Good morning.

I'm trying to figure out why one user at my workplace cannot log on to our support servers. Everyone else in the office can. I've checked in AD to se if his account belongs to the same groups as my account , and it seems to be so.  I've attempted to remove his machine from the domain and readied it. I also ran the nltest command [[nltest /Server:%hostname% /SC_RESET:northplains.com\(dc-name)]] to restore the trust relationship between his machine and the domain, which was executed successfully but no result. 

I also trued to have him log on from a different machine to see if the problem was rooted in his specific machine but still, received the same error.   Please any amount of insight would help. Really not sure how to proceed with this matter. I can be reached at npivott@northplains.com or via phone 647-537-5392

Thanks 

HI everyone,

Hope you can help. I had posted and asked something involving this little and hope you do not mind if there are some "repeats"...but I just like  to be safe. Currently my domain controllers are running in 2012r2, 2012, and 2008r2. I believe our current forest and domain function level is set to 2003 (there are only two options when I right click to raise the domain/forest level..they are 2008 and 2008r2).

I like to ask:

1.) Should I raise both forest and domain functions to 2008, or 2008r2?

2a.) Should  I raise the  domain function level before the forest level? or any specific orders in raising them? 

2b.) Any differences between them...or what will you suggest?

3.) If something goes wrong with 2008r2 level, may I change it to 2008 later on?

4.) In my environment, there may still be some application and file servers are running in 2003. Couple running XP for some reasons.. would the change affect these servers and computers?

Hope you can help. Thank you!

Takami Chiro

I noticed this error showing up in my Directory Service logs, and I've done some research and ran some commands. When I run repadmin /showrepl or repadmin /replsum, I don't see any replication errors. I ran dcdiag /e to get a little more info, and saw some warnings regarding sysvol, however, the only sysvol errors I see in the logs are regarding pausing for backup.

I ran repadmin /showvector /latency and got the output below. It lists two Domain Controllers that were demoted and removed in February of this year. They were replaced with new Domain Controllers with the same names. I'm not sure if this is part of the issue.

C:\Windows\system32>repadmin /showvector /latency DC=domainname,DC=internal
Caching GUIDs.
..
60412fcd-4cd5-4915-b3fe-ed02f2dfed21 @ USN  28281794 @ Time 2018-02-05 12:32:25
Default-First-Site-Name\ONPREM-DC1 (deleted DSA) @ USN  28362837 @ Time 2018-02-07 0
7:24:11
Default-First-Site-Name\ONPREM-DC2 (deleted DSA) @ USN  30001827 @ Time 2018-02-27 0
7:34:47
CLOUD\CLOUD-DC1                       @ USN   2370332 @ Time 2018-07-11 12:48:51
CLOUD\CLOUD-DC2                       @ USN   1757081 @ Time 2018-07-11 12:50:46
Default-First-Site-Name\ONPREM-DC3       @ USN  34359214 @ Time 2018-07-11 12:52:00
Default-First-Site-Name\ONPREM-DC2       @ USN   8066825 @ Time 2018-07-11 12:52:05
Default-First-Site-Name\ONPREM-DC1       @ USN  10051172 @ Time 2018-07-11 12:52:08

The top line of this output from 2018-02-05 is from a failed attempt to demote ONPREM-DC1 due to protection of accidental deleting. The wizard rolled back the changes successfully and the host was successfully demoted on 2018-02-07.

----------------------------------------------------------------------------------------

Below is the dcdiag output:

Directory Server Diagnosis


Performing initial setup:

   Trying to find home server...

   Home Server = onprem-dc1

   * Identified AD Forest.
   Done gathering initial info.


Doing initial required tests

   
   Testing server: Default-First-Site-Name\ONPREM-DC3

      Starting test: Connectivity

         ......................... ONPREM-DC3 passed test Connectivity

   
   Testing server: CLOUD\CLOUD-DC1

      Starting test: Connectivity

         ......................... CLOUD-DC1 passed test Connectivity

   
   Testing server: CLOUD\CLOUD-DC2

      Starting test: Connectivity

         ......................... CLOUD-DC2 passed test Connectivity

   
   Testing server: Default-First-Site-Name\ONPREM-DC1

      Starting test: Connectivity

         ......................... ONPREM-DC1 passed test Connectivity

   
   Testing server: Default-First-Site-Name\ONPREM-DC2

      Starting test: Connectivity

         ......................... ONPREM-DC2 passed test Connectivity



Doing primary tests

   
   Testing server: Default-First-Site-Name\ONPREM-DC3

      Starting test: Advertising

         ......................... ONPREM-DC3 passed test Advertising

      Starting test: FrsEvent

         ......................... ONPREM-DC3 passed test FrsEvent

      Starting test: DFSREvent

         There are warning or error events within the last 24 hours after the

         SYSVOL has been shared.  Failing SYSVOL replication problems may cause

         Group Policy problems.
         ......................... ONPREM-DC3 failed test DFSREvent

      Starting test: SysVolCheck

         ......................... ONPREM-DC3 passed test SysVolCheck

      Starting test: KccEvent

         ......................... ONPREM-DC3 passed test KccEvent

      Starting test: KnowsOfRoleHolders

         ......................... ONPREM-DC3 passed test KnowsOfRoleHolders

      Starting test: MachineAccount

         ......................... ONPREM-DC3 passed test MachineAccount

      Starting test: NCSecDesc

         ......................... ONPREM-DC3 passed test NCSecDesc

      Starting test: NetLogons

         ......................... ONPREM-DC3 passed test NetLogons

      Starting test: ObjectsReplicated

         ......................... ONPREM-DC3 passed test ObjectsReplicated

      Starting test: Replications

         ......................... ONPREM-DC3 passed test Replications

      Starting test: RidManager

         ......................... ONPREM-DC3 passed test RidManager

      Starting test: Services

         ......................... ONPREM-DC3 passed test Services

      Starting test: SystemLog

         ......................... ONPREM-DC3 passed test SystemLog

      Starting test: VerifyReferences

         ......................... ONPREM-DC3 passed test VerifyReferences

   
   Testing server: CLOUD\CLOUD-DC1

      Starting test: Advertising

         ......................... CLOUD-DC1 passed test Advertising

      Starting test: FrsEvent

         ......................... CLOUD-DC1 passed test FrsEvent

      Starting test: DFSREvent

         There are warning or error events within the last 24 hours after the

         SYSVOL has been shared.  Failing SYSVOL replication problems may cause

         Group Policy problems.
         ......................... CLOUD-DC1 failed test DFSREvent

      Starting test: SysVolCheck

         ......................... CLOUD-DC1 passed test SysVolCheck

      Starting test: KccEvent

         ......................... CLOUD-DC1 passed test KccEvent

      Starting test: KnowsOfRoleHolders

         ......................... CLOUD-DC1 passed test KnowsOfRoleHolders

      Starting test: MachineAccount

         ......................... CLOUD-DC1 passed test MachineAccount

      Starting test: NCSecDesc

         ......................... CLOUD-DC1 passed test NCSecDesc

      Starting test: NetLogons

         ......................... CLOUD-DC1 passed test NetLogons

      Starting test: ObjectsReplicated

         ......................... CLOUD-DC1 passed test ObjectsReplicated

      Starting test: Replications

         ......................... CLOUD-DC1 passed test Replications

      Starting test: RidManager

         ......................... CLOUD-DC1 passed test RidManager

      Starting test: Services

         ......................... CLOUD-DC1 passed test Services

      Starting test: SystemLog

         ......................... CLOUD-DC1 passed test SystemLog

      Starting test: VerifyReferences

         ......................... CLOUD-DC1 passed test VerifyReferences

   
   Testing server: CLOUD\CLOUD-DC2

      Starting test: Advertising

         ......................... CLOUD-DC2 passed test Advertising

      Starting test: FrsEvent

         ......................... CLOUD-DC2 passed test FrsEvent

      Starting test: DFSREvent

         ......................... CLOUD-DC2 passed test DFSREvent

      Starting test: SysVolCheck

         ......................... CLOUD-DC2 passed test SysVolCheck

      Starting test: KccEvent

         ......................... CLOUD-DC2 passed test KccEvent

      Starting test: KnowsOfRoleHolders

         ......................... CLOUD-DC2 passed test KnowsOfRoleHolders

      Starting test: MachineAccount

         ......................... CLOUD-DC2 passed test MachineAccount

      Starting test: NCSecDesc

         ......................... CLOUD-DC2 passed test NCSecDesc

      Starting test: NetLogons

         ......................... CLOUD-DC2 passed test NetLogons

      Starting test: ObjectsReplicated

         ......................... CLOUD-DC2 passed test ObjectsReplicated

      Starting test: Replications

         ......................... CLOUD-DC2 passed test Replications

      Starting test: RidManager

         ......................... CLOUD-DC2 passed test RidManager

      Starting test: Services

         ......................... CLOUD-DC2 passed test Services

      Starting test: SystemLog

         ......................... CLOUD-DC2 passed test SystemLog

      Starting test: VerifyReferences

         ......................... CLOUD-DC2 passed test VerifyReferences

   
   Testing server: Default-First-Site-Name\ONPREM-DC1

      Starting test: Advertising

         ......................... ONPREM-DC1 passed test Advertising

      Starting test: FrsEvent

         ......................... ONPREM-DC1 passed test FrsEvent

      Starting test: DFSREvent

         There are warning or error events within the last 24 hours after the

         SYSVOL has been shared.  Failing SYSVOL replication problems may cause

         Group Policy problems.
         ......................... ONPREM-DC1 failed test DFSREvent

      Starting test: SysVolCheck

         ......................... ONPREM-DC1 passed test SysVolCheck

      Starting test: KccEvent

         ......................... ONPREM-DC1 passed test KccEvent

      Starting test: KnowsOfRoleHolders

         ......................... ONPREM-DC1 passed test KnowsOfRoleHolders

      Starting test: MachineAccount

         ......................... ONPREM-DC1 passed test MachineAccount

      Starting test: NCSecDesc

         ......................... ONPREM-DC1 passed test NCSecDesc

      Starting test: NetLogons

         ......................... ONPREM-DC1 passed test NetLogons

      Starting test: ObjectsReplicated

         ......................... ONPREM-DC1 passed test ObjectsReplicated

      Starting test: Replications

         ......................... ONPREM-DC1 passed test Replications

      Starting test: RidManager

         ......................... ONPREM-DC1 passed test RidManager

      Starting test: Services

         ......................... ONPREM-DC1 passed test Services

      Starting test: SystemLog

         ......................... ONPREM-DC1 passed test SystemLog

      Starting test: VerifyReferences

         ......................... ONPREM-DC1 passed test VerifyReferences

   
   Testing server: Default-First-Site-Name\ONPREM-DC2

      Starting test: Advertising

         ......................... ONPREM-DC2 passed test Advertising

      Starting test: FrsEvent

         ......................... ONPREM-DC2 passed test FrsEvent

      Starting test: DFSREvent

         There are warning or error events within the last 24 hours after the

         SYSVOL has been shared.  Failing SYSVOL replication problems may cause

         Group Policy problems.
         ......................... ONPREM-DC2 failed test DFSREvent

      Starting test: SysVolCheck

         ......................... ONPREM-DC2 passed test SysVolCheck

      Starting test: KccEvent

         ......................... ONPREM-DC2 passed test KccEvent

      Starting test: KnowsOfRoleHolders

         ......................... ONPREM-DC2 passed test KnowsOfRoleHolders

      Starting test: MachineAccount

         ......................... ONPREM-DC2 passed test MachineAccount

      Starting test: NCSecDesc

         ......................... ONPREM-DC2 passed test NCSecDesc

      Starting test: NetLogons

         ......................... ONPREM-DC2 passed test NetLogons

      Starting test: ObjectsReplicated

         ......................... ONPREM-DC2 passed test ObjectsReplicated

      Starting test: Replications

         ......................... ONPREM-DC2 passed test Replications

      Starting test: RidManager

         ......................... ONPREM-DC2 passed test RidManager

      Starting test: Services

         ......................... ONPREM-DC2 passed test Services

      Starting test: SystemLog

         ......................... ONPREM-DC2 passed test SystemLog

      Starting test: VerifyReferences

         ......................... ONPREM-DC2 passed test VerifyReferences

   
   
   
   
   
   
   Running partition tests on : DomainDnsZones

      Starting test: CheckSDRefDom

         ......................... DomainDnsZones passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... DomainDnsZones passed test

         CrossRefValidation

   
   Running partition tests on : ForestDnsZones

      Starting test: CheckSDRefDom

         ......................... ForestDnsZones passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... ForestDnsZones passed test

         CrossRefValidation

   
   Running partition tests on : Schema

      Starting test: CheckSDRefDom

         ......................... Schema passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... Schema passed test CrossRefValidation

   
   Running partition tests on : Configuration

      Starting test: CheckSDRefDom

         ......................... Configuration passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... Configuration passed test CrossRefValidation

   
   Running partition tests on : domainname

      Starting test: CheckSDRefDom

         ......................... domainname passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... domainname passed test CrossRefValidation

   
   Running enterprise tests on : domainname.internal

      Starting test: LocatorCheck

         ......................... domainname.internal passed test LocatorCheck

      Starting test: Intersite

         Doing intersite inbound replication test on site

         Default-First-Site-Name:
         Doing intersite inbound replication test on site CLOUD:
         ......................... domainname.internal passed test Intersite

Hi, 

Very quick question for you folks. We have a couple of domain controllers (2 to be exact) that have DFSR Replication issues due to 

EVENT ID 2213

The DFS Replication service stopped replication on volume C:. This occurs when a DFSR JET database is not shut down cleanly and Auto Recovery is disabled. To resolve this issue, back up the files in the affected replicated folders, and then use the ResumeReplication WMI method to resume replication.

I ran the command to resume replication but receive the usual about maxofflinetimeinday being over 60. In this case it is over 400 days !!. 

Rather than do an authoritative restore I would like to know if there are any issues with me changing the maxofflinetimeinday's to 401 and then resuming replication? Does this setting affecting anything else?

I know AD is healthy and the group polices have been backed up etc. I cannot find a reason not do this. Obvioulsy once complete I will change the setting back to 60 days. 

Dear all,

we have one domain controller & one Additional Domain controller (windows2012r2) but now all FSMO role holded on domain controller so i am just want to know what would be better for FSMO role hold.either i transfer some role to ADC or keep all role on DC only........please suggest me.what would be happen if DC down with all hold FSMO role.......

Thanks & Regard

Naved Ali

We have a domain with policy's and also stores users files so they can move around and access their personal files, with a new computers I have connected it to the AD Domain and they can log in but <g class="gr_ gr_399 gr-alert gr_spell gr_inline_cards gr_run_anim ContextualSpelling multiReplace" data-gr-id="399" id="399">there</g> user files do not show up, do I need to do something in active directory so users can access?

Many thanks

sorry if noob question :)

Hi,

I enabled the netlogon logs using nltest and logs were populating in Debug Folder. We have lockout policy of count 2.I did map a drive using other credentials & provided the wrong credentials to make the account lockout which happened. But when I'm checking the netlogon logs , nothing is captured regarding lockout & bad password, rest everything is there like Default site & other things. Even username is also not captured in that. Logs are enabled on the server where account is locking out.

What Should I do in this case ,Kindly suggest.

Hi,

 We are trying to troubleshoot the GPO issue on one Server & even Enabling the GPSVC Logging , no result came out.

Its a default Domain policy which is failing out on one of the server only & event log is generating below error :-

"The processing of Group Policy failed. Windows attempted to read the file  from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:

 a) Name Resolution/Network Connectivity to the current domain controller.

b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller).

c) The Distributed File System (DFS) client has been disabled."

Kindly Suggest how to use Group policy logging to troubleshoot the issue .

I want to upgrade Active directory domain controller from windows server 2003 to windows server 2016. What will be challenge on client operating system which are the part of AD windows 2003 domain. Like is there any requirement to upgrade the client Operating System also.I had clients having windows 7 O S.

Hi,

We are facing Slow login issues over Active Directory in one of the branch offices as the users faces delays of upto 30 minutes in logging from secondary DC

Topology as below

Head Office (Primary DC) > MPLS > Branch Office (Secondary DC) > End User

As soon as the user is disconnected the wired / wireless connectivity of their machine, user is logged into the network but unable to login using the connectivity options (wired/wireless)

Is there any way to check the root cause of the issue

Thanks

Just yesterday a user starting having issues logging into a server.  I had them reboot and found they couldn't log in at all.  But it seems sporadic.

After much searching I am seeing the messages below on one of my domain controllers that point to the users object.  These appeared, I suspect around when I attempted change their password because of these issues.  

The DC in question was recently added (with in a month or so).  They are 3 domain controllers running Server 2012R2 domain functional level 2003

Log Name:      Directory Service
Source:        Microsoft-Windows-ActiveDirectory_DomainService
Date:          7/5/2018 3:28:07 PM
Event ID:      1955
Task Category: Replication
Level:         Information
Keywords:      Classic
User:          ANONYMOUS LOGON
Computer:      Description:
Active Directory Domain Services encountered a write conflict when applying replicated changes to the following object. 

Object: 
CN=,OU=,DC=,DC=com 
Time in seconds: 
0 

Event log entries preceding this entry will indicate whether or not the update was accepted. 

A write conflict can be caused by simultaneous changes to the same object or simultaneous changes to other objects that have attributes referencing this object. This commonly occurs when the object represents a large group with many members, and the functional level of the forest is set to Windows 2000. This conflict triggered additional retries of the update. If the system appears slow, it could be because replication of these changes is occurring. 

User Action 
Use smaller groups for this operation or raise the forest functional level to Windows Server 2003.

Team,

Recently I have got an issue with the AD replication. i will tell my scenario, so you may get some idea.

I have total of four servers in two sites (Site A and Site B). Site A is my HO and site B is my branch office. 

In Site A I had Windows Server 2012 R2 Server and Windows Server 2008 R2 server. and Site B also one server with 2K12 and another is 2K8 R2 as domain controller. Recently my Windows Server 2008 R2 server at site A has been upgraded to Server 2012 R2. these both Site has been protected by firewall. necessary ports for replication have been enabled in both firewall and the restricting of AD replication has been done in all four servers.

Site A (HO)

Server1 is windows server 2K12 R2

Server2 is Windows Server 2K12 R2 (upgraded from Server 2008 R2)

Site B (Branch)

Server3 is windows server 2K12 R2

Server4 is Windows Server 2K8 R2

before upgrading the server from 2008 R2 to Server 2K12 R2 at HO the replication was fine in between all the servers. after upgrading the server, the new server (server2) is not able to replicate with another server of Branch site which is installed with Windows Server 2K12 R2. but at the same time the server2 is able to replicate with Server4. I have checked the replication monitor and found

1. Server 1 (old Server with 2 K12 R2) is able to replicate with all servers (inter and intra Site)

2. Server 2 is able to replicate with all other servers except server 3 at Site B (Branch Office).
3. Getting error 1722 (RPC Server Unavailable) While replicating between Server2 and Server3.

i have set all necessary changes like setting of NTDS, NTFRS ports, Restricting RPC port range, Etc..  in new server (Server 2).

Kindly help me to resolve this issue.

Regards

Vinod C V

Hi All,

we are having 3 Active directory Integrated DNS  server in server 2012r2 in single site.

Q1. we want to set one AD Server to have high priority  for name resolution

Q2. we have multiple forwarder but DNS query is going round robin fashion. we want it to be set as high priority. eg.

forwarder1  high priority

forwarder2  Medium priority

forwarder3  low priority

I had an issue where a user was getting lock out messages but it seem sporadic.  After digging I noticed their account was locked out on only one of the DCs but it was not showing as locked on any other domain controller.  

I've run DCDIAG /v on the DCs and they pass all tests.  Other objects appear to be replicating.

Hi everyone,

Im trying to know if my computers im my AD have de last windows updates , but I'm not getting all the information

i´m using de comand (powershell), Get-ADComputer -Identity "PT-Computer" -Properties * | Export-CSV C:\temp\AllWindows.csv -NoTypeInformation -Encoding UTF8

but i cant get all information 

OperatingSystem: Windows 10 Pro
OperatingSystemVersion: 10.0 (17134)
OperatingSystemHotfix:
OperatingSystemServicePack:

i´m doing something wrong? 

thks.

Nuno Silva

Hi, I have the following question. In the scenario where I work with Windows server 2016 edition Data Center in cloud, I have the AD service, in on-premise I need to activate with RONLY (read only) AD, the operating system on this server can be standard Windows server edition 2016?

Thanks for any answer.

HI everyone,

Hope you can help. I had posted and asked something involving this little and hope you do not mind if there are some "repeats"...but I just like  to be safe. Currently my domain controllers are running in 2012r2, 2012, and 2008r2. I believe our current forest and domain function level is set to 2003 (there are only two options when I right click to raise the domain/forest level..they are 2008 and 2008r2).

I like to ask:

1.) Should I raise both forest and domain functions to 2008, or 2008r2?

2a.) Should  I raise the  domain function level before the forest level? or any specific orders in raising them? 

2b.) Any differences between them...or what will you suggest?

3.) If something goes wrong with 2008r2 level, may I change it to 2008 later on?

4.) In my environment, there may still be some application and file servers are running in 2003. Couple running XP for some reasons.. would the change affect these servers and computers?

Hope you can help. Thank you!

Takami Chiro

Hi,

I need help for this problem.

A PDC (W2016 Std. - AD, DNS, DHCP role) under HYPER-V (W2016 Std.) - not clusted Crash every 2-3 weeks with an KERNEL_DATA_INPAGE_ERROR (7a). He crashes spontaneously - without warning before. After restarting, he works as if nothing happened.

Whats wrong?

Here is the debug from a minidump:

Who can help? Thanks for all!

Dear greatings Oliver Richter