1
vote
1answer
24 views

Windows Server 2008R2 Domain Controllers - Failed test VerifyReferences

While running DCDIAG on our Windows Server 2008R2 Enterprise Domain Controllers, I discovered the following error message on both DCs. These domain controllers where migrated from a Windows server ...
8
votes
2answers
240 views

Demoted domain controller still authenticating users

Why is a demoted domain controller still authenticating users? Whenever users log onto workstations with domain accounts, this demoted DC authenticates them. Its security log shows their logons, ...
0
votes
1answer
5 views

Server Manager Remote Connection and Visual Studio unable to publish after password change

I have a developer user who changed his password in our Windows-only environment. Now he is unable to connect remotely to another machine via Server Manager and unable to publish to another server ...
5
votes
1answer
54 views

Different ACLs on two OU's with same “protect object from deletion” setting

Background After I configured our Active Directory so that the ability to move computers was delegated to helpdesk staff, I started hearing reports that computers would get "stuck" in specific OU's. ...
0
votes
0answers
29 views

How to resolve SSPI context error without changing Service Account from MSSQL

There is a issue while connecting from new Windows 8.1 Clients to SQL Server 2008 running on Windows Server 2008 R2. The SQL Service running under account Domain\mssqlservice on a machine thats works ...
0
votes
1answer
44 views

Joining an AD domain from Workgroup with runas

I've got an user A who is connected to a Workgroup. From this Workgroup, now, I want to connect, with the console, to the user "john" who belongs to an active directory (MYAD) Though I try : runas ...
1
vote
1answer
18 views

Unable to delegate Replicating Directory Changes to a user in AD - option missing from wizard

Disclaimer: I originally asked this over at SharePoint SE, but I figured I'd ask it here too as it's more of an AD problem than a SP specific one. I'm trying to delegate the Replicating Directory ...
4
votes
2answers
90 views

How to force active directory replication from one DC to another

I am having issues replicating AD from one DC to another. Both servers are Windows Server 2008 R2 SP1. I have used the GUI option in sites and service to force replication. I have also tried repadmin, ...
6
votes
1answer
72 views

Active Directory Country capitals (letters)

Does someone know how to solve the problem of changing all country fields at once and probably why the country field is multiplied each time I select + apply a country change until the Object is being ...
0
votes
1answer
22 views

New-ADUser -Path syntax?

Where can I find a detailed explanation of the -Path parameter of the New-ADUser command? I want to specify a rather detailed path without calling Set-Location many times to specify where I want the ...
3
votes
1answer
51 views

Domain Controller returns LDAP Referral for it's own domain

I have 2 domains, each with 2 Domain Controllers: company.local ad.company.com.au Both domains are in the same forest and have a bi-direction trust setup. We're migrating to the ad.company.com.au ...
2
votes
1answer
48 views

Is this USN Rollback?

I have 6 Windows 2008 R2 Domain Controllers, all GCs, across multiple locations (2+2+2). On my main site I have a clone of one of our DCs done a few month ago, usually totally isolated from the ...
0
votes
1answer
30 views

Group policy access with active directory

Under Active Directory (Win2008-R2), I want all "authenticated users" be able to access the "Add/Remove windows components" menu But where do I have to go in group policy to set this grant ? In ...
1
vote
1answer
35 views

limit user access in multiple RODC

I have a RODC and a RWDC.i prepopulate some password on RODC cache database. i already read this article How’s User Authentication Working In A Site With A RODC? I want to limit user access in ...
10
votes
3answers
309 views

Active Directory user names: why does the canonical name vary? Can I do something to make them uniform?

I am a self-taught administrator of a work Active Directory network used for Windows logins on ~30 PCs. I inherited the system from someone else who also didn't have any direct Microsoft training and ...
-3
votes
1answer
43 views

Building a Windows Server 2008 R2 (DNS, DHCP, AD, etc…) [closed]

I'm looking forward to build my own Windows Server 2008 R2 machine for a company that is in the process of establishment. I have some questions regarding the Windows Server. I'm pretty new to it .. I ...
0
votes
1answer
29 views

Set Country / Region field Access via Active Directory Delegation

After creating a security group for special permissions (edit User Objects fields like Street, ZIP etc.) I have a problem of not being able to delegate permission for the field "Country/Region" on a ...
0
votes
1answer
30 views

Unable to update service communication certificate

We have added a self-signed certificate when setting up AD FS, and now want to update the service communications certificate to our domain's wildcard cert. Following these instructions: ...
1
vote
1answer
55 views

User Permission Issues Within Domain

I have user that is in Domain Admins group. I am trying to access folder that has full permissions for Domain Admins group but for some reason I get "You don't currently have permission to access this ...
1
vote
2answers
401 views

'The'account is not authorized to login from this station' error while trying to acccess network share

Clients are getting this error when trying to access network shares on one of our 2008 R2 servers: The account is not authorized to login from this station. The problem started a few weeks ago. ...
0
votes
2answers
28 views

Can't login with another domain credentials even when a trust exists

I have a domain named A; it has 2 AD servers and some web servers. And this is configured to have a one way trust with a domain named B. In short, A trusts B, but B doesn't A. Also, the users of ...
1
vote
1answer
137 views

Activating Windows 7 with MAK passed in Unattend.xml via WDS

I have configured WDS to deploy a Windows 7 Pro image (Volume Licensed) and I'm using an unattend.xml file for the configuration. The only problem I'm running into is activation. I'm passing a MAK ...
1
vote
1answer
67 views

Removing old Active Directory DNS records after IP change

I've just done a restore of a server onto a VM for testing. The server is running Windows 2008 R2 and Exchange 2010, and is a domain controller (I know, not supported). This server is the only DC on ...
-1
votes
2answers
164 views

Using WDS to Deploy Custom OEM Image

So we just purchased 75 new HP machines (which all come with Windows 7 Pro OEM licenses) and generally when we make an image for a machine we just use the OEM image because it's already activated and ...
1
vote
1answer
45 views

Blocking USB through GPO in 2008 R2 & excluding certain users

I am looking for blocking USB devices in our Win 2008R2 SP1 server. I am already aware about GPO policy "\User Configuration\Policies\Administrative Templates\System\Removable Storage Access" & ...
0
votes
2answers
105 views

Reverse Lookup Zones With Multiple Active Directory Domains On The Same Subnets

I have 3 subnets, lets call them 10.10.10.1/24, 10.10.10.2/24, and 10.10.10.3/24. I also have an Active Directory Forest (all DCs/FFL/DFL @ Server 2008 R2) with 2 subdomains, we will call them ...
0
votes
0answers
91 views

ldifde command is failing with "Invalid Parameter: Bad argument '-i'. And also any equivalent PS Cmdlet?

OS - Windows Server 2008 R2 Localhost: DC as well as running an AD LDS instance Here are the command(s) I used: ldifde -i -u -f differences.ldf -s localhost:50004 -b myUserAccount MyDomain ...
4
votes
1answer
34 views

Managed Service Account has “Everyone:Change password” ACE by default

I have created a service account using the Add-ADComputerServiceAccount cmdlet and bound it to a computer account using Install-ADServiceAccount. When looking into the ACL of the created service ...
0
votes
2answers
393 views

Domain User Account Locks: Correct password used

I have a domain (DC is running Windows Server 2008 R2) and have the Account Lockout Policy enabled. When a user attempts to log into their PC (with the correct password) they receive the following ...
2
votes
0answers
49 views

Windows 2008 R2 server loses connection to Active Directory

One of our many 2008R2 servers constantly loses connection to the domain, meaning that users cannot login to shares etc on the server, and it basically becomes useless. The event sometimes generated ...
4
votes
1answer
120 views

How to add custom OID for subject field on certificates issued by Windows Server 2008 R2 CA?

I'm using a Windows Server 2008 R2 domain controller with Active Directory Certificate Services installed. It's configured as an Enterprise Root CA. I have configured a custom certificate template so ...
2
votes
0answers
58 views

Windows 2008 R2 Server: Network zones (Public / Private / Domain) Seem to change randomly

So far on 2 occasions we have noticed that the network zones assigned to our server nics has been changed without any interaction on our part. This is out of a few hundred servers we manage. Case 1) ...
0
votes
1answer
45 views

Suggestions on the best way to convert a Workgroup to a Doman / Active Directory? [closed]

I recently took over as the network admin for a small manufacturing firm. It's grown from a small mom and pop shop into a medium-sized business over the past few years, and as such trying to manage ...
0
votes
0answers
66 views

Active Directory replication over VPN - DNS resolution

I have looked around whether anyone had the same issue but so far have not seen anything that would help me. I have a homelab and two VMs (Windows 2k8r2) with public IP addresses hosted in remote ...
0
votes
3answers
99 views

Time synchronization in Active directory

I've got issues with time synchronization in a domain. I have DCs that spans time zones, however the PDC is located in a time zone where daylight savings is active, this caused all the additional DCs ...
0
votes
1answer
27 views

To identify which application uses kerberos authentication

i need to identify which application / process requesting kerberos authentication. Eg I have an PC for login i am using windows AD account. In that pc there are several applicationslike outlook, ...
0
votes
2answers
129 views

Link Aggregation & Windows Servers

So... We have a few servers that we would like load balanced link aggregation between multiple network interfaces. In the past we have used broadcom basp teaming using LACP. Today we encountered THIS ...
2
votes
1answer
69 views

Current state of EFS

I need to encrypt a 3.5TB folder on 2008 R2 server. The folder is shared and both users and applications need to access the files(pdf) in it over the network. Since the server is a VM (ESXi 5) ...
1
vote
2answers
1k views

kinit & pam_sss: Cannot find KDC for requested realm while getting initial credentials

I have a very similar problem as described in this thread on CentOS 6.3 authenticating against a 2008R2 AD DC. Here is my krb5.conf, I know for a fact that XXXXXXX.LOCAL is the true domain name: ...
0
votes
1answer
60 views

How to get additional Account Info tab in ADUC with Taskpads

as a part of delegating tasks to admins , we require to enable Additional Account tab(which shows, last password reset, SID , GUID last logon/Logoff etc) in ADUC when user properties are viewed. How ...
1
vote
3answers
133 views

Upon failure of DC, force server to find Secondary DC

In this SF question, I asked how to determine which DC a server was talking to. We are doing some resilience testing and need to demonstrate to the client that if a DC fails, there are additional DCs ...
0
votes
1answer
120 views

Cant find “Read Lockout Time” and “Write Lockout Time” for delegation on OU

Trying to delegate permissions to a group on a OU; but cant find 2 properties in special permissions for "User Objects" they are "Read Lockout Time" and "Write Lockout Time" any reason i couldnt see ...
-2
votes
1answer
47 views

Restoring Server 2008 Enterprise AD backups on Server 2008 R2

I want to take a backup of Active directory on a Server 2008 Enterprise system and restore it on a Server 2008 R2 Domain Controller. Is this possible? Are there any issues with schema differences ...
0
votes
1answer
80 views

Exporting Security Group Memberships in Batch

I have the following command but it doesn't work when put into a batch file: dsquery group DC=domain,DC=com -name "Group Name" | dsget group -members | dsget user -display >> "Group Name.txt" ...
-4
votes
1answer
114 views

settings up active directory accessible from the internet [closed]

For my small company i want to setup a domain controller I want users to be able to access the domain controller from their laptops via the internet. I need the DC for policies & management of ...
13
votes
4answers
771 views

Windows DHCP Server - get notification when a non-AD joined device gets an IP address

SCENARIO To simplify this down to it's easiest example: I have a Windows 2008 R2 standard DC with the DHCP server role. It hands out IPs via various IPv4 scopes, no problem there. WHAT I'D LIKE I ...
0
votes
0answers
20 views

Cant Add Columns to a AD Task pad except for the top level of the domain

We are working on Active Directory taskpads application for user management in our organization and facing stange issue. When we create a taskpad, and when we are at top level of the domain, i can ...
-2
votes
1answer
41 views

How to inspect traffic from PC on domain? [closed]

Is there a tool (on Microsoft domain server, or 3rd party) that can allow me to log if some domain user is generating specific traffic at chosen time (in my case, I want to know if he is using Team ...
3
votes
1answer
243 views

dsadd gives “The name provided is not a properly formed account name.”

This command: dsadd user "cn=testing dummy2,cn=Users,dc=domain,dc=local" -display "testing dummy2" -samid testing.dummy2@domain.local -pwd password76 -fn testing -ln dummy2 -disabled no -upn ...
0
votes
1answer
31 views

How can I grant different rights to a group of users based on the ownership of a file

[disclaimer : I'm not a sysadmin, I'm a programmer and I know very little on Windows Administration] I have a windows Server 2008 R2 machines that share a directory on C:\SDCN with several windows 7 ...