Reasons:

Machines with the same SID will not be able to join to the domain. From Microsoft system point of view, SID should be unique for every computer device that connected to the Active Directory.
Read More: https://www.raymond.cc/blog/how-to-use-sysprep-to-generate-unique-sid-before-cloning/

any other updates ? on changing the SID of the system.

Regards

Basavaraj.R Navalgund

banavalg@yahoo.com

Anyone know how to query a specific value with a AD LDS & AD sync  when using Full Proxy user?

According to the following article, you need to login before you can proxy.

.

https://technet.microsoft.com/en-us/library/2008.12.proxy.aspx

.

Now when I translate this to powershell, first part is working (login), but the second part, searching is not.

It returns the object is not on the server, bad enumeration.

.

$CurrentDomain = "LDAP://ADLDS"

$root = New-Object System.DirectoryServices.DirectoryEntry($CurrentDomain,$UserName,$Password)

$adfind[0].Path.UserAccountControl

I have recently gotten an HP Gen 8 microserver, the G1610t. I've been following the TechNut guide tosetting it up  on YouTube found at: https://www.youtube.com/playlist?list=PLfYIS7PWFoq5zRq9ObjDbKa-R07CwbHBV

Pretty good series and mostly smooth sailing so far until trying to join the server to the domain I have set up using sconfig where I get the error:
"The specified domain either does not exist or could not be contacted"

So, Windows 2012 on the server, configured not through Hyper-V Server but by remoting onto the desktop and setting up, only real difference I've had so far to the videos, can't see that being the issue.

On the server, using Hyper-V Manager I have created a new virtual switch and a new VM called HOME-DC01 using the Windows 2012 evaluation iso available at https://www.microsoft.com/en-us/evalcenter/evaluate-hyper-v-server-2012-r2

I'm intending this VM to be the domain controller. Once started have applied all available patches, restarted. Then in Server Manager, using the Add Role wizard, added the Active Directory Domain Services role. Promoted the server to Domain Controller and then I created a new forest and specified the domain name as home.local. Installation seems to go ok, I can log in, services seem to be running and looking in Server Manager after RDP'ing into the server all Roles are green (AD DS, DNS, File and Storage Services as well as Local Sever and All Servers)

Back on the microserver, I have changed the DNS server to be the new domain controller using sconfig. Ping to the Domain Controller using the IP address and the hostname both work. I've used google (8.8.8.8) as the secondary DNS.

Now when I try to change the domain in sconfig, I get the error:
"The specified domain either does not exist or could not be contacted"

I think the firewalls are open as needed as I've run:
Set-NetFirewallRule -DisplayGroup 'Windows Management Instrumentation (WMI)' -Enabled true
Set-NetFirewallRule -DisplayGroup 'Remote Event Log Management' -Enabled true
Set-NetFirewallRule -DisplayName "Windows Firewall Remote Management (RPC)
Set-NetFirewallRule -DisplayName "Windows Firewall Remote Management (RPC-EPMAP)

Can anyone help with my error? Point me in the direction of what else I should check or what I might have missed? I've tried recreating the VM again but got the results (which is good as it's consistent). Been at this a week and making no progress.

Hi,

On windows 2012 server with active directory.

we would like to have a policy which will not allow user to use shift+delete in any desktop.

purpose is to avoid accidently deletion of file from users (don't want to allow users to delete any file from a client machine)

Regards,

Lakshmikanth

Hi all.

If I want to catch client details that have IP addresses that are not mapped to any AD sites do I need to enable Netlogon Level i.e. NLtest /DNFlag:0x0  or is this information captured by default with logging turned off?

Thanks

Hi All,

 Is there is any opensource tool for unlocking or resetting password for domain accounts?

The system time on our workstations are off by a few minutes compared to the time showing at time.gov.

They are in sync with our domain controllers which are off of real world time by the same amount, so this issue is not causing any problems locally.

I ran a w32tm query command on a domain controller (Hyper-V VM) and it says it's syncing with source IP 86.77.84.80.

I looked up the IP in a web search and found some very old posts (like this one from 2009http://arstechnica.com/civis/viewtopic.php?t=86542), so I wonder if that IP is still a valid IP to sync to today.

How can we get our domain controller time source more accurate with live atomic clocks so that our domain clients will sync accurate time?

Whether it is recomended to do P to v conversion for domain contoller.

Scenario : i have FSMO role in diffrent server i need to migrate one physical server to VM.  after conversion what precaution i need to take. 

I am having a strange random issue with the main domain controller not accepting log in from workstations and the DNS stops resolving, but after a reboot everything works again. This mainly occurs after a windows update as been applied.

Any ideas what would cause the domain controller to stop authenticating users?

Hi,

 We have an RODC whic currently have the PRP policies set - allowed includes a large number of users, including domain admins and the deny password caching group is empty.

I want to set the "managedBy" property of the RODC to an AD group - the value is empty. Before I do this, I wanted to check if setting the property strips or removes any existing permissions?

Thanks

I work in the tech dept of a school district. I'm not super familiar with active directory and group policy yet, but know the basics.

Physically, each school has a bunch of printers throughout the building.

In active directory, we have containers by school, then by room, and in each room we have the PCs. Each room has its own GP, assigning the PCs all printers and designating the default printer for that room.

So for example, say the middle school has 10 printers, and 10 rooms. There is a separate gpo for each room, and that gpo installs all 10 of the buildings printers and sets the default printer.

Ok, on to the question...I installed a new printer on the network. How can I add that printer to multiple gpo's? I don't want to import gpo settings bc that will overwrite the default printer setting for each room; and I don't particularly want to manually edit each gpo to add this new printer (though I believe that's how its been done in the past before I arrived).

Any suggestions on adding a single 'create printer' line to a selection of multiple group policy objects? Thanks!

The error message I'm seeing is "The security database on the server does not have a computer account for this workstation trust relationship." There's nothing wrong with the trust relationship and I have removed a computer from the domain, deleted the AD account, and re-added it to the domain successfully and I still get the same message but only when I am trying to change my password. Below are all the things I have tried unsuccessfully:

• Removed the computer account from the domain, deleted the account, and re-added the computer to the domain.
• Tested with domain admin account.
• Tried changing my password logged in directly into a domain controller.
• Issue occurs both on manual password change or forced password change.
• Copied existing account and tried changing the password.
• Created brand new (not copied) account in AD and tried changing the password.
• Tried resetting password on multiple computers.
• Removing Windows updates mentioned online that may cause this issue.

The only things that have worked are:

• Changing a local user account's password.
• Changing a domain account password via AD Users and Computers.

Our workstations are Windows 7 SP1 and our servers are Windows 2008 R2 SP1.

Christopher

Hello,

I have a Windows Server 2003 Active directory domain, composed of two domain controllers. And i want to create a new Read only domain controller in a new Windows Server 2008.

When i try to execute adprep /rodcprep we get this error :

What should be done to do this please?

Regards.

We have seen that MS will be moving away from supporting the cloud-synch products Windows Azure Active Directory Sync ("DirSync") and Azure Active Directory Sync ("Azure AD Sync") in favour of Azure Active Directory Connect.

Has there been any official announcement regarding the LDAP control also called DirSync?  My assumption is that it will continue to be a feature of future server products, because--you know, angry mob--but that is just my assumption.

Perhaps my search mojo is failing me but I cannot find an official clarification.  Have any of you seen or heard anything?

Many thanks in advance.

Hi

I've already configured the Add workstations to domain on default domain policyso only tier-2 IT members can add computers to a domain.

Now, as sometimes they forget to properly move computers from container COMPUTERS to proper OU, I want to prevent them to use the Computer container.

From ADUC I've modified security settings on COMPUTER container and removing create/delete computer objects to their security group (so only domain admins and default groups such as backup operators have default security rights) and instructed them to join computers using Add-Computer -Domainname "domain" -OUPath distinguishedName

I tested from ADUC drag and drop computers from and to COMPUTERS container and everything seems fine, but then I attempted to join a computer using usual button from Computer Name popup and still managed to join computer to COMPUTERS container. (used an account that is in Tier-2 security group).

Any suggestion on how could I prevent this?

Main reasons for this are:

Can't apply GPOs to COMPUTERS so I can't prevent someone to log in locally if it's missconfigured.

GPP for printers, network shares and so on aren't applied either so users tend to call for support asking for them.

Thanks in advance

Hi,

i'm witing because i have a big problem in my network. This is the layout

SITE-A (192.168.1.0/24)

dc1.domain.local : 192.168.1.1  

dc2.domain.local :  192.168.1.2

vpn

SITE-B (192.168.2.0/24)

rodc1.domain.local: 192.168.2.1 (Read only domain controller)

from a client on site b, if i ping domain.local response the 192.168.1.1 trought VPN.

how can edit settings to response from RODC (192.168.2.1) ?

I would like to receive the response from the local server for browse \\domain.local

thank you and best regards

Hi Experts,

Can you help me on below issue.

After rebooting One of my SQL server and windows machine, In SQL Server services part, MSSQLSERVER will starts automatically but SQLSERVERAGENT  service has not start automatically, While I am trying to restart first time it will shows below error. But If I  restart 2nd time  SQLSERVERAGENT Services it will start and service will up and running fine.

My doubt it why 1st time itself not running SQLSERVERAGENT services

What we need to do for fixing this issue.

Thanks

Ramu Annamalai

Hi Team,

 I Need your help ..

Do i need to purchase CAL for the each user/computer adding to Active directory.

Thanks

People,

Can anyone here please share the steps to fix this issue where the Repadmin result is showing error fromPRODDC01-VM 192.168.1.200 into PRODDC02-VM192.168.1.201 ?

and also I cannot manage the PRODDC02-VM DNS from locally or fromPRODDC01-VM.

Here is some additional information:

PRODDC01-VM DCDIAG:

PS C:\> dcdiag

Directory Server Diagnosis

Performing initial setup:
   Trying to find home server...
   Home Server = PRODDC01-VM
   * Identified AD Forest.
   Done gathering initial info.

Doing initial required tests

   Testing server: SYDNEY\PRODDC01-VM
      Starting test: Connectivity
         ......................... PRODDC01-VM passed test Connectivity

Doing primary tests

   Testing server: SYDNEY\PRODDC01-VM
      Starting test: Advertising
         ......................... PRODDC01-VM passed test Advertising
      Starting test: FrsEvent
         ......................... PRODDC01-VM passed test FrsEvent
      Starting test: DFSREvent
         There are warning or error events within the last 24 hours after the SYSVOL has been shared.  Failing SYSVOL replication problems may cause Group Policy problems.
         ......................... PRODDC01-VM failed test DFSREvent
      Starting test: SysVolCheck
         ......................... PRODDC01-VM passed test SysVolCheck
      Starting test: KccEvent
         ......................... PRODDC01-VM passed test KccEvent
      Starting test: KnowsOfRoleHolders
         ......................... PRODDC01-VM passed test KnowsOfRoleHolders
      Starting test: MachineAccount
         ......................... PRODDC01-VM passed test MachineAccount
      Starting test: NCSecDesc
         ......................... PRODDC01-VM passed test NCSecDesc
      Starting test: NetLogons
         ......................... PRODDC01-VM passed test NetLogons
      Starting test: ObjectsReplicated
         ......................... PRODDC01-VM passed test ObjectsReplicated
      Starting test: Replications
         REPLICATION LATENCY WARNING
         ERROR: Expected notification link is missing.
         Source PRODDC02-VM
         Replication of new changes along this path will be delayed.
         This problem should self-correct on the next periodic sync.
         ......................... PRODDC01-VM passed test Replications
      Starting test: RidManager
         ......................... PRODDC01-VM passed test RidManager
      Starting test: Services
         ......................... PRODDC01-VM passed test Services
      Starting test: SystemLog
         A warning event occurred.  EventID: 0x0000000C
            Time Generated: 11/17/2016   20:44:40
            Event String:
            Time Provider NtpClient: This machine is configured to use the domain hierarchy to determine its time source
, but it is the AD PDC emulator for the domain at the root of the forest, so there is no machine above it in the domain
hierarchy to use as a time source. It is recommended that you either configure a reliable time service in the root domai
n, or manually configure the AD PDC to synchronize with an external time source. Otherwise, this machine will function a
s the authoritative time source in the domain hierarchy. If an external time source is not configured or used for this c
omputer, you may choose to disable the NtpClient.
         A warning event occurred.  EventID: 0x000727AA
            Time Generated: 11/17/2016   20:44:45
            Event String:
            The WinRM service failed to create the following SPNs: WSMAN/PRODDC01-VM.KTM.COM; WSMAN/PRODDC01-VM.
         A warning event occurred.  EventID: 0x000003F6
            Time Generated: 11/17/2016   20:44:57
            Event String:
            Name resolution for the name KTM.COM timed out after none of the configured DNS servers responded.
         A warning event occurred.  EventID: 0x0000168D
            Time Generated: 11/17/2016   20:45:31
            Event String:
            The following DNS server that is authoritative for the DNS domain controller locator records of this domain controller does not support dynamic DNS updates:
         A warning event occurred.  EventID: 0x000003F6
            Time Generated: 11/17/2016   20:45:31
            Event String:
            Name resolution for the name KTM.COM timed out after none of the configured DNS servers responded.
         A warning event occurred.  EventID: 0x000003F6
            Time Generated: 11/17/2016   20:46:02
            Event String:
            Name resolution for the name KTM.COM timed out after none of the configured DNS servers responded.
         A warning event occurred.  EventID: 0x00001796
            Time Generated: 11/17/2016   20:54:40
            Event String:
            Microsoft Windows Server has detected that NTLM authentication is presently being used between clients and this server. This event occurs once per boot of the server on the first time a client uses NTLM with this server.
         ......................... PRODDC01-VM passed test SystemLog
      Starting test: VerifyReferences
         ......................... PRODDC01-VM passed test VerifyReferences


   Running partition tests on : ForestDnsZones
      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test CrossRefValidation

   Running partition tests on : DomainDnsZones
      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test CrossRefValidation

   Running partition tests on : Schema
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation

   Running partition tests on : Configuration
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation

   Running partition tests on : KTM
      Starting test: CheckSDRefDom
         ......................... KTM passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... KTM passed test CrossRefValidation

   Running enterprise tests on : KTM.COM
      Starting test: LocatorCheck
         ......................... KTM.COM passed test LocatorCheck
      Starting test: Intersite
         ......................... KTM.COM passed test Intersite
PS C:\>

PRODDC02-VM DCDIAG:

PS C:\Users\Administrator.KTM> dcdiag

Directory Server Diagnosis

Performing initial setup:
   Trying to find home server...
   Home Server = PRODDC02-VM
   * Identified AD Forest.
   Done gathering initial info.

Doing initial required tests

   Testing server: SYDNEY\PRODDC02-VM
      Starting test: Connectivity
         The host 94ddd95e-a625-4e14-987d-fca5ab9fdf59._msdcs.KTM.COM could not be resolved to an IP address. Check the
         DNS server, DHCP, server name, etc.
         Got error while checking LDAP and RPC connectivity. Please check your firewall settings.
         ......................... PRODDC02-VM failed test Connectivity

Doing primary tests

   Testing server: SYDNEY\PRODDC02-VM
      Skipping all tests, because server PRODDC02-VM is not responding to directory service requests.


   Running partition tests on : ForestDnsZones
      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test CrossRefValidation

   Running partition tests on : DomainDnsZones
      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test CrossRefValidation

   Running partition tests on : Schema
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation

   Running partition tests on : Configuration
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation

   Running partition tests on : KTM
      Starting test: CheckSDRefDom
         ......................... KTM passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... KTM passed test CrossRefValidation

   Running enterprise tests on : KTM.COM
      Starting test: LocatorCheck
         Warning: DcGetDcName(PDC_REQUIRED) call failed, error 1355
         A Primary Domain Controller could not be located.
         The server holding the PDC role is down.
         Warning: DcGetDcName(TIME_SERVER) call failed, error 1355
         A Time Server could not be located.
         The server holding the PDC role is down.
         Warning: DcGetDcName(GOOD_TIME_SERVER_PREFERRED) call failed, error 1355
         A Good Time Server could not be located.
         ......................... KTM.COM failed test LocatorCheck
      Starting test: Intersite
         ......................... KTM.COM passed test Intersite
PS C:\Users\Administrator.KTM>

From the below screenshot, you can see that the AD object created from PRODDC02-VM 192.168.1.201 is replicated successfully in PRODDC01-VM 192.168.1.200

Any help would be greatly appreciated.

Thanks.

/* Server Support Specialist */