votes
6answers
114k views

last time an AD user has logged in?

I've noticed that we have in Active Directory more users than the company has actual employees. Is there a simple way to check multiple Active Directory accounts and see if there are any accounts that ...
26
votes
3answers
26k views

How are cached Windows credentials stored on the local machine?

How are cached Active Directory domain credentials stored on a Windows client? Are they stored in the local SAM database, thus making them susceptible to the same rainbow table attacks that local user ...
25
votes
6answers
30k views

What causes a workstation to lose trust with the domain controller?

I've received the error several times on Windows 7 Workstations and Laptops where it loses trust with the domain controller, and I know how to fix it, but why does it do that?
25
votes
3answers
2k views

What features of Windows 8/8.1 Pro will not work without a Microsoft Account?

With respect to domain-joined Windows 8/8.1 Pro machines, what features of Windows will not work unless a Microsoft Account is used? Also, aside from "feature loss," are their any gotchas of not ...
25
votes
1answer
66k views

What does the downwards arrow symbol on a User mean in Active Directory

I have created a user account called "MyUser" via Powershell, and the icon graphic in active directory different to that of the user test that I create via the UI. The scripted one has a circle ...
25
votes
0answers
2k views

What should I name my Active Directory? [duplicate]

Possible Duplicate: Windows AD Domain naming recommendations There are a lot of really screwed up configurations out there, because people didn't take a minute to sit down and think about ...
24
votes
4answers
4k views

Active Directory Health Checks

I've had some Active Directory troubles lately was was wondering what checks I could do on a regular basis I could do to ensure everything is working optimally?
24
votes
6answers
6k views

Can windows domain controller be virtualized?

Just the question on the title. There is any problem? Any experience on this?
24
votes
4answers
93k views

Force authenticated user immediate logoff (emergency case)

In Active Directory if you want to prevent a user from logging in you can either disable their account or simply reset their password. However, if you have a user who is already logged in to a ...
24
votes
6answers
44k views

Choosing local versus public domain name for Active Directory [duplicate]

What are the pros and cons of choosing a local domain name such as mycompany.local versus a publicly registered domain name such as mycompany.com (assuming that your org has registered the public name)...
24
votes
2answers
7k views

Authenticating OpenBSD against Active Directory

Edit: Reformatted this as Q&A. If anyone can change this from Community Wiki to a typical question, that's probably more appropriate as well. How can I authenticate OpenBSD against Active ...
23
votes
12answers
267k views

Best way to find the computer a user last logged on from?

I am hoping that somewhere in Active Directory the "last logged on from [computer]" is written/stored, or there is a log I can parse out? The purpose of wanting to know the last PC logged on from is ...
23
votes
3answers
10k views

Naming a new Active Directory forest - why is split-horizon DNS not recommended?

Hopefully, we all know what the recommendations for naming an Active Directory forest are, and they're pretty simple. Namely, it can be summed up in a single sentence. Use a subdomain of an existing,...
23
votes
1answer
66k views

How is DNS related to Active Directory and what are some common configurations that I should be aware of?

Please note that I do know the answer to this and have provided one below. I see a lot of newer systems administrators that don't understand the contents of my answer, so I hope that all of the ...
23
votes
7answers
44k views

Windows Appending Domain Suffix To All Lookups

I have a recurring DNS problem that has been plaguing our users occasionally causing their laptops to appended our companies domain to the end of all DNS queries. The problem only occurs when users ...
22
votes
6answers
90k views

Restrict access to IIS site to an AD Group

Is it possible in IIS to set up a site in IIS and only let users of a certain AD Group get access to it?