I have no experience in dealing with servers, but my senior has asked me to investigate on how to migrate instances on ADAM (windows server 2003 32bit) to AD LDS (Windows server 2012R2 64 bit) as in place upgrade is not an option as we're running a 32bit Server and want to migrate to a 64bit Server. can someone please give me a Walkthrough on how to do this.
Thanks in advance.
My customer want to restructure Active Directory by move object from child domain to parent domain.
I have setup an infrastructure rely on ADMT white paper that allow me to migrate computer and user objects.
But I have a problem when some users cannot migrating to the parent domain
If I check on ADMT log I see...
ERR2:7422 Failed to move source object 'CN=xxxx yyyy'. hr=0x80070005 Access is denied.
yyyy-mm-dd HH:MM:SS Updated user rights for CN=xxxx yyyy
How should I do?
PS. I have checked the security has inherit from parent object and ADMT migration account has Full permission on user object.
Thanks,
From Technet
Hi,
We would like to allow some functional accounts (ITS Accounts)can access to all company´s servers but without be domain admin and neither add them manually on local admin group in each server.
Could we do this using Group Policy management? or Active Directory delegation? (our AD is 2012).
Could anyone help me please?
Thanks and regards
Manuel Osorio
Hi All,
i have enabled Directory Service auditing in the environment, there is a security Event Log 5136 (Directory Service change).
When as an Example, change the User Manager Field from AD Side, there are two Events (5136) created in the Security Log of this DC (one for the Old Manager Value and another for the New Manager Value).
When i do the same but from the Exchange Server Side, There are two Event (5136) created in the connected DC (one for the Old Manager Value, but the other Event has an empty Value for the New Manager Value).
So does anyone has an explanation for this?
Hi all,
When i try to access a resource hosted at a relying party, and use wrong credentials, i get a 401 error page from the IDP (sts).
Is it possible to somehow redirect the user to an error page hosted at the relying party?
The 401 has a structure holding the date of today, and some HTML/Base64 kind of encoding in it. But it also contains the URL that leads to the relying party. Maybe its possible to filter that out of the URL and use that to redirect a user to another side?
Thank!
Hi All!
My company’s Exchange environment consists of the following:
Question:
I would like to upgrade our Forest and Domain functional level to 2012 R2. Judging from an article that I just read:http://tinyurl.com/exchangesp3
It would appear to me that I would first need to update Exchange (at the very least) to SP3 Rollup 5.This is fine, my only question is will Exchange continue to operate smoothly on a 2003 functional domain and forest level while I proceed to finish the other domain controller upgrades to 2012 R2?
or
Should I upgrade all domain controllers first to 2012 R2, and then on a weekend raise the functional level to 2012 and also apply SP3 and RU5 to Exchange?
Bonus Questions:
After transferring the fsmo roles of our 2003 PDC to our new 2012 R2 PDC, I run get-adserversettings on the exchange server and receive the following:
RunspaceId : 12345678-1234-1234-1234-123456789012
DefaultGlobalCatalog :OLDPDC.company.com
PreferredDomainControllerForDomain : {}
DefaultConfigurationDomainController : NEWPDC.COMPANY.com
DefaultPreferredDomainControllers : {OLDPDC.COMPANY.com}
UserPreferredGlobalCatalog :
UserPreferredConfigurationDomainController :
UserPreferredDomainControllers : {}
RecipientViewRoot : COMPANY.com
ViewEntireForest : False
Identity :
IsValid : True
This concerns me for two reasons.
1. Shouldn't the following fields be populated with the NEWPDC name:
DefaultGlobalCatalog
PreferredDomainControllerForDomain
DefaultPreferredDomainControllers
UserPreferredDomainControllers
2. If these parameters are supposed to reflect the NEWPDC, what would happen if I filled them in or edited them to show NEWPDC prior to upgrading Exchange to SP3 RU5?
Any and all comments are appreciated, thank you!
SCCM 2012 - How to add domain id to local administrator group of all clients
Hi,
i have a domain id sccmadmin which is a part of domain admins group too.
Need to add this ID to the local administrators group of all clients. How do I do this? Please help!
Hi Folks,
Hopefully one of you experts can shine some light on this topic. I work support in a large company doing I.T. (has multiple departments).
We have recently had more than a few incidents where the the user tries to login in to their computer and receive the following message: "Security Database does not have a computer account for this workstation"
Turns out we found their computer account in the 'Inactive>Disabled' OU folder in Active Directory.
Our Server Intel team may have done some cleanup and informed us of the following: "Machines that have not talked to the domain in the last 30 days have an invalid trust password and would need to be rejoined to the domain."
I 'thought' a computer account NEVER expired or become inactive - meaning if an user was out in the field for months, never on the network and then one day came back it would still be on the domain?
Can anybody inform me if the above statement is true? Even point me to a related Microsoft Article.
We have monitored some of the domain users connecting Additional domain controller from DR site instead of Primary site in primary domain controller.
What is the cause we need to know. Please clarify.
Primary domain controller and Additional domain controller FSMO roles position as below
C:\Users\exmgmt>netdom query fsmo
Schema master kingAD01.abc.AD
Domain naming master kingAD01.abc.AD
PDC kingAD03.abc-test.abc.AD
RID pool manager kingAD03.abc-test.abc.AD
Infrastructure master kingAD03.abc-test.abc.AD
The command completed successfully.
Regards,
Kumar N
Ivanildo Teixeira Galvão
Hi all
I have recently started upgrading my domain to 2012 but still in 2003 functional level. All FSMO roles moved to 2012 server. Replication of active directory objects is working fine, however the sysvol is not being replicated and hasnt since the promotion and movement of the FSMO roles. GP report shows all SYSVOL's being inaccessible. Looking at the DFS managment snapin I cannot see any SYSVOL replication job for the domain. There are no replications groups at all. Can I recreate these?
matt barnes
I have recently added 2008R2 server in my existing environment. Earlier, I had 2 DC's. But, Netlogon & Sysvol folders not showing in this new DC. Although, DNS & AD replication is working fine.
Thanks,
Sandesh
I'm trying to setup a utility to allow my help desk people to change and unlock user accounts. Changing the password doesn't seem to be much of a problem, but I can't seem to locate the appropriate attribute to unlock accounts. When they select that account the option is greyed out, along with all the options under account options. Suggestions?
Hi
After restoring a virtual DC from software that was 'Active directory unaware' the DC is in USN ROLL BACK
I have tried to demote the DC gracefully and forced and keep getting 'Access Denied' Error messages
Like to know if anyone has any idea why i cant demote it! I have seen posts about unticking 'prevent accidental deletion'
in sites and services.
The last stop would be to shut it down leave it off, then clean up the metadata on our remaining DC.
I would rather Demote the DC Properly as we have applications on it and would be a nightmare to migrate these applications
Any Ideas Guys
Thanks
Hi
After restoring a virtual DC from software that was 'Active directory unaware' the DC is in USN ROLL BACK
I have tried to demote the DC gracefully and forced and keep getting 'Access Denied' Error messages
Like to know if anyone has any idea why i cant demote it!
The last stop would be to shut it down leave it off, then clean up the metadata on our remaining DC. I would rather Demote
the DC Properly
Any Ideas Guys
Thanks
I'm trying to set up a Zentyal server in our active directory and while I understand that it's not supported, it's reporting an issue with the Active Directory that I can not seem to track down let alone fix. It is finding some cnf records regarding the root domain. Many people have had a similar issue and just set the dns to replicate in forest instead of the win2k option and this worked for them however my case is a little different and while I did need to make that change, it did not fix the problem. This is the error:
Could not join to domain. The following DNS zones are stored in the main domain partition: mi.private CNF:f1f0285a-62f7-4da9-b573-78f61efc2519, mi.private CNF:6cba3910-a2bd-48e6-8f90-b0fbd23a8c9a. This normally happen when the server is upgraded from Windows Server 2000, and Samba4 will not be able to read these zones. Please, move the zones to the "DomainDnsZones" or "ForestDnsZones" and try again. Check http://technet.microsoft.com/en-us/library/cc730964 for help on how to do that.
Any help with this would be HUGELY appreciated!!!
BTW, yes I followed the link to the technet article but the solution did not work.
I am trying to find documentation that will specifically identify the firewall configuration required with today's modern firewalls. I've found this great article on ports and usage:http://technet.microsoft.com/en-us/library/dd772723(v=ws.10).aspx.
This is great as far as it goes. But it doesn't go far enough.
A little about the configuration. 3 subnets: A, B and C. Each subnet and technically each device in a subnet is separated by a firewall. DC's are located in Subnet A and B. Servers and workstations reside in all subnets. Subnet C is technically a DMZ zone with very controlled "public" access and it requires some AD access. (I know there are federated service options here but I don't want to go there for this question.)
I want to know from the article mentioned about which direction each port is required and whether is is required by the DC's or the AD member machines. Just to be clear I am not referring to the Windows Advanced Firewall configuration here.
Example 1: Port 88, is it required inbound and outbound at all clients or just the DC?
Example 2: TCP/UDP high ports 49152-65535, To me these are "response" ports and dynamically opened as needed during communication. Therefore specific rules to open ports would not be required. Yes?
So, it would seem to me that I could open far less ports than the article describes if I knew what I was doing. I don't really want to "experiment" with this configuration.
Any guidance would be appreciated.
Thank you.
JR SBS Specialist
Hello folks,
I cant promote a member server to be a DC. This server was not even able to get added to the domain. I got that taken care of by offline join (djoin). I'm able to ping/nslookup any other DC, DNS, domain name, forest name, etc
Please see the C:\Windows\debug\dcpromoui.log and the screenshot
dcpromoui 810.E14 0000 14:49:10.837 opening log file C:\Windows\debug\dcpromoui.log