Active Directory

How can we improve Active Directory in Windows Server?

(thinking…)

Enter your idea and we'll search to see if someone has already suggested it.

If a similar idea already exists, you can support and comment on it.

If it doesn't exist, you can post your idea so others can support it.

Enter your idea and we'll search to see if someone has already suggested it.

  • Hot ideas
  • Top ideas
  • New ideas
  • My feedback
  1. Specify primary authentication method per relying party

    Not being able to specify primary authentication method per relying party is something I run into all the time. Can you please fix this? More and more vendors support SAML-based authentication and ADFS but none of them have a way of requesting Certificate Authentication as a primary authentication method. I do not want to change this on a global level, because we have other relying parties which use WIA. I'm guessing you have everything you need for this already, please fix!

    9 votes
    Sign in
    Check!
    (thinking…)
    Reset
    or sign in with
    • facebook
    • google
      Password icon
      Signed in as (Sign out)

      We’ll send you updates on this idea

      0 comments  ·  ADFS  ·  Flag idea as inappropriate…  ·  Admin →
    • Port Active Directory Module to PowerShell Core and Make Cross Platform

      Active Directory is used for more than just Windows Environments. Traditionally, scripting languages, such as python, have been used in the Linux space to perform automation against Active Directory. Now that PowerShell Core 6.0.X is GA, it would be great if the Active Directory module could be ported to be compatible with PowerShell Core and made cross-platform compatible. This would enable PowerShell based Active Directory management and automation possibilities from Linux, Mac, and IoT in addition to Windows.

      Currently, PSSnapin dependencies in the AD module make it impossible to use in PowerShell Core. This leaves AD as one of the…

      146 votes
      Sign in
      Check!
      (thinking…)
      Reset
      or sign in with
      • facebook
      • google
        Password icon
        Signed in as (Sign out)

        We’ll send you updates on this idea

        2 comments  ·  Management Tools  ·  Flag idea as inappropriate…  ·  Admin →
      • ADFS + Azure SQL Managed Instances Supportability

        ADFS + Azure SQL Managed Instances Supportability

        Add supportability for extend AD FS in Azure using Azure SQL Managed Instance to host the database.

        2 votes
        Sign in
        Check!
        (thinking…)
        Reset
        or sign in with
        • facebook
        • google
          Password icon
          Signed in as (Sign out)

          We’ll send you updates on this idea

          0 comments  ·  ADFS  ·  Flag idea as inappropriate…  ·  Admin →
        • Existing the miracle of creations as user request for

          I would like to share about something miracle,that i had seen before. The existing of the miracle object in as i wish for without using technology or any devices.

          1 vote
          Sign in
          Check!
          (thinking…)
          Reset
          or sign in with
          • facebook
          • google
            Password icon
            Signed in as (Sign out)

            We’ll send you updates on this idea

            0 comments  ·  Bug  ·  Flag idea as inappropriate…  ·  Admin →
          • LAPS - Add Cmdlets to remove permissions

            Add a CMDLET to Remove LAPS Password reset and read permissions. Currently there is only a cmdlet to add permission, but not to clean up.

            5 votes
            Sign in
            Check!
            (thinking…)
            Reset
            or sign in with
            • facebook
            • google
              Password icon
              Signed in as (Sign out)

              We’ll send you updates on this idea

              0 comments  ·  Logon, Passwords  ·  Flag idea as inappropriate…  ·  Admin →
            • Remove 'This will clear your current search result' in Find ...

              When we type in a computer in the search field, in ‘Active Directory Users and Computers’ Find ..., and forget to change to 'computer'. Then when we change it to computer it will clear the name box. with the message 'This will clear your current search result' Why? this have been bugging me for many, many years... so this is my user-voice :-)

              I would like this behavior to change. Maybe just not to clear the box, and say nothing, and just change to computer.

              Or there could be an option, to have the search filed be custom and remember…

              29 votes
              Sign in
              Check!
              (thinking…)
              Reset
              or sign in with
              • facebook
              • google
                Password icon
                Signed in as (Sign out)

                We’ll send you updates on this idea

                4 comments  ·  Management Tools  ·  Flag idea as inappropriate…  ·  Admin →
              • Add selection of specific MFA Adapter as condition

                It would be incredibly helpful if Access Authorization Rules would allow the selection of a specific MFA Adapter or mechanism as a part of a ruleset.

                For example, if a user was authenticating from a managed device, use certificate authentication, otherwise prompt for second factor using the Azure MFA adapter, or, if a user belongs to a specific group, always use certificate authentication forst, then attempt for Azure MFA, otherwsie if a user belongs to group "B", always prompt for the Azure MFA Adapter (or any other MFA provider integrated with ADFS)

                At the moment it's an all-or-nothing option. If…

                3 votes
                Sign in
                Check!
                (thinking…)
                Reset
                or sign in with
                • facebook
                • google
                  Password icon
                  Signed in as (Sign out)

                  We’ll send you updates on this idea

                  1 comment  ·  ADFS  ·  Flag idea as inappropriate…  ·  Admin →
                • Replace ADCS NDES Role Service and Intune NDES Connector with ADCS Issuing CA Intune Connector software

                  Replace ADCS NDES Role Service and Intune NDES Connector with ADCS Issuing CA Intune Connector software. Seems easier solution than having seperate server for NDES and needing to publish NDES endpoint to the web, just to issue Certs to the devices managed by Intune.

                  1 vote
                  Sign in
                  Check!
                  (thinking…)
                  Reset
                  or sign in with
                  • facebook
                  • google
                    Password icon
                    Signed in as (Sign out)

                    We’ll send you updates on this idea

                    0 comments  ·  Flag idea as inappropriate…  ·  Admin →
                  • Microsoft ADMX Templates Landing Page

                    Can Microsoft create a single landing page for all their ADMX templates so admins can easily find the latest templates without scouring the web?

                    2 votes
                    Sign in
                    Check!
                    (thinking…)
                    Reset
                    or sign in with
                    • facebook
                    • google
                      Password icon
                      Signed in as (Sign out)

                      We’ll send you updates on this idea

                      1 comment  ·  Flag idea as inappropriate…  ·  Admin →
                    • Allow token signing and decryption on a per-relying party basis

                      Currently ADFS only signs tokens with the primary token-signing certificate. This makes renewing the certificate difficult if an organization has many relying party trusts configured, as the swap has to be coordinated with multiple vendors.

                      Please allow the signing certificate to be configured on a per-relying party basis. This would allow each relying party to migrate to the new certificate on their own schedules, as opposed to a single "big bang" approach.

                      4 votes
                      Sign in
                      Check!
                      (thinking…)
                      Reset
                      or sign in with
                      • facebook
                      • google
                        Password icon
                        Signed in as (Sign out)

                        We’ll send you updates on this idea

                        2 comments  ·  ADFS  ·  Flag idea as inappropriate…  ·  Admin →
                      • GPO: turn off microsoft consumer features all sku

                        Please make the GPO object for "Turn off Microsoft consumer features" work on all skus not just Enterprise and Education. I am in education but we have been buying Pro skus as we did not know about this garbage limitation which makes no sense. Removing the XBOX app and other preloaded nonsense is necessary no matter the sku. If it can join a domain this should just work. Yes there are scripts to do this but given its supported in "some" skus this should not be necessary.

                        Tom

                        6 votes
                        Sign in
                        Check!
                        (thinking…)
                        Reset
                        or sign in with
                        • facebook
                        • google
                          Password icon
                          Signed in as (Sign out)

                          We’ll send you updates on this idea

                          0 comments  ·  Bug  ·  Flag idea as inappropriate…  ·  Admin →
                        • 2 votes
                          Sign in
                          Check!
                          (thinking…)
                          Reset
                          or sign in with
                          • facebook
                          • google
                            Password icon
                            Signed in as (Sign out)

                            We’ll send you updates on this idea

                            1 comment  ·  Flag idea as inappropriate…  ·  Admin →
                          • Publish activedirectory module to PSGallery

                            The active directory module is really useful, but a pain to install on a server/computer.
                            Current install instructions are these: https://blogs.technet.microsoft.com/ashleymcglone/2016/02/26/install-the-active-directory-powershell-module-on-windows-10/

                            I would love the possibility to just do:
                            Install-Module "ActiveDirectory" and have everything good to go.

                            14 votes
                            Sign in
                            Check!
                            (thinking…)
                            Reset
                            or sign in with
                            • facebook
                            • google
                              Password icon
                              Signed in as (Sign out)

                              We’ll send you updates on this idea

                              1 comment  ·  Management Tools  ·  Flag idea as inappropriate…  ·  Admin →
                            • Support empty PSCredential with ActiveDirectory module cmdlets

                              The PowerShell ActiveDirectory module cmdlets do not properly check for [System.Management.Automation.PSCredential]::Empty in the Credential parameter. If an Empty PSCredential is passed to one of the cmdlets, the result is a NullReferenceException. Instead, it should default to the current logged-in user like when the Credential parameter is omitted.

                              This is particularly useful when writing our own functions with an optional Credential parameter which call various AD cmdlets.

                              2 votes
                              Sign in
                              Check!
                              (thinking…)
                              Reset
                              or sign in with
                              • facebook
                              • google
                                Password icon
                                Signed in as (Sign out)

                                We’ll send you updates on this idea

                                0 comments  ·  Management Tools  ·  Flag idea as inappropriate…  ·  Admin →
                              • Set the default on a Windows trust to allow AES encryption for Kerberos

                                Set the default on a Windows trust to allow AES encryption for Kerberos. By default, any trust created between two domains, does not allow AES encryption across the trust boundary. This breaks policy application and certain tools that rely on AES encryption (the default encryption type in a modern domain). It would be nice if this was the default setting rather than having to remember to check that in the trust properties.

                                1 vote
                                Sign in
                                Check!
                                (thinking…)
                                Reset
                                or sign in with
                                • facebook
                                • google
                                  Password icon
                                  Signed in as (Sign out)

                                  We’ll send you updates on this idea

                                  0 comments  ·  Flag idea as inappropriate…  ·  Admin →
                                • Ability to navigate PS Provider by Canonical Name

                                  Ability to navigate the PowerShell provider by Canonical name and refer to objects using the CN would make working with AD much more natural.

                                  1 vote
                                  Sign in
                                  Check!
                                  (thinking…)
                                  Reset
                                  or sign in with
                                  • facebook
                                  • google
                                    Password icon
                                    Signed in as (Sign out)

                                    We’ll send you updates on this idea

                                    0 comments  ·  Management Tools  ·  Flag idea as inappropriate…  ·  Admin →
                                  • Add support for synthetic flattening of security groups

                                    There are way too many "dumb" LDAP implementations out there that simply can't deal with nested group memberships in AD. This makes it really hard to implement well organized RBAC in AD without a bunch of exceptions for the bad apps.

                                    You can fool some of them with LDAP_MATCHING_RULE_IN_CHAIN if they give you enough access to configure the filters they're using. But others are simply stuck only caring about the flat list of users returned by the "member" attribute.

                                    I envision a new constructed attribute on group objects called something like memberFlattened that basically has AD flatten the group member…

                                    1 vote
                                    Sign in
                                    Check!
                                    (thinking…)
                                    Reset
                                    or sign in with
                                    • facebook
                                    • google
                                      Password icon
                                      Signed in as (Sign out)

                                      We’ll send you updates on this idea

                                      1 comment  ·  Flag idea as inappropriate…  ·  Admin →
                                    • Saml <Subject> from AuthnRequest

                                      Allow rps to specify a saml <Subject>. When the rp knows the user adfs could then pre populate the username field on the login page.

                                      2 votes
                                      Sign in
                                      Check!
                                      (thinking…)
                                      Reset
                                      or sign in with
                                      • facebook
                                      • google
                                        Password icon
                                        Signed in as (Sign out)

                                        We’ll send you updates on this idea

                                        1 comment  ·  ADFS  ·  Flag idea as inappropriate…  ·  Admin →
                                      • AD FS support for inline registration for Azure MFA

                                        Would improve user experience a lot if AD FS would support inline user provisioning for Azure MFA. This is so inconvenient that users should do this separately, and not in app.
                                        E.g. Microsoft Intune has this integrated in provision process.

                                        Also error message for this is not provisioned users is too general and not informative at all.

                                        More info in paragraph "Registering users for Azure MFA with AD FS 2016"
                                        https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-ad-fs-and-azure-mfa

                                        4 votes
                                        Sign in
                                        Check!
                                        (thinking…)
                                        Reset
                                        or sign in with
                                        • facebook
                                        • google
                                          Password icon
                                          Signed in as (Sign out)

                                          We’ll send you updates on this idea

                                          1 comment  ·  ADFS  ·  Flag idea as inappropriate…  ·  Admin →
                                        • Allow AD FS to fall back to Forms-based authentication if Windows Integrated Authentication fails

                                          Currently, if a browser-based user comes to the AD FS sign-in page, AD FS can only decide whether to use integrated authentication by looking at the browser's user agent string. However, t

                                          There are cases where not all users arriving at the AD FS sign-in page can perform a Kerberos login - they might be within the IP range of the "internal" part of AD FS (in a split-brain DNS configuration) but the client may not be domain joined for various reasons, for example wireless users using BYOD. For these users Kerberos fails and it falls back to NTLM/Basic auth…

                                          42 votes
                                          Sign in
                                          Check!
                                          (thinking…)
                                          Reset
                                          or sign in with
                                          • facebook
                                          • google
                                            Password icon
                                            Signed in as (Sign out)

                                            We’ll send you updates on this idea

                                            3 comments  ·  ADFS  ·  Flag idea as inappropriate…  ·  Admin →
                                          ← Previous 1 3 4 5
                                          • Don't see your idea?

                                          Feedback and Knowledge Base