Tag Info

Hot answers tagged

6

This is almost certainly a DNS issue. Make sure that your clients are configured to use a resolver that is able to resolve queries for your AD domain.


4

Remember that you are not deleting a computer but a computer account Just like deleting a user doesnt eject then from the building, deleting the computer account will just mean the computer can no longer access the domain. Domain logins will fail because the domain controller won't talk to it. Computers need those accounts, with the right password, to ...


4

The DC/DNS server should use it's own ip address for primary DNS and should use 127.0.0.1 for secondary DNS (assuming a single DC/DNS server). The clients should use the DC/DNS server for DNS. You can configure the DNS server properties to use the Forwarders of your choice to resolve external DNS names.


3

Depends on the needs of your business. If you have clients connecting to this DNS server and asking it for names that are not on your network, such as google.com, facebook.com, yahoo.com, whitehouse.gov, etc... since your DNS server is not authoritative for those domains you must use Recursion or else name resolution will fail for external domain names not ...


2

The name of an Active Directory domain is only for internal usage, thus you could name it anything you want; however, in an Active Directory environment, the domain name also acts as the DNS suffix for all computers in the domain, and the domain controllers act as internal DNS servers which are (or at least behave as they were) authoritative for that DNS ...


2

IIRC Hyper-V snapshots are supported in Windows Server 2012. In all cases, snapshots are equivalent to "restore from backup". So you should honor general rules of restoring AD from backup. The most important parameter is the TSL (Tombstone Life Time). I.e. restoring a snapshot older than TSL can cause a lot of troubles. It's better and easier to rebuild the ...


2

A few ideas. Make sure all clients at the site that will experience the "outage" are using domain controllers at their own local site as DNS resolvers. DNS timeouts add little delays to everything that add up to excruciating wait times. The domain controllers at the disconnected site, in addition, should not be forwarding DNS queries to the other domain ...


2

"I also added an alias (CNAME) so that the new server can be accessed with the old server's DNS name." Nice try, but the KRB_AP_ERR_MODIFIED error is Kerberos's way of telling you to $#@! off because the names don't match. All host names, DNS A records, and SPNs must match. CNAME/alias records cannot be used in this situation. (To be more specific, ...


1

My first guess is that you have routing or numbering issues. Check the IP addresses of the servers and ensure that they are getting them from DHCP. If the DCs are not on the same subnet, there needs to be a router in between them (if only a router on a stick). Check that they can actually ping one another. Check that firewalls, local and network, are not ...


1

Just go through the normal promotion steps and add the machine to an existing domain. Once it has been promoted go into your AD users and computes, Right click the domain and select Operations Masters. Change these to your DC01 and you are done


1

If the domain controllers were not able to communicate when you demoted DC01, then you need to take the followings steps. You can google the specifics of each step. 1) Use DC02 to seize the FSMO roles (assuming they belonged to DC01 before the demotion). 2) Clean the orphaned DC from active directory 3) Promote DC01 to a domain controller 4) Move the 5 ...


1

I ended up editing the values below, removing the forest name from the values, then rebooting. All fixed now. No idea why it happened though! 'NV PrimaryDnsSuffix' & 'PrimaryDnsSuffix' in HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\System\DNSClient 'PrimaryDomainName' in ...


1

The query is a simple LDAP-Query, so you can use the negation operator: just place a ! in front of the item, and the outcome will be negated. So in your case: (&(objectCategory=computer)(!userAccountControl:1.2.840.113556.1.4.803:=2)) I tested this query in my AD. Without the exclemation mark, i get only 4 computer accounts which are disabled. With ...


1

You said the server has a static IP address, but you didn't mention the PC. Most APs have DHCP running. If that's where the PC got it's address, then you need to either enter your domain controller as the DNS server that your AP gives out, or manually override the DNS server used by the PC when it gets an address from the AP.



Only top voted, non community-wiki answers of a minimum length are eligible