Questions tagged [domain-controller]
A domain controller is a server in a Microsoft Active Directory or NT4 domain that is responsible for central authentication.
1,620
questions
46
votes
3
answers
95k
views
What should the order of DNS servers be for an AD Domain Controller and Why?
This is a Canonical Question about Active Directory DNS Settings.
Related:
What is Active Directory Domain Services and how does it work?
Assuming an environment with multiple domain controllers (...
40
votes
7
answers
220k
views
Domain Controller thinks its on a Public Network
We have a Server 2008 R2 Primary Domain Controller that seems to have amnesia when it comes to working out what kind of network it is on. The (only) network connection is identified at startup as a '...
35
votes
8
answers
34k
views
Is it best practices to have separate login for a domain for domain admins?
I typically like to set up separate logins for myself, one with regular user permissions, and a separate one for administrative tasks. For example, if the domain was XXXX, I'd set up a XXXX\bpeikes ...
29
votes
6
answers
69k
views
What causes a workstation to lose trust with the domain controller?
I've received the error several times on Windows 7 Workstations and Laptops where it loses trust with the domain controller, and I know how to fix it, but why does it do that?
25
votes
4
answers
19k
views
"Peaky" CPU Usage on Domain Controllers
We have two Windows Server 2008 SP2 (sadly not 2008 R2) Domain Controllers in a small 150 client domain that are exhibiting very "peaky" CPU usage. The Domain Controllers both exhibit the same ...
21
votes
4
answers
226k
views
Domain Admins vs. Administrators in Windows AD DC [closed]
Having read in the Microsoft Docs article Default groups the description of these two groups:
Domain Admins
Members of this group have full control of the domain. By default, this
group is ...
19
votes
3
answers
69k
views
Moving primary domain controller to new server
I have just purchased a new server that will be the new primary domain controller. I was wondering if anyone knew any articles or tutorials on how to do this change over? I would imagine it is just ...
19
votes
1
answer
33k
views
What needs to be done after a Domain Controller crash?
Assuming that at least two domain controllers were present in the domain to start with, what steps need to be taken to make Active Directory healthy after a domain controller crash?
19
votes
8
answers
29k
views
What's a read-only domain controller actually useful for?
Windows Server 2008 introduced read-only domain controllers, which receive a full replica of the domain database but can't modify it, just like a good old Windows NT BDC.
I know all the technical ins ...
18
votes
7
answers
91k
views
Is there any difference between Domain controller and Active directory?
If I want to define domain controller then i would say DC is where active directory installed or
Acitve Directory simply means: Secure centralized authentication and management
and domain controller ...
17
votes
3
answers
8k
views
How can I verify AD replication between two DCs works
We have a domain with 3 DCs in different networks and we want to decomission one of them.
However, I suspect that the two remaining DCs will not replicate properly between each other due to some ...
17
votes
3
answers
79k
views
What is a domain controller, when is it needed, and how to set it up?
I would like to know what do we mean by Domain controller and how do we make a system a Domain Controller and when do we have to make a system a DC?
16
votes
3
answers
9k
views
Why can I login to a box even if the AD Domain controller is down?
Scenario:
While my DC is running, I log into an arbitrary machine.
I stop the DC
I log off the arbitrary machine. Let's bounce it for good measure, too.
When the machine comes back up, I can still ...
16
votes
4
answers
11k
views
How bad is it to run Exchange 2016 on a Windows 2012 R2 domain controller for a small organization with assuredly fewer than 25 users?
I know that it has been officially unsupported forever and yet I have seen or heard about many small business installations of a single host running AD DS and Exchange simultaneously. For a resource-...
16
votes
2
answers
66k
views
Encrypting SMB traffic with Samba
We use Samba on Ubuntu 14.04 LTS as a PDC (primary domain controller) with roaming profiles. Everything works fine, except for if we try to enforce encryption via setting:
server signing = ...
15
votes
1
answer
2k
views
Are all domain controllers on a small network considered equivalent/equal?
Windows Server 2012 R2 w/ GUI, Hyper-V host, VM DC
I am installing my first second Domain Controller(DC) (sounds weird but that really is what I'm doing). I have what I think is a good process to ...
15
votes
3
answers
86k
views
How to convert a domain account to a local account
I have a Windows 7 laptop that was connected to a Windows domain controller. The domain controller is no longer in operation and has been shut off. The laptop, now stand alone, works fine, but I want ...
14
votes
4
answers
95k
views
Hyper-V Time Sync for VM Domain Controller
We have 2 physical hyper-V servers running 8 VMs between them, each physical server has a Domain controller on it running in a VM and all servers are 2008R2
The VM PDC is set to NTP and to sync with ...
14
votes
1
answer
3k
views
Domain Administrators account policy (After PCI audit)
One of our clients is a Tier 1 PCI company, and their auditors have made a suggestion with regards to us as System Administrators and our access rights.
We administer their entirely Windows based ...
14
votes
1
answer
707
views
Group Policy Result summary says DC is member of "BUILTIN\Administrators"
Whenever I run the Group Policy Result wizard and select a Domain Controller as the target computer, the summary shows BUILTIN\Administrators in the list of "Security Group Membership when Group ...
13
votes
3
answers
45k
views
Seizing FSMO roles from dead Windows Domain Controller
I've seen other questions and documents about doing this, but there are some things that still confuse me. Here are the documents and questions I've seen:
Retire a Dead Windows 2003 Domain Controller
...
13
votes
1
answer
17k
views
What does a domain controller (DC) use a certificate for?
Everyone talks about domain controllers and that they should have a certificate installed, but at the end of the day it is optional. Once installed, what actually makes use of that certificate? My ...
13
votes
1
answer
297
views
What does "DEL:" mean in the DistinguishedName of an AD Object?
Sorry -- I'm not really a Windows System Admin, just trying to slam through some LDAP interactions in Java.
I'm finding a ton of objects with "DEL:" in the distinguishedName. Are these orphaned ...
13
votes
5
answers
30k
views
Can an LDAP query on AD provide the netbios domain name for a single account when using the Global Catalog?
I am using ADSI Edit to look at LDAP properties of a single user account in AD. I see properties such as userPrincipalName, but I do not see one for the fully qualified domain name (FQDN) or the ...
12
votes
3
answers
9k
views
Why should you not restore a DC that was backed up 6 months ago?
Why should you not restore a DC that was backed up 6 months ago?
As I am learning Active Directory Domain Services I came across this question in one of the blogs but I was unable to find a detailed ...
12
votes
1
answer
32k
views
Domain Controller returns LDAP Referral for it's own domain
I have 2 domains, each with 2 Domain Controllers:
company.local
ad.company.com.au
Both domains are in the same forest and have a bi-direction trust setup. We're migrating to the ad.company.com.au at ...
11
votes
1
answer
24k
views
Why are there no local users and groups on Windows 2K3/2K8 domain controllers?
MS have taken great pains to remove 'Local Users and Groups' from the GUI tools, and even if you tickle up lusrmgr.msc directly it complains that the snap-in won't run on a domain controller.
The ...
11
votes
5
answers
35k
views
Two Different Domains & Domain Controllers on Single Network
I'm attempting to determine whether it is possible to have two Active Directory domain controllers running on the same network, within the same subnet, with two separate domains. I do not want these ...
11
votes
5
answers
8k
views
Replacing a W2K3 Domain Controller - what do I need to know?
I have a network of around 70 machines, currently with two DCs both running Windows Server 2003 (DC0 & DC1). DC0 is a five year old Poweredge 1850 and has recently become increasingly flakey, and ...
11
votes
3
answers
4k
views
Advice on Active Directory design for multihomed servers
I've been tasked by a customer to come up with a working Active Directory design for a scenario with the following requirements (simplified, they are actually a lot worse):
There is a subnet for ...
10
votes
7
answers
16k
views
Can a Linux server serve as a Domain Controller for Windows Machines?
In a small office setup (5-6 employees) we have seven Windows XP and Windows Vista clients, as well as a couple of linux servers.
Is it possible to set up a linux machine to act as the domain ...
10
votes
2
answers
4k
views
Demoted domain controller still authenticating users
Why is a demoted domain controller still authenticating users?
Whenever users log onto workstations with domain accounts, this demoted DC authenticates them. Its security log shows their logons, ...
10
votes
1
answer
994
views
In a multi-domain forest, what EXACTLY happens when some, but not all, of the Infrastructure Masters are on Global Catalogs?
There are plenty of TechNet articles, like this one that say that phantom object don't get updated if an Infrastructure Master is also a Global Catalog, but other than that there isn't a lot of in ...
9
votes
3
answers
53k
views
How to temporarily stop time syncing with domain controller?
I wish to do some testing on my local machine which requires me to put the date forward a year. So I can test some stuff in SQL Server (i've found it not possible to override the sql server time).
...
9
votes
2
answers
61k
views
How do Windows domain clients behave if the domain controller is offline?
If I have Windows PCs that are joined to a domain and the domain controller goes offline, what kind of behavior can I expect on the clients (assuming there is no second DC?)
Will users be able log on?...
9
votes
2
answers
27k
views
Force Windows server to use specific Domain Controller
Is there a way I can set an OWA server in my DMZ to talk to a DC in the local site?
The DMZ is located at the same (physical) site as a LAN with DCs on it. (There is no DC in the DMZ.)
Can I force ...
9
votes
1
answer
16k
views
Procedure for rebooting Domain Controllers?
We have several servers running as Domain Controllers, "DC01", "DC02", and "DC03". For some reasons, we need to reboot them.
Is there a specific procedure to follow?
Additional info: "DC01" ...
9
votes
2
answers
844
views
Backing up DC for a catastrophic case
I've been setting up off-site backups for the most critical elements of the company I work at. One of these critical elements is the DC.
Now, the company is fairly small, so has only a single forest, ...
9
votes
2
answers
6k
views
Domain Controller offline for a few days
My primary domain controller died over the weekend, its motherboard is being replaced tomorrow.
I have been told that the mac address of the server may change once the new motherboard is installed.
...
8
votes
2
answers
3k
views
Use Google Apps/Cloud Services as a Domain Controller Replacement
This is a Canonical Question about Cloud Services replacing Active Directory.
Is it possible to use Google Apps or another Cloud Service as a replacement for a Windows Domain Controller (replacing my ...
8
votes
3
answers
23k
views
Server 2012 R2 Active Directory Domain SRV dns records suddenly disappeared
I have a test domain that I recently configured. All of a sudden, no users can log in except those with cached credentials. The domain includes two domain controllers that are both global catalogs ...
8
votes
4
answers
57k
views
SNMP service security tab is missing - Windows Server 2012 R2 - DC
I have to configure the security settings for the SNMP-Service on a Windows Server. But they are missing!
Here are the facts:
OS: Windows Server 2012 R2
I installed the SNMP feature and I believe, ...
8
votes
2
answers
5k
views
Resetting DC Password from DSRM
How can I reset my DC's password? I am able to login to the server in Directory Services Restore Mode. I tried pulling up AD DS Users and Computers from there, but it does not appear that it will load ...
8
votes
1
answer
47k
views
Which firewall ports do I need to open in order for a domain trust to work?
I have two Active Directory domains in two different forests; each domain has two DCs (all of them Windows Server 2008 R2). The domains are also in different networks, with a firewall connecting them.
...
8
votes
3
answers
2k
views
Need for another Domain Controller
I have two domain controllers (Windows 2003) in one site where most of the department I support resides. There is another building (at another site) where my department resides as well, but they have ...
8
votes
1
answer
1k
views
Why would a domain controller encounter a USN rollback after an unclean shutdown?
I have this Windows Server 2008 R2 domain controller running on a physical Dell server, model PowerEdge R510.
There are some electrical problems around here, thus a black-out is, unfortunately, quite ...
8
votes
1
answer
2k
views
AD Replica DC Promotion Stall
I recently inherited infrastructure duties for a small startup I am working with. My traditional role has been development, so bear with me...
I was hoping to start off on the right foot, and get ...
7
votes
8
answers
79k
views
How to tell what time a domain user logged in?
In the "Security" event log on a Windows 2003 domain controller, I see several entries of event 540 -- "Successful Network Logon" averaging a few minutes apart throughout the day.
Is the first one of ...
7
votes
4
answers
34k
views
Search Active Directory for computers logged in, in the last 30 days
I am trying to do a PowerShell search of AD to find computers only (not servers or others) that have been logged into within the last 30 days. I have most of the script written except for the limiting ...
7
votes
3
answers
458
views
Can a Second Domain Controller, with buggy hard drive hardware, cause a corruption to Active Directory?
We have a new Domain Controller that holds all FSMO roles. We also have two old hardware servers, about 4-5 years old each, set up as secondary Domain Controllers (or better described as Domain ...