Questions tagged [domain-controller]

A domain controller is a server in a Microsoft Active Directory or NT4 domain that is responsible for central authentication.

Filter by
Sorted by
Tagged with
46 votes
3 answers
95k views

What should the order of DNS servers be for an AD Domain Controller and Why?

This is a Canonical Question about Active Directory DNS Settings. Related: What is Active Directory Domain Services and how does it work? Assuming an environment with multiple domain controllers (...
MDMarra's user avatar
  • 101k
40 votes
7 answers
220k views

Domain Controller thinks its on a Public Network

We have a Server 2008 R2 Primary Domain Controller that seems to have amnesia when it comes to working out what kind of network it is on. The (only) network connection is identified at startup as a '...
Matt Renner's user avatar
35 votes
8 answers
34k views

Is it best practices to have separate login for a domain for domain admins?

I typically like to set up separate logins for myself, one with regular user permissions, and a separate one for administrative tasks. For example, if the domain was XXXX, I'd set up a XXXX\bpeikes ...
Benjamin Peikes's user avatar
29 votes
6 answers
69k views

What causes a workstation to lose trust with the domain controller?

I've received the error several times on Windows 7 Workstations and Laptops where it loses trust with the domain controller, and I know how to fix it, but why does it do that?
leeand00's user avatar
  • 4,919
25 votes
4 answers
19k views

"Peaky" CPU Usage on Domain Controllers

We have two Windows Server 2008 SP2 (sadly not 2008 R2) Domain Controllers in a small 150 client domain that are exhibiting very "peaky" CPU usage. The Domain Controllers both exhibit the same ...
user avatar
21 votes
4 answers
226k views

Domain Admins vs. Administrators in Windows AD DC [closed]

Having read in the Microsoft Docs article Default groups the description of these two groups: Domain Admins Members of this group have full control of the domain. By default, this group is ...
Gennady Vanin Геннадий Ванин's user avatar
19 votes
3 answers
69k views

Moving primary domain controller to new server

I have just purchased a new server that will be the new primary domain controller. I was wondering if anyone knew any articles or tutorials on how to do this change over? I would imagine it is just ...
poconnor's user avatar
  • 635
19 votes
1 answer
33k views

What needs to be done after a Domain Controller crash?

Assuming that at least two domain controllers were present in the domain to start with, what steps need to be taken to make Active Directory healthy after a domain controller crash?
Nic's user avatar
  • 13.5k
19 votes
8 answers
29k views

What's a read-only domain controller actually useful for?

Windows Server 2008 introduced read-only domain controllers, which receive a full replica of the domain database but can't modify it, just like a good old Windows NT BDC. I know all the technical ins ...
Massimo's user avatar
  • 71.3k
18 votes
7 answers
91k views

Is there any difference between Domain controller and Active directory?

If I want to define domain controller then i would say DC is where active directory installed or Acitve Directory simply means: Secure centralized authentication and management and domain controller ...
d a i s y's user avatar
  • 289
17 votes
3 answers
8k views

How can I verify AD replication between two DCs works

We have a domain with 3 DCs in different networks and we want to decomission one of them. However, I suspect that the two remaining DCs will not replicate properly between each other due to some ...
Oliver Salzburg's user avatar
17 votes
3 answers
79k views

What is a domain controller, when is it needed, and how to set it up?

I would like to know what do we mean by Domain controller and how do we make a system a Domain Controller and when do we have to make a system a DC?
Guruprasad's user avatar
16 votes
3 answers
9k views

Why can I login to a box even if the AD Domain controller is down?

Scenario: While my DC is running, I log into an arbitrary machine. I stop the DC I log off the arbitrary machine. Let's bounce it for good measure, too. When the machine comes back up, I can still ...
Russell Christopher's user avatar
16 votes
4 answers
11k views

How bad is it to run Exchange 2016 on a Windows 2012 R2 domain controller for a small organization with assuredly fewer than 25 users?

I know that it has been officially unsupported forever and yet I have seen or heard about many small business installations of a single host running AD DS and Exchange simultaneously. For a resource-...
tacos_tacos_tacos's user avatar
16 votes
2 answers
66k views

Encrypting SMB traffic with Samba

We use Samba on Ubuntu 14.04 LTS as a PDC (primary domain controller) with roaming profiles. Everything works fine, except for if we try to enforce encryption via setting: server signing = ...
Kai Petzke's user avatar
15 votes
1 answer
2k views

Are all domain controllers on a small network considered equivalent/equal?

Windows Server 2012 R2 w/ GUI, Hyper-V host, VM DC I am installing my first second Domain Controller(DC) (sounds weird but that really is what I'm doing). I have what I think is a good process to ...
Alan's user avatar
  • 1,023
15 votes
3 answers
86k views

How to convert a domain account to a local account

I have a Windows 7 laptop that was connected to a Windows domain controller. The domain controller is no longer in operation and has been shut off. The laptop, now stand alone, works fine, but I want ...
HumanBacon's user avatar
14 votes
4 answers
95k views

Hyper-V Time Sync for VM Domain Controller

We have 2 physical hyper-V servers running 8 VMs between them, each physical server has a Domain controller on it running in a VM and all servers are 2008R2 The VM PDC is set to NTP and to sync with ...
Karl's user avatar
  • 191
14 votes
1 answer
3k views

Domain Administrators account policy (After PCI audit)

One of our clients is a Tier 1 PCI company, and their auditors have made a suggestion with regards to us as System Administrators and our access rights. We administer their entirely Windows based ...
Patrick's user avatar
  • 1,290
14 votes
1 answer
707 views

Group Policy Result summary says DC is member of "BUILTIN\Administrators"

Whenever I run the Group Policy Result wizard and select a Domain Controller as the target computer, the summary shows BUILTIN\Administrators in the list of "Security Group Membership when Group ...
Mathias R. Jessen's user avatar
13 votes
3 answers
45k views

Seizing FSMO roles from dead Windows Domain Controller

I've seen other questions and documents about doing this, but there are some things that still confuse me. Here are the documents and questions I've seen: Retire a Dead Windows 2003 Domain Controller ...
Mei's user avatar
  • 4,600
13 votes
1 answer
17k views

What does a domain controller (DC) use a certificate for?

Everyone talks about domain controllers and that they should have a certificate installed, but at the end of the day it is optional. Once installed, what actually makes use of that certificate? My ...
Ben Short's user avatar
  • 688
13 votes
1 answer
297 views

What does "DEL:" mean in the DistinguishedName of an AD Object?

Sorry -- I'm not really a Windows System Admin, just trying to slam through some LDAP interactions in Java. I'm finding a ton of objects with "DEL:" in the distinguishedName. Are these orphaned ...
Richie Foreman's user avatar
13 votes
5 answers
30k views

Can an LDAP query on AD provide the netbios domain name for a single account when using the Global Catalog?

I am using ADSI Edit to look at LDAP properties of a single user account in AD. I see properties such as userPrincipalName, but I do not see one for the fully qualified domain name (FQDN) or the ...
Kirk Liemohn's user avatar
12 votes
3 answers
9k views

Why should you not restore a DC that was backed up 6 months ago?

Why should you not restore a DC that was backed up 6 months ago? As I am learning Active Directory Domain Services I came across this question in one of the blogs but I was unable to find a detailed ...
user416535's user avatar
12 votes
1 answer
32k views

Domain Controller returns LDAP Referral for it's own domain

I have 2 domains, each with 2 Domain Controllers: company.local ad.company.com.au Both domains are in the same forest and have a bi-direction trust setup. We're migrating to the ad.company.com.au at ...
fukawi2's user avatar
  • 5,436
11 votes
1 answer
24k views

Why are there no local users and groups on Windows 2K3/2K8 domain controllers?

MS have taken great pains to remove 'Local Users and Groups' from the GUI tools, and even if you tickle up lusrmgr.msc directly it complains that the snap-in won't run on a domain controller. The ...
David Bullock's user avatar
11 votes
5 answers
35k views

Two Different Domains & Domain Controllers on Single Network

I'm attempting to determine whether it is possible to have two Active Directory domain controllers running on the same network, within the same subnet, with two separate domains. I do not want these ...
BSchlinker's user avatar
11 votes
5 answers
8k views

Replacing a W2K3 Domain Controller - what do I need to know?

I have a network of around 70 machines, currently with two DCs both running Windows Server 2003 (DC0 & DC1). DC0 is a five year old Poweredge 1850 and has recently become increasingly flakey, and ...
Marko Carter's user avatar
  • 4,112
11 votes
3 answers
4k views

Advice on Active Directory design for multihomed servers

I've been tasked by a customer to come up with a working Active Directory design for a scenario with the following requirements (simplified, they are actually a lot worse): There is a subnet for ...
Massimo's user avatar
  • 71.3k
10 votes
7 answers
16k views

Can a Linux server serve as a Domain Controller for Windows Machines?

In a small office setup (5-6 employees) we have seven Windows XP and Windows Vista clients, as well as a couple of linux servers. Is it possible to set up a linux machine to act as the domain ...
kdmurray's user avatar
  • 549
10 votes
2 answers
4k views

Demoted domain controller still authenticating users

Why is a demoted domain controller still authenticating users? Whenever users log onto workstations with domain accounts, this demoted DC authenticates them. Its security log shows their logons, ...
Eric Eskildsen's user avatar
10 votes
1 answer
994 views

In a multi-domain forest, what EXACTLY happens when some, but not all, of the Infrastructure Masters are on Global Catalogs?

There are plenty of TechNet articles, like this one that say that phantom object don't get updated if an Infrastructure Master is also a Global Catalog, but other than that there isn't a lot of in ...
MDMarra's user avatar
  • 101k
9 votes
3 answers
53k views

How to temporarily stop time syncing with domain controller?

I wish to do some testing on my local machine which requires me to put the date forward a year. So I can test some stuff in SQL Server (i've found it not possible to override the sql server time). ...
Alex KeySmith's user avatar
9 votes
2 answers
61k views

How do Windows domain clients behave if the domain controller is offline?

If I have Windows PCs that are joined to a domain and the domain controller goes offline, what kind of behavior can I expect on the clients (assuming there is no second DC?) Will users be able log on?...
user avatar
9 votes
2 answers
27k views

Force Windows server to use specific Domain Controller

Is there a way I can set an OWA server in my DMZ to talk to a DC in the local site? The DMZ is located at the same (physical) site as a LAN with DCs on it. (There is no DC in the DMZ.) Can I force ...
Ben's user avatar
  • 1,137
9 votes
1 answer
16k views

Procedure for rebooting Domain Controllers?

We have several servers running as Domain Controllers, "DC01", "DC02", and "DC03". For some reasons, we need to reboot them. Is there a specific procedure to follow? Additional info: "DC01" ...
pepoluan's user avatar
  • 5,108
9 votes
2 answers
844 views

Backing up DC for a catastrophic case

I've been setting up off-site backups for the most critical elements of the company I work at. One of these critical elements is the DC. Now, the company is fairly small, so has only a single forest, ...
MBender's user avatar
  • 381
9 votes
2 answers
6k views

Domain Controller offline for a few days

My primary domain controller died over the weekend, its motherboard is being replaced tomorrow. I have been told that the mac address of the server may change once the new motherboard is installed. ...
Simon Foster's user avatar
  • 2,652
8 votes
2 answers
3k views

Use Google Apps/Cloud Services as a Domain Controller Replacement

This is a Canonical Question about Cloud Services replacing Active Directory. Is it possible to use Google Apps or another Cloud Service as a replacement for a Windows Domain Controller (replacing my ...
user avatar
8 votes
3 answers
23k views

Server 2012 R2 Active Directory Domain SRV dns records suddenly disappeared

I have a test domain that I recently configured. All of a sudden, no users can log in except those with cached credentials. The domain includes two domain controllers that are both global catalogs ...
Super1337's user avatar
  • 474
8 votes
4 answers
57k views

SNMP service security tab is missing - Windows Server 2012 R2 - DC

I have to configure the security settings for the SNMP-Service on a Windows Server. But they are missing! Here are the facts: OS: Windows Server 2012 R2 I installed the SNMP feature and I believe, ...
frupfrup's user avatar
  • 863
8 votes
2 answers
5k views

Resetting DC Password from DSRM

How can I reset my DC's password? I am able to login to the server in Directory Services Restore Mode. I tried pulling up AD DS Users and Computers from there, but it does not appear that it will load ...
cmorris14's user avatar
  • 181
8 votes
1 answer
47k views

Which firewall ports do I need to open in order for a domain trust to work?

I have two Active Directory domains in two different forests; each domain has two DCs (all of them Windows Server 2008 R2). The domains are also in different networks, with a firewall connecting them. ...
Massimo's user avatar
  • 71.3k
8 votes
3 answers
2k views

Need for another Domain Controller

I have two domain controllers (Windows 2003) in one site where most of the department I support resides. There is another building (at another site) where my department resides as well, but they have ...
James's user avatar
  • 157
8 votes
1 answer
1k views

Why would a domain controller encounter a USN rollback after an unclean shutdown?

I have this Windows Server 2008 R2 domain controller running on a physical Dell server, model PowerEdge R510. There are some electrical problems around here, thus a black-out is, unfortunately, quite ...
Massimo's user avatar
  • 71.3k
8 votes
1 answer
2k views

AD Replica DC Promotion Stall

I recently inherited infrastructure duties for a small startup I am working with. My traditional role has been development, so bear with me... I was hoping to start off on the right foot, and get ...
Mark L's user avatar
  • 81
7 votes
8 answers
79k views

How to tell what time a domain user logged in?

In the "Security" event log on a Windows 2003 domain controller, I see several entries of event 540 -- "Successful Network Logon" averaging a few minutes apart throughout the day. Is the first one of ...
ℳ                            .'s user avatar
  • 173
7 votes
4 answers
34k views

Search Active Directory for computers logged in, in the last 30 days

I am trying to do a PowerShell search of AD to find computers only (not servers or others) that have been logged into within the last 30 days. I have most of the script written except for the limiting ...
Norrec's user avatar
  • 71
7 votes
3 answers
458 views

Can a Second Domain Controller, with buggy hard drive hardware, cause a corruption to Active Directory?

We have a new Domain Controller that holds all FSMO roles. We also have two old hardware servers, about 4-5 years old each, set up as secondary Domain Controllers (or better described as Domain ...
dasko's user avatar
  • 1,244

1
2 3 4 5
33