Hi All

one of my users active directory account is disabled. From the Attribute editor for that user, is there any attribute which tells me that this account is disabled.

Hi everyone!

  Devs are working on an interface to change users passwords on domain. Perhaps, it (the application) only works when I give full control on the object. In this case, a lab user test:

Doria

We have been syncing our main domain to Azure through the Azure AD Connect for a couple of years. I recently added a child domain. I honestly could not find a great article on everything I needed to do in order to give my AD Connector account access to the child domain.

I ran the following to gift it permissions: Set-ADSyncBasicReadPermissions Set-ADSyncMsDsConsistencyGuidPermissions Set-ADSyncPasswordHashSyncPermissions

I made sure those rights were set to all descendant objects, so I did not have inheriting issues.

I added a test user to the child domain. When AD Connect runs, I get an error on the child domain:

Connection Data source error code: 8344 Connected data source error: Insufficient access rights to perform this operation

If I click on log there are two entries in the object log: Password Sync - Success Password Sync - NoTargetConnection

I found a troubleshooting doc in the Microsoft Azure documentation. I walked through it, but did not find any problems.

I have googled this to death and haven't found an article that reveals my problem. Hoping there is an expert out here that has a solution!

Hello team!

  What changes when I raise domain function level? In others words, is there any kind of risk for some network protocol like SMB version 1.0 stop working or something else? We run some old Windows applications on the domain network and we are afraid that some kind of old protocol could stop working on the domain network.

--

Doria

After rebooting for this month's security updates, we're unable to logon to our DCs with our Domain Admin accounts, via RDP nor locally. We get a message that says "the user has not been granted the requested logon type at this computer". I discovered that the local administrators group on the DCs no longer contains the Domain Admins or Enterprise Admins groups, but it does contain the local administrator account. I'm aware that I can manually run a command to add those groups back, but is that the best approach to resolve this? Also, if I add a group to the local admins on one DC, will that replicate to all DCs?

Some details:
We're running all Windows Server 2012 R2 DCs on 2008 R2 Forest and Domain level functionality. We have a hub and spoke topoligy. Replication appears to be working.

We're still able to manage the domain with our Domain Admin accounts via mmc from other hosts, so this seems to only affect local authentication to DCs.

Gpresults doesn't show any GPOs manipulating the local Administrators group.

Hello, 

Keep getting the same error on all DCs. They are all replicating with 0 errors. only when i run DCDiag i get the same error. When i run GPUPDATE on the servers I can successfully run. I have checked all settings DNS. ETC. When i run GPUPATE i get another error. Any help would be great!

Here is from one of the servers: 

Microsoft Windows [Version 6.2.9200]
(c) 2012 Microsoft Corporation. All rights reserved.

C:\Windows\system32>ipconfig /registerdns

Windows IP Configuration

Registration of the DNS resource records for all adapters of this computer has b
een initiated. Any errors will be reported in the Event Viewer in 15 minutes.

C:\Windows\system32>dcdiag /fix

Directory Server Diagnosis

Performing initial setup:
   Trying to find home server...
   Home Server = BLANK-DC03
   * Identified AD Forest.
   Done gathering initial info.

Doing initial required tests

   Testing server: Default-First-Site-Name\BLANK-DC03
      Starting test: Connectivity
         ......................... BLANK-DC03 passed test Connectivity

Doing primary tests

   Testing server: Default-First-Site-Name\BLANK-DC03
      Starting test: Advertising
         ......................... BLANK-DC03 passed test Advertising
      Starting test: FrsEvent
         ......................... BLANK-DC03 passed test FrsEvent
      Starting test: DFSREvent
         ......................... BLANK-DC03 passed test DFSREvent
      Starting test: SysVolCheck
         ......................... BLANK-DC03 passed test SysVolCheck
      Starting test: KccEvent
         ......................... BLANK-DC03 passed test KccEvent
      Starting test: KnowsOfRoleHolders
         ......................... BLANK-DC03 passed test KnowsOfRoleHolders
      Starting test: MachineAccount
         ......................... BLANK-DC03 passed test MachineAccount
      Starting test: NCSecDesc
         ......................... BLANK-DC03 passed test NCSecDesc
      Starting test: NetLogons
         ......................... BLANK-DC03 passed test NetLogons
      Starting test: ObjectsReplicated
         ......................... BLANK-DC03 passed test ObjectsReplicated
      Starting test: Replications
         ......................... BLANK-DC03 passed test Replications
      Starting test: RidManager
         ......................... BLANK-DC03 passed test RidManager
      Starting test: Services
         ......................... BLANK-DC03 passed test Services
      Starting test: SystemLog
         A warning event occurred.  EventID: 0x0000043D
            Time Generated: 05/18/2020   10:16:24
            Event String:
            Windows failed to apply the Group Policy Files settings. Group Polic
y Files settings might have its own log file. Please click on the "More informat
ion" link.
         A warning event occurred.  EventID: 0x0000043D
            Time Generated: 05/18/2020   10:16:24
            Event String:
            Windows failed to apply the Group Policy Shortcuts settings. Group P
olicy Shortcuts settings might have its own log file. Please click on the "More
information" link.
         A warning event occurred.  EventID: 0x0000043D
            Time Generated: 05/18/2020   10:21:24
            Event String:
            Windows failed to apply the Group Policy Files settings. Group Polic
y Files settings might have its own log file. Please click on the "More informat
ion" link.
         A warning event occurred.  EventID: 0x0000043D
            Time Generated: 05/18/2020   10:21:24
            Event String:
            Windows failed to apply the Group Policy Shortcuts settings. Group P
olicy Shortcuts settings might have its own log file. Please click on the "More
information" link.
         A warning event occurred.  EventID: 0x0000043D
            Time Generated: 05/18/2020   10:26:24
            Event String:
            Windows failed to apply the Group Policy Files settings. Group Polic
y Files settings might have its own log file. Please click on the "More informat
ion" link.
         A warning event occurred.  EventID: 0x0000043D
            Time Generated: 05/18/2020   10:26:24
            Event String:
            Windows failed to apply the Group Policy Shortcuts settings. Group P
olicy Shortcuts settings might have its own log file. Please click on the "More
information" link.
         A warning event occurred.  EventID: 0x0000043D
            Time Generated: 05/18/2020   10:31:25
            Event String:
            Windows failed to apply the Group Policy Files settings. Group Polic
y Files settings might have its own log file. Please click on the "More informat
ion" link.
         A warning event occurred.  EventID: 0x0000043D
            Time Generated: 05/18/2020   10:31:25
            Event String:
            Windows failed to apply the Group Policy Shortcuts settings. Group P
olicy Shortcuts settings might have its own log file. Please click on the "More
information" link.
         A warning event occurred.  EventID: 0x0000043D
            Time Generated: 05/18/2020   10:36:25
            Event String:
            Windows failed to apply the Group Policy Files settings. Group Polic
y Files settings might have its own log file. Please click on the "More informat
ion" link.
         A warning event occurred.  EventID: 0x0000043D
            Time Generated: 05/18/2020   10:36:25
            Event String:
            Windows failed to apply the Group Policy Shortcuts settings. Group P
olicy Shortcuts settings might have its own log file. Please click on the "More
information" link.
         A warning event occurred.  EventID: 0x0000043D
            Time Generated: 05/18/2020   10:41:25
            Event String:
            Windows failed to apply the Group Policy Files settings. Group Polic
y Files settings might have its own log file. Please click on the "More informat
ion" link.
         A warning event occurred.  EventID: 0x0000043D
            Time Generated: 05/18/2020   10:41:25
            Event String:
            Windows failed to apply the Group Policy Shortcuts settings. Group P
olicy Shortcuts settings might have its own log file. Please click on the "More
information" link.
         A warning event occurred.  EventID: 0x0000043D
            Time Generated: 05/18/2020   10:46:25
            Event String:
            Windows failed to apply the Group Policy Files settings. Group Polic
y Files settings might have its own log file. Please click on the "More informat
ion" link.
         A warning event occurred.  EventID: 0x0000043D
            Time Generated: 05/18/2020   10:46:25
            Event String:
            Windows failed to apply the Group Policy Shortcuts settings. Group P
olicy Shortcuts settings might have its own log file. Please click on the "More
information" link.
         A warning event occurred.  EventID: 0x0000043D
            Time Generated: 05/18/2020   10:51:25
            Event String:
            Windows failed to apply the Group Policy Files settings. Group Polic
y Files settings might have its own log file. Please click on the "More informat
ion" link.
         A warning event occurred.  EventID: 0x0000043D
            Time Generated: 05/18/2020   10:51:26
            Event String:
            Windows failed to apply the Group Policy Shortcuts settings. Group P
olicy Shortcuts settings might have its own log file. Please click on the "More
information" link.
         A warning event occurred.  EventID: 0x0000043D
            Time Generated: 05/18/2020   10:56:26
            Event String:
            Windows failed to apply the Group Policy Files settings. Group Polic
y Files settings might have its own log file. Please click on the "More informat
ion" link.
         A warning event occurred.  EventID: 0x0000043D
            Time Generated: 05/18/2020   10:56:26
            Event String:
            Windows failed to apply the Group Policy Shortcuts settings. Group P
olicy Shortcuts settings might have its own log file. Please click on the "More
information" link.
         A warning event occurred.  EventID: 0x0000043D
            Time Generated: 05/18/2020   11:01:26
            Event String:
            Windows failed to apply the Group Policy Files settings. Group Polic
y Files settings might have its own log file. Please click on the "More informat
ion" link.
         A warning event occurred.  EventID: 0x0000043D
            Time Generated: 05/18/2020   11:01:26
            Event String:
            Windows failed to apply the Group Policy Shortcuts settings. Group P
olicy Shortcuts settings might have its own log file. Please click on the "More
information" link.
         A warning event occurred.  EventID: 0x0000043D
            Time Generated: 05/18/2020   11:06:26
            Event String:
            Windows failed to apply the Group Policy Files settings. Group Polic
y Files settings might have its own log file. Please click on the "More informat
ion" link.
         A warning event occurred.  EventID: 0x0000043D
            Time Generated: 05/18/2020   11:06:26
            Event String:
            Windows failed to apply the Group Policy Shortcuts settings. Group P
olicy Shortcuts settings might have its own log file. Please click on the "More
information" link.
         A warning event occurred.  EventID: 0x0000043D
            Time Generated: 05/18/2020   11:11:26
            Event String:
            Windows failed to apply the Group Policy Files settings. Group Polic
y Files settings might have its own log file. Please click on the "More informat
ion" link.
         A warning event occurred.  EventID: 0x0000043D
            Time Generated: 05/18/2020   11:11:26
            Event String:
            Windows failed to apply the Group Policy Shortcuts settings. Group P
olicy Shortcuts settings might have its own log file. Please click on the "More
information" link.
         ......................... BLANK-DC03 passed test SystemLog
      Starting test: VerifyReferences
         ......................... BLANK-DC03 passed test VerifyReferences


   Running partition tests on : ForestDnsZones
      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test
         CrossRefValidation

   Running partition tests on : DomainDnsZones
      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test
         CrossRefValidation

   Running partition tests on : Schema
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation

   Running partition tests on : Configuration
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation

   Running partition tests on : blank
      Starting test: CheckSDRefDom
         ......................... blank passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... blank passed test CrossRefValidation

   Running enterprise tests on : blank.net
      Starting test: LocatorCheck
         ......................... blank.net passed test LocatorCheck
      Starting test: Intersite
         ......................... blank.net passed test Intersite

C:\Windows\system32>

Here is GPUPDATE from a PC:

Microsoft Windows [Version 10.0.18362.720]
(c) 2019 Microsoft Corporation. All rights reserved.

C:\Users\dental>gpupdate
Updating policy...

Computer policy could not be updated successfully. The following errors were encountered:

The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). Look in the details tab for error code and description.
User Policy could not be updated successfully. The following errors were encountered:

The processing of Group Policy failed. Windows could not resolve the user name. This could be caused by one of more of the following:
a) Name Resolution failure on the current domain controller.
b) Active Directory Replication Latency (an account created on another domain controller has not replicated to the current domain controller).

To diagnose the failure, review the event log or run GPRESULT /H GPReport.html from the command line to access information about Group Policy results.

C:\Users\dental>The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). Look in the details tab for error code and description.
'The' is not recognized as an internal or external command,
operable program or batch file.

C:\Users\dental>The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). Look in the details tab for error code and description.
'The' is not recognized as an internal or external command,
operable program or batch file.

C:\Users\dental>

Hello guys recently we have had issues where our administrators in the built in administrator group inside of active directory have been getting kicked out randomly. At this point I believe it to be corrupted because we have tried several things in order to try and fix this such as adding the administrators back into the administrator group and enabling inheritance in the security section,but still no luck as they continuously get kicked out and its driving me crazy. Because not only is it not allowing us to add ourselves as domain administrators on our machines, it has also kicked out our domain users as domain administrators on their devices and is not allowing them to download things and an admin can't remote into their computers and input their login info because at this point no one has "admin" permissions. So its just been a whole frustrating situation. Has anyone ever ran into this problem before, what were some fixes that helped you out? 

*Multiple people were also logging into the domain controller with the admin info not sure if that makes a difference

Hello fellow techs, hope i am in the correct forum.  if not, i apologize!

in the past, when i removed computers from AD domain, after restarting the computer and some time after, the computer acccount/object would be disabled.  I have recently been managing a 2019 domain and i don't see this process taking place.  the computer account is still enabled.  thought it was replication and have left the accounts over night.

Has this behavior changed or is their a setting that must be configured?

appreciate your feedback.

Hamid

Regards, H a m i d A z e e z

Hello everybody,

We have made a mistake: In a customer's small domain, we were not aware that there was an enterprise CA running on a server 2008 R2 which shall be decommissioned, and installed a new enterprise CA on Windows Server 2019. Now the new root certificate does not get distributed to clients - that is were we becaem aware of the old CA.

There are no certificates that the old CA issued which are still in active use (perhaps besides those gerneated for the domain controllers or something like that). We would like to get rid of the old CA and have the new one fully working. What is the best way to achieve this? Uninstall the old CA as described in https://support.microsoft.com/en-au/help/889250/how-to-decommission-a-windows-enterprise-certification-authority-and-r and then again trying to dspublish the new root? Uninstall both and reinstall the new one? Thanks for any hint.

Best Regards, Stefan Falk

Hi All

i would like to ask a question about Unsigned LDAP how one can explain it as simple as possible you know.

If you can't explain it simply, you don't understand it well enough.

So my assumption was that like with Certificates when Dc reply to LDAP query it signs LDAP with is private key, then client could check CRL having RootCA chain see that the replay is valid and authentic and decrypt with DC public key (SSL handshake)

i have a lots of Linux boxes they trigger Unsigned events (i know it could be false postive but still) my assumption was that if i install RootCa cert on them i would resolve the issue. but it seems that Kerberos itself its signed (with what ? krbtgt password?) also  What does exactly Unsigned LDAP means? that client sending the query could not be check for autheticity ?? i could read MS documentation but no clear explanation is given imho.

so one thing that i am sure of is that i don't know how it is working =) thanks for any feedback

This issue came up during a dcpromo failure on a windows 2008r2 server.  I know I can forcibly remove but I am trying to get to the root cause.  I noticed the below event in directory services log.  The issue is there is no server named CMPS6 as indicated below.   Im guessing it was a previous DC possibly ungracefully removed.  I have only been to this site since March

This always happens when i try to run DCpromo on CMDCAxx1  then I get the AD DS cannot transfer the remaining data in directory partition  .... the directory is missing mandatory configuration....

netdom /query FSMO shows correct results

DCDiag basic scan all pass

Dnsdiag all pass

Would this be a DNS issue?  I did find the bad entry under forestdnszones and domaindnszones and In AD sites and services CMPS6 is under servers but no NTDS entried

Safe to remove from DNS?   or is a metadata cleanup needed or any other diag tools?

event log below

Task Category: Replication

Level:         Warning
Keywords:      Classic
User:          ANONYMOUS LOGON
Computer:      CMDCAxx1.clementmanor.com
Description:
Ownership of the following FSMO role is set to a server which is deleted or does not exist. 
Operations which require contacting a FSMO operation master will fail until this condition is corrected. 

FSMO Role: CN=Infrastructure,DC=DomainDnsZones,DC=clementmanor,DC=com 
FSMO Server DN: CN=NTDS Settings\0ADEL:a060d7dc-34a6-45a8-8a72-c7ffac019f5d,CN=CMPS6,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=clementmanor,DC=com 

Thanks

Craig

Craig

Hi! This question is originally posted by me on serverfault but it seems I shouldn't wait for the response there :( 

I have a weird ADSync error stating that my local active directory contains two objects with the same ProxyAddress property. One of accounts is username@domain.tld (which is correct) and the second is username@domain.onmicrosoft.com (which is inexistent in AD in my opinion) - and, according to DirSync errors report, both of them contain the same conflicting ProxyAddress username@domain.tld. AzureAD shows that both accounts source from local Active Directory. The point is that someone could create *onmicrosoft.com account years ago to test office365.

I have checked two things so far:

1. Small powershell script to test for the same proxyaddress in local AD:

Get-ADUser-Filter*-Properties proxyAddresses |foreach{foreach($address in $_.proxyAddresses){if($address -eq 'smtp:username@domain.tld'){Write-Host $address}}}

2. Checking for immutableIDs of conflicting accounts:

$user =Get-ADUser legit_account
$immutableid =[System.Convert]::ToBase64String($user.ObjectGUID.tobytearray())
$immutableid #shows the same as legit account in DirSync report

$badImmutableID ='base64 copied from bad account DirSync error report=='


$users = get-aduser -Filter*foreach($usr in $users){
    $currImmutableID =[System.Convert]::ToBase64String($usr.ObjectGUID.tobytearray())if($currImmutableID -eq $badImmutableID){
        $usr}}

This script provides no output with bad immutableID (but works with others).

I am actually stuck at this point - AzureAD won't let me delete bad account to resolve conflict saying I have to solve it in local AD while there is no such account. Any ideas would be highly appreciated.

So, I'm apparently a domain administrator now, and I have a lot to learn apparently.  The following is a dcdiag.exe results that have been sanitized and someone explain to me what I'm seeing and what may be going on?

C:\Users\USERNAME>dcdiag

Directory Server Diagnosis

Performing initial setup:
   Trying to find home server...
   Home Server = SERVERNAME
   * Identified AD Forest.
   Done gathering initial info.

Doing initial required tests

   Testing server: Default-First-Site-Name\SERVERNAME
      Starting test: Connectivity
         ......................... SERVERNAME passed test Connectivity

Doing primary tests

   Testing server: Default-First-Site-Name\SERVERNAME
      Starting test: Advertising
         ......................... SERVERNAME passed test Advertising
      Starting test: FrsEvent
         ......................... SERVERNAME passed test FrsEvent
      Starting test: DFSREvent
         ......................... SERVERNAME passed test DFSREvent
      Starting test: SysVolCheck
         ......................... SERVERNAME passed test SysVolCheck
      Starting test: KccEvent
         ......................... SERVERNAME passed test KccEvent
      Starting test: KnowsOfRoleHolders
         ......................... SERVERNAME passed test KnowsOfRoleHolders
      Starting test: MachineAccount
         ......................... SERVERNAME passed test MachineAccount
      Starting test: NCSecDesc
         ......................... SERVERNAME passed test NCSecDesc
      Starting test: NetLogons
         [SERVERNAME] User credentials does not have permission to perform
         this operation.
         The account used for this test must have network logon privileges
         for this machine's domain.
         ......................... SERVERNAME failed test NetLogons
      Starting test: ObjectsReplicated
         ......................... SERVERNAME passed test ObjectsReplicated
      Starting test: Replications
         [Replications Check,SERVERNAME] DsReplicaGetInfo(PENDING_OPS, NULL)
         failed, error 0x2105 "Replication access was denied."
         ......................... SERVERNAME failed test Replications
      Starting test: RidManager
         ......................... SERVERNAME passed test RidManager
      Starting test: Services
            Could not open NTDS Service on SERVERNAME, error 0x5
            "Access is denied."
         ......................... SERVERNAME failed test Services
      Starting test: SystemLog
         ......................... SERVERNAME passed test SystemLog
      Starting test: VerifyReferences
         ......................... SERVERNAME passed test VerifyReferences

   Running partition tests on : ForestDnsZones
      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test
         CrossRefValidation

   Running partition tests on : DomainDnsZones
      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test
         CrossRefValidation

   Running partition tests on : Schema
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation

   Running partition tests on : Configuration
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation

   Running partition tests on : domainName
      Starting test: CheckSDRefDom
         ......................... domainName passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... domainName passed test CrossRefValidation

   Running enterprise tests on : domainName.MyDomain.org
      Starting test: LocatorCheck
         ......................... domainName.MyDomain.org passed test
         LocatorCheck
      Starting test: Intersite
         ......................... domainName.MyDomain.org passed test
         Intersite

C:\Users\USERNAME>

I have a network with 3 domain controllers. On the DC with all the FSMO roles I am getting this error:

Log Name:      DFS Replication

Would anyone know my best practice for a resolution?

Thanks

Dave 

Hello,

This is to request some guidance.

I do have a Default scope on my DC Server and it leasing ip address already.

I have created a new Subnet in my Network for users. Which i have created aScope on the Same DHCP Server, it's not leasing or giving out ip.

Please advise.

Thanks and Regards,

Ronald.

Hi everyone,

I am looking for an theoretic answer on the next question: 

Imagine we have two independent domains A and B.

A trusts B, there is one-way trust where A is a resource trusting domain, B is an account trusted domain. 

The workstation W is joined to domain A. So W is a part of the domain A.  

Q:

Can a user managed by the domain B login to the workstation W with his B credentials?

Forgive me if I put this question in the wrong forum.

We are currently in the middle of a domain migration.  We are migrating all of servers and system from one domain to another.  It is time to migrate our DFS server but I know it is not just joining to new domain.  Anybody has any ideas on how to go about this without having to reinvent the whole wheel.

I will have to migrate DFS from domain.xyz to domain.com.

thanks.