113

For a non-Microsoft person, what is ADFS? ADFS is Microsoft's solution for Single Sign On and web based authentication. It is used primarily to provide a single set of credentials that can access a variety of sites not necessarily hosted within the same domain. How does it differ to things like LDAP? LDAP: Communicates using TCP/UDP on port 389 (or ...


96

Open up "Control Panel | System and Security | System" In the dialog click on "Advanced system settings" (requires Admin rights) The "System Properties" dialog will be displayed Make sure you are in the "Advanced" register In the "User Profiles" section click on "Settings" The "User Profiles" dialog is displayed Select the account. Hit Delete. Faster: ...


92

There are only two correct answers to this question. An unused sub-domain of a domain that you use publicly. For example, if your public web presence is example.com your internal AD might be named something like ad.example.com or internal.example.com. An unused second-level domain that you own and don't use anywhere else. For example, if your public web ...


89

Or with the net user command... net user /domain username


87

I've managed large numbers of workstations without AD. I had power tools (Altiris Deployment Solution), but it still hurt in certain situations: Security auditor comes in and says that our default workstation password policy isn't good enough. In order to change password complexity and expiration, etc., on 5,000 machines, we had to write a (nontrivial) ...


75

If you don't want to change local or server side GPOs: Go to Control Panel -> Credential Manager on the local computer you are trying to connect from. You will see three sections: Windows Credentials Certificate-Based Credentials Generic Credentials Remove the credentials from Windows Credentials and add it to Generic Credentials.


49

If you just deleted the partition and did not create a new partition, it is likely possible to recover. First things first - pull the drive, put it in a Linux box and do a raw clone. The first rule of data recovery is that you do your work on a clone, not the original. Now on the clone run a linux tool called testdisk. If the filesystem hasn't been ...


46

An unmentioned, super easy, and quick option is to run this from a command prompt: nltest /dclist:domainname Just replace 'domainname' with your domain You can also run some other options to find out more: /dcname:domainname gets the PDC name for the domain /dsgetdc:domainname has flags for other information Try nltest /? in your prompt to get more ...


44

First of all - and in case other users happen to visit this page - there are only certain authentication methods that allow you to do promptless SSO. These are NTLM and Kerberos. LDAP - on the other hand - will never give you promptless SSO. NTLM is actually NTLMv1 and NTLMv2. These are very different and NTLMv1 is deprecated because of serious security ...


44

Single line, no modules necessary, uses current logged user $($env:username), runs from other windows machines: (New-Object System.DirectoryServices.DirectorySearcher("(&(objectCategory=User)(samAccountName=$($env:username)))")).FindOne().GetDirectoryEntry().memberOf Qudos to this vbs/powershell article: http://technet.microsoft.com/en-us/library/...


39

You can do this in PowerShell pretty easily. I'm sure you can do it with the ds tools too, but they're old and crusty and PowerShell should be used for everything possible nowadays. Import-Module ActiveDirectory (Get-ADUser userName –Properties MemberOf | Select-Object MemberOf).MemberOf Shorter version (Get-ADUser userName –Properties MemberOf).MemberOf


38

I don't see having Active Directory (AD) as adding complexity. Rather, I see it as making administration easier. I see the functionality that it enables in the client OS as being a major tool to allow for smooth future growth and replacement of computers. From a cost perspective, there are very low cost versions of Windows Server (2012 R2 Essentials ...


35

Start → Run → secpol.msc Security Settings\Local Policies\User Rights Assignment Right pane → double-click on Allow log on through Remote Desktop Services → Add Users or Group → enter Remote Desktop Users Start → Run → services.msc Look for Remote Desktop Services and make sure the Log on account is Network Service, not Local System. Check your event logs....


34

To assist MDMarra's answer: You should NEVER use a single-label DNS name for your domain name either. This was/is available prior to Windows 2008 R2. Reasons/explanations can be found here: Deployment and operation of Active Directory domains that are configured by using single-label DNS names | Microsoft Support Don't forget to NOT use reserved words (...


33

By default, Windows will cache the last 10-25 users to log into a machine (depending on OS version). This behavior is configurable via GPO and is commonly turned off completely in instances where security is critical. If you tried to log into a workstation or member server that you had never logged into while all of your DCs are unreachable, you would get ...


33

This is by design. In short, Active Directory maps the accented/diacritical characters to their "simple" form. Please see the following Microsoft Support article. Windows logon behavior if your user name contains characters that have accents or other diacritical marks (Dead link) (Live version archived here): If your user name in the Active ...


33

You probably already know this, but bear with me. Computers have passwords in AD, just like users. We don't know our computer's password, and it changes regularly via built-in logic. The short answer is that the computer's password is no longer valid, and therefore AD doesn't trust this machine for logins any more. Why? How? Lots of things cause ...


32

Active Directory relies on a properly configured and functional DNS infrastructure. If you have an Active Directory problem, chances are that you have a DNS problem. The first thing you should check is DNS. The second thing you should check is DNS. The third thing you should check is DNS. What exactly is DNS? This is a site for professionals, so I'll ...


32

I'm posting this as answer mainly because everyone has their own "educated opinion" based on experience, 3rd party info, hearsay, and tribal knowledge within IT, but this is more a list of citations and readings "directly" from Microsoft. I used quotes because I'm sure they don't properly filter all opinions made by their employees, but ...


32

This can be done by the means of WMI filtering. The group policy client would execute the WQL query from an attached WMI filter and only apply the GPO if the query would return a non-zero number of rows. So by creating a WMI filter checking if the current system time is within a given time interval and linking this WMI filter to the GPO you want to timebomb ...


31

The answer is that the first time a client ever authenticates to Active Directory, it doesn't know what site it is in. When first joining the domain, the client makes general DNS and LDAP queries and gets a list of all the domain controllers in the domain, and it goes down the list, trying LDAP binds, and the first successful DC that it binds to - that is ...


30

Here is a link on how to accomplish this: http://netport.org/?p=255 Update 4 setting in the group policy editor in Windows 7. This security measure could frustrating when you connect and disconnect a lot to the same (or many) terminal server. To get rid of it and to be able to use saved credentials in this situation you need to configure the following: Go ...


30

If you've named your Active Directory example.org then you cannot prevent this. You've gone against Microsft's best practices for naming an AD and you're seeing one of the symptoms. You have a few choices: Migrate to a properly named AD. Something like corp.example.org. Install a web server on each DC and configure it to forward web requests for example....


30

features of Windows will not work unless a Microsoft Account is used? None. You only lose features of various software, and 99% of that is conveniences that nobody will miss. You lose the "Store" completely, and applications like "Weather" need to have the location configured (they can't just pull that data from your account). Are their any gotchas of ...


29

An "open DNS resolver" is a DNS server that's willing to resolve recursive DNS lookups for anyone on the internet. It's much like an open SMTP relay, in that the simple lack of authentication allows malicious 3rd parties to propagate their payloads using your unsecured equipment. With open SMTP relays, the problem is that they forward spam. With open DNS ...


28

What is Group Policy? Group Policy is a tool that is available to administrators that are running a Windows 2000 or later Active Directory Domain. It allows for centralized management of settings on client computers and servers joined to the domain as well as providing a rudimentary way to distribute software. Settings are grouped into objects called ...


28

AFAIK, it is considered best practice for domain/network administrators to have a standard user account for logging on to their workstation to perform routine "user" tasks (email, documentation, etc.) and to have a named administrative account that has the appropriate group membership to allow them to perform administrative tasks. This is the model I try to ...


26

Gimme the codes! powers, activate! $Groups = Get-ADGroup -Properties * -Filter * -SearchBase "OU=Groups,DC=corp,DC=ourcompany,DC=Com" Foreach($G In $Groups) { Write-Host $G.Name Write-Host "-------------" $G.Members } The point being, just take your time and break it out into steps. I know that it's fun to try to get everything and the ...


26

"Best Practice" typically dictates LPU (least privileged user)...but you are correct (as is ETL and Joe so +1) that people rarely follow this model. Most recommendations are to do as you say...create 2 accounts and not share those accounts with others. One account shouldn't have admin rights on even the local workstation you are using in theory, but again ...


26

There are always way to hack around central policies if you have local admin access - at a minimum you can make your changes locally to the registry and hack the security settings so they can't be updated by the group policy agent - but it isn't the best way to go. I'll admit to doing it 10 years ago.. but really.. don't. There are unanticipated results in a ...


Only top voted, non community-wiki answers of a minimum length are eligible