Hi,

I have single Domain Controller 30 machines are not able to contact the Server then possibly i checked internet in the Directory Server i was not able to browse Internet though Directory Server. Then i ran dcdiag /fix, I got the following errors. I have checked the network interface too but still i am unable to resolve the issue.

Other Machines connected to the Directory Server are getting internet.

Other Errors from the NETLOGON Service : Event 5722

The session setup from the computer WS-15 failed to authenticate. The name(s) of the account(s) referenced in the security database is WS-15$.  The following error occurred: Access is denied.

DistributedCOM : Event 10016

The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

C:\Windows\system32>dcdiag /fix

Directory Server Diagnosis

Performing initial setup:
   Trying to find home server...
   Home Server = ADServer2
   * Identified AD Forest.
   Done gathering initial info.

Doing initial required tests

   Testing server: Default-First-Site-Name\ADSERVER2
      Starting test: Connectivity
         The host a5062caf-4ee7-400f-a70d-9e4d8e84e0f0._msdcs.ad.xxxx.com could not be resolved to an IP address. Check the DNS server, DHCP, server name,
         etc.
         Got error while checking LDAP and RPC connectivity. Please check your firewall settings.
         ......................... ADSERVER2 failed test Connectivity

Doing primary tests

   Testing server: Default-First-Site-Name\ADSERVER2
      Skipping all tests, because server ADSERVER2 is not responding to directory service requests.


   Running partition tests on : ForestDnsZones
      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test CrossRefValidation

   Running partition tests on : DomainDnsZones
      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test CrossRefValidation

   Running partition tests on : Schema
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation

   Running partition tests on : Configuration
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation

   Running partition tests on : ad
      Starting test: CheckSDRefDom
         ......................... ad passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... ad passed test CrossRefValidation

   Running enterprise tests on : ad.vinformax.com
      Starting test: LocatorCheck
         ......................... ad.xxxx.com passed test LocatorCheck
      Starting test: Intersite
         ......................... ad.xxxx.com passed test Intersite

Kindly help me to sort out the issue.

Regards,

D.Nithyananthan.

Thanks & Regards, D.Nithyananthan.

Hi Team,

How to restrict domain joining for particular windows 10 OS version like Windows 10 education.

Apart from windows 10 Enterprise edition need to deny other windows 10 OS versions.

Regards,

Yogesh

We have a central management console which works with Active directory. We enumerate users/computers/groups etc and use it inside our console for applying the policy. Is it a good idea to consider "Lost And Found Folder" as a valid group just like others containers?

-- Vikram

Dear All,

I did delegate a user to reset domain user passwords and modified their properties, he can do his tasks on majority of domain users but not for others. I did check those users and they'r member of a security group " technical support" which has the privileges to do remote desktop on domain computers and also member of domain computers. All members of that group are having admincount 1, and as my understanding even i remove this value it well added back after an hour. I did add that user to same group" technical support" and he's admincount 1 but still he can't reset any member of that group. Enable inheritance is disabled for those users as well, i did enable it but it disabled again. Is there is any way to let that user to reset all members on that group.

Thank You

Hi,

I have a need to deny a certain group of users interactive logon to computers while at the same time those users must be still granted "RunAs" and "Run as a Service". Basically, I want to deny authentication using the GINA.

As I know that the GPO setting "Deny Log On Locally" cannot achieve that, what alternative do we have?

Thank you

PM

Hello Team,

I am new to Active Directory. So I want to ask that what is the path to learn active directory and get certified in that.

Also want to know that what is the pre-requisite required to learn Active Directory.

Regards,

Vipin

Hello

In our Organization we have configure 2-way forest trust relationship between 2 forest domains(ForestA and ForestB) with Transitive mode "Yes", Name Suffix Routing is properly set.

When checking for the trust validation the next window appear:

While checking with nltest /dclist:DomainB also give a list of DCs in the DomainB.

ForestA contain two child domain child1.ForestA and child2.ForeastA. ForestB dont have child domain.

Adding account from ForestB to ForestA's Domain Local group is success. But when we are trying to add account from ForestB to the Domain Local group in child1.ForestA it gives an error window below:

P. S. Conditional Forwarders is configured properly, all FQDNs of DomainB resolves successfully

Hello folks,

I cant promote a member server to be a DC. This server was not even able to get added to the domain. I got that taken care of by offline join (djoin). I'm able to ping/nslookup any other DC, DNS, domain name, forest name, etc

Please see the C:\Windows\debug\dcpromoui.log and the screenshot

$acl =get-acl d:\test5
$ace =new-object system.security.AccessControl.FileSystemAccessRule('Authenticated Users','FullControl','Allow')
$acl.AddAccessRule($ace)
$acl |Set-Acl

baban jamal ali

baban jamal ali

Greetings,

  I have looked everywhere but cannot find the write 'SamAccountName' permission.

  There is a samaccountname in dssec.dat but its under class '[securityPrincipal]' and setting that to zero still doesnt display it.

  Does anyone know where it is?

Thanks

David Z

We are looking to move the users/groups/service account along with permission from one forest (domainxyz.com) to another forest (Domain abc.com)

We have one-way trust between abc.com to xyz.com domains. Users/Groups and service account exist in xyz.com and accessing the resources ofabc.com (like file server (share folder), Citrix profile (Roaming, Terminal and folder redirection).

All user’s data exist in abc.com domain. Hence looking to move the Users/Groups/Service account and computer account into ABC.com domain without losing access to existing resources.

As of now users is accessing the resources in ABC.com as below.

1-     Workstation is joined to xyz.com (which need to be move inabc.com)

2-     Users login to xyz.com domain (users exist inxyz.com and configured the profile path (Roaming, Terminal, and redirected folder via group policy as\\abc.com\dfs\...........)

3-     Users login to Citrix server (All Citrix servers/fileserver/Storage is inABC.com) and access their resources.

Looking some guidance here for seamless movement.

Hi Everyone

A few months ago our DC got infected with ransomware. We setup a new server two or three weeks ago, configured it as a DC (DC01) and transferred all the FSMO roles to the new DC (DC01). DCDIAG was clean on DC01. We then demoted the infected DC and when we tried to log in via the local admin, we got a "The User Profile Service service failed the logon". I added another user to the localgroup administrators, but get the same error. I wanted to log onto the server to fully uninstall Active Directory and DNS from the server.

Can I just switch off the server completely or is there a way to see if all Domain functionality works except for dcdiag.exe?

The Problem
I cannot query the AD from the AppsServer unless I leave the domain and restart, then rejoin and NOT restart

All are fully patched with latest updates 07/05/2019

Setup (All Server2019, all single NICs)
DC01: Physical running AD DS, DHCP, DNS and file and storage services
AppsServer: Physical running Hyper-V, IIS, print and doc, file and storage services and Azure AD Connect
DC02: Virtual running AD DS, DHCP, DNS and file and storage services

Communication between the two DC's is fine, although I do get DFS Replication Event 5008 quickly followed by 5004 on DC01
Pings between the two DC's are <1ms and never miss a beat.

DCDIAG From AppsServer
dcdiag /test:advertising /v /s:dc01
* Connecting to directory service on server dc01.
   Ldap search capability attribute search failed on server dc01, return value = 81

DCDIAG From DC02
Directory Server Diagnosis

Performing initial setup:
   * Connecting to directory service on server DC01.
   * Identified AD Forest.
   Collecting AD specific global data
   * Collecting site info.
   Calling ldap_search_init_page(hld,CN=Sites,CN=Configuration,DC=domain,DC=local,LDAP_SCOPE_SUBTREE,(objectCategory=ntDSSiteSettings),.......
   The previous call succeeded
   Iterating through the sites
   Looking at base site object: CN=NTDS Site Settings,CN=Primary,CN=Sites,CN=Configuration,DC=domain,DC=local
   Getting ISTG and options for the site
   * Identifying all servers.
   Calling ldap_search_init_page(hld,CN=Sites,CN=Configuration,DC=domain,DC=local,LDAP_SCOPE_SUBTREE,(objectClass=ntDSDsa),.......
   The previous call succeeded....
   The previous call succeeded
   Iterating through the list of servers
   Getting information for the server CN=NTDS Settings,CN=DC01,CN=Servers,CN=Primary,CN=Sites,CN=Configuration,DC=domain,DC=local
   objectGuid obtained
   InvocationID obtained
   dnsHostname obtained
   site info obtained
   All the info for the server collected
   Getting information for the server CN=NTDS Settings,CN=DC02,CN=Servers,CN=Primary,CN=Sites,CN=Configuration,DC=domain,DC=local
   objectGuid obtained
   InvocationID obtained
   dnsHostname obtained
   site info obtained
   All the info for the server collected
   * Identifying all NC cross-refs.
   * Found 2 DC(s). Testing 1 of them.
   Done gathering initial info.

Doing initial required tests

   Testing server: Primary\DC01
      Starting test: Connectivity
         * Active Directory LDAP Services Check
         Determining IP4 connectivity
         * Active Directory RPC Services Check
         ......................... DC01 passed test Connectivity

Doing primary tests

   Testing server: Primary\DC01
      Starting test: Advertising
         The DC DC01 is advertising itself as a DC and having a DS.
         The DC DC01 is advertising as an LDAP server
         The DC DC01 is advertising as having a writeable directory
         The DC DC01 is advertising as a Key Distribution Center
         The DC DC01 is advertising as a time server
         The DS DC01 is advertising as a GC.
         ......................... DC01 passed test Advertising
      Test omitted by user request: CheckSecurityError
      Test omitted by user request: CutoffServers
      Test omitted by user request: FrsEvent
      Test omitted by user request: DFSREvent
      Test omitted by user request: SysVolCheck
      Test omitted by user request: KccEvent
      Test omitted by user request: KnowsOfRoleHolders
      Test omitted by user request: MachineAccount
      Test omitted by user request: NCSecDesc
      Test omitted by user request: NetLogons
      Test omitted by user request: ObjectsReplicated
      Test omitted by user request: OutboundSecureChannels
      Test omitted by user request: Replications
      Test omitted by user request: RidManager
      Test omitted by user request: Services
      Test omitted by user request: SystemLog
      Test omitted by user request: Topology
      Test omitted by user request: VerifyEnterpriseReferences
      Test omitted by user request: VerifyReferences
      Test omitted by user request: VerifyReplicas

      Test omitted by user request: DNS
      Test omitted by user request: DNS

   Running partition tests on : ForestDnsZones
      Test omitted by user request: CheckSDRefDom
      Test omitted by user request: CrossRefValidation

   Running partition tests on : DomainDnsZones
      Test omitted by user request: CheckSDRefDom
      Test omitted by user request: CrossRefValidation

   Running partition tests on : Schema
      Test omitted by user request: CheckSDRefDom
      Test omitted by user request: CrossRefValidation

   Running partition tests on : Configuration
      Test omitted by user request: CheckSDRefDom
      Test omitted by user request: CrossRefValidation

   Running partition tests on : domain
      Test omitted by user request: CheckSDRefDom
      Test omitted by user request: CrossRefValidation

   Running enterprise tests on : domain.local
      Test omitted by user request: DNS
      Test omitted by user request: DNS
      Test omitted by user request: LocatorCheck
      Test omitted by user request: Intersite

IPCONFIG /All (disabled IPV6 on DC01 and AppsServer to test)
DC01
   Host Name . . . . . . . . . . . . : DC01
   Primary Dns Suffix  . . . . . . . : domain.local
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : domain.local

Ethernet adapter NIC1:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Broadcom NetXtreme Gigabit Ethernet
   Physical Address. . . . . . . . . : 90-B1-1C-22-19-82
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 192.168.0.1(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.0.254
   DNS Servers . . . . . . . . . . . : 192.168.0.17
                                       127.0.0.1
   NetBIOS over Tcpip. . . . . . . . : Disabled -> just disabled to test

DC02
   Host Name . . . . . . . . . . . . : DC02
   Primary Dns Suffix  . . . . . . . : domain.local
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : domain.local

Ethernet adapter Ethernet:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft Hyper-V Network Adapter
   Physical Address. . . . . . . . . : 00-15-5D-00-60-0A
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::f5ad:b95d:529c:18d3%9(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.0.17(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.0.254
   DHCPv6 IAID . . . . . . . . . . . : 100668765
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-24-33-CA-A5-00-15-5D-00-60-0A
   DNS Servers . . . . . . . . . . . : 192.168.0.1
                                       127.0.0.1
   NetBIOS over Tcpip. . . . . . . . : Disabled -> just disabled to test

AppsServer
   Host Name . . . . . . . . . . . . : AppsServer
   Primary Dns Suffix  . . . . . . . : domain.local
   Node Type . . . . . . . . . . . . : Mixed
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : domain.local

 Ethernet adapter NIC1:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Broadcom NetXtreme Gigabit Ethernet #4
   Physical Address. . . . . . . . . : F0-1F-AF-E1-5E-0F
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 192.168.0.3(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.0.254
   DNS Servers . . . . . . . . . . . : 192.168.0.1
                                       192.168.0.17
   NetBIOS over Tcpip. . . . . . . . : Enabled

Other tests ran..
nltest /dsgetdc:domain.local /server:dc01
     DC: \\DC01.domain.local
     Address: \\192.168.0.1
     Dom Guid: 62ea49d6-7a05-4258-81d3-06dba557ffed
     Dom Name: domain.local
     Forest Name: domain.local
     Dc Site Name: Primary
     Our Site Name: Primary
     Flags: PDC GC DS LDAP KDC TIMESERV GTIMESERV WRITABLE DNS_DC DNS_DOMAIN DNS_FOREST CLOSE_SITE FULL_SECRET WS DS_8 DS_9 DS_10

The command completed successfully

Pings between all serves work on IP and HOST names, Firewall has been disabled for all network types, Group Policies have been disabled except on domain controllers.  My local Windows 10 machine works without any issue and can query the AD.

I'm out of ideas and would appreciate any help.

I have a 1 DC environment (no $ for a 2nd one).

It's on the fritz. Possible memory issue and/or possible windows corruption.

Anyway, I have a temporary box setup, joined domain, promoted to DC, forced replication via ad sites and services. Said it completed successfully.

New DC is a global catalog.

However, when the original DC goes offline, the new DC can no longer access AD users and computers, etc.

The new DC cannot access Netlogon either. I can connect using the original DC as the source but can't use the new DC as the source.

\\newdc\netlogon while on new DC doesn't work

\\olddc\netlogon while on new DC does work

Both DC's are 2012 R2 standard.

Thanks!

Hi, I been ask to setup one way trust between two domians but for some reason I can't do anything from domian A. i dont get option to setup any trust.

I'm enterprise/domain admin on both domains.

if I go to Actie Durectory Domians and Trusts (ADDT) in Domain B then I am able to see the option to setup trust but not from Domian A.

Domain A setup

3 Domian Controller

• 2008 R2 DC
• 2012 R2 DC
• 2016 DC

Domian B Setup

• 2012 R2
• 2016

Both of the domian are on 2008 R2 Functional level

Hi Team

DO we have any options to enable or deploy File and Print sharing in firewall  using group policy .

Hi Support,

We have two Windows 2012 Standard DCs.

We did not make any recent changes.

When checked replication today we have seen the below error

Repadmin: running command /showrepl against full DC localhost

Default-First-Site-Name\AD1

DSA Options: IS_GC

Site Options: (none)

DSA object GUID: 653b6bb0-39bc-4610-a4a7-b08248b940d6

DSA invocationID: 86a9e6b9-5f25-47f9-9147-3d8a13a108f1



DsBindWithCred to localhost failed with status 5 (0x5):

    Access is denied.

The other DC, AD2 is fine. That dc is having inbound replication from the problematic DC. AD2 is the primary DC.

Please let me know how do I troubleshoot this.

   Hello to all, I need to audit DNS changes (creation, edition and deletion of zones and records) in a DNS environment that is integrates with AD. DC versions: Win2003, 2008,  2008 R2, 2012, 2012R2 and 2016. 

   I know that there are specific configurations to generate DNS events and they depend of the DC version. Until Win2012 (included) one should use GPO + ADSEdit and with Windows 2012R2 and later an enhanced method appeared named "DNS Logging and Diagnostics" (https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn800669(v=ws.11). I didn't see any reference in "DNS Logging and Diagnostics" article and others, citing any reference to ADSIEdit. Questions:

   1-  How to configure DNS audit events (zone and record - deletion, creation and edition) on a single domain that have DCs in versios like 2008, 2012 and 2016? Will one kind ("legacy" x "Logging and Diagnostics") of configuration impact on another one? How to enable DNS audit to get DNS events on several types of DCs - like the ones written here?

   2- is there a GPO to configure "Logging and Diagnostics"? 

   Thanks in advance.

   Regards, EEOC.