r/activedirectory

So I need help regarding Domain controllers. I have 2 DC one is Primary domain controller and secondary domain controller.In PDC I can able to see the sysvol files like script inside my domain but when I checked on secondary domain controller I can't able to see the folders inside Sysvol (script) files. I checked with showrepl/repsummary and repadmin command they are normal every 5 objects is syncing successful and no fails. What can I do here?

I'm using Nessus and working though CIS baseline compliance for Windows 11 Enterprise, and there are some controls for User Config settings, e.g.

User Config\Policies\Administrative Templates\Windows Components\Cloud Content\Configure Windows Spotlight on lock screen

The issue is that some of my systems have a local user account installed by some third-party software. This account never logs in, so it never picks up the user policy, and the nessus scan picks up the non-compliant registry entry, e.g.

HKU\<SID>\Software\Policies\Microsoft\Windows\Cloudcontent

Is there some magic command that I can use to tell the system to apply the user policy to a local account?

Hi, I'm working through CIS Baseline compliance and one of the controls is to set "Interactive Logon: Smart Card Removal Behaviour" to "Lock workstation".

However, when I set this on a test machine, I completely lose the ability to RDP to it - I don't even get a login prompt. Local login still works fine.

We don't use smart cards, so I have no experience of what complexities they bring.

Is this normal/expected, and if so, is there a way to enable this control and still retain the ability to RDP?

Thanks!

I was looking a bit more into the new-ish 32k page size in the AD database and what it means in practise. My take that I came up is: If you don't have an urgent need or aren't doing a new Install, the actual advantage in practise isn't that big unless you have a very large directory. The risks are actual if you haven't checked a couple of things.

It's mostly about records that have a huge amount of multi-valued attributes but I don't see that in the directories I currently have access to. It's likely to happen in very huge directories with deep nested groups etc.

Would you agree with me or am I ignoring something obvious?

There are a couple of things you should check before even considerung the upgrade:

• No inplace upgraded Domain Controllers are OK
• Your AD Backup should support it (i.e. Veeam seems to require specific versions)
• You need to have backups since it's a one-way street, once the DB is converted to 32k page size it's not reversible.

And so far it also seems like this is the only new optional feature in Active Directory that actually requires a Domain and Forest Functional Level of 2025 - right?

Hi everyone,

We have an existing on-prem AD environment where Microsoft Entra Seamless SSO has been configured for quite some time.

During a recent AD security assessment, the AZUREADSSOACC computer account was highlighted as a security risk because its Kerberos decryption key/password has not been rotated recently.

Microsoft's documentation recommends periodically rolling over the Kerberos decryption key for the AZUREADSSOACC account, at least every 30 days. The documentation also provides PowerShell commands to perform the rollover from the Microsoft Entra Connect server.

Before making this change in our environment, we are planning to test it in our lab first.

I would like to understand the practical production impact:

• Has anyone performed an AZUREADSSOACC password/Kerberos key rollover in an existing production environment?
• Did the rollover cause any Seamless SSO interruption or authentication issues?
• Did users need to log off/restart their devices or purge existing Kerberos tickets?
• Were there any issues with Microsoft Entra Connect or the existing Seamless SSO configuration after the rollover?
• Is there anything specific we should verify before and after the rollover?
• If you have performed this in a large/older AD environment, did you encounter any unexpected behavior?

We are not looking to disable/reconfigure Seamless SSO; the goal is only to perform the recommended Kerberos decryption key/password rollover on the existing AZUREADSSOACC account as a security remediation.

Any real-world production experience would be really helpful, especially from anyone who has done this in an older AD environment.

Thanks!

Working through an AD security finding in an isolated lab and want a sanity check on my understanding before I take this to a client.

The finding: "Domain trust to a third-party domain without quarantine" (ANSSI vuln1_trusts_domain_notfiltered). Description says it looks for outbound forest trusts where the Quarantine flag is false, meaning the trusted domain isn't subject to SID filtering.

What I did in the lab:

Built two forests, forestA.local and forestB.local, and created an outbound forest trust from A (B trusts A, so A's users can be authorized in B).

Scanned it — passed clean. Trust attributes read:

Direction               : Outbound
ForestTransitive        : True
SIDFilteringForestAware : False
SIDFilteringQuarantined : False

I'd expected SIDFilteringQuarantined : False to fire the finding, but it didn't. My read is that quarantine isn't the active control on a forest trust, so False there is the normal secure default. Is that right?

Then I ran:

netdom trust forestA.local /domain:forestB.local /EnableSIDHistory:Yes

Re-scanned — finding fired. Trust attributes now showed 72 [TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL, TRUST_ATTRIBUTE_FOREST_TRANSITIVE]. Quarantine never changed; only SID history did.

Where I'm confused:

1. Is "enabling SID history" and "disabling SID filtering" the same change described two ways, or are they genuinely separate controls? My current understanding is that on a forest trust there's no independent filtering switch — allowing SID history is how filtering gets relaxed. Correct?
2. Am I right that the switch differs by trust type? Forest trust → /EnableSIDHistory, external trust → /Quarantine. Same underlying protection, different lever depending on type.
3. The scanner's result line says "Quarantine is disabled or SID history is enabled" — so two independent trigger conditions, either one alone fires it. Does that match how you'd read it?

Why it matters: I need to phrase this correctly in a client report. My current wording is:

>

Does that hold up, or am I conflating things?

Also — practical question — has anyone hit a case where disabling SID history broke legitimate cross-forest access? Trying to work out what to ask a client before remediating, since I assume an in-flight migration is the one genuine reason it'd be on.

Hi everyone, I recently took over IT support for a company—it fell on my shoulders overnight because our previous IT guy unexpectedly passed away—and I inherited an Active Directory environment with about 25 PCs. We're slowly migrating to Entra ID, but for the past few hours, I’ve been stuck trying to deploy a printer to users via GPO—yeah, I know, printer deployment is always a pain. It's not like I can't just walk over to those few machines and add it manually, but it's driving me crazy if I can't get it done through GPO. You get me, right?

So, here's the deal: on my own PC, I added an IPP printer using port 631 via direct communication—there's no dedicated print server in the office. However, I just can't get it to deploy using GPO. The driver is the built-in Microsoft IPP Class Driver, so it should be present on all client machines. I've tried pushing it as a TCP/IP printer under both User and Computer Configurations, but no luck.

For the printer path, I've tried using http://, ipp://, and IP_ADDRESS/ipp/print. I might be configuring this in the completely wrong place, though, because the next tab mentions TCP/IP RAW ports, whereas I'm using IPP.

Could you guys at least point me in the right direction?

Hi,

I have a GPO to create a shared drive when a user is a member of a security group, hardcore AD I know. This GPO being in the user realm.

I need this to apply to both members of the security group AND also computers NOT in a specific OU (so servers in the main).

Would anyone be able to tell me the best way of doing this, I've read about loopback processing and the more I read the more confused I get as this reads that it is for the computer realm only.

Hello folks!

I am curious how you handle the PAW Design in your company when admin tiering is implemented.

My Approach:
Tier 0 Administration PAW - Physical notebook on admin-vlan Port and firewalled to allow everything for administrate tier0

Tier 1 PAW - This is the "main" PC of the IT-People. There job is to administer the whole day and I consider Jump-Hosts from office-pcs as no-clean-keyboard and therefore as insecure.

Tier 2 Administration / Office work - this is where the Admin connects from his t1-pc to a remote desktop server hosting all office related stuff like mails, websurfing and teams.

I shifted tier 1 and tier 2 devices around to have clean keyboard. The IT Users I work with sometimes are unsatisfied because office work takes place in a rdp-session. The companies I consult are too small to use 3 physical devices as PAW and it is too incomfortable for them.

Looking forward to hear how you handle the security/comfort.

Hello everyone,

I am a fresh grad and have ~2 years of general IT/operations/support experience and Im looking to move away from daily support/ticketing job,

Finally, I got an offer "Junior Windows Engineer" role focused on:

• Automated deployment & configuration of Windows Server
• Managing large-scale Active Directory through code/scripting (PowerShell, CI/CD, Git, Ansible).
• Building tools specific platforms/project (pure automation, zero helpdesk tasks).

My questions:

1. Is focusing on Windows/AD automation a solid foundation for long-term career growth?
2. Is it worth taking this over a general IT support role?

Im also concerned about getting stuck with legacy tech instead of moving into cloud solutions, (where the career path seems more promising?).

Also I have heard that the project is fairly old, so there's a good chance I will be dealing with outdated tech and legacy documentation. Is that a real risk?

Would appreciate any insights or advice from you!

Hello, i just started an intern ship at a IT company and work alot in the AD and was wondering if its a good thing to learn powershell?

We've recently had an AD audit which has reported that accounts have unconstrained Kerberos delegation.

A number of these are SQL accounts. The delegation setting has appeared due to setting an SPN on the account as follows:

contoso\SQLS0003
MSSQLSvc/server01.contoso.com,MSSQLSvc/server01.contoso.com:1433

If I want to change this to constrained delegation, do I just go into the account properties and set:

"Trust this user for delegation specific services only" Use Kerberos

And select the account itself as a delegated object?

To be fair, I am not a deep-tech person. I work for Netwrix, and someone told me yesterday that with cloud migration, Active Directory's days are numbered.
I kind of disagree. What about organizations that prefer on-premises infrastructure? What about those locked into strict compliance regulations that practically require on-prem?
What do you think?

Anything i should know, learning material? topic suggestions? I am learning 100% frm youtube for now.

Hello experts,

I have configured Microsoft Entra Seamless SSO with Password Hash Synchronization (PHS). My current setup is that my on-premises domain is xyz.com, and my Microsoft Entra tenant is on.microsoft2345.com. I added cloud domain as an alternative UPN suffix in Active Directory. Initially, Seamless SSO was working, but it is currently not working.

Is there anything I might have missed or need to check? Any guidance would be really helpful.

When the cloud push started a decade ago, the selling point made complete sense: hardware was a pain to manage, SANs were expensive, disk drives died constantly, and scaling required months of lead time. Cloud promised high availability and low operational overhead.

Fast forward to today, and the reality on the ground feels completely different:

1. Hardware is ridiculously reliable. Modern enterprise compute, hypervisors, NVMe storage, and 10G/40G local networking just work. You can drop a couple of redundant nodes in a rack, set up hyper-converged storage, and touch it maybe twice a year.
2. Local network speed/latency beats the WAN every time. Running traffic locally over high-speed switches is instant, predictable, and doesn't rely on ISP stability or cloud provider region outages.
3. The cost equation flipped. Cloud billing has turned into an endless maze of egress fees, API call costs, compute markups, and surprise monthly charges that balloon every time management blinks.

It makes me wonder: if local hardware, compute, and networking have gotten this fast, cheap, and stable, why are we still defaulting to cloud for standard workloads?

I get it for massive, unpredictable elastic scaling, global CDN edge delivery, or multi-region AI workloads. But for standard line-of-business applications, storage, and core infrastructure, running on compute you own feels faster, safer, and infinitely cheaper.

I'd love to hear from people managing infrastructure day-to-day:

• Is cloud still genuinely giving you value over local compute/networking, or are you just stuck there due to legacy decisions?
• Has anyone actually run the ROI comparison recently between modern local hardware vs. cloud compute costs?
• What are the honest dealbreakers holding you back from bringing workloads back on-prem?

Guys I'll encouter active directory in my class this year , so what do you recommend to learn about it , just reading resources please , thanks in advance

Do daily onprem AD maintainers use any tool for visibility / reporting? if yes why are they bloated?
I am using one, which takes gbs of storage and exteremely slow.