Hi,

Dawid

Hi,

I've created a new AD forest and after adding additional DCs for replication to another site, I've got a lot of errors occurring. I've tried a number of suggested tools to troubleshoot: repadmin, dcdiag, dnslint, repadmin, but I'm just stuck fixing the remaining errors. I'm pretty sure it's a DNS issue, but as I'm new Active Directory I'm a bit lost. Any help would be much appreciated. Let me know if you need the output from any other commands.

All servers log this error frequently (but replication appears to be working fine):

These are the other errors that remain:

DC1NY
An error event occurred.  EventID: 0x0000272C
            Time Generated: 05/29/2014   12:35:41
            Event String:
            DCOM was unable to communicate with the computer 172.16.0.1 using any of the configured protocols; requested by PID     1aec (C:\Windows\system32\dcdiag.exe).
         An error event occurred.  EventID: 0x0000272C
            Time Generated: 05/29/2014   12:35:57
            Event String:
            DCOM was unable to communicate with the computer 8.8.4.4 using any of the configured protocols; requested by PID     1aec (C:\Windows\system32\dcdiag.exe).
         An error event occurred.  EventID: 0x0000272C
            Time Generated: 05/29/2014   12:35:57
            Event String:
            DCOM was unable to communicate with the computer 8.8.8.8 using any of the configured protocols; requested by PID     1aec (C:\Windows\system32\dcdiag.exe).
         ......................... DC1NY failed test SystemLog

** please note, these are the addresses in the forwarders tab in the DNS manager. The 172 address is the local gateway.

NY01\DC1NYLV

Starting test: DFSREvent
         The DFS Replication Event Log. 
         The event log DFS Replication on server dc1nylv.l**t.com could
         not be queried, error 0x6ba "The RPC server is unavailable."
         ......................... DC1NYLV failed test DFSREvent
      Starting test: KccEvent
         * The KCC Event log test
         The event log Directory Service on server dc1nylv.l**t.com could
         not be queried, error 0x6ba "The RPC server is unavailable."
         ......................... DC1NYLV failed test KccEvent

NY01\DC1NYLVPS
Starting test: DFSREvent
         The DFS Replication Event Log. 
         The event log DFS Replication on server
         dc1nylvps.l**tp**g.com could not be queried, error 0x6ba
         "The RPC server is unavailable."
         ......................... DC1NYLVPS failed test DFSREvent
Starting test: KccEvent
         * The KCC Event log test
         The event log Directory Service on server
         dc1nylvps.l**tpl**g.com could not be queried, error 0x6ba
         "The RPC server is unavailable."
         ......................... DC1NYLVPS failed test KccEvent

AZ01\DC1AZ
Starting test: SystemLog
         * The System Event log test
         An error event occurred.  EventID: 0x0000272C
            Time Generated: 05/29/2014   12:46:20
            Event String:
            DCOM was unable to communicate with the computer 8.8.4.4 using any of the configured protocols; requested by PID     1900 (C:\Windows\system32\dcdiag.exe).
         An error event occurred.  EventID: 0x0000272C
            Time Generated: 05/29/2014   12:46:20
            Event String:
            DCOM was unable to communicate with the computer 8.8.8.8 using any of the configured protocols; requested by PID     1900 (C:\Windows\system32\dcdiag.exe).
         An error event occurred.  EventID: 0x0000272C
            Time Generated: 05/29/2014   12:46:20
            Event String:
            DCOM was unable to communicate with the computer 172.16.0.1 using any of the configured protocols; requested by PID     1900 (C:\Windows\system32\dcdiag.exe).
         ......................... DC1AZ failed test SystemLog

AZ01\DC1PHXLV
Starting test: Advertising
         Fatal Error:DsGetDcName (DC1PHXLV) call failed, error 1722
         The Locator could not find the server.
         Printing RPC Extended Error Info:
         Error Record 1, ProcessID is 4384
          (DcDiag)

            System Time is: 5/29/2014 17:2:35:242
            Generating component is 2 (RPC runtime)

            Status is 1722 The RPC server is unavailable.

            Detection location is 193
         Error Record 2, ProcessID is 4384
          (DcDiag)

            System Time is: 5/29/2014 17:2:35:242
            Generating component is 5 (redirector)

            Status is 53 The network path was not found.

            Detection location is 190
            NumberOfParameters is 2
            Long val: 1441792
            Unicode string: \\DC1PHXLV\PIPE\NETLOGON
         ......................... DC1PHXLV failed test Advertising


** please note: System time on this server doesn't look correct (all others look fine),

this diagnostic was run at approximately 12:45pm, would this cause issues? */

Starting test: SysVolCheck
         * The File Replication Service SYSVOL ready test 
         [DC1PHXLV] An net use or LsaPolicy operation failed with error 53,
         The network path was not found..
         The registry lookup failed to determine the state of the SYSVOL.  The
         error returned  was 0x35 "The network path was not found.".  Check the
         FRS event log to see if the SYSVOL has successfully been shared. 
         ......................... DC1PHXLV failed test SysVolCheck
Starting test: MachineAccount
         Checking machine account for DC DC1PHXLV on DC DC1PHXLV.
         Could not open pipe with [DC1PHXLV]:failed with 53:
         The network path was not found.
         Could not get NetBIOSDomainName
         Failed can not test for HOST SPN
         Failed can not test for HOST SPN
         * SPN found :LDAP/dc1phxlv.l**t.com/l**t.com
         * SPN found :LDAP/dc1phxlv.l**t.com
         * SPN found :LDAP/DC1PHXLV
         * SPN found :LDAP/e4cf2cb9-4236-4cd5-a71e-413bd3eda572._msdcs.corp.l**t.net
         * SPN found :E3514235-4B06-11D1-AB04-00C04FC2DCD2/e4cf2cb9-4236-4cd5-a71e-413bd3eda572/l**t.com
         * SPN found :HOST/dc1phxlv.l**t.com/l**t.com
         * SPN found :HOST/dc1phxlv.l**t.com
         * SPN found :HOST/DC1PHXLV
         * SPN found :GC/dc1phxlv.l**t.com/corp.l**t.net
Starting test: NCSecDesc
         * Security Permissions check for all NC's on DC DC1PHXLV.
         * Security Permissions Check for
           DC=DomainDnsZones,DC=l**t,DC=com
            (NDNC,Version 3)
         * Security Permissions Check for
           DC=l**t,DC=com
            (Domain,Version 3)
         * Security Permissions Check for
           DC=ForestDnsZones,DC=corp,DC=l**t,DC=net
            (NDNC,Version 3)
         * Security Permissions Check for
           CN=Schema,CN=Configuration,DC=corp,DC=l**t,DC=net
            (Schema,Version 3)
         * Security Permissions Check for
           CN=Configuration,DC=corp,DC=l**t,DC=net
            (Configuration,Version 3)
         * Security Permissions Check for
           DC=l**tp**g,DC=com
         Ldap search capability attribute search failed on server DC1PHXLV,
         return value = 81
         * Security Permissions Check for
           DC=corp,DC=l**t,DC=net
         ......................... DC1PHXLV failed test NCSecDesc

Starting test: NetLogons
         * Network Logons Privileges Check
         [DC1PHXLV] An net use or LsaPolicy operation failed with error 53,
         The network path was not found..
         ......................... DC1PHXLV failed test NetLogons

AZ01\DC1PHXLVPS
      Starting test: Advertising
         Fatal Error:DsGetDcName (DC1PHXLVPS) call failed, error 1722
         The Locator could not find the server.
         Printing RPC Extended Error Info:
         Error Record 1, ProcessID is 4384
          (DcDiag)

            System Time is: 5/29/2014 17:5:4:323
            Generating component is 2 (RPC runtime)

            Status is 1722 The RPC server is unavailable.

            Detection location is 193
         Error Record 2, ProcessID is 4384
          (DcDiag)

            System Time is: 5/29/2014 17:5:4:323
            Generating component is 5 (redirector)

            Status is 53 The network path was not found.

            Detection location is 190
            NumberOfParameters is 2
            Long val: 1441792
            Unicode string: \\DC1PHXLVPS\PIPE\NETLOGON
         ......................... DC1PHXLVPS failed test Advertising
Starting test: DFSREvent
         The DFS Replication Event Log. 
         The event log DFS Replication on server
         dc1phxlvps.l**tp**g.com could not be queried, error 0x6ba
         "The RPC server is unavailable."
         ......................... DC1PHXLVPS failed test DFSREvent

Starting test: SysVolCheck
         * The File Replication Service SYSVOL ready test 
         [DC1PHXLVPS] An net use or LsaPolicy operation failed with error 53,
         The network path was not found..
         The registry lookup failed to determine the state of the SYSVOL.  The
         error returned  was 0x35 "The network path was not found.".  Check the
         FRS event log to see if the SYSVOL has successfully been shared. 
         ......................... DC1PHXLVPS failed test SysVolCheck

Starting test: KccEvent
         * The KCC Event log test
         The event log Directory Service on server
         dc1phxlvps.l**tp**g.com could not be queried, error 0x6ba
         "The RPC server is unavailable."
         ......................... DC1PHXLVPS failed test KccEvent
Starting test: MachineAccount
         Checking machine account for DC DC1PHXLVPS on DC DC1PHXLVPS.
         Could not open pipe with [DC1PHXLVPS]:failed with 53:
         The network path was not found.
         Could not get NetBIOSDomainName
         Failed can not test for HOST SPN
         Failed can not test for HOST SPN
Starting test: NCSecDesc
         * Security Permissions check for all NC's on DC DC1PHXLVPS.
         * Security Permissions Check for
           DC=DomainDnsZones,DC=l**tp**g,DC=com
            (NDNC,Version 3)
         * Security Permissions Check for
           DC=l**tp**g,DC=com
            (Domain,Version 3)
         * Security Permissions Check for
           DC=ForestDnsZones,DC=corp,DC=l**t,DC=net
            (NDNC,Version 3)
         * Security Permissions Check for
           CN=Schema,CN=Configuration,DC=corp,DC=l**t,DC=net
            (Schema,Version 3)
         * Security Permissions Check for
           CN=Configuration,DC=corp,DC=l**t,DC=net
            (Configuration,Version 3)
         * Security Permissions Check for
           DC=l**t,DC=com
         Ldap search capability attribute search failed on server DC1PHXLVPS,
         return value = 81
         * Security Permissions Check for
           DC=corp,DC=l**t,DC=net
         ......................... DC1PHXLVPS failed test NCSecDesc
Starting test: NetLogons
         * Network Logons Privileges Check
         [DC1PHXLVPS] An net use or LsaPolicy operation failed with error 53,
         The network path was not found..
         ......................... DC1PHXLVPS failed test NetLogons

Hi,

I need to test my AD replication and health. Also need to check if AD sites and services is configured properly. What can I use for that?

Dear

I have two Domain Controllers.

AD50 & AD100

If i give AD50 as primary DNS in Network connections of client machine, it work fine and users are able to logon

If i give AD100 as primary DNS in Network connections of client machine, It gives user name and password incorrect error to remote desktop users whereas domain admins are able to logon.

Replication, AD health, DNS all are working fine on ADs.

Any idea???

Rox_Star

Hi,

Can somebody guide us as to what we're doing wrong?

We have this scenario:

Problem: We receive the following error when supplying the Username/Password of the Trusted Domain. When using native Domain, it works fine and shows the "First Name", "Last Name", and "Email".

Setup Details:

1. Servers: Server 2012 (with IIS 8) --- Firewalls turned off between both
2. IIS: Application Pool running under Custom Identity of the Resource Forest (Parent.com)
3. IIS: Web App binded with both IP, and www.customdomain.com (for which DNS entries with both domain are properly setup, can do NSLookup without issues.)
4. IIS: Authentication: Windows (Negotiate, NTLM) + (Kernel-Mode Enabled),  +  ASP.Net Impersonation (Authenticated Users)
5. NTFS Permissions: "Authenticated Users" granted "Read and Execute" NTFS permission on the Web App folder. Additionally, we have also granted "Domain Users" of Trusted Domain, the same permissions.
6. Delegation: Both Domain Controllers are by default checked as "Trusted for delegation" Kerberos - (All Services)
7. SPN: SPN set with machine account. We have tried various variations but didn't work.
8. Local Security Policy: (Have added the AppPool User (i.e. the Custom User Account) into:

1.   Act as part of the Operating System
2.   Impersonate a Client After Authentication
3.    Run as a Service 

Web.config

<system.web><authentication mode="Windows" /><identity impersonate="true"/><authorization><allow users="*" /><deny users="?" /></authorization><compilation debug="true" strict="false" explicit="true" targetFramework="4.0"><assemblies><add assembly="System.DirectoryServices.AccountManagement, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" /><add assembly="System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /><add assembly="System.Net, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /><add assembly="System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /><add assembly="mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" /></assemblies></compilation><customErrors mode="Off" /></system.web>

Default.aspx.cs

using (PrincipalContext pc = new PrincipalContext(ContextType.Domain))
		using (HostingEnvironment.Impersonate())
	    {
    		UserPrincipal up = UserPrincipal.FindByIdentity(pc, principal.Identity.Name);
		{
			userEmail = up.EmailAddress;
    			userFirstName = up.GivenName;
			userLastName = up.Surname;
    			userLogin = up.SamAccountName;
		}

	  
		}

Hi,

Yesterday during server maintenance, all servers were shutdown. Upon turn up, found VPN client not able to authenticate. Checked RADIUS protocols, AD Cisco ASA configs, and AAA server configs. All configs seem accurate. On the AAA server (DC) checked all services, ensured all were running. Worked with Cisco and determined AD sending "bad packets" ASA not guilty. How could a shutdown create such an issue? How do I resolve?

Hi,

I am undergoing streamlining of usernames in Local AD. Instead of renaming the existing users, I am planning to create new users and copy old user profile to the new user account. scenario is as under:-

1. Currently user "abc" has domain account abc@domain.local.

2. I created new user with abcxyz with the domain account abcxyz@domain.local.

3. I need to copy user "abc" profile to the newly created user account "abcxyz"

** User Profiles are local not Roaming.

Is it a workable solution? if so, then how can I do this? if not, then what could be the alternate?

Thanks.

Can an AD site be a member of two different site links?

Our network is a full mesh MPLS with various link speeds so I would like to control what sites replicate with each other. For example, for 4 sites with the same high speed links I was going to create a site link called Core and set replication schedule to every 60 minutes:

When sites are part of a site link, is a full mesh topology automatically created between them?

Also, if I then wanted to force a site with a low speed link to only replicate with one of the 4 core sites I.E. Site A would i just create another site link and add the core site and the new site? If so how would costing affect this scenario if at all?

Hi,

 should I put the Web Application Proxy  server  on my domain?

 I've seen documents saying it should be on a domain, and I also seen that it should not be on my domain.

 I thin it should be in a workgroup since it is in DMZ.

 What I would like to now is where should I put  the WAP  server' should I add the server to 

 my domain or should the server be in workgroup

pls adv,

thanks.

Erró

We have a requirement to isolate Development/QA/Test Servers into a separate AD Forests from the current Production AD Forest. The Application Development users will still remain in the production environment, so that this move is seemless.

Now to achieve this requirement, should be use any Migration tools like ADMT to move the servers between AD Forests and then establish a one-way trust between the prod and dev AD Forests? or can we just disjoin the dev servers from prod AD Forest and join to the Dev AD Forest? I suspect that by disjoining and rejoining the dev servers the SID's in the ACL's will be lost and applications will break.

Also will there be any issues with Users in Different AD Forest and Dev Servers in a different AD Forest and accessing these Dev Servers over a trust?

Kindly advice what should be the right approach for such kind of a separation.

Regards

We currently have a combination of a script and a tool that takes care of this task.

The script sets the time of a computer “X” to the time of Domain Controller. It compares the time of all computers got through “net view” command with the time of the computer “X”. The task captures the list of computers with the time variation of 2 minutes or more along with their computer name and also whether the time is running fast/slow with respect to the reference time of the computer “X”. The task stores all the system time difference in a raw file RawOutputFile.txt.

Then the script uses TimeDelta.pl (Perl) to find the servers/computers which have an error of over 2 minutes and store them in a CSV format, including the amount of error in time in the file PerlOutput.csv, and also sends the same information thru email to a set of recipients.

Is there a single tool available that can take care of this task? All we need to do is, check the time of all computers in the environment, and then get the difference in time with respect to the PDC. Once this is done, send a report of the computers that are slower/faster to a set of email recipients.

Hi,

I manage an AD used by multiple companies (all owned by a parent company, my employer) and there's been some change to which company employs which people. We use UPNs as login-names (firstname.lastname@company.com) and when people switch employer we change their UPN to reflect that, so we can still tell them it's just their email-address.

I did this for a new company and they can all log in with their new UPNs, but when they reboot their computer their old UPN is shown and they have to switch user and type in the new one again. It's like the client computer has their old UPN cashed and doesn't update it, or something.

Does anybody know a solution to this? Reinstalling their computers would probably do the trick, but they wouldn't be happy about it..

We run a 2008 R2 domain, clients are all Windows 7 Ent, deployed and joined in the domain via SCCM.

hi everybody,

my question is about the replication of change on the RWDC to the RODC. 
is it possible to replicate the data from the RWDC to the RODC with only one way connection (from RWDC to RODC)?

it seems to work only when the  connection is bidirectional, or I understand something wrong?

Thanks for Help

hello,

i have project where i have to do a lot changes to AD users data. i do not want do it on procuction.

How can i do clone of AD data /ldap/? i can clone one DC but i would like to colone only LDAP. i have never done this. how to start?

thx in adv for any tip.

Voytas

Hi all,

We got years ago an external trust between the forest of our partner and our forest.

The trust was created between the child domain of our forest and the single domain in the partner's forest.

Suddenly they decided to remove the trust. They did it on their side without informing us. The removal was done using the 2nd option: remove the trust on the local server and on the remote DC.

Now we cant get rid of the trust, always is saying this message:

"A trusted-domain object cannot be found for the trust to domain <partner.local>. The trust may have been removed by another user"

Therefore it is still listed in the AD Trust GUI.

Is there any way to get rid of it?

Thanks,

We have an internal website that uses an ADFS 3.0 instance. The problem we're seeing is that even though Chrome works just fine (with forms-based authentication), IE fails. For IE - even if the ADFS' URL is listed as an Intranet site, and "Automatic Logon with currnet username  and password" is set - a password prompt is still presented, and even with correct credentials, an HTTP 400 is given back to the client.

Any idea what could generate this behavior ?

Hi All,

We have an environment setup with Sharepoint Azure and Sharepiont online. Federation has been installed using Windows 2012 R2 ( ADFS 3.0). The trust between the Azure & Online was setup and hybrid search functionality was perfectly allright.

Due to recent changes, we rebuild the Sharepoint Azure environment and the trust has been rebuild. Federation works fine, but when we logon to Sharepoint Online in o365 and do a search, it does not search the Azure platform sharepoint. We get Errors of

- event id 325 (

The Federation Service could not authorize token issuance for caller '<USERNAME>'. The caller is not authorized to request a token for the relying party 'urn:federation:MicrosoftOnline'. See event 501 with the same Instance ID for caller identity.

-event id 1000 (An error occurred during processing of a token request. The data in this event may have the identity of the caller (application) that made this request

another one is

- event id 364 ( Encountered error during federation passive request. 

I am not sure where we are going wrong now. here are few things we have checekd

- we have rebuild the MSOL Federation using - Update-msolfederatedDomain 

- Time sync between ADFS and proxy server verified.

- service account has permissions on the cert private key

- Issuance rules allows all users to access the federation. (two factor auth is setup and is working perfectly fine)

Let me know what more i can check on this topic to get this up and running.

Our organization would like to provide an environment where shared core services are housed in a root domain with several client domains having access to these core services. We would also like to provide email, file, and other services within separate client domains, but maintain privacy of user lists, email address lists, etc. between these client domains. Client2 users should not be able to see the users’ names, accounts, etc. or enumerate address lists, attributes, or groups that pertain to Client1 domain (and vice versa). In a nutshell, we’d like to shield all visibility of other client domains between each other but still be able to manage this as one directory. Is one forest possible (figure 1), or are we relegated to having separate forests (figure 2) with external trusts linked to the core domain?