hi,

both of our primary and secondary domain controllers are crashed .  but i restored primary dc from a full server backup . still  not able to get it working . no backups of secondary dc . primary dc has dhcp role installed.

what are the steps should i follow.need a explained answer . thanks 

Is it possible to 'chain' AD Domain Controllers together such that there is a different network path between each DC...

DC1(root) ------- DC2 ------ DC3 ------ DC4 ------ etc...

In the minimal diagram above:

DC1 can only contact DC2 directly but not DC3 or DC4
DC2 can contact DC1 & DC3 directly but not DC4
DC3 can contact DC2 & DC4 directly but not DC1
DC4 can only contact DC3 directly but not DC1 or DC2

Can DC's 3 & 4 function correctly like this or does each peer DC need to have direct connectivity with the forest root?

Hi people i need generate wildcard certificate for *.domain1.com and *.sub.domain2.com

one second level wildcard and one third level wildcard. It is posibble to include this two domains in one wildcard certificate? I need it from public authority.

Thanks

Hello ,

I'm windows admin ,a user report to me that after he changed his password after expiration his account is locked out frequently ,I asked him to disconnect all network drives , I make sure no applicatin is using old password ..... but the issue still persist I would like to know if there is any tools like Account Lockout and Management Tools for windows 2008 R2  to help me determin why this account is loked and which computer or service is  tring to log on with his account

Regards

I've tried following the instructions found here: https://support.microsoft.com/en-us/kb/288167, but still cannot get a domain controller at my remote site to replicate.  The connection is good, the server is reachable, but the last replication was 21 days ago.

This is my current repadmin /replsummary:

Jason

Hi,

i have a requirement, where i have created an (Example OU) and under this OU i have placed few computers now i want only specific users should login to computers placed in (Example OU) only ,and not to any other computers in domain.i know this can be achieved by group policy but this is not preferable in my environment as in future i have to create many of such OU's.

Can i achieve this by OU Delegation, is there any such OU delegation where i can define that select user will login to computers that are placed in (Example OU) and if this user try to login in some other computer that is not part of (Example OU) they should get deny access.  

Friends:

My AD DS is throwing an error reading "An attempt to fetch the password of a group managed service account failed."  The name of the service account is msa; the computer that it references is my domain controller.  And it is reporting error 6, whatever that means.

Does anyone know what this is and how to fix it?

Micah

Hi All,

Please help me out to remove RODC role without affecting the server production environment. Is there is a way to perform it?

I am using windows server 2012 R2. RODC is in forest environment.

Thank You!!!

Regards,

Chinmay

Hello,

We currently don't have network admin onsite, and we are struggling some DNS resolving issues.

I added new A record to DNS.When I ping it, it is timed out, and can't reach to the website. It is DNN website which I made required configuration on it. What should I do to reach to the site from our network? We can access to the site from outside. What am I missing? Can you guys give me some direction?

Thank You

Hello,

i have domain controller and additional domain controller both now working , i have Also exchange 

the computer container & domain controller container  in DC is empty , all computers appear in ADC.

today i am try to search for (Microsoft Exchange System Objects)  did not find it on DC if find it ADC

NOTE: if create user in DC or in ADC it appear in both server.

please Advise me.

thanks

We are upgrading our DC's to 2008 R2, which has IPV6 enabled by default. Replication at a single site works fine, but we're running into problems replication across sites which are connected by VPN. Server 2003 did not have problems replicating across sites so I know there is not a connection or port problem. If I ping the GUID across sites, it tries to use the IPV6 address which will fail as our router/firewall/VPN endpoint is not IPV6 aware.
My question is, will AD try to connect over IPV4 if it first tries IPV6 and fails?
*We are using Direct Access, so disabling IPV6 is not a good solution.

hello,

I have one Domain Controller on windows server 2012

and many problems with them.

the main problem: that I can open  ADSI Edit console only, all others AD consoles don't work

DCDIAG/FIX

ipconfig /all

Windows IP Configuration

   Host Name . . . . . . . . . . . . : dc01
   Primary Dns Suffix  . . . . . . . : domain.local
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : domain.local

Ethernet adapter Ethernet:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft Hyper-V Network Adapter
   Physical Address. . . . . . . . . : 00-15-5D-BF-45-05
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::5507:3ae8:676e:4ab9%12(Preferred)
   IPv4 Address. . . . . . . . . . . : 172.16.191.215(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . :
   DHCPv6 IAID . . . . . . . . . . . : 251663709
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-19-27-DB-13-00-15-5D-BF-45-05

   DNS Servers . . . . . . . . . . . : 172.16.191.215
   NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter isatap.{1581C831-AF29-44A7-B2A4-C6B94AF3C967}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Directory Service Event ID 1126

Active Directory Domain Services was unable to establish a connection with the global catalog.
 
Additional Data
Error value:
1355 The specified domain either does not exist or could not be contacted.
Internal ID:
3200e24
 
User Action:
Make sure a global catalog is available in the forest, and is reachable from this domain controller. You may use the nltest utility to diagnose this problem.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-ActiveDirectory_DomainService" Guid="{0e8478c5-3605-4e8c-8497-1e730c959516}" EventSourceName="NTDS General" />
    <EventID Qualifiers="49152">1126</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>18</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2013-06-11T10:41:08.072581900Z" />
    <EventRecordID>313</EventRecordID>
    <Correlation />
    <Execution ProcessID="548" ThreadID="680" />
    <Channel>Directory Service</Channel>
    <Computer>dc01.domain.local</Computer>
    <Security UserID="S-1-5-7" />
  </System>
  <EventData>
    <Data>3200e24</Data>
    <Data>1355</Data>
    <Data>The specified domain either does not exist or could not be contacted.</Data>
  </EventData>
</Event>

SYSTEM Event ID 1129

The processing of Group Policy failed because of lack of network connectivity to a domain controller. This may be a transient condition. A success message would be generated once the machine gets connected to the domain controller and Group Policy has successfully processed. If you do not see a success message for several hours, then contact your administrator.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-GroupPolicy" Guid="{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}" />
    <EventID>1129</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2013-06-11T10:31:09.972110300Z" />
    <EventRecordID>5093</EventRecordID>
    <Correlation ActivityID="{785FA1A7-8FE6-4FCF-8180-4BBB9CA729FB}" />
    <Execution ProcessID="916" ThreadID="1192" />
    <Channel>System</Channel>
    <Computer>dc01.domain.local</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="SupportInfo1">1</Data>
    <Data Name="SupportInfo2">1532</Data>
    <Data Name="ProcessingMode">1</Data>
    <Data Name="ProcessingTimeInMilliseconds">16</Data>
    <Data Name="ErrorCode">1222</Data>
    <Data Name="ErrorDescription">The network is not present or not started. </Data>
  </EventData>
</Event>

SYSTEM Event ID 10010

The server {9BA05972-F6A8-11CF-A442-00A0C90A8F39} did not register with DCOM within the required timeout.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
    <EventID Qualifiers="0">10010</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2013-06-11T10:24:45.658290000Z" />
    <EventRecordID>4944</EventRecordID>
    <Correlation />
    <Execution ProcessID="772" ThreadID="1956" />
    <Channel>System</Channel>
    <Computer>dc01.domain.local</Computer>
    <Security UserID="S-1-5-21-74712226-1288518128-2718553363-500" />
  </System>
  <EventData>
    <Data Name="param1">{9BA05972-F6A8-11CF-A442-00A0C90A8F39}</Data>
  </EventData>
</Event>

Port Query :

Port            Local IP        State            Remote IP:Port
TCP 53          127.0.0.1       LISTENING        0.0.0.0:0
TCP 53          172.16.191.215  LISTENING        0.0.0.0:0
UDP 53          127.0.0.1                        *:*
UDP 53          172.16.191.215                   *:*
TCP 88          0.0.0.0         LISTENING        0.0.0.0:0
UDP 88          172.16.191.215                   *:*
UDP 123         0.0.0.0                          *:*
TCP 135         0.0.0.0         LISTENING        0.0.0.0:0
TCP 135         127.0.0.1       ESTABLISHED      127.0.0.1:58949
TCP 135         172.16.191.215  ESTABLISHED      172.16.191.215:58952
UDP 137         172.16.191.215                   *:*
UDP 138         172.16.191.215                   *:*
TCP 139         172.16.191.215  LISTENING        0.0.0.0:0
TCP 389         0.0.0.0         LISTENING        0.0.0.0:0
TCP 389         127.0.0.1       ESTABLISHED      127.0.0.1:49159
TCP 389         127.0.0.1       ESTABLISHED      127.0.0.1:49160
TCP 389         127.0.0.1       ESTABLISHED      127.0.0.1:49161
TCP 389         172.16.191.215  ESTABLISHED      172.16.191.215:49175
TCP 389         172.16.191.215  ESTABLISHED      172.16.191.215:49180
UDP 389         0.0.0.0                          *:*
TCP 445         0.0.0.0         LISTENING        0.0.0.0:0
TCP 464         0.0.0.0         LISTENING        0.0.0.0:0
UDP 464         172.16.191.215                   *:*
TCP 593         0.0.0.0         LISTENING        0.0.0.0:0
TCP 636         0.0.0.0         LISTENING        0.0.0.0:0
TCP 3268        0.0.0.0         LISTENING        0.0.0.0:0
TCP 3269        0.0.0.0         LISTENING        0.0.0.0:0
TCP 3389        0.0.0.0         LISTENING        0.0.0.0:0
UDP 3389        0.0.0.0                          *:*
UDP 5355        0.0.0.0                          *:*
TCP 5985        0.0.0.0         LISTENING        0.0.0.0:0
TCP 9389        0.0.0.0         LISTENING        0.0.0.0:0
TCP 47001       0.0.0.0         LISTENING        0.0.0.0:0
TCP 49152       0.0.0.0         LISTENING        0.0.0.0:0
TCP 49153       0.0.0.0         LISTENING        0.0.0.0:0
TCP 49154       0.0.0.0         LISTENING        0.0.0.0:0
TCP 49155       0.0.0.0         LISTENING        0.0.0.0:0
TCP 49156       0.0.0.0         LISTENING        0.0.0.0:0
TCP 49156       127.0.0.1       ESTABLISHED      127.0.0.1:58950
TCP 49156       172.16.191.215  ESTABLISHED      172.16.191.215:49177
TCP 49158       0.0.0.0         LISTENING        0.0.0.0:0
TCP 49159       127.0.0.1       ESTABLISHED      127.0.0.1:389
TCP 49160       127.0.0.1       ESTABLISHED      127.0.0.1:389
TCP 49161       127.0.0.1       ESTABLISHED      127.0.0.1:389
TCP 49170       0.0.0.0         LISTENING        0.0.0.0:0
TCP 49171       0.0.0.0         LISTENING        0.0.0.0:0
TCP 49175       172.16.191.215  ESTABLISHED      172.16.191.215:389
TCP 49177       172.16.191.215  ESTABLISHED      172.16.191.215:49156
TCP 49180       172.16.191.215  ESTABLISHED      172.16.191.215:389
TCP 49182       0.0.0.0         LISTENING        0.0.0.0:0
UDP 49783       127.0.0.1                        *:*
TCP 49804       172.16.191.215  ESTABLISHED      172.16.191.69:445
UDP 57560       127.0.0.1                        *:*
TCP 58949       127.0.0.1       ESTABLISHED      127.0.0.1:135
TCP 58950       127.0.0.1       ESTABLISHED      127.0.0.1:49156
TCP 58952       172.16.191.215  ESTABLISHED      172.16.191.215:135

also :

NETLOGON share is missing

that's all.

Help please

Hello

Today we noticed that a newly installed domain controller has problems with the replication.

a dcdiag says:

C:\Users\administrator.TECNOFIL>dcdiag

Directory Server Diagnosis

Performing initial setup:

   Trying to find home server...

   Home Server = TECGVM02

   * Identified AD Forest.

   Done gathering initial info.

Doing initial required tests

   Testing server: Default-First-Site-Name\TECGVM02

     Starting test: Connectivity

         ......................... TECGVM02 passed test Connectivity

Doing primary tests

   Testing server: Default-First-Site-Name\TECGVM02

      Starting test: Advertising

         ......................... TECGVM02 passed test Advertising

      Starting test: FrsEvent

         ......................... TECGVM02 passed test FrsEvent

     Starting test: DFSREvent

         There are warning or error events within the last 24 hours after the

         SYSVOL has been shared.  Failing SYSVOL replication problems may cause

         Group Policy problems.

         ......................... TECGVM02 failed test DFSREvent

      Starting test: SysVolCheck

         ......................... TECGVM02 passed test SysVolCheck

      Starting test: KccEvent

         A warning event occurred.  EventID: 0x80000603

            Time Generated: 12/12/2015   09:09:04

            Event String:

            Active Directory Domain Services could not disable the software-base

d disk write cache on the following hard disk.

         A warning event occurred.  EventID: 0x80000B46

            Time Generated: 12/12/2015   09:09:15

            Event String:

            The security of this directory server can be significantly enhanced

by configuring the server to reject SASL (Negotiate, Kerberos, NTLM, or Digest)

LDAP binds that do not request signing (integrity verification) and LDAP simple

binds that are performed on a clear text (non-SSL/TLS-encrypted) connection.  Ev

en if no clients are using such binds, configuring the server to reject them wil

l improve the security of this server.

         ......................... TECGVM02 passed test KccEvent

      Starting test: KnowsOfRoleHolders

         ......................... TECGVM02 passed test KnowsOfRoleHolders

      Starting test: MachineAccount

         ......................... TECGVM02 passed test MachineAccount

      Starting test: NCSecDesc

         ......................... TECGVM02 passed test NCSecDesc

      Starting test: NetLogons

         ......................... TECGVM02 passed test NetLogons

      Starting test: ObjectsReplicated

         ......................... TECGVM02 passed test ObjectsReplicated

      Starting test: Replications

         ......................... TECGVM02 passed test Replications

      Starting test: RidManager

         ......................... TECGVM02 passed test RidManager

      Starting test: Services

         ......................... TECGVM02 passed test Services

      Starting test: SystemLog

         A warning event occurred.  EventID: 0x80040020

            Time Generated: 12/12/2015   09:09:04

            Event String:

            The driver detected that the device \Device\Harddisk0\DR0 has its wr

ite cache enabled. Data corruption may occur.

         A warning event occurred.  EventID: 0x80040020

            Time Generated: 12/12/2015   09:09:04

            Event String:

            The driver detected that the device \Device\Harddisk0\DR0 has its wr

ite cache enabled. Data corruption may occur.

         A warning event occurred.  EventID: 0x80040020

           Time Generated: 12/12/2015   09:09:04

            Event String:

            The driver detected that the device \Device\Harddisk0\DR0 has its wr

ite cache enabled. Data corruption may occur.

         A warning event occurred.  EventID: 0x00001796

            Time Generated: 12/12/2015   09:09:18

            Event String:

            Microsoft Windows Server has detected that NTLM authentication is pr

esently being used between clients and this server. This event occurs once per b

oot of the server on the first time a client uses NTLM with this server.

         A warning event occurred.  EventID: 0x00002724

            Time Generated: 12/12/2015   09:09:25

            Event String:

            This computer has at least one dynamically assigned IPv6 address.For

reliable DHCPv6 server operation, you should use only static IPv6 addresses.

         ......................... TECGVM02 passed test SystemLog

      Starting test: VerifyReferences

        ......................... TECGVM02 passed test VerifyReferences

   Running partition tests on : ForestDnsZones

      Starting test: CheckSDRefDom

         ......................... ForestDnsZones passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... ForestDnsZones passed test

         CrossRefValidation

   Running partition tests on : DomainDnsZones

      Starting test: CheckSDRefDom

         ......................... DomainDnsZones passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... DomainDnsZones passed test

         CrossRefValidation

   Running partition tests on : Schema

      Starting test: CheckSDRefDom

         ......................... Schema passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... Schema passed test CrossRefValidation

   Running partition tests on : Configuration

      Starting test: CheckSDRefDom

         ......................... Configuration passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... Configuration passed test CrossRefValidation

   Running partition tests on : tecnofil

      Starting test: CheckSDRefDom

         ......................... tecnofil passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... tecnofil passed test CrossRefValidation

   Running enterprise tests on : tecnofil.ch

      Starting test: LocatorCheck

         ......................... tecnofil.ch passed test LocatorCheck

      Starting test: Intersite

         ......................... tecnofil.ch passed test Intersite

C:\Users\administrator.TECNOFIL>

Anybody an idea how to get this replication error between dc1 (TECGVM01) and dc2 (TECGVM02) fixxed?

Regards and thank you

Hi Everyone,

We have 2008R2 Domain controllers and the FFL/DFL is set to 2008R2. We also have the Account locked out duration policy set to 30 mts. What I need to understand is how do the users still send or receive emails with their ActiveSync and RPC/HTTPs enabled (on their mobile devices and non-domain joined PC's) whose account is locked out? where as they cannot access the OWA/Outlook or even login to their PC's during the locked out duration.

Does it have something to do with the Kerberos ticket life time?

Regards,

NitBinz

Dear DNS Admin,

We have three domain controller all are GC I have small doubt I have some issues from DNS from _Msdcs  I have seen my three domain controller from _Msdcs location is it correct ? 

Hello Experts,

Here is our current environment in our Domain -

Hello All,

1)If we add a machine to a  domain , will it be added to active directory(Domain Controller) compters list automatically or do we need to add it manually.

2)Are the DNS records created automatically or we need to maually create and entry for that particular computer.

waiting for your replies , Thanks in advance!!

Paramesh KA