Quantcast
Channel: Directory Services forum
Viewing all 31638 articles
Browse latest View live
↧

Trust relationship error on PDC

April 7, 2014, 2:09 pm
$
0
0

Hello,

We are getting the error "The security database on the server does not have a computer account for this workstation trust relationship" on our main domain controller.  We have a primary domain controller and also a second domain controller on one domain.  We are unable to logon to the PDC when this is happening and have to do a hard reboot to get it back up.  At the same time our VPN does not roll over to the BDC so we are unable to logon at the time of the error.

We are receiving 5722, 5805 in reference to the BDC on the PDC and we are getting 5783 (in reference to the PDC) and 5719 on the BDC.  We are also getting 7 on the PDC as well mentioning the security account manager failed a KDC request. 

I've been jumping all over the net to find a solution, but it seems they are all in regards to workstations or other servers with the trust relationship error and nothing in regards to this error on a PDC. 

Any help will be greatly appreciated!

↧
Search

NBTSTAT -A and Ping Different Answer

January 21, 2015, 2:09 pm
$
0
0

Hi All,

  Can someone clarify this or sort this issue?

Ping pc1

 reply from 10.1.181.56


NBTSTAT -A 10.1.181.56 = pc2

Ping pc2

 reply from 10.1.181.56


How do we fix this?

What cause to this confusion? 

As

↧
↧

Account is keep on lockout

January 20, 2015, 4:40 am
$
0
0

Hi,

One of my user Account is keepon Locking Out. I dono what is happening.

When i enable it is locking out on that moment itself.

In Event it is generating with particular ID 4625 and 4776 with One particular Server Ip

If i check that server northing is related to his ID, I checked Credential Manager, Services, Schedule Task.

Many thanks in advance

Regards, Hari Prasad.D

↧

Trust Verification Status = 1311 0x51f ERROR_NO_LOGON_SERVERS

January 21, 2015, 5:34 pm
$
0
0

Hi All,

  We are having intermittence disconnection to forest trust and when i run the following command found this

nltest /sc_verify:external.com

Flags: 80
Trusted DC Name
Trusted DC Connection Status Status = 1311 0x51f ERROR_NO_LOGON_SERVERS
Trust Verification Status = 1311 0x51f ERROR_NO_LOGON_SERVERS
The command completed successfully

We have 5 DC's and  only one cause this issue.

As

↧

AD Integrated DNS Setup

January 21, 2015, 2:43 pm
$
0
0

Hi All,

  I have 6 Site and SiteA(Prod) and SiteB (DR) connect to the Internet. All other sites are connect to internet via SiteA.

How do i configure DNS Forwarders.

 SiteA : Internet Provider 1 / Internet Provider 2

 SiteB: Internet Provider 1 / Internet Provider 2

 SiteC: SiteA & SiteB DC

SiteD: SiteA & SiteB DC

Is this correct?

  • Uncheck the box for "Use root hints if no forwarders are available".

As


↧
↧

Unable to get a user's full list of group memberships from global catalog

January 14, 2015, 7:11 am
$
0
0

I'm having trouble getting a user's full list of group memberships from a global catalog inside a single forest.

The scenario is a bit unique:

We have 2 domains within the forest - domainA.example.com and domainB.example.com:

  • The domains share a transitive trust between them.
  • Each domain has a single domain controller, which are also global catalogs.
  • domainA holds only computer objects, while domainB holds only user objects and group.
  • I am trying to get the user's group memberships, which are all globalgroups.

The client i'm using (a java client i wrote) doesn't have access to domainB directly, only to domainA.

Therefore, in order to get a domainA user's list of group memberships, i have to query domainA... i did this using Global Catalog - the problem was that when i ask the GC from domainA to get me the list of groups (using thememberOf attribute),i get a partial list of groups (65 groups out of 106 groups the user belongs to).

I am trying to figure out why that is, and whether or not this is even the correct method, considering the fact that i don't have direct access to domainB (it is blocked via a firewall)




↧

Randomly slow login with roaming profile in DFS Namespace but fine when in same root share???

May 16, 2014, 2:34 am
$
0
0

Hi

I have an issue with random login speeds and it seems to boil down to DFS Namespace.

Server 2008 R2 WDC at HQ (namepace server)

Server 2008 R2 RODC at test site (namespace target)

I have an XP client test pc at the test site which logs in super quick with the profile path written as \\RODC\Profiles$\%username%

But if I change the profile path to \\domain.com\Profiles\%username% then login hangs around randomly at different points and is very sluggish

This is doing my head in because I really need to get this nailed so I can continue to roll out AD with Roaming Profiles across multiple sites.  Fast login is critical!

Please help?

Many thanks

Kevin

↧

WMIC returning printer port

January 22, 2015, 2:01 am
$
0
0

Hi,

is it possible to get in which port the printers are installed (in a computer) with the wmic tool?

Thanks a lot.

Regards.

↧
Search

NEED YOUR HELP!

January 21, 2015, 9:01 am
$
0
0

three forests and domains example: a.local, b.internal, c.mis
a.local has two way EXTERNAL trusts with b.internal
b.internal has two way forest trusts with c.mis

does a.local have or one way two way trust with c.mis?

Thank you!

↧
↧

Grant Read Access to Active Directory Deleted Objects Container on Windows 2012 domain.

January 22, 2015, 7:44 am
$
0
0

I am installing Checkpoint in a Windows 2012 domain.  I created an service account for the active directory scanner and am now required to give it special permissions for checkpoint to the "Deleted objects container".

I was able to find this KB article for windows 2000 and 2003.  http://support.microsoft.com/kb/892806

I need to know if this is still valid for 2012?  Or if there is an updated KB article I am missing somewhere.

I am trying to avoid making this account a domain admin.

Please advise.

This is the guide from checkpoint:

Directory Scanner

If your organization uses the Microsoft Active Directory Service, you can import users, groups, Organizational units (OUs) and computers from multiple AD domains into the Endpoint Security Management Server. After the objects are imported, you can assign policies that appropriately reflect the needs of the organization.

Setting Directory Scanner Credentials

When you first login to the Endpoint Security Management Console, theMy Organizationtree is empty. To populate the tree with users from the active directory, use the Directory Scanner Configuration Service.

The Directory Scanner scans the defined Active Directory and fills theDirectoriesnode in the My Organization tab, copying the existing Active Directory structure to the server database. For this to succeed, the user account associated with the Check Point AD Scanner service requires read permissions to:

All Active Directory containers from the root of the scanned Domain.

The deleted objects container.

An object deleted from the Active Directory is not immediately erased but moved to the Deleted Objects container. Comparing objects in the AD with those in the Deleted objects container gives a clear picture of network resources (computers, servers, users, groups) that have changed since the last scan.

↧

How to Remove User from Built in Administrators group With Group Policy Enabled

January 22, 2015, 1:40 am
$
0
0

Hi,

I want to remove user from Administrator group which is in restricted group. So I cannot remove him through Active Directory what is the way to remove user from Administrator restricted group.

Thanks

Jibran Ishtiaq

↧

Domain Upgrade & Cross Forest Trusts

January 22, 2015, 8:57 am
$
0
0

Hi,

I manage a single  windows 2003 Forest with a single domain (AD Level Windows 2003 R2). I'm preparing to upgrade the domain to Windows 2008 R2 but before I do I'm hoping someone can advise if this will impact on a number of cross forest trusts I have with related organisations. 

The trusts are a mix of 1 way and 2 way non transitive domain level trusts. 

My query is, will I need to recreate these trusts after and "adprep /forestprep" or "adprep/domainprep" (getting resources on the opposing side lined up to do create\recreate trusts is a big job so I'm hoping the impact with be zero).

Thanks in advance

Paul

↧

How to extend AD schema for Exchange

January 22, 2015, 7:28 am
$
0
0

Hi,

Please can someone help me understand the process for extending AD schema for Exchange?

I’m conceded because there are some cautions noted generally in the process so i’m looking for best practice to ensure extending in a safe and smooth manor.

Bit of background on our environment - 

Moving to Office365 in a hybrid environment, never used Microsoft products for email. 

New On-prem AD Physical DC, 2012 Server with DirSync to Azure/ O365

OU’s populated with objects.

Would like to manage users and distribution groups from within AD on-prem.

Many thanks,

Leo.

↧
↧

Error on Domain Controller

January 22, 2015, 9:56 pm
$
0
0

I'm having error on my AD, I have posted the netdom query fsmo and dcdiag, kindly assess 

Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Users\Administrator.MSI>netdom query fsmo
Schema master               msipdc.msi.com
Domain naming master        *** Warning: role owner is a deleted DC: CN=NTDS Set
tings\0ADEL:dfa10364-430a-4c4d-b9a0-d6850ea15217,CN=MSISVR16,CN=Servers,CN=Defau
lt-First-Site-Name,CN=Sites,CN=Configuration,DC=msi,DC=com
PDC                         msipdc.msi.com
RID pool manager            msipdc.msi.com
Infrastructure master       msipdc.msi.com
The command completed successfully.


C:\Users\Administrator.MSI>dcdiag

Directory Server Diagnosis

Performing initial setup:
   Trying to find home server...
   Home Server = MSIPDCWIN082
   * Identified AD Forest.
   Ldap search capabality attribute search failed on server AD2003, return
   value = 81
   Got error while checking if the DC is using FRS or DFSR. Error:
   Win32 Error 81The VerifyReferences, FrsEvent and DfsrEvent tests might fail
   because of this error.
   Ldap search capabality attribute search failed on server BDC, return value =
   81
   Got error while checking if the DC is using FRS or DFSR. Error:
   Win32 Error 81The VerifyReferences, FrsEvent and DfsrEvent tests might fail
   because of this error.
   Ldap search capabality attribute search failed on server MSISVR16, return
   value = 81
   Got error while checking if the DC is using FRS or DFSR. Error:
   Win32 Error 81The VerifyReferences, FrsEvent and DfsrEvent tests might fail
   because of this error.
   Ldap search capabality attribute search failed on server MSISVR18, return
   value = 81
   Got error while checking if the DC is using FRS or DFSR. Error:
   Win32 Error 81The VerifyReferences, FrsEvent and DfsrEvent tests might fail
   because of this error.
   Ldap search capabality attribute search failed on server USER, return value
   = 81
   Got error while checking if the DC is using FRS or DFSR. Error:
   Win32 Error 81The VerifyReferences, FrsEvent and DfsrEvent tests might fail
   because of this error.
   Ldap search capabality attribute search failed on server DAVAO-DOMAIN,
   return value = 81
   Got error while checking if the DC is using FRS or DFSR. Error:
   Win32 Error 81The VerifyReferences, FrsEvent and DfsrEvent tests might fail
   because of this error.
   Ldap search capabality attribute search failed on server WIN-G2DE8M6184O,
   return value = 81
   Got error while checking if the DC is using FRS or DFSR. Error:
   Win32 Error 81The VerifyReferences, FrsEvent and DfsrEvent tests might fail
   because of this error.
   Ldap search capabality attribute search failed on server MSIPDCWIN08, return
   value = 81
   Got error while checking if the DC is using FRS or DFSR. Error:
   Win32 Error 81The VerifyReferences, FrsEvent and DfsrEvent tests might fail
   because of this error.
   Ldap search capabality attribute search failed on server MSIPDCWIN08V2,
   return value = 81
   Got error while checking if the DC is using FRS or DFSR. Error:
   Win32 Error 81The VerifyReferences, FrsEvent and DfsrEvent tests might fail
   because of this error.
   [PDC2K8] LDAP bind failed with error 1326,
   Logon failure: unknown user name or bad password..
   Got error while checking if the DC is using FRS or DFSR. Error:
   Logon failure: unknown user name or bad password.The VerifyReferences,
   FrsEvent and DfsrEvent tests might fail because of this error.
   Done gathering initial info.

Doing initial required tests

   Testing server: Default-First-Site-Name\MSIPDCWIN082
      Starting test: Connectivity
         ......................... MSIPDCWIN082 passed test Connectivity

Doing primary tests

   Testing server: Default-First-Site-Name\MSIPDCWIN082
      Starting test: Advertising
         Warning: DsGetDcName returned information for \\pdccebu.msi.com, when
         we were trying to reach MSIPDCWIN082.
         SERVER IS NOT RESPONDING or IS NOT CONSIDERED SUITABLE.
         ......................... MSIPDCWIN082 failed test Advertising
      Starting test: FrsEvent
         There are warning or error events within the last 24 hours after the
         SYSVOL has been shared.  Failing SYSVOL replication problems may cause
         Group Policy problems.
         ......................... MSIPDCWIN082 passed test FrsEvent
      Starting test: DFSREvent
         ......................... MSIPDCWIN082 passed test DFSREvent
      Starting test: SysVolCheck
         ......................... MSIPDCWIN082 passed test SysVolCheck
      Starting test: KccEvent
         A warning event occurred.  EventID: 0x80000785
            Time Generated: 01/23/2015   13:28:28
            Event String:
            The attempt to establish a replication link for the following writab
le directory partition failed.
         A warning event occurred.  EventID: 0x80000785
            Time Generated: 01/23/2015   13:28:41
            Event String:
            The attempt to establish a replication link for the following writab
le directory partition failed.
         ......................... MSIPDCWIN082 passed test KccEvent
      Starting test: KnowsOfRoleHolders
         Warning:
         CN=NTDS Settings\0ADEL:dfa10364-430a-4c4d-b9a0-d6850ea15217,CN=MSISVR16
,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=msi,DC=com
         is the Domain Owner, but is deleted.
         ......................... MSIPDCWIN082 failed test KnowsOfRoleHolders
      Starting test: MachineAccount
         ......................... MSIPDCWIN082 passed test MachineAccount
      Starting test: NCSecDesc
         ......................... MSIPDCWIN082 passed test NCSecDesc
      Starting test: NetLogons
         Unable to connect to the NETLOGON share! (\\MSIPDCWIN082\netlogon)
         [MSIPDCWIN082] An net use or LsaPolicy operation failed with error 67,
         The network name cannot be found..
         ......................... MSIPDCWIN082 failed test NetLogons
      Starting test: ObjectsReplicated
         ......................... MSIPDCWIN082 passed test ObjectsReplicated
      Starting test: Replications
         REPLICATION-RECEIVED LATENCY WARNING
         MSIPDCWIN082:  Current time is 2015-01-23 13:37:30.
            CN=Schema,CN=Configuration,DC=msi,DC=com
               Last replication received from MSISVR16 at
          2013-11-13 09:00:00
               WARNING:  This latency is over the Tombstone Lifetime of 60
         days!
               Last replication received from MSISVR18 at
          2013-12-06 08:59:37
               WARNING:  This latency is over the Tombstone Lifetime of 60
         days!
               Last replication received from DAVAO-DOMAIN at
          2014-09-04 14:14:21
               WARNING:  This latency is over the Tombstone Lifetime of 60
         days!
               Last replication received from MSIPDCWIN08 at
          2015-01-20 17:45:15
               Last replication received from PDC2K8 at
          2015-01-22 13:53:24
               Last replication received from WIN-G2DE8M6184O at
          2015-01-20 14:45:03
               Last replication received from AD2003 at
          2011-10-05 11:50:41
               WARNING:  This latency is over the Tombstone Lifetime of 60
         days!
            CN=Configuration,DC=msi,DC=com
               Last replication received from MSISVR16 at
          2013-11-13 08:59:52
               WARNING:  This latency is over the Tombstone Lifetime of 60
         days!
               Last replication received from MSISVR18 at
          2013-12-06 08:59:07
               WARNING:  This latency is over the Tombstone Lifetime of 60
         days!
               Last replication received from DAVAO-DOMAIN at
          2014-09-04 14:14:22
               WARNING:  This latency is over the Tombstone Lifetime of 60
         days!
               Last replication received from MSIPDCWIN08 at
          2015-01-20 17:45:11
               Last replication received from PDC2K8 at
          2015-01-22 14:45:20
               Last replication received from WIN-G2DE8M6184O at
          2015-01-20 14:49:03
               Last replication received from AD2003 at
          2011-10-05 12:14:29
               WARNING:  This latency is over the Tombstone Lifetime of 60
         days!
            DC=msi,DC=com
               Last replication received from MSISVR16 at
          2013-11-13 09:05:47
               WARNING:  This latency is over the Tombstone Lifetime of 60
         days!
               Last replication received from MSISVR18 at
          2013-12-06 09:02:33
               WARNING:  This latency is over the Tombstone Lifetime of 60
         days!
               Last replication received from MSIPDCWIN08 at
          2015-01-20 18:02:45
               Last replication received from PDC2K8 at
          2015-01-22 14:43:48
               Last replication received from WIN-G2DE8M6184O at
          2015-01-20 15:25:20
               Last replication received from AD2003 at
          2011-10-05 12:15:05
               WARNING:  This latency is over the Tombstone Lifetime of 60
         days!
         ......................... MSIPDCWIN082 passed test Replications
      Starting test: RidManager
         ......................... MSIPDCWIN082 passed test RidManager
      Starting test: Services
         ......................... MSIPDCWIN082 passed test Services
      Starting test: SystemLog
         A warning event occurred.  EventID: 0x000727A5
            Time Generated: 01/24/2015   00:08:03
            Event String:
            The WinRM service is not listening for WS-Management requests.
         A warning event occurred.  EventID: 0x000727A5
            Time Generated: 01/24/2015   00:08:06
            Event String:
            The WinRM service is not listening for WS-Management requests.
         An error event occurred.  EventID: 0x0000002E
            Time Generated: 01/24/2015   00:44:27
            Event String:
            The time service encountered an error and was forced to shut down. T
he error was: 0x80070005: Access is denied.
         An error event occurred.  EventID: 0xC0001B6F
            Time Generated: 01/24/2015   00:44:27
            Event String:
            The Windows Time service terminated with the following error:
         An error event occurred.  EventID: 0x0000002E
            Time Generated: 01/23/2015   12:49:27
            Event String:
            The time service encountered an error and was forced to shut down. T
he error was: 0x80070700: An attempt was made to logon, but the network logon se
rvice was not started.
         An error event occurred.  EventID: 0xC0001B6F
            Time Generated: 01/23/2015   12:49:27
            Event String:
            The Windows Time service terminated with the following error:
         A warning event occurred.  EventID: 0x00001795
            Time Generated: 01/23/2015   13:00:24
            Event String:
            The program dns.exe, with the assigned process ID 2172, could not au
thenticate locally by using the target name Rpcss/pdc2k8.msi.com. The target nam
e used is not valid. A target name should refer to one of the local computer nam
es, for example, the DNS host name.
         A warning event occurred.  EventID: 0x8000001D
            Time Generated: 01/23/2015   13:07:31
            Event String:
            The Key Distribution Center (KDC) cannot find a suitable certificate
 to use for smart card logons, or the KDC certificate could not be verified. Sma
rt card logon may not function correctly if this problem is not resolved. To cor
rect this problem, either verify the existing KDC certificate using certutil.exe
 or enroll for a new KDC certificate.
         A warning event occurred.  EventID: 0x000003F6
            Time Generated: 01/23/2015   13:08:59
            Event String:
            Name resolution for the name msi.com timed out after none of the con
figured DNS servers responded.
         A warning event occurred.  EventID: 0x000003F6
            Time Generated: 01/23/2015   13:13:41
            Event String:
            Name resolution for the name msi.com timed out after none of the con
figured DNS servers responded.
         A warning event occurred.  EventID: 0x00001795
            Time Generated: 01/23/2015   13:38:14
            Event String:
            The program lsass.exe, with the assigned process ID 456, could not a
uthenticate locally by using the target name ldap/pdc2k8.msi.com. The target nam
e used is not valid. A target name should refer to one of the local computer nam
es, for example, the DNS host name.
         ......................... MSIPDCWIN082 failed test SystemLog
      Starting test: VerifyReferences
         ......................... MSIPDCWIN082 passed test VerifyReferences


   Running partition tests on : Schema
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation

   Running partition tests on : Configuration
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation

   Running partition tests on : msi
      Starting test: CheckSDRefDom
         ......................... msi passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... msi passed test CrossRefValidation

   Running enterprise tests on : msi.com
      Starting test: LocatorCheck
         ......................... msi.com passed test LocatorCheck
      Starting test: Intersite
         ......................... msi.com passed test Intersite



↧

Bridgehead Server

January 22, 2015, 12:43 pm
$
0
0

How secure are bridgehead servers?  This is a question that my instructor asked me via discussion.

↧
Search

Account Operators couldn't reset their own passwords

January 22, 2015, 2:27 pm
$
0
0

We have new admin accounts created for the L1 admins and they're supposed to have the ability to unlock accounts, reset user passwords, create, delete and modify groups and membership, manage print servers and add/remove computers to domain.

These admin accounts are part of Account Operators, Print Operators and another security group (delegated in OU level for managing the workstations in the domain like adding/removing).

We're using Windows 2012 R2 Standard.

The issue is the new admin accounts have the ability to perform all their tasks other than resetting their own passwords. Appreciate your response on this as this is creepy and lingering for a week and still couldn't figure out the cause.

↧

Force Forest Trust to establish between Core DCs

January 22, 2015, 7:16 pm
$
0
0

Hi,

The scenario is as follows; 2 forests which require a trust. Network comms only allow Domain Controllers residing in respective data centres to talk yet there are multiple remote sites in each forest.

I am finding that the verification and trust secure channel works intermittently and external network monitoring indicates DCs trying to talk to remote site DCs (which indeed fails).

_msdcs nslookup returns all DCs in 'other' domain and all with same priority and weight (0,100). There is conditional forwarding configured (also tried Stub and Primary Zones with same result). I am suspecting that a round robin / pseudorandom effect is happening that results in timeouts.

How does one establish consistent trust communication between 'bridgehead' domain controllers while ignoring those DCs that are not reachable?

Appropriate ports are open and tested. These are Windows 2008 DCs in Windows 2003 functional level. I have researched DCLocator and AD Site configuration without luck. If we need to change SRV records for ONLY those trust domain requests, how would that be achieved?

Thanks in Advance,

Al

↧
↧

Windows Server 2012 DC with Server 2008 DC

January 20, 2015, 8:22 pm
$
0
0

I have 2 DC's installed for my Domain. One is 2012(DC1) and the other one is 2008(DC2). 2008 one I installed later. I have the below setup.

DC1

  • IP - 192.168.1.4
  • Windows Server 2012
  • DNS : 127.0.0.1, 192.168.1.11

 

DC2

  • IP - 192.168.1.11
  • Windows Server 2008 R2
  • DNS : 192.168.1.4, 127.0.0.1

Workstation Computer

  • Windows XP
  • IP - 192.168.1.32
  • DNS : 192.168.1.11

Because I want to test the new DC(DC2), I shut down DC1 and tried to log in to the Workstation computer but it says the Domain is not available. But when I turn on the DC1 and try to log in, it logs me in fine even though the DNS I set on the workstation computer is only DC2 IP. That means, the workstation computer user account is always authenticated by DC1 even though the request goes through DC2. I'm not sure what is going on here. Any ideas??


↧

Computer domain re-join

January 23, 2015, 3:34 am
$
0
0

Hi

If we manually change the domain membership of a server from DomainA to DomainB, but then need to return it to DomainA (e.g. something doesn't work while on DomainB) can this be done cleanly ?  Or is it effectively creating a new computer account back in DomainA ?  With new GUID/SID etc ?

Would a full backup of the server (including system state) make any difference ? I don't think it would as it is the reference in A.D. which has been changed.

Does the computer account go disabled or get deleted when removed from DomainA ?  Or does this depend on what account is used to perform the task ?

Thanks

↧

Windows 2008 R2 Event Id 12294 User Locked

January 23, 2015, 2:59 am
$
0
0

Dear All

I have suddenly facing problem that our users going to be locked out. event 12294 is generated active directory server.

please find attached error log

pls help

Sunil

SUNIL PATEL SYSTEM ADMINISTRATOR

↧
Viewing all 31638 articles
Browse latest View live
Search
<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>