Setting up Active Directory - Best Solution

Hi all, 
Pretty new to all the Windows 2012 business, but i have had a good crack at it. 
I am building my artefact for my university dissertation, and i am building a virtual environment for a small fictional financial company. I have set up and configured my CentOS FTP Server, and my WS 2012 R2 File Server, however i want to get an Active Directory
Server Set up.
I suppose i have a couple of questions really...
1) What is the best way to do this? I have two servers (File Server & Active Directory Server) on the same domain, and i want to add users and groups using Active Directory that have access to the file server, as it will act as their own personal desktop
space. I have a virtual machine, that will be used as a "Hot Desk" which all users can access to get their personal documents, this is connected to my File Server. 
2) is this really necessary? Im aware i can just add users to the file server via the server dashboard, however the AD gives me more security and control over the users. So is it worth spending a while setting it up when it may not be absolute necessary?
I hope i have made my scenario clear. 
Many thanks in advance!
Al

It can be installed on the same server, but if you are talking about a single server installation, there is not much benefit.  In a workgroup environment, you need to set up an account for each user.  In an AD environment, you need to set up an
account for each user.  In a workgroup environment, you can create security groups to control access to resources.  In an AD environment, you can create security groups to control access to resources.
The real benefit to AD comes if you want to manage users who can log in from different devices, or if you have multiple resource servers.  In a workgroup with multiple resource servers, you have to set up accounts and security groups on every server. 
In an AD environment, you set up accounts and groups once.  Similarly, with client machines, if you have a workgroup and you want to allow users to log onto any computer, you have to set up user accounts on every computer.  In an AD environment,
you only have to set up the accounts once and then join all the client machines to the domain.
.:|:.:|:. tim

Similar Messages

  • Help with setting up active directory domain controller/DNS - need this for Clustering

    Disclaimer: I am new to Active Directory, so please dont rule out the obvious things I may have overlooked.
    I need to set up Active Directory Domain controller on at least one server so I can run clustering. I set up the domain controller and ran Cluster validation and that failed - unable to reach writable domain controller.
    When I look at my server manager AD DS complain about DNS:
    NASE-2012-234    4015    Error    Microsoft-Windows-DNS-Server-Service    DNS Server    1/14/2014 12:54:06 AM
    The DNS server has encountered a critical error from the Active Directory. Check that the Active Directory is functioning properly. The extended error debug information (which may be empty) is "". The event data contains the error.
    When I click on DNS this is the error:
    The DNS server has encountered a critical error from the Active Directory. Check that the Active Directory is functioning properly. The extended error debug information (which may be empty) is "". The event data contains the error.
    Output of DCDiag -v is below.
    PS C:\Users\Administrator> dcdiag -v
    Directory Server Diagnosis
    Performing initial setup:
       Trying to find home server...
       * Verifying that the local machine NASE-2012-234, is a Directory Server.
       Home Server = NASE-2012-234
       * Connecting to directory service on server NASE-2012-234.
       * Identified AD Forest.
       Collecting AD specific global data
       * Collecting site info.
       Calling ldap_search_init_page(hld,CN=Sites,CN=Configuration,DC=lab,DC=nase,DC=com,LDAP_SCOPE_SUBTREE,(objectCategory=
    ntDSSiteSettings),.......
       The previous call succeeded
       Iterating through the sites
       Looking at base site object: CN=NTDS Site Settings,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=lab,DC=nas
    e,DC=com
       Getting ISTG and options for the site
       * Identifying all servers.
       Calling ldap_search_init_page(hld,CN=Sites,CN=Configuration,DC=lab,DC=nase,DC=com,LDAP_SCOPE_SUBTREE,(objectClass=ntD
    SDsa),.......
       The previous call succeeded....
       The previous call succeeded
       Iterating through the list of servers
       Getting information for the server CN=NTDS Settings,CN=NASE-2012-234,CN=Servers,CN=Default-First-Site-Name,CN=Sites,C
    N=Configuration,DC=lab,DC=nase,DC=com
       objectGuid obtained
       InvocationID obtained
       dnsHostname obtained
       site info obtained
       All the info for the server collected
       * Identifying all NC cross-refs.
       * Found 1 DC(s). Testing 1 of them.
       Done gathering initial info.
    Doing initial required tests
       Testing server: Default-First-Site-Name\NASE-2012-234
          Starting test: Connectivity
             * Active Directory LDAP Services Check
             The host c0c507c4-fb9b-49a6-9a01-ef79d7960c94._msdcs.lab.nasecom could not be resolved to an IP address.
             Check the DNS server, DHCP, server name, etc.
             Got error while checking LDAP and RPC connectivity. Please check your firewall settings.
             ......................... NASE-2012-234 failed test Connectivity
    Doing primary tests
       Testing server: Default-First-Site-Name\NASE-2012-234
          Skipping all tests, because server NASE-2012-234 is not responding to directory service requests.
          Test omitted by user request: Advertising
          Test omitted by user request: CheckSecurityError
          Test omitted by user request: CutoffServers
          Test omitted by user request: FrsEvent
          Test omitted by user request: DFSREvent
          Test omitted by user request: SysVolCheck
          Test omitted by user request: KccEvent
          Test omitted by user request: KnowsOfRoleHolders
          Test omitted by user request: MachineAccount
          Test omitted by user request: NCSecDesc
          Test omitted by user request: NetLogons
          Test omitted by user request: ObjectsReplicated
          Test omitted by user request: OutboundSecureChannels
          Test omitted by user request: Replications
          Test omitted by user request: RidManager
          Test omitted by user request: Services
          Test omitted by user request: SystemLog
          Test omitted by user request: Topology
          Test omitted by user request: VerifyEnterpriseReferences
          Test omitted by user request: VerifyReferences
          Test omitted by user request: VerifyReplicas
          Test omitted by user request: DNS
          Test omitted by user request: DNS
       Running partition tests on : ForestDnsZones
          Starting test: CheckSDRefDom
             ......................... ForestDnsZones passed test CheckSDRefDom
          Starting test: CrossRefValidation
             ......................... ForestDnsZones passed test CrossRefValidation
       Running partition tests on : DomainDnsZones
          Starting test: CheckSDRefDom
             ......................... DomainDnsZones passed test CheckSDRefDom
          Starting test: CrossRefValidation
             ......................... DomainDnsZones passed test CrossRefValidation
       Running partition tests on : Schema
          Starting test: CheckSDRefDom
             ......................... Schema passed test CheckSDRefDom
          Starting test: CrossRefValidation
             ......................... Schema passed test CrossRefValidation
       Running partition tests on : Configuration
          Starting test: CheckSDRefDom
             ......................... Configuration passed test CheckSDRefDom
          Starting test: CrossRefValidation
             ......................... Configuration passed test CrossRefValidation
       Running partition tests on : lab
          Starting test: CheckSDRefDom
             ......................... lab passed test CheckSDRefDom
          Starting test: CrossRefValidation
             ......................... lab passed test CrossRefValidation
       Running enterprise tests on : lab.nasecom
          Test omitted by user request: DNS
          Test omitted by user request: DNS
          Starting test: LocatorCheck
             GC Name: \\NASE-2012-234.lab.nasecom
             Locator Flags: 0xe000f3fd
             PDC Name: \\NASE-2012-234.lab.nasecom
             Locator Flags: 0xe000f3fd
             Time Server Name: \\NASE-2012-234.lab.nasecom
             Locator Flags: 0xe000f3fd
             Preferred Time Server Name: \\NASE-2012-234.lab.nasecom
             Locator Flags: 0xe000f3fd
             KDC Name: \\NASE-2012-234.lab.nasecom
             Locator Flags: 0xe000f3fd
             ......................... lab.nase.com passed test LocatorCheck
          Starting test: Intersite
             Skipping site Default-First-Site-Name, this site is outside the scope provided by the command line arguments
             provided.
             ......................... lab.nasecom passed test Intersite
    PS C:\Users\Administrator>

    http://social.technet.microsoft.com/Forums/en-US/home?forum=winserverDS is the forum for Directory Services questions.  You might want to post your question there.
    .:|:.:|:. tim

  • User synchronization issue between Active Directory and Solution manager.

    Requirement:
    Synchronize the users between Active directory and solution manager system.
    <u>What we did:</u>
    1.     Created RFC connection (LDAP_RFC) for LDAP connector.
    2.     Created new LDAP connector that utilize the RFC (LDAP_RFC).
    3.     Created new logical LDAP Server(CUA).Here we have to maintain the connection
    details to the physical directory.
    4.     We maintained the communication user that is used by the LDAP connector to bind the LDAP Directory Server.
    5.     In transaction LDAPMAP specific SAP data fields, we mapped to the desired
    directory attributes.
    6.     Testing from LDAP transaction working fine. We are able to see the attributes and
    values       from Active directory.
    <b><u>Issue:</u></b>
    When executed the program RSLDAPSYNC_USER for user synchronization from t-code se38 with below selection .
    LDAP Server = CUA (created earlier)
    LDAP Connector = LDAP_RFC (RFC connection created created ealier)
    In the tab: (Object that exist both in the directory and in the Database:)
    Selected: Compare Time Stamp.
    In the tab: (Objects the only exist in the Directory.)
    Selected : Create in Database.
    In the tab(Objects that only Exist in the Database:
    Selected: Ignore Object.
    Result from the report shows that connection to LDAP server is fine and ‘0’(zero) objects in Directory.
    The program does not create any new user in the Solution Manager system.
    Any help on this issue greatly appreciated.
    Thanks & Regards,
    Harish

    where did you see this error ? is there anymore details.
    i think the account you are using for Sync does not have Replicate Directory Changes permission in AD. follow below article and give Replicate directory changes permission.
    http://technet.microsoft.com/en-us/library/hh296982(v=office.15).aspx
    Thanks, Noddy

  • Pre-populate adapter for setting the Active Directory OU for a user

    Hi All
    I created a pre-populate adapter that set the Active Directory OU for a user...
    In the end the status of the resource is still showing "provisioning"..
    It must be "Provsioned"..did I miss something ?
    The logs speak as below :-
    08:01:12,678 INFO [STDOUT] Running Create User
    08:01:12,678 INFO [STDOUT] Before appending Root Context:OU=Human Resources,
    08:01:12,678 INFO [STDOUT] tcUtilLDAPController.java : hierString : OU=Human Resources,dc=mydomain,dc=com
    08:01:13,553 ERROR [ACTIVEDIRECTORYCONTROLLER] Problem creating object: javax.naming.OperationNotSupportedException: [LD
    AP: error code 53 - 0000001F: SvcErr: DSID-031A0FC0, problem 5003 (WILL_NOT_PERFORM), data 0
    ]; remaining name 'cn=ASYMONDS'
    08:03:18,756 INFO [[xlWebApp]] action: LogonAction: User 'XELSYSADM' logged on in session 8116CBC0FA1481D06A207A1941B9
    E096
    08:22:31,256 ERROR [WEBAPP] Class/Method: ProvisionedResourcesForUserAction/confirmEnableSelection encounter some proble
    ms: No checkbox was checked.

    Just verify the OU value is correctly populated , first try doing the provisioning by manually giving OU and everything .
    Is it successful ?
    Then we can check if something wrong going with pre pop.
    Thanks
    Suren

  • NSS 6000 - Setting/Configuring Active Directory

    Hello,
    Do we have an administration guide / tech white paper explaining how to configure the different features such as VLAN and Active Directory on the NSS plattform?
    Regards, Hans-Petter

    http://www.cisco.com/en/US/products/ps9957/prod_maintenance_guides_list.html
    That should give you all the info you are looking for. The admin guide is very insightful, and a must have. Don't forget, when upgrading FW on the NSS, always run the update twice; back to back. This will ensure no old code remains, as a reboot after an upgrade can cause old code to come back and give us problems (also flush your browser cache after the upgrade).
    Let us know if you need anything else.

  • Active Directory synchronization working, authentication not on CUBM BE5000 8.6(1a)

    I successfully set up Active Directory synchronization between my CUCM BE5000 appliance running 8.6(1a) and our Windows 2008 Server Active Directory.  Users are replicating successfully, but authentication is not working even though I am using the same LDAP manager distinguished name and password for both.  I have a suspicion to the cause of this problem but for the record, the following is my relevant configuration:
    System/LDAP/LDAP System:
    LDAP Server Type Microsoft Active Directory iPlanet or Sun ONE LDAP Server OpenLDAP Microsoft Active Directory Application Mode
    LDAP Attribute for User ID userPrincipalName sAMAccountName mail employeeNumber telephoneNumber
    LDAP Server Type: Microsoft Active Directory
    LDAP Attribute for User ID: userPrincipalName
    System/LDAP/LDAP Directory:
    LDAP Configuration Name: bgctnv.local
    LDAP Manager Distinguished Name: CN=cm.sync,OU=BGCTNV Users,DC=bgctnv,DC=local
    LDAP User Search Base: DC=bgctnv,DC=local
    LDAP Server Information: bgctnv.local, port 389 (to query any domain controller in DNS; I have also tried specific IP addresses)
    System/LDAP/LDAP Authentication:
    LDAP Manager Distinguished Name: CN=cm.sync,OU=BGCTNV Users,DC=bgctnv,DC=local
    LDAP User Search Base: LDAP user search base is formed using the User ID information (pre-populated, I cannot change this)
    LDAP Server Information: bgctnv.local, port 3268
    All of my Active Directory users are now populated and active under End Users.  However, I am not able to log into /ccmuser among other things using my valid domain credentials.  I am a super user as well as a standard end user.
    Curiously, invalid usernames (userPrincipalName in my case) return the error "Log on failed - Invalid User ID or Password" while a valid username, with or without the correct password, returns only "Log on failed."  That seems to imply that some part of the authentication or LDAP bind is taking place.
    Here's the catch.  The base domain here is bgctnv.local while we use bgctnv.org as a valid and acceptable alternative UPN suffix in Active Directory.  Every Microsoft and every third-party program I have used will accept [email protected], but I'm beginning to think that CM will not, or is having some sort of translation issue.  I read that alternative suffixes can cause problems in Active Directory forests with multiple trees, but this is a vanilla, single domain environment.
    I don't even know where to look to debug this issue.  Has anyone seen this before or can anyone tell me where to look for logs?
    Thanks,
    John

    I found the following:
    http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/srnd/8x/directry.html
    As mentioned in the section on LDAP Synchronization, in order to support synchronization with an AD forest that has multiple trees, the UserPrincipalName (UPN) attribute must be used as the user ID within Unified CM. When the user ID is the UPN, the LDAP authentication configuration page within Unified CM Administration does not allow you to enter the LDAP Search Base field, but instead it displays the note, "LDAP user search base is formed using userid information."
    This may help in some situations where there are multiple trees in an AD forest, but it is definitely not the solution.  Even with multiple trees, it is common to use alternative UPN suffixes.  Nothing in AD requires or even recommends that you exclusively use your AD domain root as the UPN suffix.
    For example, company.local may use company.com as an alternative but primary UPN suffix to provide simplicity for users.  Users can then achieve more broad SSO capabilities by using their familiar email credentials when authenticating for company.local services.
    When using UserPrincipalName as the LDAP synchronization attribute for the CM User ID, the configuration requires that the search base for authentication be derived from the UPN suffix, regardless of whether it is a single domain or multiple trees within a forest.  This makes it impossible to authenticate by UPN unless your UPN is explicitly your root domain name.  From the example above, CM would try to bind [email protected] against DC=company,DC=com instead of the correct DC=company,DC=local.
    The logical solution would be to allow the administrator the option.  Why not have a choice of whether to generate the user search base from the userid (UPN) information, or be able to specify the search base as well like it allows with any other synchronization attribute?
    Would this be a feature request, bug report, or neither?  I'd really appreciate it if Cisco considered this but I don't know the proper channel.

  • MeetingPlace Express can support Active Directory?

    We are running MeetingPlace Express v1.1.2.1001. I was wondering if it is possible to use MS Active Directory integration? The purpose would be to enable us to select "from directory" under invitees when scheduling a meeting and it would pull the users/e-mail addresses from MS Active Directory.
    I noticed under System Configuration, Usage Configuration, in the LDAP section you can select Directory Type Active Directory. However I cannot find any documentation on integration MS A/D.
    If not, any word on the best way to get this integrated in a MS A/D environment?
    ryan

    Active Directory is supported for authentication, but I don't believe it is for profile related information though I may be incorrect.
    Once you set the Active Directory parameters via the Usage Configuration screen, you must define set the "isLocalUser" parameter to "No" during the import of user profiles. You cannot set this parameter from the User Profiles page, only via an import of user profile information.
    Once you've set the isLocalUser parameter to No, MPE will look to AD for user authentication.

  • Active Directory provider problem in 11g

    I am having the opposite problem than many others I see setting up Active Directory as the user store for OBIEE 11g. On two of the installations I have done the Active Directory users work but the original weblogic user does not work in OBIEE. It works fine in the WLS console and the FM Enterprise Manager but fails in analytics. The error I'm getting is:
    'weblogic' was authenticated but could not be located within the Identity Store.
    When others were having this problem they had left the default provider's control flag set at "REQUIRED" and not changed it to "SUFFICIENT". But I have done this (and gone back and reset it again) but the error persists. Any thoughts.

    Setting virtualize=true worked. I had tried this before but I think I did what I almost did this time. I almost created the variable virtual instead of virtualize. Thanks. The instructions I followed from Oracle didn't have this step. And I am wondering why it is necessary. The help for the SUFFICIENT setting says:
    A SUFFICIENT value specifies this LoginModule need not succeed. If it does succeed, control is returned to the application. If it fails and other Authentication providers are configured, authentication proceeds down the LoginModule list.
    Before I set this. yes, my AD users could login to EM and the WLS console. Other than this the AD integration has worked well.
    Edited by: dirkt on Sep 19, 2011 12:36 PM

  • Active Directory Diagnostics not running in PerfMon

    Hello all!
    I am trying to run Active Directory Diagnostics in Performance Monitor to address an lsass issue in which lsass consumes too much CPU. 
    I opened PerfMon from an elevated Command Prompt and expanded the tree: Data Collector Sets -> System -> Active Directory Diagnostics.  I right-clicked Active Directory Diagnostics and selected "Start."  The diagnostic is supposed
    to run for 300 seconds and then generate a report.  Problem is, nothing happened after that.  If I right-click Active Directory Diagnostics again, the "Start" option is greyed out. 
    Under Reports -> System -> Active Directory Diagnostics, there are no items to show.
    I consulted the following Microsoft Document:
    http://support.microsoft.com/kb/971714 and found the following file path where the reports should be located: %systemdrive%\Perflogs\ADDS\<var>date report generation run</var>\*.  But there is no ADDS folder and the Admin folder that
    is there is empty.
    Has anyone seen this before?  If so, how did you resolve it?
    Thanks.

    Have you tried reload the AD DS perf counters?
    http://technet.microsoft.com/en-us/library/cc961948.aspx
    Enfo Zipper
    Christoffer Andersson – Principal Advisor
    http://blogs.chrisse.se - Directory Services Blog

  • How to create a disabled account in Active Directory?

    Hi all,
    I got the assignment to create AD accounts as soon as a new employee is entered into the hr system, which might be several weeks before their contract actually starts. Therefore the account should be disabled until the start of their contract and be enabled then.
    Now, I tried a very simple approach and set accounts[Active Directory].disable=true during active sync when creating the account. According to the audit-entries, the value is set correctly, but my AD just doesn't bother. The account is created but not disabled. :-(
    What can I do? The workflow so far was just "start -> provision -> end" and I tried to change it to "start -> provision -> disable ->end" with a new action like this:
    <Activity id='4' name='Disable AD'>
    <Action id='0' application='com.waveset.session.WorkflowServices'>
    <Argument name='op' value='checkoutView'/>
    <Argument name='type' value='Disable'/>
    <Argument name='id' value='$(user.waveset.accountId)'/>
    <Argument name='authorized' value='true'/>
    </Action>
    <Action id='1'>
    <setvar name='view.resourceAccounts.currentResourceAccounts[AD].selected'>
    <Boolean>true</Boolean>
    </setvar>
    <setvar name='view.resourceAccounts.currentResourceAccounts[AD].disabled'>
    <Boolean>true</Boolean>
    </setvar>
    </Action>
    <Action id='0' application='com.waveset.session.WorkflowServices'>
    <Argument name='op' value='commitView'/>
    <Argument name='view' value='$(view)'/>
    </Action>
    <Action id='2' process='Provision'>
    <Argument name='op' value='provision'/>
    </Action>
    <Transition to='end'/>
    <WorkflowEditor x='736' y='192'/>
    </Activity>
    However, there is no success. Probably I got some basic misunderstanding, since provision does not seem to complete when the workflow changes from provision to disable?
    Any help woud be greatly appreciated.
    CU,
    Patrick.

    You need to use DisableViewer view.
    Check following code.
    <Action id='0' application='com.waveset.session.WorkflowServices'>
    <Argument name='op' value='checkoutView'/>
    <Argument name='type' value='DisableViewer'/>
    <Argument name='id' value='$(userId)'/>
    <Argument name='Form' value='Empty Form'/>
    <Return from='view' to='disableView'/>
    </Action>
    Regards,
    MK

  • Password Sync from Active Directory Locking Accounts

    Hello,
    We recently set up Active Directory as a resource and are synching passwords. We are using IDM 7.1.1.11. We are noticing that when actions in IDM push the password out to AD, and they sync comes back to IDM, the sync workflow is locking up the account, before the original IDM action completes. For example, when an admin resets a users password, they see several error messages stating that the account is locked by the account that authenticates through the password sync utility. They also see succesful password reset messages, but I would like it if they didn't see errors saying the account is locked. We are using a direct connection between the Password Sync util and IDM. Has anyone ran into this? Any advice on overcoming it?
    Thanks.
    Jim

    I opened a support case with Sun about this issue, and they recommended logging a trace file for com.waveset.adapter.ActiveDirectoryActiveSyncAdapter. While the tracefile does not seem to contain any useful information, the simple fact that there is tracing going on for it now seems to be easing the situation. In my test environment I saw occurrences of this locking problem drop by 90-95% simply by turning the tracing on. I started tracing in production in the hopes that it will at least lessen the occurances of this.
    Sounds like we are taking the same approach Raj, the problem I've been having with it is getting it to happen will I'm debugging our reset password workflow. I want to make sure I add the locking check in the right place, so I was attempting to determine which area to check for it.
    I'll be sure to keep the thread updated if anything changes on our end.
    Jim

  • Setting up Wiki Calendars in iCal with Active Directory Accounts

    I'm Having a little trouble wrapping my head around our Wiki Calendar Solution,
    Id like to find a way to get the 10.6 Wiki Server Calendar's in iCal Client - using our active directory authentication.
    I have a test 10.6 Server bound to our Active Directory with Wiki's up and running and am able to log in with AD account's and view and manage the Wiki Calendar - I can see how to subscribe to the calendar's - But I need full integration with iCal and maybe even Outlook - subscribing only provides read access.
    anyone have any idea how his can be accomplished in and active directory setting - my searches have lead me to OD solutions and thats not going to work.

    I don't know how much I'll be able to help, but I do have AD accounts using wiki services. Can you verify a few things:
    1. The AD group is listed in the "Wiki Creators" box in Server Admin, yes?
    2. If you open Terminal and run "sudo serveradmin settings teams:enableClearTextAuth", does it return "teams:enableClearTextAuth = yes"?
    3. If you open System Preferences -> Accounts and then edit the directory servers, does the AD domain show as working normally?
    Also, have you worked to isolate the problem? Have you tried creating an OD user to test against the wiki? Are the logs showing anything?

  • How to set in Windows 8.1 the Account Picture from Active Directory

    Hello All,
    In my company I have uploaded the photos for
    each employees in
    Active Directory using a powershell script that set the attribute
    thumbnailphoto.
    This is useful for images in Lync and Outlook,
    now I want to use these pictures
    to sync with the account picture
    in Windows 8.1 but I haven't found anything in internet that helps me
    for this.
    I hope someone can help me,
    Thanks!

    Hi,
    You can try the steps in following article:
    Using Pictures from Active Directory
    http://msitpros.com/?p=1036
    This response contains a reference to a third party World Wide Web site. Microsoft is providing this information as a convenience to you. Microsoft does not control these sites and has not tested any software or information found on these sites; therefore,
    Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. There are inherent dangers in the use of any software found on the Internet, and Microsoft cautions you to make sure that you
    completely understand the risk before retrieving any software from the Internet.
    For your reference, here is the similar thread with different method:
    http://social.technet.microsoft.com/Forums/en-US/d6e7b2c3-c343-4900-a01d-24bfb30357b6/is-there-a-solution-to-set-user-account-picture-from-active-directory-thumbnailphoto-attribute-in?forum=w8itproinstall
    Hope these would be helpful.
    Kate Li
    TechNet Community Support

  • Best practice for Active Directory User Templates regarding Distribution Lists

    Hello All
    I am looking to implement Active Directory User templates for each department in the company to make the process of creating user accounts for new employees easier. Currently when a user is created a current user's Active directory account is copied, but
    this has led to problems with new employees being added to groups which they should not be a part of.
    I have attempted to implement this in the past but ran into an issue regarding Distribution Lists. I would like to set up template users with all group memberships that are needed for the department, including distribution lists. Previously I set this up
    but received complaints from users who would send e-mail to distribution lists the template accounts were members of.
    When sending an e-mail to the distribution list with a member template user, users received an error because the template account does not have an e-mail address.
    What is the best practice regarding template user accounts as it pertains to distribution lists? It seems like I will have to create a mailbox for each template user but I can't help but feel there is a better way to avoid this problem. If a mailbox is created
    for each template user, it will prevent the error messages users were receiving, but messages will simply build up in these mailboxes. I could set a rule for each one that deletes messages, but again I feel like there is a better way which I haven't thought
    of.
    Has anyone come up with a better method of doing this?
    Thank you

    You can just add arbitrary email (not a mailbox) to all your templates and it should solve the problem with errors when sending emails to distribution lists.
    If you want to further simplify your user creation process you can have a look at Adaxes (consider it's a third-party app). If you want to use templates, it gives you a slightly better way to do that (http://www.adaxes.com/tutorials_WebInterfaceCustomization_AllowUsingTemplatesForUserCreation.htm)
    and it also can automatically perform tasks such as mailbox creation for newly created users (http://www.adaxes.com/tutorials_AutomatingDailyTasks_AutomateExchangeMailboxesCreationForNewUsers.htm).
    Alternatively you can abandon templates at all and use customizable condition-based rules to automatically perform all the needed tasks on user creation such as OU allocation, group membership assignment, mailbox creation, home folder creation, etc. based on
    the factors you predefine for them.

  • Active Directory Changes have causes users to loose access to Projects they are set as contributor too.

    Hello,
    We recently had an employee of our helpdesk delete (by accident) and recreate a number of Active Directory user profiles.  The profiles were created exactly like they were before, but now those users are not able to access the projects in TFS that they
    have contributor permissions too.  Some of these users can see a minimal set of objects in the Source Control Explorer, but each item has a (+) plus sign next to it as if the object does not exist in the repository.  The users and windows groups
    that are concerned are still listed inside of TFS's group memberships for each project.  I have confirmed that the sync from AD with TFSJobAgent.exe is completing with out errors as well.
    Is this a SID issue where TFS actually thinks that these are new users, and if so how can I best fix it for those users?
    Doug Dayley

    Hi Doug, 
    Thanks for your reply.
    Ok, let’s check whether TFS Server can identify this user and its groups which this user belonged to. Please execute below command for this one user, then view command result, check if the user name and SID both show correctly in result, and whether this
    user belonged to groups all listed in command result.
    Tfssecurity /imx “domain\username” /collection:URL
    If this user’s all information show correctly in command result. Please try to remove this user from your TFS server, then clean the TFS Cache, re-add this user back to TFS Server, then check if this user can access your team project as expect.
    Clean the Cache for TFS 2013 manually(delete the content of the folder only, not the cache folder itself):
    Clean the Cache folder on Server machine. The folder path is:
    C:\Program Files\Microsoft Team Foundation Server 12.0\Application Tier\Web Services\_tfs_data.  
    After cleaned, on Server machine, click Start and select
    Run… to open the dialog box, then input iisreset.exe and click OK, wait it run completely.
    We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
    Click
    HERE to participate the survey.

Maybe you are looking for

  • How can I lock text sizes in presentations?

    Sorry folks, frustrated and confused.  Still trying to hold on to Keynote from iWork 09 since that is what I am used to and don't see anything in the new free version that is better.  I create presentations on a MacBook Pro and have particular type s

  • Acrobat 9 installation suddenly stopped working

    I use Acrobat 9 every day. (In case you wonder why, I need Sort Comments by Color, and Acrobat 9 was the last version that contained that feature.) It worked great until today, when I got the following error message: "Adobe Acrobat could not install

  • Playbook suddenly stopped working

    I have had my playbook since Christmas and yesterday I registered for slacker radio and when I plugged in my headphones, the thing just shut down.  I had about 50% battery left.  I have tried to reboot by pressing all the buttons and holding them for

  • I am trying to sync my iPhone 5 on iTunes but it identifies it as my iPad?  why?

    I am trying to sync my iphone5 onto itunes but it keeps identifying it as my ipad.  How do I change it?  Now, I only get a screen on my iphone showing "itunes" and a iphone "plug" pointing to the "itunes".  I cannot get out of that mode. 

  • AP and number of users served.

    Hi all, Iv a question related to capacity or number of users one AP can serve. For instance, one open space without the walls and 2 APs (one 1252AG and one 1231G) and 50 people. Is it enough to connect all people to WiFi? For instance, every AP will