AD Sites Question

April 27, 2014, 8:20 am

≫ Next: Can not we seize Shema FSMO role? isn't it recommended?

≪ Previous: how to set password after checking password history using vbscript?

$

0

0

Hey Guys!

was reviewing AD infra and struggling with a question

A single AD forest , single Domain configured across 3 sites Manhattan ( hub site ) , Newark ( spoke )  , Brooklyn ( spoke ).
I have disabled BASL and manually configured Site Links

Manhattan - Newark

Manhattan - Brooklyn

No connectivity between Newark and Brooklyn.

There are no multiple routes among any 3 sites , so I hope the AD site Cost doesn't come into play( selects mandatory route )

Subnets:

Manhattan has 3 subnets and 1 DC

Newark has 3 subnets and 1 DC

Brooklyn has 1 subnet and 1 DC

DNS Conf:

Manhattan clients Primary DNS : its DC

Manhattan clients secondary DNS : to Newark

Newark clients Primary DNS : its DC

Newark clients secondary DNS : to Manhattan

Brooklyn clients Primary DNS : its DC

Brooklyn clients secondary DNS : to Manhattan

All the DNS Servers replicate at forest level and DNS is configured as part of DC

If my Newark DC dies , will the clients communicate / Authenticate with Manhattan DC ? , please correct my below explanation :)

Eg:

1)  when Newark client logon --> Netlogon queries primary DNS for 15 seconds and doesn't get a response, switch over to secondary DNS

Question : Does AD DNS registers all AD Sites-Subnets in a domain ?

2) Secondary DNS picks the request , parse through the sites and provides client with list of all Domain controllers (from all sites )

3) client pings ( datagram ) all the domain controllers from the obtained list and every domain controller respond back to the datagram

4) first domain controller to respond will be prioritized

5) client starts communicating with the DC

In my scenario , can I assume Step4 to be Manhattan DC will respond first to the netlogon client request ?

Second Question:

In the even of DC down at Newark , how can I point my clients to authenticate with Brooklyn  DC  ( provided there is a site link between Brooklyn and Newark ? rather reaching to Manhattan

a) Pointing Newark client's secondary DNS to Brooklyn DC ?

b) configure Brooklyn DC SrV record weight and priority equal to Newark DC ?

---

Can not we seize Shema FSMO role? isn't it recommended?

April 25, 2014, 1:25 am

≫ Next: Server 2012 R2 Domain Controllers stop accepting log in and replication failure.

≪ Previous: AD Sites Question

$

0

0

Can not we seize Shema FSMO role? isn't it  recommended?

Server 2012 R2 Domain Controllers stop accepting log in and replication failure.

April 27, 2014, 12:39 pm

≫ Next: Active Requestor over Web Application Proxy and ADFS 3.0 (Windows 2012 R2)

≪ Previous: Can not we seize Shema FSMO role? isn't it recommended?

$

0

0

We have recently completed a Domain upgrade to 2012 R2 AD DS from native 2003 AD. The issue we are experiencing is that for seemingly no reason the 2012 hosts will randomly stop accepting (RDP) logins and we see replication failures. We also cannot otherwise remotely manage the host (remote service management etc...). The only way I've been able to recover from this condition is to restart the affected host, after which (RDP) logins are again accepted and successful replication starts again. Logs aren't showing any issues prior to the issue happening and it is not specific to one host. I have been digging around to find a solution to this abnormal behavior but as yet haven't come across anything specific to what I am seeing.

Domain level is 2008 R2 and our few remaining 2008 R2 hosts never experience this. Only seems to be the 2012 hosts and randomly among all the DCs. Not one specific 2012 host is affected.

We have 20 DCs total.

Are there any known issues? Any advice on what I may be able to look at?

We are otherwise healthy aside from this intermittent replication/login issue.

Active Requestor over Web Application Proxy and ADFS 3.0 (Windows 2012 R2)

April 28, 2014, 5:34 am

≫ Next: Active Directory System Time is decreasing automatically

≪ Previous: Server 2012 R2 Domain Controllers stop accepting log in and replication failure.

$

0

0

Hi,

Is it possible to preauthenticate and authenticate with the active requestor profile (ws-federation) over WAP and ADFS? And/Or can you do it with SAML 2.0? Is there an example application?

Thank you for your help!

Cheers

Active Directory System Time is decreasing automatically

April 25, 2014, 7:28 am

≫ Next: Updating the Active Directory Schema

≪ Previous: Active Requestor over Web Application Proxy and ADFS 3.0 (Windows 2012 R2)

$

0

0

Hi,

I have 4 DC. 3 DC in My main office, one is primary and rest of the DC is Additional and other one is remote location, that also additional domain. all are synch together right now I am getting Time issue. when i have change the correct time in my DC, its decreasing automatically. 

Can you please advice How it was happen and what is solution to fix this ?

Updating the Active Directory Schema

April 10, 2014, 1:35 am

≫ Next: Change primary SMTP address using powershell for AD NOT Exchange

≪ Previous: Active Directory System Time is decreasing automatically

$

0

0

Good morning all,

I have been tasked with updating our Active Directory Schema version. Currently our version is "47" which is Server 2008 R2 and I am going to be updating to either 56 or 59 (Server 2012 or R2 depending on licensing). We aren't updating the OS - just the schema.

Is there some guides out there that I should look at before performing this.

1. I understand that the only backup plan I will have is to perform a full forest recovery is there a guide out there to do this?

2. Is there a specific guide I should be following when it comes to the schema master and upgrading it? 

3. Is there a specific server that I should be performing the upgrade on as we have several domain controllers.

Any other additional information would be brilliant.

Regards, 

Change primary SMTP address using powershell for AD NOT Exchange

December 3, 2013, 6:39 am

≫ Next: Trust relationship error on PDC

≪ Previous: Updating the Active Directory Schema

$

0

0

I am in a Office 365 Hybrid mode, this question has been asked on the Office 365 forums and I was directed here.

Using PowerShell for Exchange 2007+ its a fairly simple process to change the primary SMTP.

Using a PowerShell script with a couple simple variables this is what I would use for Exchange:

Set-MailBox "$getUsername" -EmailAddressPolicyEnabled $false -PrimarySmtpAddress $getSMTP

Is there any equivalent or something similar to this for AD PowerShell?

Trust relationship error on PDC

April 7, 2014, 2:09 pm

≫ Next: DFS replication errors in Windows Server 2008 R2 AD

≪ Previous: Change primary SMTP address using powershell for AD NOT Exchange

$

0

0

Hello,

We are getting the error "The security database on the server does not have a computer account for this workstation trust relationship" on our main domain controller.  We have a primary domain controller and also a second domain controller on one domain.  We are unable to logon to the PDC when this is happening and have to do a hard reboot to get it back up.  At the same time our VPN does not roll over to the BDC so we are unable to logon at the time of the error.

We are receiving 5722, 5805 in reference to the BDC on the PDC and we are getting 5783 (in reference to the PDC) and 5719 on the BDC.  We are also getting 7 on the PDC as well mentioning the security account manager failed a KDC request. 

I've been jumping all over the net to find a solution, but it seems they are all in regards to workstations or other servers with the trust relationship error and nothing in regards to this error on a PDC. 

Any help will be greatly appreciated!

---

DFS replication errors in Windows Server 2008 R2 AD

April 28, 2014, 9:07 am

≫ Next: why normally we choose dot local extension for domain name

≪ Previous: Trust relationship error on PDC

$

0

0

Hello Everyone, below is the issue I encountered,

There are 4 domain controllers in the same domain, all running Windows Server 2008 R2 Standard, SP1.

Events with ID 2104 and 2212 appear once per hour on DC01, as follows.

Log Name: DFS Replication
Source: DFSR
Event ID: 2104
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: <computer name>
Description:
The DFS Replication service failed to recover from an internal database error on volume <drive letter>:. Replication has been stopped for all replicated folders on this volume.

Additional Information:
Error: 9214 (Internal database error (-1605))
Volume: <GUID>
Database: <drive letter>:\System Volume Information\DFSR

Log Name: DFS Replication
Source: DFSR
Event ID: 2212
Task Category: None
Level: Warning
Keywords: Classic
User: N/A
Computer: <computer name>
Description:
The DFS Replication service has detected an unexpected shutdown on volume <drive letter>:. This can occur if the service terminated abnormally (due to a power loss, for example) or an error occurred on the volume. The service has automatically initiated a recovery process. The service will rebuild the database if it determines it cannot reliably recover. No user action is required.

Additional Information:
Volume: <drive letter>
GUID: <GUID>

On DC02, below error event appear every 5 minutes,

Log Name: System
Source: GroupPolicy
Event ID: 1058
Task Category: None
Level: Error
Keywords: Classic
User: COMPANYDOMAINNAME\USER01
Computer: <computer name>
Description:
The processing of Group Policy failed. Windows attempted to read the file \\COMPANYDOMAINNAME\SysVol\COMPANYDOMAINNAME\Policies\{8B6EB647-E111-4166-8171-1F638C3B288C}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
a) Name Resolution/Network Connectivity to the current domain controller.
b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller).
c) The Distributed File System (DFS) client has been disabled.

There is no error appear on the remaining two DCs, which are located in another network seperated by a firewall from DC01 & DC02.

I've tried the workround steps in http://support.microsoft.com/kb/979295 on DC01, but I got stucked at step 1.
Because the only "gvsn" I could find in the latest DFSR debug log is as follow,
20140428 14:39:18.892 6400 VLMG  6753 VolumeManager::RefreshIdRecords LDB Updating ID Record:
+    fid                             0x20000000116AD
+    usn                             0x56e7548
{output omitted for brevity}
+    data                            0
+    gvsn                            {A0620116-5A87-4276-BEAF-0EF4F405F22A}-v84
+    uid                             {A0620116-5A87-4276-BEAF-0EF4F405F22A}-v11
+    parent                          {D5CC7E58-5D76-4545-83F7-6786966B875D}-v1
{output omitted for brevity}
+    csId                            {D5CC7E58-5D76-4545-83F7-6786966B875D}
+    hash                            C1E13422-778425E8-A74A342B-CFF6CAAE
+    similarity                      00000000-00000000-00000000-00000000
+    name                            Policies

and when I put it in below command:
DFSRDIAG.EXE GUID2NAME /rgname:"domain system volume" /guid:{A0620116-5A87-4276-BEAF-0EF4F405F22A}
I got below output:
Cannot find any reference to GUID <a0620116-5a87-4276-beaf-0ef4f405f22a> in replication group <domain system volume> scope
Operation Succeeded

I haven't applied the hotfix in kb979247 yet which is because the symptoms are different from mine.
I only installed IE9 and its mostly recently cumulative update(KB2925418) on DC01 and DC02 before this issue ocurred.

Any thoughts? Thanks in advance!

---

fight

why normally we choose dot local extension for domain name

April 11, 2014, 2:16 am

≫ Next: adfs 2.1 - page not displayed

≪ Previous: DFS replication errors in Windows Server 2008 R2 AD

$

0

0

hi....i have one question about choosing the domain name mostly we choose .local extension for the domain why is so whats happen if we choose .com or any other top level domain extension.......2nd part of the question........

i have joined the domain its ok working my domain controller is my dns server as well now form the client computer when i open the google  it works my question is this ....how the query of google.com is resolved as i have a local dns server and in forward zone its not mentioned what is ip address of google.....is it automatically referred to any other dns server or how its worksss.......??

Thanks

adfs 2.1 - page not displayed

April 28, 2014, 8:55 am

≫ Next: DNS 4004 and 4015 events

≪ Previous: why normally we choose dot local extension for domain name

$

0

0

I have ADFS 2.1 setup and was working. I have put a new SSL and token-signing certs on and now am unable to get to the idpinitiatedsignon page. I don't get any errors in the log at all. The return from the server is "ERR_CONENCTION_REST". I get this same behaviour while going directly to the ADFS server even from its self. Because there is no errors being logged I don't know how to fix this issue or even where to start looking.

DNS 4004 and 4015 events

April 21, 2014, 9:48 am

≫ Next: how can provide access only Taskbar and auto-hide option to user

≪ Previous: adfs 2.1 - page not displayed

$

0

0

Hello,

I am on a SBS 2011 system, and I am not an expert on server management. Before this server people where on a 2003 server. I have try to make during the periode of change speaking the 2 servers eatch other.

I have seen that I got a DNS 4004 and 4015 events.   And by reading topic on the web, I didn't find a way to clear this situation (and maybe making wrong things and make it worst).

On my DNS server, on direct zone,  i have all the tree _msdcs, but the primary zone link to the AD  myserver.local is close (it is this zone that get problema). The revers zone look like ok.

On DCDIAG the first connectivity test failed.  Test of serveur not done, partition test all ok.

When starting nsllokup, the default server is unknow.

Could you kindly give and help this point ? And what can I do to give you all information to allow a good analyse.  (Ps: serveur is in french)

Thanks in advance

how can provide access only Taskbar and auto-hide option to user

April 28, 2014, 10:31 am

≫ Next: AD Domain Trust Assessment Examples/Documentation

≪ Previous: DNS 4004 and 4015 events

$

0

0

Hi

I have requirement to provide access only Taskbar and auto-hide option to user through GPO.

But I have GPO which is already "Prevent Changes to Taskbar and Start Menu Settings".

How can I make changes through registry and any other way to allow users only Taskbar and auto hide option.

Please suggest or guide.

AD Domain Trust Assessment Examples/Documentation

April 28, 2014, 10:52 am

≫ Next: Can't Remove Old Exchange Server

≪ Previous: how can provide access only Taskbar and auto-hide option to user

$

0

0

Hello

Does one have a case study or example of documentation used to do a AD assessment for a Domain Trust? I would like to provide info regarding sites. 

Thank you so much

Can't Remove Old Exchange Server

April 23, 2014, 7:00 am

≫ Next: Replication Issue

≪ Previous: AD Domain Trust Assessment Examples/Documentation

$

0

0

While going through ADSI edit, I noticed there is an entry for an old Mail Server object in the Domain Controllers OU. It only appears in ADSIEdit and not under AD Users and Computers and it didn't show under ntdsutil either.

I have full permissions under the domain admin account, but when I try to delete it and I get the error:

Operation Failed. Eror code: 0x5

Access is denied.

00000005: SecErr: DSID-031A121F, problem 4003

(INSUFF_ACCESS_RIGHTS), data 0

I've heard that this can be caused by a former Trust Account that is no longer present. Under that objects properties, under the UserAccountControl attribute is 0x820 = (PASSWD_NOTREQD | INTERDOMAIN_TRUST_ACCOUNT)

and also under sAMAccountType 805306370 = (TRUST_ACCOUNT)

I'm not sure what the best process would be to remove this object. 

I appreciate any thoughts and future assistance!

 

---

Replication Issue

April 28, 2014, 10:23 am

≫ Next: Deleted Trust still coming in Microsoft_DomainTrustStatus query

≪ Previous: Can't Remove Old Exchange Server

$

0

0

We installed a 2012R2 domain controller a couple of months ago, it is not a FSMO holder.  Our FSMO DC's are 2003.  It seems ever since the upgrade when a new 2008 R2 DC is added it pulls replication from CORP, but CORP does not pull it from the remote DC.  Other remote DC's are working, and so is the 2012R2 DC.  Just the recently added are not.  Replication Monitor shows them working correctly.  DCDIAG comes back looking good except for the RODC, which we do not have.  DC DIAG /connection:test is successful.  Repadmin /replsum comes back successful to the DC's it is supposed to.  We do not use the KCC, other sites are restricted via firewall.  All sites are able to communicate with CORP, but not each other.  Hub and spoke.  The dc's in question are creating connections to sites they cannot communicate with.  The older DC's are not exhibiting this behavior.  We have checked the firewall and the AD ports are open both ways. 

Deleted Trust still coming in Microsoft_DomainTrustStatus query

April 25, 2014, 12:38 am

≫ Next: Netlogon Share not avail on Both the DC (Win2012)

≪ Previous: Replication Issue

$

0

0

Hello Guys,

I am facing a strange issue, I have deleted a stale trust from Active directory Domain And Trust and don't see its TDO/Trust accounts in ADSIEDIT, but still the trust name is coming up in the wmi query of "Microsoft_DomainTrustStatus" class. Due to this our monitoring system is generating alert.

From where that class is picking up the trust? How can I clean it?

Thanks in advance!!

Regards..

Himanshu

---

MCTS|MCSE|MCSA:Messaging|CCNA

Netlogon Share not avail on Both the DC (Win2012)

April 28, 2014, 7:46 am

≫ Next: Trying to make computer member of .org internal after creating .local

≪ Previous: Deleted Trust still coming in Microsoft_DomainTrustStatus query

$

0

0

Hi all,

        Both the AD DC's are not showing Net Logon Share.

       Due to some H/w failure of Hyper-V, we restored the Old AD Backup which doesn't show any Net Logon or sysvol share. After following the below article its started showing only Sysvol.

http://www.ms4u.info/2013/07/sysvol-and-netlogon-share-is-missing.html

DCDIAG results here:

************************************************************************************************

         Unable to connect to the NETLOGON share! (\\DC01\netlogon)

         [DC01] An net use or LsaPolicy operation failed with error

         67, The network name cannot be found..

         ......................... DC01 failed test NetLogons

         An error event occurred.  EventID: 0x0000165B

            Time Generated: 04/28/2014   14:12:22

            Event String:

            The session setup from computer 'PUNE-MKG' failed because the security database does not contain a trust account 'PUNE-MKG$' referenced by the specified computer.  


         An error event occurred.  EventID: 0x000016AD

            Time Generated: 04/28/2014   14:14:49

            Event String:

            The session setup from the computer PUNE-MKG failed to authenticate. The following error occurred: 


         An error event occurred.  EventID: 0x0000165B

            Time Generated: 04/28/2014   14:14:54

            Event String:

            The session setup from computer 'ABC123-PC' failed because the security database does not contain a trust account 'ABC123-PC$' referenced by the specified computer.  


         An error event occurred.  EventID: 0x00000448

            Time Generated: 04/28/2014   14:14:56

            Event String:

            The processing of Group Policy failed. Windows could not apply the registry-based policy settings for the Group Policy object LDAP://CN=Machine,cn={31B2F340-016D-11D2-945F-00C04FB984F9},cn=policies,cn=system,DC=ABC,DC=in. Group Policy settings will not be resolved until this event is resolved. View the event details for more information on the file name and path that caused the failure.

         An error event occurred.  EventID: 0x000016AD

            Time Generated: 04/28/2014   14:17:08

            Event String:

            The session setup from the computer ABC123-PC failed to authenticate. The following error occurred: 


         An error event occurred.  EventID: 0x0000165B

            Time Generated: 04/28/2014   14:18:02

            Event String:

            The session setup from computer 'SURESH-PC' failed because the security database does not contain a trust account 'SURESH-PC$' referenced by the specified computer.  


         An error event occurred.  EventID: 0x00000448

            Time Generated: 04/28/2014   14:19:57

            Event String:

            The processing of Group Policy failed. Windows could not apply the registry-based policy settings for the Group Policy object LDAP://CN=Machine,cn={31B2F340-016D-11D2-945F-00C04FB984F9},cn=policies,cn=system,DC=ABC,DC=in. Group Policy settings will not be resolved until this event is resolved. View the event details for more information on the file name and path that caused the failure.

         An error event occurred.  EventID: 0x000016AD

            Time Generated: 04/28/2014   14:20:08

            Event String:

            The session setup from the computer SURESH-PC failed to authenticate. The following error occurred: 


         An error event occurred.  EventID: 0x00000448

            Time Generated: 04/28/2014   14:24:58

            Event String:

            The processing of Group Policy failed. Windows could not apply the registry-based policy settings for the Group Policy object LDAP://CN=Machine,cn={31B2F340-016D-11D2-945F-00C04FB984F9},cn=policies,cn=system,DC=ABC,DC=in. Group Policy settings will not be resolved until this event is resolved. View the event details for more information on the file name and path that caused the failure.

         An error event occurred.  EventID: 0x0000165B

            Time Generated: 04/28/2014   14:26:30

            Event String:

            The session setup from computer 'MARKETING-231L' failed because the security database does not contain a trust account 'MARKETING-231L$' referenced by the specified computer.  


         An error event occurred.  EventID: 0x000016AD

            Time Generated: 04/28/2014   14:28:41

            Event String:

            The session setup from the computer MARKETING-231L failed to authenticate. The following error occurred: 


         An error event occurred.  EventID: 0x0000165B

            Time Generated: 04/28/2014   14:28:49

            Event String:

            The session setup from computer 'SIWAN-DEPOT' failed because the security database does not contain a trust account 'SIWAN-DEPOT$' referenced by the specified computer.  


         An error event occurred.  EventID: 0x00000448

            Time Generated: 04/28/2014   14:29:58

            Event String:

            The processing of Group Policy failed. Windows could not apply the registry-based policy settings for the Group Policy object LDAP://CN=Machine,cn={31B2F340-016D-11D2-945F-00C04FB984F9},cn=policies,cn=system,DC=ABC,DC=in. Group Policy settings will not be resolved until this event is resolved. View the event details for more information on the file name and path that caused the failure.

         An error event occurred.  EventID: 0x000016AD

            Time Generated: 04/28/2014   14:30:55

            Event String:

            The session setup from the computer SIWAN-DEPOT failed to authenticate. The following error occurred: 


         An error event occurred.  EventID: 0x0000165B

            Time Generated: 04/28/2014   14:31:50

            Event String:

            The session setup from computer 'PROJECTS-111' failed because the security database does not contain a trust account 'PROJECTS-111$' referenced by the specified computer.  


         An error event occurred.  EventID: 0x0000165B

            Time Generated: 04/28/2014   14:33:18

            Event String:

            The session setup from computer 'RANCHI-DEPO01' failed because the security database does not contain a trust account 'RANCHI-DEPO01$' referenced by the specified computer.  


         An error event occurred.  EventID: 0x000016AD

            Time Generated: 04/28/2014   14:34:09

            Event String:

            The session setup from the computer PROJECTS-111 failed to authenticate. The following error occurred: 


         An error event occurred.  EventID: 0x00000448

            Time Generated: 04/28/2014   14:34:59

            Event String:

            The processing of Group Policy failed. Windows could not apply the registry-based policy settings for the Group Policy object LDAP://CN=Machine,cn={31B2F340-016D-11D2-945F-00C04FB984F9},cn=policies,cn=system,DC=ABC,DC=in. Group Policy settings will not be resolved until this event is resolved. View the event details for more information on the file name and path that caused the failure.

         An error event occurred.  EventID: 0x000016AD

            Time Generated: 04/28/2014   14:35:54

            Event String:

            The session setup from the computer RANCHI-DEPO01 failed to authenticate. The following error occurred: 


         An error event occurred.  EventID: 0x00000448

            Time Generated: 04/28/2014   14:40:00

            Event String:

            The processing of Group Policy failed. Windows could not apply the registry-based policy settings for the Group Policy object LDAP://CN=Machine,cn={31B2F340-016D-11D2-945F-00C04FB984F9},cn=policies,cn=system,DC=ABC,DC=in. Group Policy settings will not be resolved until this event is resolved. View the event details for more information on the file name and path that caused the failure.

         An error event occurred.  EventID: 0x0000165B

            Time Generated: 04/28/2014   14:42:17

            Event String:

            The session setup from computer 'LKO-MKTG5' failed because the security database does not contain a trust account 'LKO-MKTG5$' referenced by the specified computer.  


         An error event occurred.  EventID: 0x0000165B

            Time Generated: 04/28/2014   14:42:25

            Event String:

            The session setup from computer '010-201' failed because the security database does not contain a trust account '010-201$' referenced by the specified computer.  


         An error event occurred.  EventID: 0x000016AD

            Time Generated: 04/28/2014   14:44:29

            Event String:

            The session setup from the computer LKO-MKTG5 failed to authenticate. The following error occurred: 


         An error event occurred.  EventID: 0x000016AD

            Time Generated: 04/28/2014   14:44:29

            Event String:

            The session setup from the computer 010-201 failed to authenticate. The following error occurred: 


         An error event occurred.  EventID: 0x00000448

            Time Generated: 04/28/2014   14:45:01

            Event String:

            The processing of Group Policy failed. Windows could not apply the registry-based policy settings for the Group Policy object LDAP://CN=Machine,cn={31B2F340-016D-11D2-945F-00C04FB984F9},cn=policies,cn=system,DC=ABC,DC=in. Group Policy settings will not be resolved until this event is resolved. View the event details for more information on the file name and path that caused the failure.

         An error event occurred.  EventID: 0x00000448

            Time Generated: 04/28/2014   14:50:02

            Event String:

            The processing of Group Policy failed. Windows could not apply the registry-based policy settings for the Group Policy object LDAP://CN=Machine,cn={31B2F340-016D-11D2-945F-00C04FB984F9},cn=policies,cn=system,DC=ABC,DC=in. Group Policy settings will not be resolved until this event is resolved. View the event details for more information on the file name and path that caused the failure.

         An error event occurred.  EventID: 0x0000165B

            Time Generated: 04/28/2014   14:51:45

            Event String:

            The session setup from computer 'MKTG-01' failed because the security database does not contain a trust account 'MKTG-01$' referenced by the specified computer.  


         An error event occurred.  EventID: 0x000016AD

            Time Generated: 04/28/2014   14:54:05

            Event String:

            The session setup from the computer MKTG-01 failed to authenticate. The following error occurred: 


         An error event occurred.  EventID: 0x0000165B

            Time Generated: 04/28/2014   14:54:05

            Event String:

            The session setup from computer 'HUBLI' failed because the security database does not contain a trust account 'HUBLI$' referenced by the specified computer.  


         An error event occurred.  EventID: 0x00000448

            Time Generated: 04/28/2014   14:55:03

            Event String:

            The processing of Group Policy failed. Windows could not apply the registry-based policy settings for the Group Policy object LDAP://CN=Machine,cn={31B2F340-016D-11D2-945F-00C04FB984F9},cn=policies,cn=system,DC=ABC,DC=in. Group Policy settings will not be resolved until this event is resolved. View the event details for more information on the file name and path that caused the failure.

         An error event occurred.  EventID: 0x000016AD

            Time Generated: 04/28/2014   14:56:08

            Event String:

            The session setup from the computer HUBLI failed to authenticate. The following error occurred: 


         An error event occurred.  EventID: 0x0000165B

            Time Generated: 04/28/2014   14:58:52

            Event String:

            The session setup from computer 'SWR-100' failed because the security database does not contain a trust account 'SWR-100$' referenced by the specified computer.  


         An error event occurred.  EventID: 0x00000448

            Time Generated: 04/28/2014   15:00:03

            Event String:

            The processing of Group Policy failed. Windows could not apply the registry-based policy settings for the Group Policy object LDAP://CN=Machine,cn={31B2F340-016D-11D2-945F-00C04FB984F9},cn=policies,cn=system,DC=ABC,DC=in. Group Policy settings will not be resolved until this event is resolved. View the event details for more information on the file name and path that caused the failure.

         An error event occurred.  EventID: 0x000016AD

            Time Generated: 04/28/2014   15:01:08

            Event String:

            The session setup from the computer SWR-100 failed to authenticate. The following error occurred: 


         An error event occurred.  EventID: 0x00000448

            Time Generated: 04/28/2014   15:05:04

            Event String:

            The processing of Group Policy failed. Windows could not apply the registry-based policy settings for the Group Policy object LDAP://CN=Machine,cn={31B2F340-016D-11D2-945F-00C04FB984F9},cn=policies,cn=system,DC=ABC,DC=in. Group Policy settings will not be resolved until this event is resolved. View the event details for more information on the file name and path that caused the failure.

         An error event occurred.  EventID: 0x0000165B

            Time Generated: 04/28/2014   15:05:08

            Event String:

            The session setup from computer 'MIR-ELECT-23-PC' failed because the security database does not contain a trust account 'MIR-ELECT-23-PC$' referenced by the specified computer.  


         An error event occurred.  EventID: 0x000016AD

            Time Generated: 04/28/2014   15:07:12

            Event String:

            The session setup from the computer MIR-ELECT-23-PC failed to authenticate. The following error occurred: 


         An error event occurred.  EventID: 0x00000448

            Time Generated: 04/28/2014   15:10:05

            Event String:

            The processing of Group Policy failed. Windows could not apply the registry-based policy settings for the Group Policy object LDAP://CN=Machine,cn={31B2F340-016D-11D2-945F-00C04FB984F9},cn=policies,cn=system,DC=ABC,DC=in. Group Policy settings will not be resolved until this event is resolved. View the event details for more information on the file name and path that caused the failure.

         ......................... DC01 failed test SystemLog

************************************************************************************************

Kindly Someone help

Trying to make computer member of .org internal after creating .local

April 28, 2014, 7:43 am

≫ Next: Ports Required for Trusts bidirectional or unidirectional for Internal client–External domain domain controllers ?

≪ Previous: Netlogon Share not avail on Both the DC (Win2012)

$

0

0

I have an internal .local domain and a public .org domain name... all works well except now i am trying to deploy a AD FS server and i need to be able to authenticate servers to the .org name internally... anybody know how i can go about adding the .org to my internal domain controllers? I have already added the .org UPN suffix to my .local domain and I have created my .org forward lookup zone... i am able to create AD users with the .org UPN suffix and I am able to resolve servers to the .org A records but i cannot add computers as members to the .org domain... 

i tried manually creating the smdcs zone and _dc and _tcp zones within that and manually creating the SRV records but when i try connect the computer to the domain, the computer is able to contact the domain controller however then recieves a generic message as seen in the screen shot..

Ports Required for Trusts bidirectional or unidirectional for Internal client–External domain domain controllers ?

April 28, 2014, 3:28 am

≫ Next: Display of computer object in permissions of object

≪ Previous: Trying to make computer member of .org internal after creating .local

$

0

0

Hello ! -  Bit confused find out the direction of the ports for Internal client–External domain domain controllers trust?

I know the communication between the child domain computer subnet and the Root DCs, on the following ports. But not very sure which direction it should be?

Is it bi directional or unidirectional ? Please help !

-          tcp 135, 
-          tcp/udp – 389
-          tcp 3268
-          tcp/udp - 88
-          tcp/udp - 53
-          tcp 3268
-          tcp 445
-          dynamic rpc ports for NTDS. Netlogon 

---

Anoop C Nair - @anoopmannur :: MY Site: www.AnoopCNair.com ::FaceBook: ConfigMgr(SCCM) Page ::Linkedin: Linkedin<