A Reddit user raised this great question today that I am not aware of. So I did a little research and here is the breakdown of what it is. What is KRBTGT? The KRBTGT is a local default account that acts as a service account for the Key Distribution Center (KDC) service. It’s created automatically when a new domain is […]
If a user account gets locked out, I can follow these tips to find out why and when it happened. But how can I check and gather lockout info along with the bad password attempts info of all users across the entire AD domain? Asking help from PowerShell is my answer. There are two places where we can gather this […]
As time goes on, the computer accounts in your AD could be getting quite messy. More and more computer accounts became obsolete as their physical counterpart gets disposed. At one point, a cleaning job is due to be performed to clean up the mess. There are probably a lot of ways but here is a PowerShell way that is pretty […]
When there are too many login attempts occurred, the account used to attempt will get locked out. By default, after 5 bad password attempts the domain account will be locked out by the Active Directory server. To get to the bottom of why the account is being locked out, here are a few tips and tricks you can try. Which domain […]
Here are some PowerShell examples that we can use to count the numbers of user accounts in Active Directory. Total number of user accounts in AD PS> (Get-ADUser -filter *).count Total number of user accounts in an OU PS> (Get-ADUser -filter * -searchbase “OU=Vancouver, OU=MyCompany, DC=Domain, DC=Local”).count Replace the SearchBase with your own OU path. Total number of enabled/disabled accounts in […]
PassCore is a very simple 1-page web app written in C#, using ASP.NET MVC 4 and Directory Services. It allows users to change their Active Directory password on their own, provided the user is not disabled. PassCore does not require any configuration, as it obtains the principal context from the current domain. If you are looking for a free AD […]
If you got this message regarding your AD server that has PDC emulator role doesn’t have a proper NtpClient set up, like below: Here is how you can get this sorted out: Log on to the AD server (with PDC role) with administrator account and open elevated command prompt, and run the following commands: net stop w32time w32tm /config /manualpeerlist:”0.uk.pool.ntp.org,0x1 […]