主题： active-directory
-
Windows LAPS: unique local administrator passwords for Windows Server, and who is allowed to read one
Windows LAPS (built in to Windows Server 2019 and 2022 with the April 11, 2023 update or later, and to Windows Server 2025) automatically randomizes and rotates each machine's local administrator password and stores it in Active Directory or Microsoft Entra ID; in AD, Domain Admins can read it by default and every other reader needs an explicitly delegated permission.
-
Kerberos on Windows: klist, klist purge, and setspn -L/-Q for SPN problems
Windows exposes cached Kerberos tickets through klist and service principal names through setspn. Duplicate SPNs and clock skew between a client and a domain controller are the two failures that most often turn into confusing 'cannot authenticate' errors rather than a clear Kerberos message.
-
Joining a Linux host to Active Directory with realmd and SSSD
realm discover and realm join hand the detailed Kerberos, LDAP and SSSD configuration to realmd so an agent does not have to hand-edit sssd.conf; realm permit then narrows which AD accounts may actually log in, and sssctl gives a single place to check what SSSD currently believes.
-
Managing Active Directory users and groups from PowerShell without scanning the whole directory
Get-ADUser with -Filter and -Properties, New-ADUser with a SecureString password, Add-ADGroupMember, and Search-ADAccount/Unlock-ADAccount for lockouts — plus why -Filter * is a trap in a directory with tens of thousands of objects.
-
Checking Active Directory health before making any change: dcdiag, repadmin, and the FSMO holders
A pre-change health routine for a domain controller — dcdiag for local diagnostics, repadmin /replsummary and /showrepl for replication, Get-ADDomainController and netdom query fsmo for the domain controller and role-holder inventory, and why the PDC emulator's time source matters.
-
Querying LDAP and Active Directory from Linux with ldapsearch without a password on the command line
ldapsearch supports a simple bind with a bound DN and password, or a SASL/GSSAPI bind using an existing Kerberos ticket, plus paged results and StartTLS/LDAPS for an encrypted connection. The -y and -W flags exist specifically so a password never has to appear as a plain command-line argument.
机器可读： JSON