New answers tagged active-directory
0
votes
Enabling Protected Users on Windows 2019 AD prevents users from logging in
Members of the protected users group will require a domain controller connection to log in. No cached logon will be allowed. It is possible your users at home rely on cached credentials (logon type 11)...
- 787
0
votes
Filter groups that SSSD receives from AD server
The ldap_group_search_base sssd.conf parameter optionally accepts an LDAP filter.
Example:
ldap_group_search_base = ou=groups,dc=example,dc=com?subtree?(cn=ssh_access)
More details are in the sssd-...
- 315
0
votes
Accepted
How can I authenticate workstation on Azure ID when tenant uses SAML to Google?
There is no way to authenticate users for Windows logon using federated domains on M365 by SAML
- 21
2
votes
Accepted
Can I use one FQDN for all DCs for server authentication and one FQDN for NTP synchronisation?
Anycast is not needed or recommended for use with NTP - see the NTP Best Current Practice RFC. (I actually think the RFC does not go far enough and should explicitly recommend against anycast NTP if ...
- 4,032
1
vote
Can I use one FQDN for all DCs for server authentication and one FQDN for NTP synchronisation?
You already have a name. The domain name. You can create your own CNAMEs if you want. But if any DC DNS record is present but does not answer or an IP for a DC that is having issues, it is the ...
- 35k
0
votes
Can I use one FQDN for all DCs for server authentication and one FQDN for NTP synchronisation?
There might be quite some sysadmins who would have faced this issue. who could have a better answer than me but here is my thought.
You could create a failover architecture between your windows ...
- 27
1
vote
Get SID for each member of a local group
@Ryan Bolger 's solution mostly works, however there's an issue where if there's 2 accounts with the same name, but different domains, the SID will be duplicated since the translate as it was only ...
- 121
0
votes
How can I find out what AD groups I'm a member of?
I've stumbled upon this many times and finally I wrote the small PowerShell script to filter them out by name.
whoami /groups | Select-String -Pattern "[\w-]*)\s+Group" | % { $_.matches....
- 101
0
votes
Powershell 5.1 - Get-ADUser fails to find user unless running as Administrator
Nevermind. I figured it out. Looks like someone has messed around with the permissions and for whatever reason Authenticated Users no longer has read privileges on the account and this is triggering ...
0
votes
Windows Server 2019, Hide or Disable file history (Shadow Copy) for users in active directory that accessing a network share
If you want to disable the RESTORE button in PREVIOUS VERSIONS/SHADOW COPIES using a Group Policy Object (GPO), you are smart. Humans make mistakes so IT Administrators need to set policies to protect ...
- 4,574
0
votes
Enabling Protected Users on Windows 2019 AD prevents users from logging in
Please indicate if you are aware that a patch is available: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23397 at the bottom, you find the download links.
0
votes
Exch 2019 - Change display name for the stored mails
There is no built-in and convenient way to change the display name of the sender for messages that have already been received.
Because the received message is displaying static content, not dynamic.
...
- 11
2
votes
Can I add multiple users in the Managedby attribute in active directory?
That is a Single-Valued attribute, so it isn't possible to set multiple values.
- 109k
4
votes
Enabling Protected Users on Windows 2019 AD prevents users from logging in
Protected Users is not for regular users. It is for the most privileged user accounts. Remove the regular user accounts from the Protected Users group.
- 35k
1
vote
Accepted
How to enable Kerberos delegation from SQL Server to DFS File Share
So, it turns out that during our initial troubleshooting we enabled kerberos delegation for the DBSERVER$ computer account in AD. This apparently caused the system to go down a different path looking ...
- 175
0
votes
Split DNS Issue - Configuring a new domain controller with an existing Apache web HTTP services using the same domain name "example.com"
There are already several questions and answers on this forum regarding this concept. Generally, it is not a good practice to use a TLD for an existing DNS zone, but rather create a new sub zone for ...
- 35k
1
vote
Get the SID of a Linux computer joined to a windows AD domain
To retrieve the SID you can simply use the realm command like this realm list --machine
It will give you the machine domain name information and the associated SID
- 215
0
votes
How to get properties for multiple users using Get-ADUser
This command will get you all the properties of the user
Get-ADUser usernamehere -Properties * | Select-Object name,office
you can add the Select object to define the information you want to see
Get-...
1
vote
Accepted
Windows Authentication with OpenID Connect (OIDC) with Active Directory (AD FS)?
Maybe keycloak can help you here, it can be mediate between LDAP and OIDC.
- 36
0
votes
Add-ADGroupMember : Cannot find an object with identity: '{DistinguishedName}' under: 'DC=DOMAIN,DC=ORG,DC=com'
I am trying to add this group to a user:
AXSDevelopers
I got this error:
Add-ADGroupMember : Cannot find an object with identity: 'AXSDevelopers' under: 'DC=nxmbus,DC=local'.
I opened the UI of &...
1
vote
Accepted
What to do with DNS if IP address is changed?
I've reread the question a few times and have an update.
Either create a DHCP reservation for the server in the Linksys mesh interface... If you have access to that.
If not, from a computer on the ...
- 1,540
0
votes
Adding a machine to a domain fails with internal error
This solution works for me. Disable AllwNt4Crypto in register of DC
https://learn.microsoft.com/es-mx/services-hub/health/remediation-steps-ad/disable-the-allownt4crypto-setting-on-all-affected-domain-...
- 1
2
votes
Accepted
How to use AD CS to auto-renew certs for securing IIS websites that use SNI?
You can't expect the CA to permit IIS to enrol for a certificate for all your SNI sites and the CA doesn't know that you own those names. If the CA issues certificates for any Subject the client ...
- 4,304
0
votes
Powershell - Test user credentials in AD, with password reset
Here's a way to get the remaining days for a given user before they password expires:
(([datetime]::FromFileTime((Get-ADUser user -Properties "msDS-UserPasswordExpiryTimeComputed")."...
- 598
1
vote
Backtracking from a folder to AD groups
Is it possible for me to tackle this purely from the AD groups and not worry about the folder at all?
No. ACLs are defined on the filesystem object (your folder), not in AD itself.
You would need to ...
- 35.9k
0
votes
why active directory computer object has machine password?
The computer account is a type of user account. It needs to logon and access resources, independent of any user account. To do this, it needs to specify credentials, in the form of a username and ...
- 35k
0
votes
Trouble debugging user access to Windows SMB shares
It sounds like you've hit most of the pain points for a Windows network share, but have you checked the NTFS permissions on the folder? Those often get overlooked but still are required to allow ...
0
votes
Realmd / SSSD Sudo performance issues
The question is old but it may solve the day for someone.
I would check first for DNS/LDAP latency issues. Every login is checked against AD every time, so this causes some latency. RedHat also ...
2
votes
Accepted
Why is Windows Restarting my Service which I've Manually Stopped?
This is NOT due to Windows behavior. I found out from our Cloud Services Provider that they have their own automation tool which monitors for stopped services and restarts them. I've instructed them - ...
- 131
0
votes
Kerberos auth from non-domain joined machines using custom UPN suffix
Is there any way to get Kerberos to work from non-domain joined machines when you are using non-default UPN suffixes?
Unfortunately no. While this is common in Linux implementations, the complexities ...
- 35k
1
vote
How to configure DNS for internal domain resolution on Windows Server?
How can I configure DNS to ensure that office.example.com always resolves to the private IP address?
By only using the internal private IP address of the DNS Server(s) on the clients. Never use ...
- 35k
0
votes
How to configure DNS for internal domain resolution on Windows Server?
Is this a new AD because we run into the same issues because of using “.nl” for our internal domain.
If you want to resolve this, you have to create an internal DNS zone for example.com and put all ...
- 147
0
votes
Two Different Domains & Domain Controllers on Single Network
Yes, it is possible to have two Active Directory domain controllers running on the same network, within the same subnet, with two separate domains, without linking them in any way. However, as you ...
1
vote
Accepted
Powershell - get name and mobile from group with more than 5000 members
You can get all group members directly using Get-ADGroupMember, even with subgroups
get-adgroup 'xxxx' |Get-ADGroupMember -Recursive |
get-aduser -Properties name,mobile |sort name |select name,...
- 21.8k
2
votes
Accepted
Active Directory: Account Operators can delete Domain Admin accounts
The effective permissions appear to be hiding the fact that the AO can
delete the object. I truly don't understand this.
I liked this Secure Identity post so much about this topic, I figured I'd ...
- 1,075
0
votes
User can't change password due to complexity
Honestly this sounds like you're encountering a secondary product setting policy via local GPO edits. Something like ScriptLogic (aka Desktop Authority).
Some symptoms you'd see on older PCs would be:
...
- 1
0
votes
SQL Server Kerberos Configuration Manager error "The LDAP server is unavailable"
I have the same problem. After debugging it quite a while I noticed there seems to be a bug in the regex code in the 4.2.1 version of the Kerberos Configuration Manager for SQL Server.
It parses ...
Top 50 recent answers are included