I'm working on a multi-domain Exchange 2016 configuration running on Server 2012 R2.  Since it is multi-domain we use a third party control panel to manage the users.  The issue may not be due to the 3rd partly control panel but shortly after an update to the control panel we noticed the SAMaccountName was being created completely different than about a week ago.  The vendor reported that there is nothing in their product to change the default way Windows created the SAMaccountName.  We noticed since Folder Redirection uses the SAMaccountName to create the folder names.  I have done some google searching but can not find anything on what could be altering the default way Windows creates the SAMaccountName.

Any ideas would be greatly appreciated.

Hi All:

This is probably a bad question that has been asked and solved before but after 6-7 hours of searching and finding no solution I am posting this question.

Sequence of events.  Had 2 2012R2 DC's, added 2 2016 DC's.  Made sure that the fsmo roles were transferred and that all the new servers were GCs.  Went to demote the two 2012R2 DC's.  First went fine.  Second did not go well said that it was a GC.  So I went and used dssites.msc and removed the GC from the 2012R2.  Then I tried to remove it it complained about DNS so I went ahead and forced the removal.

Next I logged into my remaining 2016 DC's and found that when I launched Active Directory Userse and Computers i get Naming information cannot be located because the specified domain can either does not exist or could not be contacted.

Next I worked several hours making sure all the dns entries were cleaned up and that all the names resolved correctly.

Than I ran dcdiag.exe and here is the output below.

Any ideas?

Directory Server Diagnosis


Performing initial setup:

   Trying to find home server...

   Home Server = WSDC03

   * Identified AD Forest. 
   Done gathering initial info.


Doing initial required tests


   Testing server: Default-First-Site-Name\WSDC03

      Starting test: Connectivity

         ......................... WSDC03 passed test Connectivity



Doing primary tests


   Testing server: Default-First-Site-Name\WSDC03

      Starting test: Advertising

         Fatal Error:DsGetDcName (WSDC03) call failed, error 1355

         The Locator could not find the server.

         ......................... WSDC03 failed test Advertising

      Starting test: FrsEvent

         ......................... WSDC03 passed test FrsEvent

      Starting test: DFSREvent

         There are warning or error events within the last 24 hours after the

         SYSVOL has been shared.  Failing SYSVOL replication problems may cause

         Group Policy problems. 
         ......................... WSDC03 failed test DFSREvent

      Starting test: SysVolCheck

         ......................... WSDC03 passed test SysVolCheck

      Starting test: KccEvent

         ......................... WSDC03 passed test KccEvent

      Starting test: KnowsOfRoleHolders

         ......................... WSDC03 passed test KnowsOfRoleHolders

      Starting test: MachineAccount

         ......................... WSDC03 passed test MachineAccount

      Starting test: NCSecDesc

         ......................... WSDC03 passed test NCSecDesc

      Starting test: NetLogons

         Unable to connect to the NETLOGON share! (\\WSDC03\netlogon)

         [WSDC03] An net use or LsaPolicy operation failed with error 67,

         The network name cannot be found..

         ......................... WSDC03 failed test NetLogons

      Starting test: ObjectsReplicated

         ......................... WSDC03 passed test ObjectsReplicated

      Starting test: Replications

         [Replications Check,WSDC03] A recent replication attempt failed:

            From WSDC02 to WSDC03

            Naming Context: DC=ForestDnsZones,DC=woodsonsystems,DC=com

            The replication generated an error (8524):

            The DSA operation is unable to proceed because of a DNS lookup failure.



            The failure occurred at 2018-10-15 17:50:06.

            The last success occurred at 2018-10-15 15:28:36.

            7 failures have occurred since the last success.

            The guid-based DNS name

            b79d8804-e4b4-4f7a-a164-d0b347d3a687._msdcs.woodsonsystems.com

            is not registered on one or more DNS servers.

         [WSDC02] DsBindWithSpnEx() failed with error 1722,

         The RPC server is unavailable..
         [Replications Check,WSDC03] A recent replication attempt failed:

            From WSDC02 to WSDC03

            Naming Context: DC=DomainDnsZones,DC=woodsonsystems,DC=com

            The replication generated an error (8524):

            The DSA operation is unable to proceed because of a DNS lookup failure.



            The failure occurred at 2018-10-15 17:50:06.

            The last success occurred at 2018-10-15 15:28:45.

            7 failures have occurred since the last success.

            The guid-based DNS name

            b79d8804-e4b4-4f7a-a164-d0b347d3a687._msdcs.woodsonsystems.com

            is not registered on one or more DNS servers.

         [Replications Check,WSDC03] A recent replication attempt failed:

            From WSDC02 to WSDC03

            Naming Context: CN=Schema,CN=Configuration,DC=woodsonsystems,DC=com

            The replication generated an error (8524):

            The DSA operation is unable to proceed because of a DNS lookup failure.



            The failure occurred at 2018-10-15 17:50:06.

            The last success occurred at 2018-10-15 10:57:03.

            15 failures have occurred since the last success.

            The guid-based DNS name

            b79d8804-e4b4-4f7a-a164-d0b347d3a687._msdcs.woodsonsystems.com

            is not registered on one or more DNS servers.

         [Replications Check,WSDC03] A recent replication attempt failed:

            From WSDC04 to WSDC03

            Naming Context: CN=Schema,CN=Configuration,DC=woodsonsystems,DC=com

            The replication generated an error (8524):

            The DSA operation is unable to proceed because of a DNS lookup failure.



            The failure occurred at 2018-10-15 17:50:06.

            The last success occurred at 2018-10-15 16:58:13.

            2 failures have occurred since the last success.

            The guid-based DNS name

            62adf46a-2c3b-4577-aa76-2ffcb4f051b8._msdcs.woodsonsystems.com

            is not registered on one or more DNS servers.

         [Replications Check,WSDC03] A recent replication attempt failed:

            From WSDC02 to WSDC03

            Naming Context: CN=Configuration,DC=woodsonsystems,DC=com

            The replication generated an error (8524):

            The DSA operation is unable to proceed because of a DNS lookup failure.



            The failure occurred at 2018-10-15 17:50:06.

            The last success occurred at 2018-10-15 15:28:48.

            7 failures have occurred since the last success.

            The guid-based DNS name

            b79d8804-e4b4-4f7a-a164-d0b347d3a687._msdcs.woodsonsystems.com

            is not registered on one or more DNS servers.

         [Replications Check,WSDC03] A recent replication attempt failed:

            From WSDC04 to WSDC03

            Naming Context: CN=Configuration,DC=woodsonsystems,DC=com

            The replication generated an error (8524):

            The DSA operation is unable to proceed because of a DNS lookup failure.



            The failure occurred at 2018-10-15 17:50:06.

            The last success occurred at 2018-10-15 17:41:05.

            1 failures have occurred since the last success.

            The guid-based DNS name

            62adf46a-2c3b-4577-aa76-2ffcb4f051b8._msdcs.woodsonsystems.com

            is not registered on one or more DNS servers.

         [Replications Check,WSDC03] A recent replication attempt failed:

            From WSDC02 to WSDC03

            Naming Context: DC=woodsonsystems,DC=com

            The replication generated an error (8524):

            The DSA operation is unable to proceed because of a DNS lookup failure.



            The failure occurred at 2018-10-15 17:50:06.

            The last success occurred at 2018-10-15 15:29:56.

            8 failures have occurred since the last success.

            The guid-based DNS name

            b79d8804-e4b4-4f7a-a164-d0b347d3a687._msdcs.woodsonsystems.com

            is not registered on one or more DNS servers.

         ......................... WSDC03 failed test Replications

      Starting test: RidManager

         ......................... WSDC03 passed test RidManager

      Starting test: Services

         ......................... WSDC03 passed test Services

      Starting test: SystemLog

         A warning event occurred.  EventID: 0x000003F6

            Time Generated: 10/15/2018   17:36:00

            Event String:

            Name resolution for the name woodsonsystems.com timed out after none of the configured DNS servers responded.

         A warning event occurred.  EventID: 0x000727A5

            Time Generated: 10/15/2018   17:49:09

            Event String:

            The WinRM service is not listening for WS-Management requests. 


         A warning event occurred.  EventID: 0x80040020

            Time Generated: 10/15/2018   17:49:24

            Event String:

            The driver detected that the device \Device\Harddisk0\DR0 has its write cache enabled. Data corruption may occur.

         A warning event occurred.  EventID: 0x80040020

            Time Generated: 10/15/2018   17:49:24

            Event String:

            The driver detected that the device \Device\Harddisk0\DR0 has its write cache enabled. Data corruption may occur.

         A warning event occurred.  EventID: 0x80040020

            Time Generated: 10/15/2018   17:49:24

            Event String:

            The driver detected that the device \Device\Harddisk0\DR0 has its write cache enabled. Data corruption may occur.

         A warning event occurred.  EventID: 0x000003F6

            Time Generated: 10/15/2018   17:49:26

            Event String:

            Name resolution for the name _ldap._tcp.dc._msdcs.woodsonsystems.com. timed out after none of the configured DNS servers responded.

         A warning event occurred.  EventID: 0x000003F6

            Time Generated: 10/15/2018   17:49:27

            Event String:

            Name resolution for the name wpad timed out after none of the configured DNS servers responded.

         A warning event occurred.  EventID: 0x000727AA

            Time Generated: 10/15/2018   17:49:54

            Event String:

            The WinRM service failed to create the following SPNs: WSMAN/WSDC03.woodsonsystems.com; WSMAN/WSDC03. 


         A warning event occurred.  EventID: 0x0000000C

            Time Generated: 10/15/2018   17:49:55

            Event String:

            Time Provider NtpClient: This machine is configured to use the domain hierarchy to determine its time source, but it is the AD PDC emulator for the domain at the root of the forest, so there is no machine above it in the domain hierarchy to use as a time source. It is recommended that you either configure a reliable time service in the root domain, or manually configure the AD PDC to synchronize with an external time source. Otherwise, this machine will function as the authoritative time source in the domain hierarchy. If an external time source is not configured or used for this computer, you may choose to disable the NtpClient.

         An error event occurred.  EventID: 0x00000469

            Time Generated: 10/15/2018   17:49:56

            Event String:

            The processing of Group Policy failed because of lack of network connectivity to a domain controller. This may be a transient condition. A success message would be generated once the machine gets connected to the domain controller and Group Policy has successfully processed. If you do not see a success message for several hours, then contact your administrator.

         An error event occurred.  EventID: 0x00000469

            Time Generated: 10/15/2018   17:50:10

            Event String:

            The processing of Group Policy failed because of lack of network connectivity to a domain controller. This may be a transient condition. A success message would be generated once the machine gets connected to the domain controller and Group Policy has successfully processed. If you do not see a success message for several hours, then contact your administrator.

         A warning event occurred.  EventID: 0xC000042B

            Time Generated: 10/15/2018   17:52:00

            Event String:

            The RD Session Host server cannot register 'TERMSRV' Service Principal Name to be used for server authentication. The following error occured: The specified domain either does not exist or could not be contacted.


         ......................... WSDC03 failed test SystemLog

      Starting test: VerifyReferences

         ......................... WSDC03 passed test VerifyReferences



   Running partition tests on : ForestDnsZones

      Starting test: CheckSDRefDom

         ......................... ForestDnsZones passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... ForestDnsZones passed test

         CrossRefValidation


   Running partition tests on : DomainDnsZones

      Starting test: CheckSDRefDom

         ......................... DomainDnsZones passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... DomainDnsZones passed test

         CrossRefValidation


   Running partition tests on : Schema

      Starting test: CheckSDRefDom

         ......................... Schema passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... Schema passed test CrossRefValidation


   Running partition tests on : Configuration

      Starting test: CheckSDRefDom

         ......................... Configuration passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... Configuration passed test CrossRefValidation


   Running partition tests on : woodsonsystems

      Starting test: CheckSDRefDom

         ......................... woodsonsystems passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... woodsonsystems passed test

         CrossRefValidation


   Running enterprise tests on : woodsonsystems.com

      Starting test: LocatorCheck

         Warning: DcGetDcName(GC_SERVER_REQUIRED) call failed, error 1355

         A Global Catalog Server could not be located - All GC's are down.

         Warning: DcGetDcName(TIME_SERVER) call failed, error 1355

         A Time Server could not be located.

         The server holding the PDC role is down.

         Warning: DcGetDcName(GOOD_TIME_SERVER_PREFERRED) call failed, error

         1355

         A Good Time Server could not be located.

         Warning: DcGetDcName(KDC_REQUIRED) call failed, error 1355

         A KDC could not be located - All the KDCs are down.

         ......................... woodsonsystems.com failed test LocatorCheck

      Starting test: Intersite

         ......................... woodsonsystems.com passed test Intersite

Dear Team,

We have windows server 2003 R2 with sp2 DC. All the users password was set never expired. Yesterday i had applied Default Domain Policy with complex Password enabled, Minimum Password age:8  character, 3 Password history,Maximum password age:60 days,Miniumum Password age:59 days.

I have removed never password expired on few users, but still they are not able to change password nor its prompting for Password expired message.

Kindly advise.

i have user that is trying to log into computer X on the domain but it is receiving error

You cannot log on because the method is not allowed .

I looked in local policy but I cant add the user there because it is grayed out and therefore this might be defined globally in DC. i looked in DC under policy/comp. config//security setting/user right assignment/ allow log on locally. If I add this particular user there would this work and would it create any problems?

Hi,

3 domain controllers, 2 in site A, 1 in site B

We have replaced our domain controller in site B, so it is now running Windows Server 2016. All replication seems fine, and can not see anything spesific error in dcdiag or repadmin.

But when we run the command "Nltest /dsregdns" we are getting this error

********************

C:\Windows\system32>Nltest /dsregdns
Flags: 0
Connection Status = 1311 0x51f ERROR_NO_LOGON_SERVERS
The command completed successfully

C:\Windows\system32>

********************

I read another question on the forum that the problem had solved it selft after a couple of days, but now our domain controller has not been rebooted for 4 days, so I guess it will not self heal itself :)

The domain controller is pointing to itself for DNS, it is a global catalog (all servers in the domain are).
The DNS service is running and will permit me to ping other domain controllers.

The other 2 domain controllers are reporting ok on the command

********************

PS C:\Windows\system32> Nltest /dsregdns
Flags: 0
Connection Status = 0 0x0 NERR_Success
The command completed successfully
PS C:\Windows\system32>
********************

Suggestions ?

/Regards Andreas

HI everyone 

 We are  implementing  new app for  our Email system . but some users are not able to connect from their Iphone,s .

We investigate and found that some user are missing some attributes .

please give me solution how i can add these attributes in missing attributes user .

Hello All,

I have a client with a 2012 R2 server.  I just tried to install RRAS for VPN and it said that it worked, rebooted and looked like it was installing what it needed. When it restarted the RRAS option was not present in admin tools but the RRAS service was running.  This seems to have done something to DNS since no users could see the server by name in shares but could ping it by IP and name.  If I turned off RRAS service and disabled it from running everything was fine.  Except that any scanners that used the server name to locate the folder for scans would not work unless i changed it to the IP address and even then only a few of them worked correctly and scanned to the folder on the server.  I also received DNS error 4015 in event viewer.  I don't know why RRAS service is installed but not the gui and why I am now experiencing DNS/AD issues.  The only error that dcdiag came back with was  the following:

Also communicating with alternate dns like 8.8.8.8 failed but that will happen and I should not be worried about it???  Any thoughts or direction would be greatly appreciated.

Regards,

Rob

Rob Battaglia

After following the deployment guide here 

I'm not getting prompted on the client to enroll, and when trying to enroll the options are grayed out. The client log Microsoft-Windows-HelloForBusiness/Operational errors out with 

The device registration prerequisite check failed. (EventID 7200)

The Primary Account Primary Refresh Token prerequisite check failed. (EventID 7200)

Windows Hello for Business prerequisites check failed. Error: 0x8007051F (EventID 7054)

GPO, MFA, Certs and ADFS are set up. Service accounts all nominal, every step of the guide checked 10 times over. The errors don't seem to be documented, and something is missing. Please help!

Hi,

Our company have 3 domain controllers, when we doing domain migration to new forest, we cannot use ADMT tools as the following error occur:

The Security System detected an authentication error for the server LDAP/server1.zh.xxxxx.com/zh.xxxxx.com. The failure code from authentication protocol Kerberos was "The name or SID of the domain specified is inconsistent with the trust information for that domain. (0xc000019b)".

So we checked these 3 domain controllers, the SID is really the same (maybe the old staffs do wrong things).

Then we want to change the SID to solve the issue, but we found that only demote and promote the DC again (also by Microsoft Forums)  :

It is impossible to change the SID on a Domain controller, what you have to do is to demote it first, remove from domain, change SID with SYSPREP and promote again.

But when we try to demote one of the DC, it seems all AD down, we cannot login to the domain, the "Active Directory Users and Computers" cannot be opened as it told that the Domain cannot be contracted.

Then we promote again with the "demoted" DC, the AD seems becomes normal.

So we want to know how to change SID in this case ??

Or the error from ADMT can be solved by other solutions ?

Thanks !

HI,

What is the benefit If  I add  client pc name to AD  prior to joining to the domain 

Thanks 

Hi

I'm trying to create a new child domain (F) in a mixed 2012R2 / 2016 DC environment best pictured as follows

DCPROMO.LOG on the server shows the following and I'm struggling to find any relevant information for a fix

-----------------------------------------

------------------------------------------

All sensible suggestions gratefully received

Thanks

Hi,

I disabled in hyper-v virtual switch option "Allow management operating system to share this connection" to have dedicated psychical network adapter for my virtual guest  - domain controller 2012 r2. But after that, on domain my network connection is treated as "Public" not Domain. I tried to change this using command:

"Set-NetconnectionProfile -InterfaceAlias Ethernet -NetworkCategory Domain"

but I get error: Unable to set NetworkCategory to 'DomainAuthenticated'.  This NetworkCategory type will be set automatically when authenticated to a domain network.

I asked in hyper-v forum already but did not get any help. Please help.

Hi,

I am looking for a solution to set up deny interactive logon with limited hours for service account.

Since it is a service account, the service has to run all the time.  But I would like to configure the logon hours.  I know I can change the logon hour setting for that account from the object property.  However, when change the logon hour setting, the service is also stopped - that is the problem.  We just want to limit the logon hours, but the service is running all the time.

Thank you,

Hello All, 

We're in the middle of a migration to O365 and we're currently in hybrid mode, my question is does our domain/forest level need to be at a certain level for the migration? Does it matter if we move from 2008r2 level to 2012 or 2016?

Thanks,