Questions tagged [active-directory]

A Microsoft technology that constitutes an LDAP directory service with centralized management functionality for user accounts, computer accounts, groups, and configuration management across many Windows servers and desktops.

Filter by
Sorted by
Tagged with
14
votes
3answers
10k views

Removing old computers on a domain

The Windows Domain I manage has hundreds of computer names which I don't recognise and I'd like to remove old ones which aren't in use before trying to track down the misnamed ones. Is there someway ...
14
votes
5answers
50k views

Is there any difference between Domain controller and Active directory?

If I want to define domain controller then i would say DC is where active directory installed or Acitve Directory simply means: Secure centralized authentication and management and domain controller ...
14
votes
3answers
3k views

What next after a Windows domain account has been compromised?

We're preparing for a scenario when one of the accounts in a domain gets compromised—what to do next? Disabling the account would be my first go-to answer, but we had pentesters here a few weeks ago ...
14
votes
5answers
2k views

Windows 2008 R2 AD servers on fanless flash based systems

We have a number of branch offices where having an AD/DNS server would make a big difference to user experience. The following characteristics apply: There is no air conditioned server room, and no ...
14
votes
5answers
42k views

Reverse DNS records not registered when using DHCP

I've stumbled upon a strange behaviour with Windows machines, which seems to be fairly consistent between all Windows versions from Vista/2008 to 8.1/2012 R2; it doesn't happen instead when using ...
14
votes
1answer
1k views

AD Administrator account logon mystery - last logon timestamp

We've found the domain Administrator account - which we do not use except in the event of a disaster recovery scenario - has a recent date in the LastLogonTimeStamp attribute. As far as I am aware, no-...
14
votes
8answers
18k views

Set DNS host name for managed service account?

The documentation contains the example: New-ADServiceAccount service1 -DNSHostName service1.contoso.com -Enabled $true This parameter is required. What exactly is the purpose of a DNSHostName and ...
14
votes
6answers
40k views

Linux + Active directory authentication + only letting certain groups login

I have some linux boxes that use Windows Active Directory authentication, that works just fine (Samba + Winbind). What I would like to do now though is only allow certain people or certain groups to ...
14
votes
3answers
5k views

Windows 2008 R2 CA and auto-enrollment: how to get rid of >100,000 issued certificates?

The basic problem I'm having is that I have >100,000 useless machine certificates cluttering up my CA, and I'd like to delete them, without deleting all certs, or time jumping the server ahead, and ...
14
votes
1answer
461 views

Group Policy Result summary says DC is member of “BUILTIN\Administrators”

Whenever I run the Group Policy Result wizard and select a Domain Controller as the target computer, the summary shows BUILTIN\Administrators in the list of "Security Group Membership when Group ...
14
votes
10answers
37k views

Windows 2008 DHCP service fails - “…failed to see a directory server for authorization.”

I have a small environment running Windows 2008 R2 where the DHCP service on the domain controller fails every two weeks. The most-visible error is Event ID 1059 and the Event Viewer message is: "...
13
votes
5answers
176k views

List All Groups and Their Members with PowerShell on Win2008r2

I am new to powershell, but I've been reading manuals and practiced a little bit. My objective is to List all users in all Security Groups under specified path. I have found the way to do it: get-...
13
votes
3answers
2k views

Do I Need to Configure Active Directory Sites if We Have a High Speed WAN?

I work at an organization with 15 physical sites. The corporate headquarters has two DC's, which hold all the FSMO roles between them. Each remote site has one DC onsite. When I started working here, ...
13
votes
5answers
34k views

Find the GPO name with an GUID?

I'm monitoring ad logs, when someone modify an AD Object, I could see a log, but only the GUID of that Group Policy was provided in the line. So given an GUID of a Group Policy, is it possible to get ...
13
votes
7answers
65k views

How do I find new Active Directory accounts that have been made in the last 90 days?

How do i find new Active Directory accounts that have been made in the last 90 days? does anyone know who to do this? I can't figure it out. Thanks in advance.
13
votes
6answers
10k views

Move Active Directory from 2003 to 2008

Im not a expert admin in Active Directory so I'm in need of some help. At my work, we have bought a new server with the 2008 server OS. And the old AD domain controller is run on a 2003 server. The ...
13
votes
3answers
42k views

Seizing FSMO roles from dead Windows Domain Controller

I've seen other questions and documents about doing this, but there are some things that still confuse me. Here are the documents and questions I've seen: Retire a Dead Windows 2003 Domain Controller ...
13
votes
2answers
5k views

New-ADUser -Name Length too long

I need to add about 500 users to an OU in AD I have scripted out everything I need, however, it gives the error: the name provided is not a properly formed Here is the script New-ADUser -Name ...
13
votes
8answers
43k views

Web interface to allow users to change their Active Directory password

I have a few web applications that use Active Directory to authenticate. What I would like to be able to do is provide a simple web page that would allow users to update their AD password. This wasn'...
13
votes
2answers
163 views

Migrate AD DS Server 2003 to Server 2008 R2

I would like to get a couple opinions Found this article online and wanted to know if it is good to follow http://www.msserverpro.com/migrating-active-directory-domain-controller-from-windows-server-...
13
votes
4answers
55k views

How to create a limited “domain admin” that does not have access to domain controllers?

I'm looking to create an account similar to a Domain Admin, but without access to domain controllers. In other words, this account will have full Administrator rights to any client machine in the ...
13
votes
8answers
126k views

Kinit Won't Connect to a Domain Server : Realm not local to KDC while getting initial credentials

I am setting up a testbed environment where Linux (Ubuntu 10.04) clients will authenticate to a Windows Server 2008 R2 Domain Server. I am following the official Ubuntu guide to set up a Kerberos ...
13
votes
6answers
45k views

How to join domain and still maintain settings from unjoined user profile?

I have some Vista x64 workstatons configured for software development that have never been joined to our AD domain. The users have lots of custom settings in their local unjoined user profiles that ...
13
votes
4answers
32k views

Will Active Directory Allow You to Add Two Computers of the Same Name?

I'm hoping someone can confirm my observations because I'm questioning my memory... The title kind of says it all. While working rapidly on deploying a number of similar systems, it appeared that we ...
13
votes
1answer
25k views

Where does Active Directory-integrated DNS store its data?

This has been bugging me for a while. We all know Active Directory is a LDAP database. We also know that the Windows DNS service, when running on a domain controller, can store its data in AD ...
13
votes
1answer
77k views

Command to remove computer from non-existant domain

I lost my domain controller machine, and then add new domain controller but with a new domain. How do I remove network machines from old domain using command line and add to new domain? Machines ...
13
votes
3answers
12k views

How safe are Windows Active Directory Schema Updates?

I'm trying to get a better understanding about how Active Directory handles Schema updates, specifically how safe the procedure actually is given how critical AD is and given the range of situations ...
13
votes
1answer
162 views

What does “DEL:” mean in the DistinguishedName of an AD Object?

Sorry -- I'm not really a Windows System Admin, just trying to slam through some LDAP interactions in Java. I'm finding a ton of objects with "DEL:" in the distinguishedName. Are these orphaned ...
13
votes
1answer
18k views

Configure WinRM using a .bat file without yes/no prompt

I want to configure winrm in all my clients using a bat file. after running bat file winrm quickconfig command there's a prompt for a yes/no answer. I don't know how to answer "yes" in the batch file.
13
votes
4answers
5k views

How can I make WSUS less invasive for our users?

We have WSUS pushing updates out to our user's workstations, and things are going relatively well with one annoying caveat: there seems to be an issue with a pop-up being displayed in front of some ...
13
votes
1answer
512 views

Moving on-prem AD to AWS

I am moving my local AD domain to AWS and I am not sure the best way to do it. Scenario: I have 2 on-prem domains (.local and .net). I am retiring one of them and moving to the other. Both are ...
13
votes
3answers
81k views

How do you trace/debug LDAP connections against Active Directory?

I am spoiled, and have been doing most of my LDAP work with eDirectory, which has a utility called DSTrace which is lovely, and for LDAP specifically, will show you all the bind attempts, the source ...
13
votes
2answers
506 views

What is the industry standard method for administering the change of the local administrator password for all machines on a domain?

Although there appears to be three available options, one of which is actually secure, there seems to be only two available choices that will be able to impact machines that are not powered on at the ...
13
votes
1answer
967 views

Is it OK to use my public domain name as my internal AD domain name instead of using .local internally?

I am taking over a project and the local domain name is domain.com; they also have a website at domain.com. I have always used domain.local for AD, and am wondering if that is a best practice or is ...
13
votes
1answer
5k views

Import Powershell AD Module during MDT Task Sequence

I have written this short powershell script to rename a computer as part of an MDT task sequence: Import-Module ActiveDirectory $AdminUsername = 'domain.com\administrator' $AdminPassword = 'password'...
12
votes
3answers
21k views

What is Location field in Active Directory used for?

Is the Location field in Active Directory used for anything other than listing where objects are physically located? I am interested if this is just a user friendly field to help people find printers ...
12
votes
2answers
3k views

How to create an additional domain controller using Windows Server 2008 R2 Server Core?

I'm currently running Windows Server 2008 R2, can anyone tell me how I can replicate the active directory to another server which has been installed using Server Core install.
12
votes
2answers
4k views

Temporary membership to AD group

We restrict the running of exe's across the organization. But based on justifications & approvals we add users to (specific) AD groups for 24 hours. Currently the process of removing the users ...
12
votes
3answers
35k views

What happens when a computer joins an Active Directory domain?

What changes are applied to a client when it joins an AD domain? How is a domain member supposed to behave when disconnected to the network? Are users able to login? Will domain user policies still ...
12
votes
1answer
631 views

NTP Service Auto-Discovery

Are there any methods I could use to provide auto-discovery for NTP? I recently moved to a new job that has a parent company that recently started providing Active Directory. I've been implementing ...
12
votes
2answers
24k views

How to let non-admins manage selected domain groups' membership?

I'm on Windows Server 2012, Active Directory is on and working. All the project we manage have 2 dedicated groups, one for managers with access to all related files (including invoices, timetables and ...
12
votes
3answers
30k views

Which field to use when authenticating against Active Directory?

Active Directory user objects include a number of fields that can be considered an identifier. The following lists some of these with their label in ADUC and their attribute name: Full Name - cn ? - ...
12
votes
2answers
60k views

is there a way to do an ldap ping? [closed]

Is there a way to ping and ldap server? I have seen ldapsearch and ldapwhoami but would appreciate something a bit more like ping. Essentially we have a bip address in front of a selection of LDAP ...
12
votes
1answer
3k views

For how long can a client be shutdown in AD?

We are setting up a training environment to be used after summer holiday. Management wants us to set up clients now before the vacation. Since the clients are to be shipped away, they will be off line ...
12
votes
2answers
3k views

Why should you not restore a DC that was backed up 6 months ago?

Why should you not restore a DC that was backed up 6 months ago? As I am learning Active Directory Domain Services I came across this question in one of the blogs but I was unable to find a detailed ...
12
votes
1answer
5k views

What does a domain controller (DC) use a certificate for?

Everyone talks about domain controllers and that they should have a certificate installed, but at the end of the day it is optional. Once installed, what actually makes use of that certificate? My ...
12
votes
2answers
21k views

Which AD permission is required to allow impersonation of an account?

I have a Windows service account. I need to grant it permission to impersonate another account within a group on another trusted domain, without delegation. So effectively, my service account says '...
12
votes
1answer
2k views

How many FSMO roles are there?

I've always understood that there are five FSMO roles, but sometimes I see something that says there are seven. How many are there, really?
12
votes
2answers
905 views

Why is my domain controller causing my router to send advertisements for Unique Local Addresses?

I'm currently evaluating Server 2012 to serve as a domain controller in a small heterogeneous network of Linux and Windows workstations and servers, all of which would eventually be joined to the ...
12
votes
3answers
3k views

Server credential management for Linux and Windows

We are a relatively small shop (as far as number of sysadmins) with a mix of RHEL, Solaris, Windows 2003 and Windows 2008 servers; about 200 servers in all. For our administrator accounts (root in ...