Hi to all,

I'm having an issue with my DC.

I have two DC's in my domain: DC01 and DC02.

I changed the names for both DC's and now I'm having the following error when I try to create a new user :Windows cannot verify that the user name is unique because the following error occurred while contacting the global catalog:Logon failure: unknown user name or bad password.

Please can you help me.

Thanks.

We have external users connecting to our network through a VPN service.  If their account they are logging into their PC with (ex. jsmith) matches an account on our domain (ex. abc\jsmith), we see invalid password attempts on our domain account.  The external users are mostly running a version of Windows 7 and joined to another domain.  So, when they login to their PC, they login to the account home\jsmith.  As soon as they connect up to the VPN, we see invalid passwords on the 2008 DC's for account ndgov\jsmith coming from the IP address assigned to their external users computer on our domain.  We see this from many different computers.  The only solution we have found is to either have the user change their account they are logging into the external PC (if their ID's actually match) to use an account that does not belong to our domain or synch their passwords.

We have utilized VPN for many years, but this only reared it's head when we migrated to a new solution due to support for Windows 7 (couple years ago).  So, not sure if this is a Windows 7 issue where it is not sending the domain information with the request or our DC's that are ignoring the domain information in the authentication request.

Any insight would be appreciated. 

Thanks in advance.

Greetings.

I'm Willing to take all information of an active directory (W2003) for each user the server has. This means to know all the configuration that affects to each user (Department, Site, GPOs, logon Scripts etc...). In general, i know what info i should check to have all the information from each user, but i would like to ask for some tips/guide/tools (official tools) that maybe could help me to take this information. Maybe there are some points that i'm not considering.

Thanks in advance.

Hi,

I am receiving the following error while trying to migrate user with SIDHistory on my ADMT 3.2 Server.

"Could not verify auditing and TcpipClientSupport on domains. Will not be able to migrate Sid's. Access is denied."

NOTE: I have already followed the recommendations as per the following article, but still it doesn't appear to be working and I am receiving the above error.

http://technet.microsoft.com/en-us/library/cc974410(v=ws.10).aspx

STEPS ALREADY FOLLOWED:

HA

Current setup:  3 x Windows 2003 R2 Enterprice domain controllers, a file server, Exchange 2003 single server and various other member servers.  Clients running either Windows XP Pro SP2 or Windows 7 Pro SP1

The problem: Inability to promote a domain controller. Have to rely on Install From Media (IFM) to promote. Things fail when normal dcpromo is used and the same error appears: "Directory Object Not Found"

The probable cause:  MS support found out that the "iscriticalsystemobject" attribute of the built-in admin account was set to False instead of True.  Unable to change to True because it says the account is owned by SAM.  This glitch most likely existed from Day 1. 

Attempts:  attempts to promote new DCs have obviously failed unless of course IFM is used.  Attempt to conduct an in-place upgrade of a Windows 2003 DC to Windows 2008 DC and then use the IFM method to promote a Windows 2008 R2 DC have also failed.  Due to different OS level versions.

Questions:

1) Are there any known fixes for this attribute problem with admin account?

2) if there are none, what is the next option?  Create a new domain?

3) Should a new domain be started or a new forest?

4) Can the new domain/forest link to the old one to allow cross usage of resources as well as migration of AD objects?

5) If not will ADMT work? Will ADMT also bring over the nasty attribute issue as well?

6) Any suggestions where to go from here?

Hi

 I have 10 DCs in my child domain and in parent domain have 3 Dcs.

I don't have any DNS in root domain.

 I have all ADDNS in child domain and my parent domain DCs are pointing to child Domain ADDNS in TCP/IP properties on preferred DNS.

 As of now everything is working fine.

 But i can see some discrepancy in my child domain ADDNS settings as follows:

 1:- DC20, 21, 22, 23 & 24 has the same conditional forwarders updated to each other and except these 5 dcs, all other dcs don't have same conditional forwarders.

 2:- DC20, 21, 22, 23 &  24 has the ISP IP address details in the forwarders but other remaining DCs are having DC20, DC21 IP address in the forwarders.

 Also I have forest wide zone data replication enabled in the ADDNS.

I want to know that why its discrepancies in the same domain Active directory integrated DNS?

Hello all,

we have the HQ Active Directory and we have around 200 branch also we have a daily integration process that takes between 2 to 6 H to complete this integration process get the AD Users from Softpeople DB, we need to implement RODC in each branch with considering the following 

1- no replication should be happen between the AD and the RODC before the end of the integration process

2-  each branch has its OU that contains all users and Groups can we assign an OU to a certain RODC ?

3- can we choose certain  objects to be replicated or just attributes ?

hi,

We have some usernames and passwords in a domain (Active Directory) and we wanna transfer or copy them to another domain, the main point is that there's no any relation and replication between these two domain controllers.

My question is that how can i do this???

thanx in advance .MoRi

Hi Team,

I need to block IP addresses using DNS sinkholing.  How to configure in DNS ?

kindly help out me.

This posting is provided "AS IS" with no warranties and confers no rights! Always test ANY suggestion in a test environment before implementing!

Hello Everyone,

I've a small setup at home and here are the details:

1. I've installed AD on one machine and it's DNS server too (with static IP). And this was done few months back.

2. Now, I've a installed a router too and it's connected to internet, hence I can access internet nicely.

3. My domain controller and a smartphone is connected to router via wireless. And these both are getting their IPs from DHCP enabled router.

Here I'm confused that does DNS forward lookup zone get updated with new IP for domain controller?? And how does everything syncs up? There is one more thing, when I try to access my DC with my smartphone using hostname, it doesn't show up on the phone but it does show up when accessed using IP of DC. Please someone help.

Kind regards,

Aniruddha 

In working with two different, and totally unrelated, unconnected AD domains, and in each I've found the same pecularity.

Both domains function normally. No issues whatsoever.

About a year ago, I rev'd the schema in each to the level of Windows Server 2008 R2. I installed new computers and promoted them to Domain Controllers, leaving in place, 'for the moment,' the old Windows Server 2003 domain controllers that were being superceded.

No issues.

Situation:   each domain has two W2K3 DC's and two W2K8 DC's running at the W2K3 Forest and Domain functional levels.

Last week, I was about to demote the Windows Server 2003 domain controllers when I noticed a pecularity. In running replmon on the oldsters, I noted that each W2K8 DC had connections to each of the W2K3 domain controllers -- but not to its partner W2K8 DC. Running DSSITE.MSC on each W2K8 controller confirmed this.

It didn't look as if the two W2K8 DC's had connections to each other.

Is this normal, or pathological?

Will this clear up when I demote the W2K DC's, or wll it require further action?

Thanks in advance.

Raghuraj Sharma

Hello all.  i can't seem to add a pc to my office domain.  I could do this in the past with no problem but now I can't....   I am sing the domain admin account.  

windows 2000 server. windows xp pro laptop.  

I will post the error messages and logs soon as possible.

Thanks

Hi,

i m getting bellow error under "Directory Service" events on my every domain controller...

pls. help me to sort this out.

-------

This is the replication status for the following directory partition on this directory server. Directory partition:CN=Configuration,DC=Domain ,DC=com This directory server has not recently received replication information from a number of directory servers.  The count of directory servers is shown, divided into the following intervals.

More than 24 hours:
1
More than a week:
1
More than one month:
1
More than two months:
0

---------------------

repadmin /showvector /latency DC=domain,DC=Com  shows bellows..

2851c3ac-1108-4aac-9608-a07d32c879e7 @ USN     41591 @ Time (unknown)
1223c1fc-1402-4b30-833f-c24ba17841b8 @ USN    185138 @ Time (unknown)
1e5c730d-eddc-4492-b909-b4a27fae2db7 @ USN      6619 @ Time 2005-10-31 12:58:30
7a922154-dc44-4efd-b4c4-6ca7d5644371 @ USN     22134 @ Time 2007-01-05 11:05:20
90ef3ee7-54ec-4696-881b-368368ea4f47 @ USN     16591 @ Time 2007-02-20 17:25:02
fa3c588b-6865-45e6-92d1-854767942944 @ USN   3621800 @ Time 2007-08-29 15:26:18
e66046a1-4a70-4538-9cc2-b50d50396825 @ USN    973525 @ Time 2007-11-23 10:52:12
308b9a54-bb7f-4f08-90b6-105365974da9 @ USN     51581 @ Time 2008-03-05 11:05:58
7e12d19d-6407-4546-920a-97346d2fe4a5 @ USN   1453417 @ Time 2008-05-12 18:26:23
0044325e-eb34-4067-9ddb-d76d8e926be2 @ USN  10195260 @ Time 2008-05-12 19:07:57
948c7c7d-c535-42dc-8f03-bd17548242c8 @ USN   1432178 @ Time 2008-05-26 18:20:24
e3b0b895-9ebe-438b-a95a-af917286995b @ USN  10580025 @ Time 2008-05-27 17:22:15
d2b7e144-e1f8-4983-85d2-509227bca11d @ USN  10752012 @ Time 2008-06-02 22:22:15
283f3bea-a49f-4e23-b293-edbb4e801afc @ USN     41031 @ Time 2008-07-04 07:00:12
ee9a214a-7cb7-4493-9962-2e12032768d7 @ USN     53589 @ Time 2008-07-04 12:50:09
f998f4f5-5088-47ac-b425-8437550076a4 @ USN  10842471 @ Time 2008-07-08 15:15:13
7240d8dd-5230-4825-b2ac-f62505d5e678 @ USN   1630669 @ Time 2008-09-26 15:50:38
fd29e05f-d068-48e7-b391-512e5f91feb3 @ USN  20359052 @ Time 2009-06-15 09:04:42
626aed3b-6ab6-47c2-bbe1-6948d543a439 @ USN   6675257 @ Time 2009-06-15 09:06:02
aecb0b51-b38f-4e8d-a1d4-3c8409b3c2a6 @ USN   2669438 @ Time 2009-08-31 07:31:35
d47a4101-688f-4467-91ef-dca4ffacdf34 @ USN   3333066 @ Time 2009-12-11 09:20:25
25a579f2-e9db-4a65-9c87-4b9ef0c33538 @ USN   1776084 @ Time 2010-03-19 18:43:38
13caf359-e384-4f10-85bb-18a9645545b9 @ USN  12084560 @ Time 2010-03-24 17:41:13
15d09514-1108-44d0-85a5-8c8f05442d7d @ USN   1724423 @ Time 2010-04-07 15:52:43
9aac8154-4bd7-4942-9eee-cdada4ee13b9 @ USN     57349 @ Time 2010-10-28 10:29:44
c1638603-067d-4b56-99db-8c951dee801d @ USN  19403280 @ Time 2011-01-06 18:58:50
a1b069a1-355d-4018-97e0-72cfdb69e6c7 @ USN  11165974 @ Time 2011-01-12 15:39:08
7a7ce435-2f93-4dd1-95d9-67d623f9a666 @ USN    823756 @ Time 2011-01-27 15:15:27
b0214bbd-503a-4771-9736-ff436f4fd5dc @ USN     90285 @ Time 2011-01-31 16:13:29
558a28f3-e4b8-455c-a9d2-dda8ea32a77a @ USN   5220516 @ Time 2012-08-21 11:07:09
LofacBranch\TECHMAIN                 @ USN   1457345 @ Time 2012-12-21 11:58:20
Cotta-Road\LCRMAIN                   @ USN   1724284 @ Time 2012-12-21 11:58:23
CLC-Head-Office\CLCMAIN              @ USN   8042487 @ Time 2012-12-21 11:58:23
XXXX-Head-Office\ROOTDC          @ USN  57482205 @ Time 2012-12-21 11:59:54
XXXX-Head-Office\ADC             @ USN  41784326 @ Time 2012-12-21 11:59:58
XXXX-Head-Office\PDC             @ USN  49975130 @ Time 2012-12-21 12:00:02

-------------------------------

Event Details:

----------------------------

I am seeing event ID 11 in event viewer for many servers (all sql servers) – windows 2003 Domain

There are multiple accounts with name MSSQLSvc/bq_sqlsrv.uk.corp.company.net:1433 of type DS_SERVICE_PRINCIPAL_NAME.

There are multiple accounts with name MSSQLSvc/dk_sqlsrv.uk.corp.company.net:1433 of type DS_SERVICE_PRINCIPAL_NAME.

There are multiple accounts with name MSSQLSvc/om_sqlsrv.uk.corp.company.net:1433 of type DS_SERVICE_PRINCIPAL_NAME.

So i had a read of this bloghttp://blog.joeware.net/2008/07/17/1407/ and ran his adfind tool which gives the below results.

C:\AdFind>adfind -sc c:bq_sqlsrv

AdFind V01.46.00cpp Joe Richards (joe@joeware.net) March 2012

Using server: CORPPL-AD02.corp.company.net:3268

Directory: Windows Server 2003

dn:CN=BQ_SQLSRV,OU=SQL Servers,OU=DB Management,DC=uk,DC=corp,DC=company,DC=

net

>objectClass: top

>objectClass: person

>objectClass: organizationalPerson

>objectClass: user

>objectClass: computer

>cn: BQ_SQLSRV

>distinguishedName: CN=BQ_SQLSRV,OU=SQL Servers,OU=DB Management,DC=uk,DC=corp,D

C=company,DC=net

>instanceType: 0

>whenCreated: 20040929141155.0Z

>whenChanged: 20120802201548.0Z

>displayName: BQ_SQLSRV$

>uSNCreated: 51099

>uSNChanged: 33966792

>name: BQ_SQLSRV

>objectGUID: {5A8EE7D2-32CD-4D60-B172-41B8CDABC96E}

>userAccountControl: 4096

>pwdLastSet: 129875983252290738

>primaryGroupID: 515

>objectSid: S-1-5-21-3484230728-397263411-2833629501-76113

>sAMAccountName: BQ_SQLSRV$

>sAMAccountType: 805306369

>dNSHostName: bq_sqlsrv.uk.corp.company.net

>servicePrincipalName: HOST/BQ_SQLSRV

>servicePrincipalName: HOST/bq_sqlsrv.uk.corp.company.net

>objectCategory: CN=Computer,CN=Schema,CN=Configuration,DC=net

>lastLogonTimestamp: 129884116473501859

--------------------------------------------------------------------------------------------------------------------------------------

Using server: CORPPL-AD02.corp.company.net:3268

Directory: Windows Server 2003

dn:CN=DK_SQLSRV,OU=SQL Servers,OU=DB Management,DC=uk,DC=corp,DC=company,DC=

net

>objectClass: top

>objectClass: person

>objectClass: organizationalPerson

>objectClass: user

>objectClass: computer

>cn: DK_SQLSRV

>distinguishedName: CN=DK_SQLSRV,OU=SQL Servers,OU=DB Management,DC=uk,DC=corp,D

C=company,DC=net

>instanceType: 0

>whenCreated: 20110104131322.0Z

>whenChanged: 20120805003536.0Z

>displayName: DK_SQLSRV$

>uSNCreated: 19016744

>uSNChanged: 34016653

>name: DK_SQLSRV

>objectGUID: {DDC551AB-F3F3-4BA9-BF8F-B1C169B6D670}

>userAccountControl: 4096

>pwdLastSet: 129886005142941672

>primaryGroupID: 515

>objectSid: S-1-5-21-3484230728-397263411-2833629501-144616

>sAMAccountName: DK_SQLSRV$

>sAMAccountType: 805306369

>dNSHostName: DK_SQLSRV.uk.corp.company.net

>servicePrincipalName: MSSQLSvc/DK_SQLSRV.uk.corp.company.net:1433

>servicePrincipalName: HOST/DK_SQLSRV.uk.corp.company.net

>servicePrincipalName: HOST/DK_SQLSRV

>objectCategory: CN=Computer,CN=Schema,CN=Configuration,DC=net

>dSCorePropagationData: 20120717092325.0Z

>dSCorePropagationData: 20120717092325.0Z

>dSCorePropagationData: 20120717092325.0Z

>dSCorePropagationData: 20120116132841.0Z

>dSCorePropagationData: 16010721193529.0Z

>lastLogonTimestamp: 129879221365397394

 --------------------------------------------------------------------------------------------------------------------------

C:\AdFind>adfind -sc c:om_sqlsrv

AdFind V01.46.00cpp Joe Richards (joe@joeware.net) March 2012

Using server: CORPPL-AD02.corp.company.net:3268

Directory: Windows Server 2003

dn:CN=OM_SQLSRV,OU=SQL Servers,OU=DB Management,DC=uk,DC=corp,DC=company,DC=

net

>objectClass: top

>objectClass: person

>objectClass: organizationalPerson

>objectClass: user

>objectClass: computer

>cn: OM_SQLSRV

>distinguishedName: CN=OM_SQLSRV,OU=SQL Servers,OU=DB Management,DC=uk,DC=corp,D

C=company,DC=net

>instanceType: 0

>whenCreated: 20120508133504.0Z

>whenChanged: 20120730083024.0Z

>displayName: OM_SQLSRV$

>uSNCreated: 31819155

>uSNChanged: 33884157

>name: OM_SQLSRV

>objectGUID: {A9DD88A8-832F-4E03-96BC-6A7A650859C3}

>userAccountControl: 4096

>pwdLastSet: 129862424766223764

>primaryGroupID: 515

>objectSid: S-1-5-21-3484230728-397263411-2833629501-142265

>sAMAccountName: OM_SQLSRV$

>sAMAccountType: 805306369

>dNSHostName: OM_SQLSRV.uk.corp.company.net

>servicePrincipalName: MSSQLSvc/OM_SQLSRV.uk.corp.company.net:1433

>servicePrincipalName: HOST/OM_SQLSRV

>servicePrincipalName: HOST/OM_SQLSRV.uk.corp.company.net

>objectCategory: CN=Computer,CN=Schema,CN=Configuration,DC=net

>dSCorePropagationData: 20120508145251.0Z

>dSCorePropagationData: 20120508145251.0Z

>dSCorePropagationData: 20120508145251.0Z

>dSCorePropagationData: 16010108151513.0Z

>lastLogonTimestamp: 129881103046782065

1. I have many other sql servers in our estate that produce no errors and just have two SPN's ( HOST\netbious and HOST\fqdn) which i believe are the defaults  
2. But I am worried about deleting MSSQLSvc/DK_SQLSRV.uk.corp.company.net:1433 because i can’t find any information that says MSSQLSvc will map to HOST   
3. I can’t find MSSQLSvc/BQ_SQLSRV.uk.corp.company.net:1433
4.  All 3 servers have sql installed and running.
5. I have many other sql servers in our estate that produce no errors and just have two SPN's ( HOST\netbios and HOST\fqdn) which i believe are the defaults

So i am not really sure how to proceed

Hello All,

I'm running into some serious network lag issues with mapped drives dropping and other weird Group Policy inconsistencies.  We have 2 DC on our domain and I've just run DCDIAG on one of the DCs - output is included below.  Any help is greatly appreciated!

Also, there have been a lot of repeated errors on the DC1 machine including:

Application - Userenv - EventID 1053 - Windows cannot determine the user or computer name.

System - Kerberos - EventID 4 - The kerberos client received a KRB_AP_ERR_MODIFIED error... password used to encrypt the kerberos service ticket is different than that on the target server... etc

DNS Server - DNS - EventID 4000 - The DNS server was unable to open Active Directory...

DCDiag results

DC1 - "PE2800"

Domain Controller Diagnosis

Performing initial setup:
   Done gathering initial info.

Doing initial required tests

   Testing server: Default-First-Site-Name\PE2800
      Starting test: Connectivity
         ......................... PE2800 passed test Connectivity

Doing primary tests

   Testing server: Default-First-Site-Name\PE2800
      Starting test: Replications
         [Replications Check,PE2800] A recent replication attempt failed:
            From PE2901 to PE2800
            Naming Context: DC=ForestDnsZones,DC=fla,DC=checkmate-florida,DC=com
            The replication generated an error (8614):
            The Active Directory cannot replicate with this server because the time since the last replication with this server has exceeded the tombstone lifetime.
            The failure occurred at 2012-12-25 21:48:31.
            The last success occurred at 2000-11-19 16:58:15.
            877 failures have occurred since the last success.
         [PE2901] DsBindWithSpnEx() failed with error -2146893022,
         The target principal name is incorrect..
         [Replications Check,PE2800] A recent replication attempt failed:
            From PE2901 to PE2800
            Naming Context: DC=DomainDnsZones,DC=fla,DC=checkmate-florida,DC=com
            The replication generated an error (8614):
            The Active Directory cannot replicate with this server because the time since the last replication with this server has exceeded the tombstone lifetime.
            The failure occurred at 2012-12-25 21:48:31.
            The last success occurred at 2000-11-19 16:58:15.
            877 failures have occurred since the last success.
         [Replications Check,PE2800] A recent replication attempt failed:
            From PE2901 to PE2800
            Naming Context: CN=Schema,CN=Configuration,DC=fla,DC=checkmate-florida,DC=com
            The replication generated an error (8614):
            The Active Directory cannot replicate with this server because the time since the last replication with this server has exceeded the tombstone lifetime.
            The failure occurred at 2012-12-25 21:48:31.
            The last success occurred at 2000-11-19 16:58:15.
            877 failures have occurred since the last success.
         [Replications Check,PE2800] A recent replication attempt failed:
            From PE2901 to PE2800
            Naming Context: CN=Configuration,DC=fla,DC=checkmate-florida,DC=com
            The replication generated an error (8614):
            The Active Directory cannot replicate with this server because the time since the last replication with this server has exceeded the tombstone lifetime.
            The failure occurred at 2012-12-25 21:49:31.
            The last success occurred at 2000-11-19 16:58:15.
            2044 failures have occurred since the last success.
         [Replications Check,PE2800] A recent replication attempt failed:
            From PE2901 to PE2800
            Naming Context: DC=fla,DC=checkmate-florida,DC=com
            The replication generated an error (8614):
            The Active Directory cannot replicate with this server because the time since the last replication with this server has exceeded the tombstone lifetime.
            The failure occurred at 2012-12-25 22:08:06.
            The last success occurred at 2000-11-19 17:13:12.
            78085 failures have occurred since the last success.
         REPLICATION-RECEIVED LATENCY WARNING
         PE2800:  Current time is 2012-12-25 22:08:18.
            DC=ForestDnsZones,DC=fla,DC=checkmate-florida,DC=com
               Last replication recieved from PE2901 at 2000-11-19 16:58:15.
               WARNING:  This latency is over the Tombstone Lifetime of 60 days!
            DC=DomainDnsZones,DC=fla,DC=checkmate-florida,DC=com
               Last replication recieved from PE2901 at 2000-11-19 16:58:15.
               WARNING:  This latency is over the Tombstone Lifetime of 60 days!
            CN=Schema,CN=Configuration,DC=fla,DC=checkmate-florida,DC=com
               Last replication recieved from PE2901 at 2000-11-19 16:58:15.
               WARNING:  This latency is over the Tombstone Lifetime of 60 days!
            CN=Configuration,DC=fla,DC=checkmate-florida,DC=com
               Last replication recieved from PE2901 at 2000-11-19 16:58:15.
               WARNING:  This latency is over the Tombstone Lifetime of 60 days!
            DC=fla,DC=checkmate-florida,DC=com
               Last replication recieved from PE2901 at 2000-11-19 17:13:12.
               WARNING:  This latency is over the Tombstone Lifetime of 60 days!
         ......................... PE2800 passed test Replications
      Starting test: NCSecDesc
         ......................... PE2800 passed test NCSecDesc
      Starting test: NetLogons
         ......................... PE2800 passed test NetLogons
      Starting test: Advertising
         ......................... PE2800 passed test Advertising
      Starting test: KnowsOfRoleHolders
         Warning: PE2901 is the Schema Owner, but is not responding to DS RPC Bind.
         [PE2901] LDAP bind failed with error 8341,
         A directory service error has occurred..
         Warning: PE2901 is the Schema Owner, but is not responding to LDAP Bind.
         Warning: PE2901 is the Domain Owner, but is not responding to DS RPC Bind.
         Warning: PE2901 is the Domain Owner, but is not responding to LDAP Bind.
         Warning: PE2901 is the PDC Owner, but is not responding to DS RPC Bind.
         Warning: PE2901 is the PDC Owner, but is not responding to LDAP Bind.
         Warning: PE2901 is the Rid Owner, but is not responding to DS RPC Bind.
         Warning: PE2901 is the Rid Owner, but is not responding to LDAP Bind.
         Warning: PE2901 is the Infrastructure Update Owner, but is not responding to DS RPC Bind.
         Warning: PE2901 is the Infrastructure Update Owner, but is not responding to LDAP Bind.
         ......................... PE2800 failed test KnowsOfRoleHolders
      Starting test: RidManager
         ......................... PE2800 failed test RidManager
      Starting test: MachineAccount
         ......................... PE2800 passed test MachineAccount
      Starting test: Services
         ......................... PE2800 passed test Services
      Starting test: ObjectsReplicated
         ......................... PE2800 passed test ObjectsReplicated
      Starting test: frssysvol
         ......................... PE2800 passed test frssysvol
      Starting test: frsevent
         ......................... PE2800 passed test frsevent
      Starting test: kccevent
         An Warning Event occured.  EventID: 0x8025082D
            Time Generated: 12/25/2012   22:03:31
            (Event String could not be retrieved)
         An Warning Event occured.  EventID: 0x8025082D
            Time Generated: 12/25/2012   22:03:31
            (Event String could not be retrieved)
         An Warning Event occured.  EventID: 0x8025082D
            Time Generated: 12/25/2012   22:03:31
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000748
            Time Generated: 12/25/2012   22:03:31
            (Event String could not be retrieved)
         An Warning Event occured.  EventID: 0x8025082D
            Time Generated: 12/25/2012   22:03:31
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000748
            Time Generated: 12/25/2012   22:03:31
            (Event String could not be retrieved)
         An Warning Event occured.  EventID: 0x8025082D
            Time Generated: 12/25/2012   22:03:31
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000748
            Time Generated: 12/25/2012   22:03:31
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000748
            Time Generated: 12/25/2012   22:03:31
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000748
            Time Generated: 12/25/2012   22:03:31
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC00007FA
            Time Generated: 12/25/2012   22:03:45
            (Event String could not be retrieved)
         ......................... PE2800 failed test kccevent
      Starting test: systemlog
         An Error Event occured.  EventID: 0x40000004
            Time Generated: 12/25/2012   21:08:40
            Event String: The kerberos client received a

         An Error Event occured.  EventID: 0x40000004
            Time Generated: 12/25/2012   21:08:42
            Event String: The kerberos client received a

         An Error Event occured.  EventID: 0x40000004
            Time Generated: 12/25/2012   21:10:39
            Event String: The kerberos client received a

         An Error Event occured.  EventID: 0x40000004
            Time Generated: 12/25/2012   21:10:39
            Event String: The kerberos client received a

         An Error Event occured.  EventID: 0x40000004
            Time Generated: 12/25/2012   21:13:19
            Event String: The kerberos client received a

         An Error Event occured.  EventID: 0x40000004
            Time Generated: 12/25/2012   21:18:31
            Event String: The kerberos client received a

         An Error Event occured.  EventID: 0x40000004
            Time Generated: 12/25/2012   21:33:31
            Event String: The kerberos client received a

         An Error Event occured.  EventID: 0x40000004
            Time Generated: 12/25/2012   21:33:31
            Event String: The kerberos client received a

         An Error Event occured.  EventID: 0x40000004
            Time Generated: 12/25/2012   21:52:14
            Event String: The kerberos client received a

         ......................... PE2800 failed test systemlog
      Starting test: VerifyReferences
         ......................... PE2800 passed test VerifyReferences

   Running partition tests on : ForestDnsZones
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom

   Running partition tests on : DomainDnsZones
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom

   Running partition tests on : Schema
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom

   Running partition tests on : Configuration
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom

   Running partition tests on : fla
      Starting test: CrossRefValidation
         ......................... fla passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... fla passed test CheckSDRefDom

   Running enterprise tests on : fla.checkmate-florida.com
      Starting test: Intersite
         ......................... fla.checkmate-florida.com passed test Intersite
      Starting test: FsmoCheck
         ......................... fla.checkmate-florida.com passed test FsmoCheck

DC2 - PE2901

hey guys i want to add a delegation control, where i would like to have a user Read/Write permissions over an OU.

I can do this manually,but how can i do it pro grammatically??

can any one help me out here

Hello,

I'm working on building a disaster recovery plan for Active Directory.

AD production environment is made of 2008 R2 SP1 domain controllers, all DNS and Global catalog, and two domain (a root and a child). AD Recycle Bin is enabled.

By browsing Technet documentation, removing temporarily the Global Catalog role during recovery operations is a part of the process (as to prevent lingering objects).

However i wonder if it is necessary when all of your DC are Global Catalog, and located on the same AD site.

I'm still quite green with this kind of high-level AD stuff so advice from more aknowledgeable people would be appreciated.

Regards,

Neb

I set up a stand alone AD LDS server in DMZ, and was able to configure it to adamsync to our internal AD manually. The way I sync is to run adamsync as a local administrator, while in the configuration XML file I added internal AD user (see below). 

<source-ad-account>adldsuser</source-ad-account>
<account-domain>domain.us</account-domain>

When I run adamsync, I use /passprompt to enter domain\adldsuser password in command line. The problem is obvious: I have to remember to login to manually sync it every a couple days. I am desperate to know how to schedule it so that it can sync automatically. I tried search online but can't find any solution to it. 

In a practical world, how do you guys configure AD LDS in DMZ? and how to you accomplish syncing automatically?

Thanks

Byron