(I am new to this Field)

we have Primary Domain Controller (PDC) with name DC1, and Domain Name DC.local, and one Additional Domain Controller (ADC) with name DC2.

DNS and DHCP are also in PDC and ADC.

from three years i face no problem as Whatever change i made in PDC it replicated to ADC. 

But last week our ADC i.e. DC1 become down, and we are unable to Ping the Domain DC.local, and we are also unable to open the local Web based applications (if i put IP address instead of Machine Name, It is Working).

but users are able to login to Domain with no problems.

- We have DNS integreted with AD

- Any change in DNS in DC1 replicated to DNS in DC2

I am Confused that why ADC i.e. DC2 is not Fully Replacing the PDC i.e. DC1

Hi

I have inherited a very unhealthly AD environment comprising of 5 DCs with 1 2008 DC and 4 DC on 2003 R2 (2 are in a DMZ environment for our hosted Exchange 2007 setup)

Whilst it works, there are certains I can see one of these is I had problems editing policies on 1 2003 DC. It came up with the message:

when migrating users from one forest to another I get the following error:-

err2:7295 cannot get the os version for source.doman.local. no network path found.

This is migrating from a windows 2003 domain to a windows 2008 domain.

DCs: Windows Server 2008 R2
File server: Windows Server 2008 R2
Clients: Windows 7/Windows XP/Non-Windows OS

Clients are able to access the file server by name, but unable to access by IP address. I captured the packages, it's stuck at the authentication if accessing by IP address. No TREE CONNECT after SESSION SETUP. I checked the system was using Kerberos authentication if accssing the file server by name, and using NTLM authentication if accessing by IP address. So it means perhaps there was a problem with the NTLM authentication. I already checked some settings in the Security policy on the file server. I didn't find anything suspicious.

Hello,

in Active Directory under the organizational Units there is a property "msExchRecipientValidatorCookies".

Does someone know what this property is used for ?

We want to use this property to store some additional data in the organizational unit.

Thanks for your help.

gruss Daniel Ovadia MBSS - Microsoft Dynamics CRM MCNPS

Hi All,

Can you please let us know how GPO corruption can occur and what all can be down to prevent GPo corruption issues

Problem1:

I have a Win Svr 2003 St Sp2 (svr A),  and a Win Svr 2008 R2 Ent (svrB) active directory. NIC settings for svr A, prefered dns ip was point to himself and alternate to svr B ip, and NIC settings for svr B vice versa. I went to svr A's dnsmgmt, I'm getting a "X" on svr B and error stating "Cannot contact DNS server", so i run a ping test, able to ping svr B. On svr B dnsmgmt console, I'm able to view both svr on the list. Can anyone out there help me?

Problem2:

After the case with svr A unable to contact svr B DNS, users are unable to contact the some servers in the domain via hostname e.g \\printsvr01, but instead of using hostname IP address works e.g \\192.168.0.1. So, are they related to each other Problem 1 and Problem 2

About half of our DC's are one hour behind.  All are running Server 2003, including the NTP server (DC1).  All servers are in the same AD group with the same policies.  It happened about 2 weeks ago, at the same time according to the System Event Logs.  Please see logs below:The time provider

Event ID: 25

NtpClient cannot determine whether the response received from dc1.domain.com has  a valid signature. The response will be ignored. The error was: The interface is unknown. (0x800706B5)

Event ID: 22

The time provider NtpServer encountered an error while digitally signing the  NTP response for peer xxx.xxx.xxx.157:123.  NtpServer cannot provide secure (signed) time to the client and will ignore the request. The error was: The interface is unknown. (0x800706B5)

It doesn't make sense that half of the servers are correct and half are an hour behind, when they all have the same NTP server.  One server gives an Information Event Log that says it is recieving the correct time from DC1, but it is still an hour behind.

Any suggestions?

Thanks, Josh.

I heard new Adaxes 2011.3 has a powerful self-service password reset and scheduled task tools, has anyone tried it? I need full-service Identity Management tool which has this feature. But the tool is not freeand I want to know your opinion on it. Any advice is highly appreciated

SID like S-1-5-21-19604・・・  is displayed in security tab of folder.

It means this SID's object is deleted from AD but folder has that ACE entry ?

The lone DC(server 2012) I'm running in a single forest/domain does not seem to be advertising itself. Very little has been done to this machine. The AD DS server role has been installed and removed several times, along with a few other AD roles. As such, I suspect this may be the result of an improper removal of AD DS. All active directory tools are unable to contact the dc. Additionally, when I've tried to demote the dc, with the last dc in domain option selected, it fails. Glancing at the dcdiag results, it looks like there are several dns records showing up from previous installations of AD DS.
The machine is pointing to itself as the primary dns server and I've set up a forwarding zone for our ISP's dns servers.
Doing a fresh install is certainly possible but I'd like to be able to work this out incase it ever comes up in the future.
Thanks for bearing with me, I'm very new at this.

Here are the results from dcdiag /c /e /v and ipconfig /all:
------------------------------------------------------------------------------------
Directory Server Diagnosis
Performing initial setup:
   Trying to find home server...
   * Verifying that the local machine serv1, is a Directory Server.
   Home Server = serv1
   * Connecting to directory service on server serv1.
   * Identified AD Forest.
   Collecting AD specific global data
   * Collecting site info.
   Calling ldap_search_init_page(hld,CN=Sites,CN=Configuration,DC=testsite,DC=sys,LDAP_SCOPE_SUBTREE,(objectCategory=ntDSSiteSettings),.......
   The previous call succeeded
   Iterating through the sites
   Looking at base site object: CN=NTDS Site Settings,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=testsite,DC=sys
   Getting ISTG and options for the site
   * Identifying all servers.
   Calling ldap_search_init_page(hld,CN=Sites,CN=Configuration,DC=testsite,DC=sys,LDAP_SCOPE_SUBTREE,(objectClass=ntDSDsa),.......
   The previous call succeeded....
   The previous call succeeded
   Iterating through the list of servers
   Getting information for the server CN=NTDS Settings,CN=SERV1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=testsite,DC=sys
   objectGuid obtained
   InvocationID obtained
   dnsHostname obtained
   site info obtained
   All the info for the server collected
   * Identifying all NC cross-refs.
   * Found 1 DC(s). Testing 1 of them.
   Done gathering initial info.
Doing initial required tests
  
   Testing server: Default-First-Site-Name\SERV1
      Starting test: Connectivity
         * Active Directory LDAP Services Check
         Determining IP4 connectivity
         Determining IP6 connectivity
         * Active Directory RPC Services Check
         ......................... SERV1 passed test Connectivity
Doing primary tests
  
   Testing server: Default-First-Site-Name\SERV1
      Starting test: Advertising
         Fatal Error:DsGetDcName (SERV1) call failed, error 1355
         The Locator could not find the server.
         ......................... SERV1 failed test Advertising
      Starting test: CheckSecurityError
         * Dr Auth:  Beginning security errors check!
         No KDC found for domain testsite.sys in site Default-First-Site-Name (1355, NULL)
         [SERV1] Unable to contact a KDC for the destination domain in it's own site.  This means either there are no
         available KDC's for this domain in the site, *including* the destination DC itself, or we're having network or
         packet fragmentation issues connecting to it.  We'll check packet fragmentation connection to the destination
         DC, make recommendations, and continue.
         Checking UDP fragmentation issues to SERV1.
          The KDC on SERV1 isn't responsive, please verify that it's running and advertising.
         No KDC found for domain testsite.sys in site (ALL SITES) (1355, NULL)
         [SERV1] Unable to contact a KDC for the destination domain.  If no KDC for the destination domain is
         available, replication will be blocked!
         If there is some KDC for that domain available, check network connectivity issues or see possible packet
         fragmentation issues above.
         Checking machine account for DC SERV1 on DC SERV1.
         * SPN found :LDAP/serv1.testsite.sys/testsite.sys
         * SPN found :LDAP/serv1.testsite.sys
         * SPN found :LDAP/SERV1
         * SPN found :LDAP/serv1.testsite.sys/TESTSITE
         * SPN found :LDAP/42a7c2fa-f356-4c33-9790-c72bba9ed933._msdcs.testsite.sys
         * SPN found :E3514235-4B06-11D1-AB04-00C04FC2DCD2/42a7c2fa-f356-4c33-9790-c72bba9ed933/testsite.sys
         * SPN found :HOST/serv1.testsite.sys/testsite.sys
         * SPN found :HOST/serv1.testsite.sys
         * SPN found :HOST/SERV1
         * SPN found :HOST/serv1.testsite.sys/TESTSITE
         * SPN found :GC/serv1.testsite.sys/testsite.sys
         [SERV1] No security related replication errors were found on this DC!  To target the connection to a specific
         source DC use /ReplSource:<DC>.
         ......................... SERV1 passed test CheckSecurityError
      Starting test: CutoffServers
         * Configuration Topology Aliveness Check
         * Analyzing the alive system replication topology for CN=Schema,CN=Configuration,DC=testsite,DC=sys.
         * Performing upstream (of target) analysis.
         * Performing downstream (of target) analysis.
         * Analyzing the alive system replication topology for CN=Configuration,DC=testsite,DC=sys.
         * Performing upstream (of target) analysis.
         * Performing downstream (of target) analysis.
         * Analyzing the alive system replication topology for DC=testsite,DC=sys.
         * Performing upstream (of target) analysis.
         * Performing downstream (of target) analysis.
         ......................... SERV1 passed test CutoffServers
      Starting test: FrsEvent
         * The File Replication Service Event log test
         Skip the test because the server is running DFSR.
         ......................... SERV1 passed test FrsEvent
      Starting test: DFSREvent
         The DFS Replication Event Log.
         There are warning or error events within the last 24 hours after the SYSVOL has been shared.  Failing SYSVOL
         replication problems may cause Group Policy problems.
         An error event occurred.  EventID: 0xC00004B2
            Time Generated: 11/03/2012   19:55:47
            Event String:
            The DFS Replication service failed to contact domain controller  to access configuration information. Replication is stopped. The service will try again during the next configuration polling cycle, which will occur in 60 minutes. This event can be caused by TCP/IP connectivity, firewall, Active Directory Domain Services, or DNS issues.
            
            Additional Information:
            Error: 1355 (The specified domain either does not exist or could not be contacted.)
         An error event occurred.  EventID: 0xC00004B2
            Time Generated: 11/03/2012   20:54:47
            Event String:
            The DFS Replication service failed to contact domain controller  to access configuration information. Replication is stopped. The service will try again during the next configuration polling cycle, which will occur in 60 minutes. This event can be caused by TCP/IP connectivity, firewall, Active Directory Domain Services, or DNS issues.
            
            Additional Information:
            Error: 1355 (The specified domain either does not exist or could not be contacted.)
         A warning event occurred.  EventID: 0x80001780
            Time Generated: 11/03/2012   21:12:40
            Event String:
            The DFS Replication service failed to update configuration in Active Directory Domain Services. The service will retry this operation periodically.
            
            Additional Information:
            Object Category: msDFSR-LocalSettings
            Object DN: CN=DFSR-LocalSettings,CN=SERV1,OU=Domain Controllers,DC=testsite,DC=sys
            Error: 1355 (The specified domain either does not exist or could not be contacted.)
            Domain Controller: 
            Polling Cycle: 60
         A warning event occurred.  EventID: 0x800008A5
            Time Generated: 11/03/2012   21:12:44
            Event String:
            The DFS Replication service stopped replication on volume C:. This occurs when a DFSR JET database is not shut down cleanly and Auto Recovery is disabled. To resolve this issue, back up the files in the affected replicated folders, and then use the ResumeReplication WMI method to resume replication.
            
            Additional Information:
            Volume: C:
            GUID: 627D5E18-70F0-446D-BC1D-06C6B6710CD1
            
            Recovery Steps
            1. Back up the files in all replicated folders on the volume. Failure to do so may result in data loss due to unexpected conflict resolution during the recovery of the replicated folders.
            2. To resume the replication for this volume, use the WMI method ResumeReplication of the DfsrVolumeConfig class. For example, from an elevated command prompt, type the following command:
            wmic /namespace:\\root\microsoftdfs path dfsrVolumeConfig where volumeGuid="627D5E18-70F0-446D-BC1D-06C6B6710CD1" call ResumeReplication
            
            For more information, seehttp://support.microsoft.com/kb/2663685.
         A warning event occurred.  EventID: 0x80001780
            Time Generated: 11/03/2012   21:17:42
            Event String:
            The DFS Replication service failed to update configuration in Active Directory Domain Services. The service will retry this operation periodically.
            
            Additional Information:
            Object Category: msDFSR-LocalSettings
            Object DN: CN=DFSR-LocalSettings,CN=SERV1,OU=Domain Controllers,DC=testsite,DC=sys
            Error: 1355 (The specified domain either does not exist or could not be contacted.)
            Domain Controller: 
            Polling Cycle: 60
         A warning event occurred.  EventID: 0x80001780
            Time Generated: 11/03/2012   21:32:43
            Event String:
            The DFS Replication service failed to update configuration in Active Directory Domain Services. The service will retry this operation periodically.
            
            Additional Information:
            Object Category: msDFSR-LocalSettings
            Object DN: CN=DFSR-LocalSettings,CN=SERV1,OU=Domain Controllers,DC=testsite,DC=sys
            Error: 1355 (The specified domain either does not exist or could not be contacted.)
            Domain Controller: 
            Polling Cycle: 60
         A warning event occurred.  EventID: 0x80001780
            Time Generated: 11/03/2012   22:32:51
            Event String:
            The DFS Replication service failed to update configuration in Active Directory Domain Services. The service will retry this operation periodically.
            
            Additional Information:
            Object Category: msDFSR-LocalSettings
            Object DN: CN=DFSR-LocalSettings,CN=SERV1,OU=Domain Controllers,DC=testsite,DC=sys
            Error: 1355 (The specified domain either does not exist or could not be contacted.)
            Domain Controller: 
            Polling Cycle: 60
         ......................... SERV1 failed test DFSREvent
      Starting test: SysVolCheck
         * The File Replication Service SYSVOL ready test
         The registry lookup failed to determine the state of the SYSVOL.  The error returned  was 0x0
         "The operation completed successfully.".  Check the FRS event log to see if the SYSVOL has successfully been
         shared.
         ......................... SERV1 passed test SysVolCheck
      Starting test: FrsSysVol
         * The File Replication Service SYSVOL ready test
         The registry lookup failed to determine the state of the SYSVOL.  The error returned  was 0x0
         "The operation completed successfully.".  Check the FRS event log to see if the SYSVOL has successfully been
         shared.
         ......................... SERV1 passed test FrsSysVol
      Starting test: KccEvent
         * The KCC Event log test
         Found no KCC errors in "Directory Service" Event log in the last 15 minutes.
         ......................... SERV1 passed test KccEvent
      Starting test: KnowsOfRoleHolders
         Role Schema Owner = CN=NTDS Settings,CN=SERV1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=testsite,DC=sys
         Role Domain Owner = CN=NTDS Settings,CN=SERV1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=testsite,DC=sys
         Role PDC Owner = CN=NTDS Settings,CN=SERV1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=testsite,DC=sys
         Role Rid Owner = CN=NTDS Settings,CN=SERV1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=testsite,DC=sys
         Role Infrastructure Update Owner = CN=NTDS Settings,CN=SERV1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=testsite,DC=sys
         ......................... SERV1 passed test KnowsOfRoleHolders
      Starting test: MachineAccount
         Checking machine account for DC SERV1 on DC SERV1.
         * SPN found :LDAP/serv1.testsite.sys/testsite.sys
         * SPN found :LDAP/serv1.testsite.sys
         * SPN found :LDAP/SERV1
         * SPN found :LDAP/serv1.testsite.sys/TESTSITE
         * SPN found :LDAP/42a7c2fa-f356-4c33-9790-c72bba9ed933._msdcs.testsite.sys
         * SPN found :E3514235-4B06-11D1-AB04-00C04FC2DCD2/42a7c2fa-f356-4c33-9790-c72bba9ed933/testsite.sys
         * SPN found :HOST/serv1.testsite.sys/testsite.sys
         * SPN found :HOST/serv1.testsite.sys
         * SPN found :HOST/SERV1
         * SPN found :HOST/serv1.testsite.sys/TESTSITE
         * SPN found :GC/serv1.testsite.sys/testsite.sys
         ......................... SERV1 passed test MachineAccount
      Starting test: NCSecDesc
         * Security Permissions check for all NC's on DC SERV1.
         * Security Permissions Check for
           CN=Schema,CN=Configuration,DC=testsite,DC=sys
            (Schema,Version 3)
         * Security Permissions Check for
           CN=Configuration,DC=testsite,DC=sys
            (Configuration,Version 3)
         * Security Permissions Check for
           DC=testsite,DC=sys
            (Domain,Version 3)
         ......................... SERV1 passed test NCSecDesc
      Starting test: NetLogons
         * Network Logons Privileges Check
         Unable to connect to the NETLOGON share! (\\SERV1\netlogon)
         [SERV1] An net use or LsaPolicy operation failed with error 67, The network name cannot be found..
         ......................... SERV1 failed test NetLogons
      Starting test: ObjectsReplicated
         SERV1 is in domain DC=testsite,DC=sys
         Checking for CN=SERV1,OU=Domain Controllers,DC=testsite,DC=sys in domain DC=testsite,DC=sys on 1 servers
            Object is up-to-date on all servers.
         Checking for CN=NTDS Settings,CN=SERV1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=testsite,DC=sys in domain CN=Configuration,DC=testsite,DC=sys on 1 servers
            Object is up-to-date on all servers.
         ......................... SERV1 passed test ObjectsReplicated
      Starting test: OutboundSecureChannels
         * The Outbound Secure Channels test
         ** Did not run Outbound Secure Channels test because /testdomain: was not entered
         ......................... SERV1 passed test OutboundSecureChannels
      Starting test: Replications
         * Replications Check
         * Replication Latency Check
         ......................... SERV1 passed test Replications
      Starting test: RidManager
         * Available RID Pool for the Domain is 1600 to 1073741823
         * serv1.testsite.sys is the RID Master
         * DsBind with RID Master was successful
         * rIDAllocationPool is 1100 to 1599
         * rIDPreviousAllocationPool is 1100 to 1599
         * rIDNextRID: 1102
         ......................... SERV1 passed test RidManager
      Starting test: Services
         * Checking Service: EventSystem
         * Checking Service: RpcSs
         * Checking Service: NTDS
         * Checking Service: DnsCache
         * Checking Service: DFSR
         * Checking Service: IsmServ
         * Checking Service: kdc
         * Checking Service: SamSs
         * Checking Service: LanmanServer
         * Checking Service: LanmanWorkstation
         * Checking Service: w32time
            Could not open w32time Service on SERV1, error 0x424
            "The specified service does not exist as an installed service."
         * Checking Service: NETLOGON
         ......................... SERV1 failed test Services

I have this problems, that i change the user’s password, but the next day it have change back to the old password.

I remember that i have this problems early on some other systems, but can’t seem to find the Microsoft kB about this.

On this system there are only one DomainController, so it not something synchronisation that have gone wrong over night.

Could someone help me out here?

Regards Kenneth Dalbjerg

Regards Kenneth Dalbjerg

Does any one know if it is possible to create a trust relationship between two different Active Directory forests that share the same root namespace?  The scenario is:

Forest/Domain A:

  NetBIOS name: ACME

  Active Directory namespace: acme.com

Forest/Domain B:

  NetBIOS name: CONTOSO

  Active Directory namespace: contoso.acme.com

I'm wondering how this would work if DNS in both forests/domains is authoritative for the acme.com namespace.  There was never any physical relation between the forest/domains - they were built by different IT admins at different times but now this organization would like to establish a trust so as to share resources (eventually they will likely migrate to single forest).

Schyler

I have two DCs , DCA & DCB .... .......................On DCB DNS is not replicating.

whats the best way to resolve the situation.  I have followed below steps didnt work thn I have run Dcpromo again

1  ) Rebooted DCB

2 ) Run Repadmin.

3 ) Rename  DNS folder on DCB thn restarted the DNS services.

Hi,

Do you know if there is a way to force using ldaps 636 and disable LDAP access on non secure port 389 without affect AD features?

Regards

Here is my issue and I am first trying to determine if I am just not understanding AD or if there is actually something wrong because my DC promotion was problematic. If I am not understanding AD then I hope someone will take pity and help me.

I have a 2012 server as DC for company.com and a 2012 server as a child DC child.company.com and here are my issues.

1. I make a new used in company.com called TEST. I make a global group in company.com called TESTGROUP. I add TEST to TESTGROUP and make TEST GROUP TEST's primary group and remove TEST from DOMAIN USERS. TESTGROUP IS NOT A MEMBER OF ANY GROUP. My problem is TEST STILL ACTS LIKE IT HAS DOMAIN USER RIGHTS.

ok,,so, i ran domain prep, forestprep...i have 2003 2 dc's now in my 2003 domain,,,i want to add a 2008 server as a dc, it tells me it cant hold the dns cus no other 2008 dc is present,,i will be removing the 2 2003 dc's...how can i make the new 2008 hold the dns ???

Steven J Einhorn

Windows Server 2003 sp2, Terminal Server 2008.

Setting up sales department with VPN and RDP, everyone is fine except one user who gets an error message.  Your interactive logon privilege has been disabled.  I also just found out that she has been having a problem sending email from her BB when sending outside the GAL.  Don't know if there related.  Any help would be great.