Hi,

can we force a password policy for the DSRM password in all our domain controllers?

Hi,

Is it possible to Export Users with OU and Description information from an AD Group?

Thanks.

We are using Server 2008 Standard and have around 400 users and 89 Organizational Unit.

Our Manager told me to activate delegation of control for one of our colleagues to only reset password and unlock users.

I give him delegation of control to target it Organizational Unit which This Organizational Unit contains sub Ous.

What the problem is he is able to only reset few of the users only he is unable to reset most of the  users which is in the same OU.

I have checked the user which is able to reset its password and the user which he is not able to reset its password group membership they both have the same member ship of groups.

Thanks 

Windows server 2008 standaard. I just remove domain controller, DNS complete out of the server. 

then In the LAN card. properties>TCp/IP>IPV4>Advance>TAB DNS> remove DNS Suffix for this connection.

I mad my server completly stand alone server.

My Question. 

1. I loged in to server as local administrator. Then i opened cmd. I saw users/administrator.s1.000??. 
2. administrator.s1.000 ???? What does this mean????

HI Guys,

I'm looking for Powershell command to Enable/Disable the "Deny this user permissions to log on to remote desktop session host server" on user object.

Not able to find the correct attribute. can anyone please help me with poweshell command.

found some LDAP commands but i'm not sure on this. i need to set this value for bulk users. 

Thanks in advance.

Regards,

Gops

Hi All,

we have web servers in the DMZ network, which should authenticate users via LDAPS against our Active Directory. We have an RODC (Server 2016 Core) in the DMZ network, which should  forward the LDAP authentication requests to a writable DC. Our problem is that only users can be authenticated via LDAPS whose passwords are cached on the RODC. But we want, that no passwords need to be cached on the RODC. The RODC should always forward the request to a writable DC. Is that possible?

Hi,

I was trying to migrate my old WIndows Server 2008 32 bit OS to new OS Windows Server 2019, but apparently it was not possible.

My exchange server 2007 was my copy of my old domain controller still intact but unable to connect to my newly renamed DC server.

My existing Active directory server was roles for the below.

1. CA server
2. Active directory domain services
3. Network policy server
4. Web Server
5. File Server
6. DNS Server

For the migration, below were the steps i did

1. Add 2 domain controller to the existing active directory pool for replication and failover (one windows Server 2012, one is Windows Server 2019 to migrate - during the migration stage, im getting a lot of DNS issue, but i kept persist it and it worked (tried many times of ipconfig /flushdns & ipconfig /registerdns, took a few tries)
2. Successfully added 2 domain controller into the pool and replicated (but the DNS server needed to be manually replicated)
3. Backup CA cert, policies & SYSVOL folder, Did DC Promo.exe the old server, remove CA server then proceeded with the removal of DC server, then change the IP address and domain name of the server

Replication status of the server at that time unknown. I proceeded with the switchover, initially there was already error, but didn't know where to start. I started changing one of the server back to the old server name & IP address, the second server which was added to the DC pool was demoted, and this is where all hell broke loose. The problems became nightmare for me

In my attempt to get the 1st DC server which I replicated, below were the errors found.

C:\Users\pcsb002pg>dcdiag

Directory Server Diagnosis

Performing initial setup:
   Trying to find home server...
   Home Server = adserver
   * Identified AD Forest.
   Done gathering initial info.

Doing initial required tests

   Testing server: Default-First-Site-Name\ADSERVER2
      Starting test: Connectivity
         ......................... ADSERVER2 passed test Connectivity

Doing primary tests

   Testing server: Default-First-Site-Name\ADSERVER2
      Starting test: Advertising
         Fatal Error:DsGetDcName (ADSERVER2) call failed, error 1722
         The Locator could not find the server.
         ......................... ADSERVER2 failed test Advertising
      Starting test: FrsEvent
         ......................... ADSERVER2 passed test FrsEvent
      Starting test: DFSREvent
         The event log DFS Replication on server ADServer2.pcsb.local could not
         be queried, error 0x721 "A security package specific error occurred."
         ......................... ADSERVER2 failed test DFSREvent
      Starting test: SysVolCheck
         [ADSERVER2] An net use or LsaPolicy operation failed with error 64,
         The specified network name is no longer available..
         ......................... ADSERVER2 failed test SysVolCheck
      Starting test: KccEvent
         The event log Directory Service on server ADServer2.pcsb.local could
         not be queried, error 0x721"A security package specific error occurred."
         ......................... ADSERVER2 failed test KccEvent
      Starting test: KnowsOfRoleHolders
         ......................... ADSERVER2 passed test KnowsOfRoleHolders
      Starting test: MachineAccount
         Could not open pipe with [ADSERVER2]:failed with 64:
         The specified network name is no longer available.
         Could not get NetBIOSDomainName
         Failed can not test for HOST SPN
         Failed can not test for HOST SPN
         ......................... ADSERVER2 passed test MachineAccount
      Starting test: NCSecDesc
         ......................... ADSERVER2 passed test NCSecDesc
      Starting test: NetLogons
         [ADSERVER2] An net use or LsaPolicy operation failed with error 64,
         The specified network name is no longer available..
         ......................... ADSERVER2 failed test NetLogons
      Starting test: ObjectsReplicated
         ......................... ADSERVER2 passed test ObjectsReplicated
      Starting test: Replications
         [Replications Check,ADSERVER2] A recent replication attempt failed:
            From EXCHANGE to ADSERVER2
            Naming Context: DC=ForestDnsZones,DC=pcsb,DC=local
            The replication generated an error (1908):
            Could not find the domain controller for this domain.
            The failure occurred at 2020-03-17 00:01:12.
            The last success occurred at 2020-03-16 22:29:03.
            5 failures have occurred since the last success.
            Kerberos Error.
            A KDC was not found to authenticate the call.
            Check that sufficient domain controllers are available.
         [Replications Check,ADSERVER2] A recent replication attempt failed:
            From EXCHANGE to ADSERVER2
            Naming Context: DC=DomainDnsZones,DC=pcsb,DC=local
            The replication generated an error (1908):
            Could not find the domain controller for this domain.
            The failure occurred at 2020-03-17 00:01:12.
            The last success occurred at 2020-03-16 22:29:06.
            5 failures have occurred since the last success.
            Kerberos Error.
            A KDC was not found to authenticate the call.
            Check that sufficient domain controllers are available.
         [Replications Check,ADSERVER2] A recent replication attempt failed:
            From EXCHANGE to ADSERVER2
            Naming Context: CN=Schema,CN=Configuration,DC=pcsb,DC=local
            The replication generated an error (1908):
            Could not find the domain controller for this domain.
            The failure occurred at 2020-03-17 00:01:12.
            The last success occurred at 2020-03-16 22:28:45.
            5 failures have occurred since the last success.
            Kerberos Error.
            A KDC was not found to authenticate the call.
            Check that sufficient domain controllers are available.
         [Replications Check,ADSERVER2] A recent replication attempt failed:
            From EXCHANGE to ADSERVER2
            Naming Context: CN=Configuration,DC=pcsb,DC=local
            The replication generated an error (1908):
            Could not find the domain controller for this domain.
            The failure occurred at 2020-03-17 00:01:12.
            The last success occurred at 2020-03-16 22:34:34.
            5 failures have occurred since the last success.
            Kerberos Error.
            A KDC was not found to authenticate the call.
            Check that sufficient domain controllers are available.
         [Replications Check,ADSERVER2] A recent replication attempt failed:
            From EXCHANGE to ADSERVER2
            Naming Context: DC=pcsb,DC=local
            The replication generated an error (1908):
            Could not find the domain controller for this domain.
            The failure occurred at 2020-03-17 00:01:12.
            The last success occurred at 2020-03-16 22:35:25.
            5 failures have occurred since the last success.
            Kerberos Error.
            A KDC was not found to authenticate the call.
            Check that sufficient domain controllers are available.
         ......................... ADSERVER2 failed test Replications
      Starting test: RidManager
         ......................... ADSERVER2 passed test RidManager
      Starting test: Services
         Could not open Remote ipc to [ADServer2.pcsb.local]: error 0x40"The specified network name is no longer available."
         ......................... ADSERVER2 failed test Services
      Starting test: SystemLog
         The event log System on server ADServer2.pcsb.local could not be
         queried, error 0x721 "A security package specific error occurred."
         ......................... ADSERVER2 failed test SystemLog
      Starting test: VerifyReferences
         ......................... ADSERVER2 passed test VerifyReferences


   Running partition tests on : ForestDnsZones
      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test
         CrossRefValidation

   Running partition tests on : DomainDnsZones
      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test
         CrossRefValidation

   Running partition tests on : Schema
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation

   Running partition tests on : Configuration
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation

   Running partition tests on : pcsb
      Starting test: CheckSDRefDom
         ......................... pcsb passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... pcsb passed test CrossRefValidation

   Running enterprise tests on : pcsb.local
      Starting test: LocatorCheck
         Warning: DcGetDcName(GC_SERVER_REQUIRED) call failed, error 1722
         A Global Catalog Server could not be located - All GC's are down.
         Warning: DcGetDcName(PDC_REQUIRED) call failed, error 1722
         A Primary Domain Controller could not be located.
         The server holding the PDC role is down.
         Warning: DcGetDcName(TIME_SERVER) call failed, error 1722
         A Time Server could not be located.
         The server holding the PDC role is down.
         Warning: DcGetDcName(GOOD_TIME_SERVER_PREFERRED) call failed, error
         1722
         A Good Time Server could not be located.
         Warning: DcGetDcName(KDC_REQUIRED) call failed, error 1722
         A KDC could not be located - All the KDCs are down.
         ......................... pcsb.local failed test LocatorCheck
      Starting test: Intersite
         ......................... pcsb.local passed test Intersite

C:\Users\pcsb002pg>

The above is my DCdiag diagnostics.

I also noticed my DNS is quite screwed.

I'm so stuck and don't know what to do and where to start. My whole office is gonna come after me tomorrow.

I have roughly 25 staffs i the office, with exchange server & some other applications such as firewall, Lyncserver & network drivers require active directory to connect.

Please help me. 

Hello,

We have a Windows Server SBS 2008 DC that we are trying to decommission.  It also was our exchange server (2007) but we migrated to O365.  We have a new Server 2012 R2 DC up and running.  Ive moved the following roles to the 2012 server:

• ADDS, DNS, DHCP
• FSMO roles
• Global Catalog Server

Now when I try to run dcpromo on the SBS server, it gets to the end and fails saying it can't find a global catalog server.  Ive check the firewalls and also made sure  the NIC is pointing to the new server for DNS.  When I try to uninstall Exchange 2007 from the SBS server, I get the same error message stating it can't find a GC server.  Does anyone have any suggestions? 

Thanks.

There are threads here in the forums that include statements that computer accounts are not automatically deleted.

Given the number of tools and scripts that look for old/stale computer accounts for deletion this seems to all make sense. Likewise, this would apply to user accounts too. This question does not apply to tombstone objects which I realize have been 'deleted'.

My question is if there is a canonical/authoritative statement from Microsoft stating that (computer or user) accounts are not auto-deleted, e.g. KB article or product documentation?

Thank-you.

Hi

My AD doesn't refresh my computers name. Still showing old computers name. How I can refresh?

on the windows 2003 box I do an NS look up below and below that the 2008 results,  I need the 2008 box to react just like the 2003 box so that all I have to do is type in lit and it will add in the domain name

> lit
Server:  UnKnown
Address:  192.168.86.24

Name:    lti.example.net
Address:  192.168.86.190

>

windows 2008 results

> lit
Server:  dns.example.net
Address:  192.168.86.23

*** dns.example.net can't find lit: Server failed
>

but when 

Hi Team,

I want to deploy wifi authentication with Active Directory, below the information.

1. WiFi authentication from Active Directory.

2. I will time mention ( will remain connected 2 or 3 hr) then will auto disconnect.

3. Need networking presentation details.

Hello,

I add a new member to the Event Log Readers group but the account is removed by System and I am unable to find the cause.  This only seems to be happening in one of my domains.  I have found the event id 4733 that states system but I am not sure why its doing this.  How do I get a membership to stick to this group?

The Domain Controllers are 2012 R2.

Thanks!

Shawn

dears,

i'm facing this issue on my proxy server: the trust relationship between this workstation and primary domain failed.

i tried to reset the computer account it didn't work.

i am able to log in wity my local admin.

i tried the reset-computermachinepassword and test-computersecurechannel cmdlet but they are returning the following error: 

cannot get domain information about the local computer because of the following exception not found.

any idea about that?

the only thing remaining is disjoining and joining the proxy. will this cause me any issues experts?

or i can disjoin and join

best regards

Hi, 

We have domain A and domain B.Two-way trust is enabled between A and B domain. 

We have application (App1) in A domain,  can we perform the LDAP integration with domain A and search the users in domain B. 

Please share the detail. 

Regards,

S Kannan

Rgds, S Kannan

We have Microsoft Active Directory which has 1 million entries. We are using ldapjs node module paging search to retrieve entries from the Active Directory. As per our observation in some retrieve calls the results size returned is less than page size. For example if my page size is 100 and expecting to retrieve 100 results but it is not returning 100 results instead it is returning less number of records even though my active directory server has more than page size records available. 

This behavior is intermittent and not fixed. Please suggest if anyone facing same behavior while retrieving data from Active Directory.

Thanks in advance.

Hi Support,

When run the BPA in the Windows 2016 DC, we found one of the DC have many error as below: 

  Issue:
  The Active Directory Domain Services Best Practices Analyzer (AD DS BPA) is not able to collect data about the hostname DNS A/AAAA records from the DNS servers.

  Impact:
  The AD DS BPA will not be able to validate configuration data about the hostname DNS A/AAAA records.

  Resolution:
  Troubleshoot the DNS servers to determine the root cause of the problem.

When check the DirectoryServices_EngineReport, it have this error:
                          <HostNameDnsRecord>
                                            <Error>
                                              <Report>true</Report>
                                              <DataItem>the hostname DNS A/AAAA records</DataItem>
                                              <Computer>the DNS servers</Computer>
                                              <Message>This element requires a valid Server Hostname</Message>
                                              <FullyQualifiedErrorId>This element requires a valid Server Hostname</FullyQualifiedErrorId>
                                              <Exception>
                                                <Type>System.ArgumentException</Type>
                                                <Message>This element requires a valid Server Hostname</Message>
                                                <InnerException>
                                                  <Type>Microsoft.ActiveDirectory.Management.ADIdentityNotFoundException</Type>
                                                  <Message>Cannot find directory server with identity: 'Server$'.</Message>

I checked DNS have the server record. Try to use ntdsutil and the server can be found. The replication on all DC is healthly.

Any idea?

Best Regards

Chong