Hot answers tagged

27

taskkill.exe /F /IM explorer.exe runas /user:%USERDOMAIN%\%USERNAME% explorer.exe This will kill explorer, then reopen with your user account... It will prompt you for your password and that will get you a new token, thereby updating your membership.


26

Gimme the codes! powers, activate! $Groups = Get-ADGroup -Properties * -Filter * -SearchBase "OU=Groups,DC=corp,DC=ourcompany,DC=Com" Foreach($G In $Groups) { Write-Host $G.Name Write-Host "-------------" $G.Members } The point being, just take your time and break it out into steps. I know that it's fun to try to get everything and the ...


23

Assuming all your Domain Controllers are Windows Server 2003 or later you can do this with native Active Directory's dynamic objects functionality without any scripting. Let's say that a user account, "Bob", needs to be in the "Accounting" group for 24 hours. Create a "Bob in Accounting 24 Hours" group and specify an entry-TTL for 24 hours (the duration ...


22

You can specify the managedBy attribute, and check the box for "Manager can update membership list". (This grants write permission for the Member attribute.) The person(s) who need to edit the group may be able to do it with the DSQuery widget, for which you can create the following shortcut: rundll32 dsquery,OpenQueryWindow They can search for the group ...


17

FreeIPA is probably what you're looking for. It's to Linux what Active Directory is to Windows. (It can also talk to AD if you have a heterogeneous environment, but shouldn't be used to manage Windows machines directly. Use AD for that.) Red Hat's documentation (they call it Identity Management) is very thorough and easy to follow, and should be mostly ...


17

pam_ldap and nsswitch have no caching mechanisms, but nscd or sssd may be present on your system that implement cache. To invalidate / flush nscd groups cache use: sudo nscd --invalidate=group To invalidate / flush sssd groups cache use: sudo sss_cache -G


12

There is no standard requiring any interoperability meaning of this groups. Traditionally the adm group is used to give a user access to some sort of system log files. See e.g. ls -l /var/log. The sys group normally intended to give a user some kind of administration rights. E.g. archlinux use this group for cups administration. Other distributions behave ...


12

There is no such thing as a Dynamic Security Group in Active Directory, only Dynamic Distribution groups. To accomplish this, I think the most viable option would be to have a Powershell script determining who are in the given OU and updating the security group accordingly, maybe like this: Import-Module ActiveDirectory $groupname = PseudoDynamicGroup $...


12

Yes, this discrepancy is normal. I've seen it so many times I stopped looking at the /etc/passwd and /etc/group files and instead started looking at group memberships the way they should be looked at: getent group <groupname> and groups <username>.


12

Yes, there is a difference between the primary and supplementary groups. The primary group is the main one shown in /etc/passwd, that a user is in upon login. For a user to be in a supplementary group, their user name is added to the group entry in /etc/group. If you use id -a <user>, it will show the primary and the supplementary groups. The ...


10

Here is a much better solution. This will put everything in a 3 column csv with group name, username, and sam account name. A lot easier to figure out what group someone is in when there's 400 users in a group as you don't have to scroll. Import-Module ActiveDirectory $Groups = (Get-AdGroup -filter * | Where {$_.name -like "**"} | select name -...


9

According to the man page (http://linux.die.net/man/8/useradd): UID_MAX (number), UID_MIN (number) Range of user IDs used for the creation of regular users by useradd or newusers. I'm pretty sure that if you set UID_MAX in /etc/login.defs to 5554 you will get the behavior you are looking for.


9

If you only have a single domain and all of your domain controllers are global catalogs, there isn't much impact. Best practice is all domain controllers should be GC's. In large forests with multiple domains, it can be advantageous to limit what groups are universal. This is due to the member attribute of universal groups are replicated to the global ...


9

As silly as it sounds, it's because Domain Users is not actually in the memberOf attribute. You can verify in ADUC by turning on View - Advanced Features, going to the Attributes tab on your object and opening the memberOf attribute (not the "Member Of" tab). The "Member Of" tab you see on an object's properties in ADUC is actually a conglomeration of the ...


8

You can't delete the 'NT Authority\Authenticated Users' (SID S-1-5-11) group. You also cannot view this group in AD Users and Computers, which would explain why you can't see it using that tool. It's not a "real" security group the way that "DOMAIN\Domain Admins" is, for instance. The membership of "Authenticated Users" is dynamically generated and ...


7

What you're seeing is the SID (Security Identifier) of an object. Generally, Windows is nice enough to automatically translate this SID into a user's display name for you in the Security dialog, so that you don't have to hunt for it, but if a Domain Controller is unable to be contacted when the ACL is being viewed, you'll see a SID. You'll also see this SID ...


7

Set-ADGroup "SecurityGroupName" -Replace @{mail="test@example.com"}


6

had the same problem today with Jenkins 2. LDAP is configured working and I can login as AD user, I can add AD user to matrix, but when I add a group into matrix, it shows "user/group not found" for that group. Finally fixed it following https://wiki.jenkins-ci.org/display/JENKINS/LDAP+Plugin#LDAPPlugin-Groupsearchbase The fix is to add (& (cn={0}) (...


6

Based on the documentation: Manage groups. On most platforms this can only create groups. Group membership must be managed on individual users. On some platforms such as OS X, group membership is managed as an attribute of the group, not the user record. Providers must have the feature ‘manages_members’ to manage the ‘members’ property of a ...


6

I would suggest a good local consultant to assess the particulars of your situation... Really. There may be other business requirements or nuances that people on this forum may not recognize or be invested-enough to consider. A dedicated resource is your best bet... Otherwise, we're just throwing product recommendations at you for something that's easily ...


6

You could handle this a few ways, none are native to AD: Write a script and put it in task scheduler. Have it query a text file or CSV somewhere on the network with the current list. Have it remove people not on that list at runtime. Use something like System Center Orchestrator to create a runbook to add users to the group and to remove them after X hours ...


6

According to the AD design guidance, there are 2 things to consider when designing your structure: 1)delegation of administrative control and 2)group policies. Since Group Policies don't apply to groups, you're basically left with one - delegation of Administrative control. Your model B gives the option to do some local delegation of administrative tasks ...


6

Simple: Someone or something removed him from these groups. This doesn't happen automatically and I've never seen an AD failure that's caused this - it was either an error from another administrator, or an automated process gone awry, such as a script. There's likely nothing you can do now, but in the future you can audit Directory Services changes.


6

Extend your Get-ADUser line: $getmembership = Get-ADUser $User -Properties MemberOf | Select -ExpandProperty memberof | Get-ADGroup -Properties name | Where { $_.GroupCategory -eq 'Security' } | Select -ExpandProperty Name This will feed the DN of the Group to Get-ADGroup to retrieve additional properties, then filter on group category and select the name ...


5

If you dont care about remote users such as LDAP or NIS, to list users and their associated groups in a simple way: cut -d: -f1 /etc/passwd | xargs groups Output; root : root myuser : root www-data fuse anotheruser : anotheruser cdrom floppy audio dip video plugdev scanner bluetooth netdev


5

Another option - you can open up Local Users and Groups for the remote computer using this command: lusrmgr.msc /computer=computername


5

While the solution provided by @Mircea_Vutcovici worked for me, my only criticism is that people may get squeamish when they see bitwise operators in use. For instance, I'll be handing over an Apache Bloodhound installation, that uses Apache HTTPd as the front end with AD group auth, to a group of fellow developers. They're going to have issues coming to ...


5

Solved: php-fpm doesn't run as the nginx user of course. It can be configured (in CentOS) in the file /etc/php-fpm.d/www.conf. I edited its config by adding line 45: 44 ;group = nobody 45 group = webadmin Then restarted it: sudo /etc/init.d/php-fpm restart


5

What I've discovered, that I'm hoping someone else can beat (by having these rights applies to existing objects) is: Establish proper DNS communication between the two forests. In my case, this required a DNS delegation zone and properly configured conditional forwarders. Create a two-way, forest trust with forest-wide authentication. Add the Domain ...


5

Groups are a different kind of object from users, so differentiating them is already possible, even easy. Built-in accounts are usually left in the Users container, while user accounts and service accounts are typically sorted into separate OUs either under the Users container or outside of the Users container. Either way, sorting by OU would be a visual ...


Only top voted, non community-wiki answers of a minimum length are eligible