I want to export a list

prephare using LDAP and not Powershell bat it can be both

with all users that haven't logged in on the past 120 days and are still active (not the disabled ones)

I need only their display name, email and descriptions.

Hi,

We have two Windows 2012 DCs. After the primary DC went down, users were unable to login to an RDP Server and getting error message, "Local security policy cannot be contacted". Does this mean the second DC is not working fine. Both DCs have the same roles installed.

Thanks.

Hi All,

I have been asked quite a few questions about our infrastructure and in particular ADFS (Active Directory Federation Services). I have no idea as I don't have anything to do with Federated Services. I don't even know if it is set up in our Domain. I basically need to find out if we have Federation Services installed. Would anyone have any advice on how to check if we even have Federation Services installed on our Domain.

Any information would be greatly received.

Regards.

In my domain local users can fetch users, groups and OU information by using net user or net group commands. I want to restrict local users by accessing such information by active directory. From where in AD I can set such settings?

Hi 

I have total 3 DCs in my organization. DC1 and DC2 are located on Site A where as DC3 on Site B.

Now Sysvol is in inconsistent state on DC1 and DC2 but its fine on DC3.

Can i do authoritative sync from DC3 on Site B to DC1 and DC2?

what will be best practices. just for info. all fsmo rols are on DC1.

I would be thankful for help.

also DC1 and DC2 give error 

The DFS Replication service detected invalid msDFSR-Subscriber object data while polling for configuration information.

Regards

Hi,

Do we still need to have a conditional forwarders between two domain having a forest level trust over internet connected with ipsec vpn tunnel. If not then how to configure the DNS properly to let both the domains resolve DNS names of each other properly?

Thanks.

Hello,
I have a software that uses DNS and reverse DNS of company domain to work properly.
At the moment, in the company, there are two domain controllers.
Both of them has got AD, DHCP and DNS services.

I would improve, if it is possible DNS replication time between these two domain controllers.
These two DC are in the same VLAN and in the same site.

How can I check it?
Is it possibile decrease DNS replication time?
How can I check if all, about DNS, work properly?

Thanks so much!

Federico

Why does the domain controller change its own "whenchanged" attribute ?

Are these changed periodically by the domain controller itself ?

What are the causes changes in the attribute ?

Recently one of our AD LDAP connected applications stopped authenticating users .While they asked if there was any change done at the DC ,WE said No change ..but then they came out with a LDAP screen shot shows the Domain controller had some changes ..they showed the "whenchanged" attribute of the domain controller which coincided with LDAP authentication issue which they faced on their Application

Can I know the domain controller by itself changes this value ..does installation of patch change this attribute?

---

Shiva

Hello, I'm using Active Directory on Windows server 2016, other application in my company which works on linux, is connected to my DC. Sometimes this application couldn't synchronize users from my DC. I want to proof that problem isn't on my side, I can't find any event logs related to this problem. I need monitoring software to show them logs, please any advice. Thanks

---

Shota Tadumadze

Dears,

We have several locations in our organization that are divided into groups at AAD.Each group has a license assigned that is automatically assigned to members of this group.I would like to limit the number of members of individual groups so as not to exceed the number of licenses intended for the group.Unfortunately, I don't see this option anywhere in Azure. Groups are synchronized to the AAD from our local AD in which it is also not possible to set the number of members of a particular group other than the default.

Do you have any idea how to do this? No matter in AD or AAD.                                                          I will be very grateful for all the subordinates.

LDAP channel binding in Java, what is the eqvivalent parameter to send in order to match the Windows server configuration?

If the server is configured with 'LdapEnforceChannelBinding = 1 (When Supported) or 2 (Always)

I've configured the 'java.naming.security.authentication' as 'strong' but the authentication fails.

If I send 'java.naming.security.authentication' as 'simple', the authentication succeeds even if the server was configured

with 'LdapEnforceChannelBinding = 1 (When Supported) or 2 (Always)

https://support.microsoft.com/en-us/help/4520412/2020-ldap-channel-binding-and-ldap-signing-requirements-for-windows

Hello

I've an Active Directory forest with a parent domain (example.intranet) and a child domain (labs.example.intranet). In DNS zone of example.intranet there is a zone delegation for labs.example.intranet, this zone delegation has three NS resources (the child domain has 3 domain controllers), as far as I know when a client of the parent NS asks them for a resocurce in labs.example.intranet, the parent NS will return the client the list of NS available for child zone. In Active Directory Sites and Services each child domain domain controller it's associated to a specified network. But I've the following doubt: when a DNS client asks to the parent domain NS for a resoruce in the child domain: in what order are returned the three NS of child domain defined in the zone delegation and what NS will be used the first? Are Active Directory Sites and Subnets relevant for this NS order? Is there any way to force what NS is returned first? Is it random or depends of the subnet location of the client? And, if the firts NS returned can't answer to the client, Will the client use the next NS until it gets an answer?

Thanks in advance

Hi,

Few weeks before we migrated our 3 DC's from 2008 R2 to 2016 currently both Forest & Domain functional lever is Windows Server 2008R2, everything seems to be fine but when generated AD Active Health report shows the following error message in all 3 DC's

1. Sysvol mode is not DFS-R

2. Advertising failed, consider running: dcdiag.exe /test:Advertising

3. DNS failed, consider running: dcdiag.exe /test:DNS

4. VerifyEnterpriseReferences failed, consider running: dcdiag.exe /test:verifyEnterpriseReference.

When executing the dcdiag receive with the following result, kindly advise further!

C:\Windows\system32>dcdiag.exe

Directory Server Diagnosis

Performing initial setup:
   Trying to find home server...
   Home Server = DC1
   * Identified AD Forest.
   Done gathering initial info.

Doing initial required tests

   Testing server: Default-First-Site-Name\DC1
      Starting test: Connectivity
         ......................... DC1 passed test Connectivity

Doing primary tests

   Testing server: Default-First-Site-Name\DC1
      Starting test: Advertising
         ......................... DC1 passed test Advertising
      Starting test: FrsEvent
         There are warning or error events within the last 24 hours after the SYSVOL has been shared.  Failing SYSVOL
         replication problems may cause Group Policy problems.
         ......................... DC1 passed test FrsEvent
      Starting test: DFSREvent
         ......................... DC1 passed test DFSREvent
      Starting test: SysVolCheck
         ......................... DC1 passed test SysVolCheck
      Starting test: KccEvent
         ......................... DC1 passed test KccEvent
      Starting test: KnowsOfRoleHolders
         ......................... DC1 passed test KnowsOfRoleHolders
      Starting test: MachineAccount
         ......................... DC1 passed test MachineAccount
      Starting test: NCSecDesc
         ......................... DC1 passed test NCSecDesc
      Starting test: NetLogons
         ......................... DC1 passed test NetLogons
      Starting test: ObjectsReplicated
         ......................... DC1 passed test ObjectsReplicated
      Starting test: Replications
         ......................... DC1 passed test Replications
      Starting test: RidManager
         ......................... DC1 passed test RidManager
      Starting test: Services
         ......................... DC1 passed test Services
      Starting test: SystemLog
         An error event occurred.  EventID: 0x00002720
            Time Generated: 07/06/2020   14:29:48
            Event String:
            The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
         An error event occurred.  EventID: 0x00002720
            Time Generated: 07/06/2020   14:30:31
            Event String:
            The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
         An error event occurred.  EventID: 0x00002720
            Time Generated: 07/06/2020   14:31:18
            Event String:
            The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
         ......................... DC1 failed test SystemLog
      Starting test: VerifyReferences
         ......................... DC1 passed test VerifyReferences


   Running partition tests on : DomainDnsZones
      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test CrossRefValidation

   Running partition tests on : ForestDnsZones
      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test CrossRefValidation

   Running partition tests on : Schema
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation

   Running partition tests on : Configuration
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation

   Running partition tests on : ***********
      Starting test: CheckSDRefDom
         ......................... *********** passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... *********** passed test CrossRefValidation

   Running enterprise tests on : ***********.com
      Starting test: LocatorCheck
         ......................... ***********.com passed test LocatorCheck
      Starting test: Intersite
         ......................... ***********.com passed test Intersite

C:\Windows\system32>

Thanks in advance

dear all,

can its possible i am able to make bulk Activer directory users (1400 users) csv format import through

win 2012 server

any powershell or other option through 

Hello,

My computer is automatically restarting, when I consulted the event viewer, the error was as follows:

"A critical system process, C: \ WINDOWS \ system32 \ lsass.exe, failed with status code c0000005. The machine must now be restarted."

I'm unable to find any documentation confirming that Server 2016 (or 2008R2, 2012, & 2019) uses an algorithm other than MD4 (NTLM) to hash passwords stored in Active Directory. Here is an article targeted at 2008 R2 which confirms this:

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/hh994558(v=ws.10)

MD4 is now considered insecure and recommended to not be used for passwords.

Is this true that Microsoft uses the MD4 (insecure) hashing algorithm for passwords stored in the Active Directory database? If so, why would they do this? If not, does anyone have documentation stating what they do use?

Thanks

Hello All,

we have environment , which has only one win2012 R2 DC , now we are not able to create any user object getting below error

windows cannot create the object xxxxx because the directory server has exhausted the pool of relative identifer

when we netdom query fsmo - below error

The specified domain either does not exist or could not be contacted.

The command failed to complete successfully

i am able to login to the server 

Please advise.

regards

Aamir Masthan

---

NA

When I try to join a fully-updated Win10Pro workstation to a newly installed Windows Server 2016 Standard (hostname "wisdom") with a newly configured domain (configured according to this tutorial: https://blogs.technet.microsoft.com/canitpro/2017/02/22/step-by-step-setting-up-active-directory-in-windows-server-2016/ ), I am prompted for the credentials of a domain administrative user at the domain controller (as I expect), and I'm certain that I'm typing in these credentials correctly, but after I submit these credentials, I get the following error message which reads in part:

=:=:=:=:=:=:=:=:=:=:

The following error occurred when DNS was queried for the service location (SRV) resource record used to locate an Active Directory Domain Controller (AD DC) for domain "osteoboon.lan":

The error was: "DNS name does not exist."

(error code 0x0000232B RCODE_NAME_ERROR)

The query was for the SRV record for _ldap._tcp.dc._msdcs.osteoboon.lan

Common causes of this error include the following:

- The DNS SRV records required to locate a AD DC for the domain are not registered in DNS. These records are registered with a DNS server automatically when a AD DC is added to a domain. They are updated by the AD DC at set intervals. This computer is configured to use DNS servers with the following IP addresses:

10.69.169.4 [this is the correct LAN IPv4 address of my AD DC]

-One or more of the following zones do not include delegation to its child zone:

osteoboon.lan
lan
. (the root zone)

=:=:=:=:=:=:=:=:=:=:

I realize of course that the TLD ".lan" does not exist (I chose it for that very reason, similar to how the reserved ".local" TLD is often used for LAN domain names, but at https://en.wikipedia.org/wiki/.local#Microsoft_recommendations I read recommendations against using ".local" for this purpose because there are non-Microsoft machines on my network that probably use zeroconf), and when I created the domain on the DC (hostname "wisdom"), I read the following: "A delegation for this DNS server cannot be created because the authoritative parent zone cannot be found or it does not run Windows DNS server. If you are integrating with an existing DNS infrastructure, you should manually create a delegation to this DNS server in the parent zone to ensure reliable name resolution from outside the domain "osteoboon.lan". Otherwise, no action is required."

And I am NOT "...integrating with an existing DNS infrastructure...", so I initially thought I could get by with the "no action is required." message. But because of the subject error message "An AD DC for the domain "osteoboon.lan" could not be contacted.", it now seems to me that I do need to do something different with this DC. But I'm not sure what to do.

From the workstation attempting to join the domain, I have successfully pinged the following:

ping wisdom

And I see 4 lines beginning with the following as expected:

Reply from ...

I think this uses the DC's NetBIOS name and although it takes 10 seconds for the lookup to occur before the replies from the addresses of the DC show up on the command line, they do return.

But when I attempt to ping wisdom.osteoboon.lan, I immediately see the following error message: "Ping request could not find host wisdom.osteoboon.lan. Please check the name and try again."

On the DC itself, when I issue the following command in the PowerShell, I get the subsequent output:

PS C:\Users\Administrator> dcdiag /v

Directory Server Diagnosis

Performing initial setup:
   Trying to find home server...
   * Verifying that the local machine wisdom, is a Directory Server.
   Home Server = wisdom
   * Connecting to directory service on server wisdom.
   * Identified AD Forest.
   Collecting AD specific global data
   * Collecting site info.
   Calling ldap_search_init_page(hld,CN=Sites,CN=Configuration,DC=osteoboon,DC=lan,LDAP_SCOPE_SUBTREE,(objectCategory=ntD
SSiteSettings),.......
   The previous call succeeded
   Iterating through the sites
   Looking at base site object: CN=NTDS Site Settings,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=osteoboon,D
C=lan
   Getting ISTG and options for the site
   * Identifying all servers.
   Calling ldap_search_init_page(hld,CN=Sites,CN=Configuration,DC=osteoboon,DC=lan,LDAP_SCOPE_SUBTREE,(objectClass=ntDSDs
a),.......
   The previous call succeeded....
   The previous call succeeded
   Iterating through the list of servers
   Getting information for the server CN=NTDS Settings,CN=WISDOM,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Confi
guration,DC=osteoboon,DC=lan
   objectGuid obtained
   InvocationID obtained
   dnsHostname obtained
   site info obtained
   All the info for the server collected
   * Identifying all NC cross-refs.
   * Found 1 DC(s). Testing 1 of them.
   Done gathering initial info.

Doing initial required tests

   Testing server: Default-First-Site-Name\WISDOM
      Starting test: Connectivity
         * Active Directory LDAP Services Check
         Determining IP4 connectivity
         Determining IP6 connectivity
         * Active Directory RPC Services Check
         ......................... WISDOM passed test Connectivity

Doing primary tests

   Testing server: Default-First-Site-Name\WISDOM
      Starting test: Advertising
         The DC WISDOM is advertising itself as a DC and having a DS.
         The DC WISDOM is advertising as an LDAP server
         The DC WISDOM is advertising as having a writeable directory
         The DC WISDOM is advertising as a Key Distribution Center
         The DC WISDOM is advertising as a time server
         The DS WISDOM is advertising as a GC.
         ......................... WISDOM passed test Advertising
      Test omitted by user request: CheckSecurityError
      Test omitted by user request: CutoffServers
      Starting test: FrsEvent
         * The File Replication Service Event log test
         Skip the test because the server is running DFSR.
         ......................... WISDOM passed test FrsEvent
      Starting test: DFSREvent
         The DFS Replication Event Log.
         There are warning or error events within the last 24 hours after the SYSVOL has been shared.  Failing SYSVOL
         replication problems may cause Group Policy problems.
         An error event occurred.  EventID: 0xC00004B2
            Time Generated: 03/31/2018   18:14:44
            Event String:
            The DFS Replication service failed to contact domain controller  to access configuration information. Replic
ation is stopped. The service will try again during the next configuration polling cycle, which will occur in 60 minutes
. This event can be caused by TCP/IP connectivity, firewall, Active Directory Domain Services, or DNS issues.

            Additional Information:
            Error: 1355 (The specified domain either does not exist or could not be contacted.)
         An error event occurred.  EventID: 0xC00004B2
            Time Generated: 03/31/2018   18:51:20
            Event String:
            The DFS Replication service failed to contact domain controller  to access configuration information. Replic
ation is stopped. The service will try again during the next configuration polling cycle, which will occur in 60 minutes
. This event can be caused by TCP/IP connectivity, firewall, Active Directory Domain Services, or DNS issues.

            Additional Information:
            Error: 160 (One or more arguments are not correct.)
         A warning event occurred.  EventID: 0x80001780
            Time Generated: 03/31/2018   18:56:21
            Event String:
            The DFS Replication service failed to update configuration in Active Directory Domain Services. The service
will retry this operation periodically.

            Additional Information:
            Object Category: msDFSR-LocalSettings
            Object DN: CN=DFSR-LocalSettings,CN=WISDOM,OU=Domain Controllers,DC=osteoboon,DC=lan
            Error: 1355 (The specified domain either does not exist or could not be contacted.)
            Domain Controller:
            Polling Cycle: 60
         ......................... WISDOM failed test DFSREvent
      Starting test: SysVolCheck
         * The File Replication Service SYSVOL ready test
         File Replication Service's SYSVOL is ready
         ......................... WISDOM passed test SysVolCheck
      Starting test: KccEvent
         * The KCC Event log test
         Found no KCC errors in "Directory Service" Event log in the last 15 minutes.
         ......................... WISDOM passed test KccEvent
      Starting test: KnowsOfRoleHolders
         Role Schema Owner = CN=NTDS Settings,CN=WISDOM,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,
DC=osteoboon,DC=lan
         Role Domain Owner = CN=NTDS Settings,CN=WISDOM,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,
DC=osteoboon,DC=lan
         Role PDC Owner = CN=NTDS Settings,CN=WISDOM,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=
osteoboon,DC=lan
         Role Rid Owner = CN=NTDS Settings,CN=WISDOM,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=
osteoboon,DC=lan
         Role Infrastructure Update Owner = CN=NTDS Settings,CN=WISDOM,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN
=Configuration,DC=osteoboon,DC=lan
         ......................... WISDOM passed test KnowsOfRoleHolders
      Starting test: MachineAccount
         Checking machine account for DC WISDOM on DC WISDOM.
         * SPN found :LDAP/wisdom.osteoboon.lan/osteoboon.lan
         * SPN found :LDAP/wisdom.osteoboon.lan
         * SPN found :LDAP/WISDOM
         * SPN found :LDAP/wisdom.osteoboon.lan/OSTEOBOON
         * SPN found :LDAP/bd6d48a1-a374-4670-aac4-e9098a9a3224._msdcs.osteoboon.lan
         * SPN found :E3514235-4B06-11D1-AB04-00C04FC2DCD2/bd6d48a1-a374-4670-aac4-e9098a9a3224/osteoboon.lan
         * SPN found :HOST/wisdom.osteoboon.lan/osteoboon.lan
         * SPN found :HOST/wisdom.osteoboon.lan
         * SPN found :HOST/WISDOM
         * SPN found :HOST/wisdom.osteoboon.lan/OSTEOBOON
         * SPN found :GC/wisdom.osteoboon.lan/osteoboon.lan
         ......................... WISDOM passed test MachineAccount
      Starting test: NCSecDesc
         * Security Permissions check for all NC's on DC WISDOM.
         * Security Permissions Check for
           DC=ForestDnsZones,DC=osteoboon,DC=lan
            (NDNC,Version 3)
         * Security Permissions Check for
           DC=DomainDnsZones,DC=osteoboon,DC=lan
            (NDNC,Version 3)
         * Security Permissions Check for
           CN=Schema,CN=Configuration,DC=osteoboon,DC=lan
            (Schema,Version 3)
         * Security Permissions Check for
           CN=Configuration,DC=osteoboon,DC=lan
            (Configuration,Version 3)
         * Security Permissions Check for
           DC=osteoboon,DC=lan
            (Domain,Version 3)
         ......................... WISDOM passed test NCSecDesc
      Starting test: NetLogons
         * Network Logons Privileges Check
         Verified share \\WISDOM\netlogon
         Verified share \\WISDOM\sysvol
         ......................... WISDOM passed test NetLogons
      Starting test: ObjectsReplicated
         WISDOM is in domain DC=osteoboon,DC=lan
         Checking for CN=WISDOM,OU=Domain Controllers,DC=osteoboon,DC=lan in domain DC=osteoboon,DC=lan on 1 servers
            Object is up-to-date on all servers.
         Checking for CN=NTDS Settings,CN=WISDOM,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=asci
olla,DC=lan in domain CN=Configuration,DC=osteoboon,DC=lan on 1 servers
            Object is up-to-date on all servers.
         ......................... WISDOM passed test ObjectsReplicated
      Test omitted by user request: OutboundSecureChannels
      Starting test: Replications
         * Replications Check
         * Replication Latency Check
         ......................... WISDOM passed test Replications
      Starting test: RidManager
         * Available RID Pool for the Domain is 1602 to 1073741823
         * wisdom.osteoboon.lan is the RID Master
         * DsBind with RID Master was successful
         * rIDAllocationPool is 1102 to 1601
         * rIDPreviousAllocationPool is 1102 to 1601
         * rIDNextRID: 1116
         ......................... WISDOM passed test RidManager
      Starting test: Services
         * Checking Service: EventSystem
         * Checking Service: RpcSs
         * Checking Service: NTDS
         * Checking Service: DnsCache
         * Checking Service: DFSR
         * Checking Service: IsmServ
         * Checking Service: kdc
         * Checking Service: SamSs
         * Checking Service: LanmanServer
         * Checking Service: LanmanWorkstation
         * Checking Service: w32time
         * Checking Service: NETLOGON
         ......................... WISDOM passed test Services
      Starting test: SystemLog
         * The System Event log test
         An error event occurred.  EventID: 0x00002720
            Time Generated: 03/31/2018   20:21:10
            Event String:
            The application-specific permission settings do not grant Local Activation permission for the COM Server app
lication with CLSID
            {D63B10C5-BB46-4990-A94F-E40B9D520160}
             and APPID
            {9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
             to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the applicati
on container Unavailable SID (Unavailable). This security permission can be modified using the Component Services admini
strative tool.
         ......................... WISDOM failed test SystemLog
      Test omitted by user request: Topology
      Test omitted by user request: VerifyEnterpriseReferences
      Starting test: VerifyReferences
         The system object reference (serverReference) CN=WISDOM,OU=Domain Controllers,DC=osteoboon,DC=lan and backlink
         on CN=WISDOM,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=osteoboon,DC=lan are correct.
         The system object reference (serverReferenceBL)
         CN=WISDOM,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=osteoboon,DC=lan and backlink
         on
         CN=NTDS Settings,CN=WISDOM,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=osteoboon,DC=lan
         are correct.
         The system object reference (msDFSR-ComputerReferenceBL)
         CN=WISDOM,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=osteoboon,DC=lan and backlink
         on CN=WISDOM,OU=Domain Controllers,DC=osteoboon,DC=lan are correct.
         ......................... WISDOM passed test VerifyReferences
      Test omitted by user request: VerifyReplicas

      Test omitted by user request: DNS
      Test omitted by user request: DNS

   Running partition tests on : ForestDnsZones
      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test CrossRefValidation

   Running partition tests on : DomainDnsZones
      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test CrossRefValidation

   Running partition tests on : Schema
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation

   Running partition tests on : Configuration
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation

   Running partition tests on : osteoboon
      Starting test: CheckSDRefDom
         ......................... osteoboon passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... osteoboon passed test CrossRefValidation

   Running enterprise tests on : osteoboon.lan
      Test omitted by user request: DNS
      Test omitted by user request: DNS
      Starting test: LocatorCheck
         GC Name: \\wisdom.osteoboon.lan
         Locator Flags: 0xe001f3fd
         PDC Name: \\wisdom.osteoboon.lan
         Locator Flags: 0xe001f3fd
         Time Server Name: \\wisdom.osteoboon.lan
         Locator Flags: 0xe001f3fd
         Preferred Time Server Name: \\wisdom.osteoboon.lan
         Locator Flags: 0xe001f3fd
         KDC Name: \\wisdom.osteoboon.lan
         Locator Flags: 0xe001f3fd
         ......................... osteoboon.lan passed test LocatorCheck
      Starting test: Intersite
         Skipping site Default-First-Site-Name, this site is outside the scope provided by the command line arguments
         provided.
         ......................... osteoboon.lan passed test Intersite
PS C:\Users\Administrator>


So my question is, how do I fix this? I need to be able to join 10 or so workstations to this DC within the next 24 hours or else Monday will be a very bad day for a lot of people (and therefore, for me too).

Any thoughts?

Thank you!

Best,
Os

Server12R2 DC with Single CA in AD that has expiration date in November, installed in 2010.

Planning to run   All Tasks | Renew CA Certificate  to update it. no pending requests, all issued certs in all panes have expired... I'm concerned that updating certificate will muck something up with AD. Should i just go ahead and renew it, or is there a way to test first if anything is using it? Generated two certs against the CA and they both terminate at the end date of the CA's cert. When i do renew, the soon to expire one is still active correct, until it expires?

Hello All,

i need some advise here, we are currently have win2012 r2 dc, and planning to upgrade to win 2019 DC.

Please let us know if we have to extend the schema or just get new server with 2019 OS and promote it?

regards

Aamir Masthan

---

NA