Hot answers tagged

5

A forest is a security boundary. A domain is a management boundary. With modern delegation, fine-grained password policies, and item-level targeting in GPO, its entirely possible to create management boundaries within a single domain as well. There's no "right" answer. Evaluate your situation and choose whichever is most appropriate based on your ...


4

tcp/53 DNS tcp/88 Kerberos tcp/135 RPC tcp/445 sysvol share tcp/389 LDAP tcp/464 Kerberos password (Max/Unix clients) tcp/636 LDAP SSL (if the domain controllers have/need/use certificates) tcp/1688 KMS (if KMS is used. Not necessarily AD, but the SRV record is in AD and clients need to communicate with the KMS). tcp/3268 LDAP GC tcp/3269 ...


3

The command is accurate because it will search for computers whose password has not changed in the number of days that you specify. (By default, computers change their own passwords every 30 days as long as they're connected to the domain.) Source This information is replicated amongst domain controllers, in the pwdLastSet attribute, so assuming ...


3

With only one valid certificate depending on the existing CA after this week, I would do the following: Spin up an entirely new parallel PKI infrastructure (however complicated you care to make it) Generate a new cert to replace the one remaining and migrate the application to use the new cert Decommission the old CA entirely. If the two certs that are ...


2

OK, the problem is that the client has an APIPA address (169.254.139.214), which means that it isn't getting an ip address from DHCP. I can see in your screenshots that the DHCP server has a red arrow, which means it hasn't been authorized, which means it won't assign ip addressing information to clients. You need to authorize the DHCP server and then things ...


2

You can use the same name and IP but as suggested you will need to clean up AD first and remove references to the failed DC. you can use NTDSUTIL to do this. NTDSUTIL.exe allows you to do a metadata clean up. this way you don't have to go through and manually delete stuff. use the link below, it as all the information you need. https://technet.microsoft....


2

You may have better luck promoting to DC from media, as described in this MS TechNet article Basically, you will move all necessary data in one go with a packed file, instead of establishing all those connections over your high latency connections. After promotion there will be need of regular replication, which will be retried continuously and, hopefully, ...


2

You can demote your DC and run sysprep with generalize option. "C:\Windows\System32\Sysprep\sysprep.exe". Demoting will reset Windows security database, sysprepping will regenerate all SIDs. Time needed for this will be approximatelly the same as rebuilding it from scratch. Somehow it doesn't look like the migration problem is with your new domain if it's ...


2

The easiest, cleanest thing to do would be to wipe the server and start from scratch.


1

I'm asking because during inavailability dc-A (FSMO owner) dc-B and dc-C wont replicate with each other. Not accurate. They aren't needed. If a connection stops working to one site due to network issues, the ISTG will create a connection to the other site. You may want to read the following: How Active Directory Replication Topology Works - ...


1

You can use the same name and IP address, but before you build the new domain controller, you should go through both DNS and ADSIEdit and make sure (carefully) to remove any references to the old name and IP address. Normally when you demote a domain controller and remove any computer from a domain, the AD cleanup is done for you. DNS doesn't always catch ...


1

The client will need to access Kerberos so that's TCP 88 Then there is the Global Catalogue service so that's TCP 3268 There is the KPassword service TCP 464 (this allows password changes) Then there is LDAP port TCP 389, clients still need to access this to help locate domain controllers. There are also UDP ports for Kerberos (88) and KPassword (464) I am ...



Only top voted, non community-wiki answers of a minimum length are eligible