New answers tagged

0

My solution is simple (found it all in the internet but never in one place): During install select domain users for the services on the "Server Configuration" page. Using Managed Service Accounts did not work, because you need the passwords for these accounts. I created xAnalyseSvr, xMsDtsSvr, xReportSvr, xSqlAgent, xSQLSvr,... (starting with x fasted up ...


0

Your spns need to be added the service accounts, not the local administrator. ADSIEdit can be really helpful in figuring out where they go.


0

I solved this by using the following GPO setting: Computer Configuration -> Policies -> Administrative Templates -> Network -> DNS Client -> Dynamic update -> Enabled Which is strange, since the behaviour when not configured is enabled. I double checked and we don't have any other Group Policies active concerning DNS, except for the suffix search list.


5

There is a wealth of public information on how the DC Locator process works. Essentially it performs a series of DNS lookups and LDAP pings, and also attempts to stratify the results by selecting the closest domain controller. It's unusual for Windows DC Locator to continue to use a failed domain controller, unless the domain controller is passing the ...


0

Make sure the proper services in the domain controller is on, and run analyzer to ensure your DC is healthy Make sure your DNS is properly advertised Best Practices Analyzer Active Directory Best Practices Analyzer Test telnet port 389 and 3269 from this new machine to the DC


1

There is no immediate impact if your PDC DC goes down. You can plan to manually seize the PDC role from one of the remaining domain controllers. The process is descrbed well here https://www.petri.com/seizing_fsmo_roles


0

You can't transfer, but you can seize them: Seize the Operations Master Role https://technet.microsoft.com/en-us/library/cc816779%28v=ws.10%29.aspx


1

Ok I can now, after the testlab, answer this myself. The initial request for a TGT from the system being logged into to the domain controller contains the username in clear text in the kerberos payload of the network packet(s) (that much was already known). But: When logging in with domainname\username, this will be the username. When logging in with the ...


2

We typically use Exchange HUB as a File Share Witness server. Here are MS's recommendations The witness server can't be a member of the DAG. The witness server must be in the same Active Directory forest as the DAG. The witness server must be running Windows Server 2012, Windows Server 2008 R2, Windows Server 2008, Windows Server 2003 R2, or Windows Server ...


0

After installing a new domain controller, you may find that the "WINDOWS FIREWALL" does not get set properly to "DOMAIN: ON". This is a result of bad installation defaults provided by Microsoft. To fix this, clear the IP6 DNS settings on the network connection from "::0" back to automatic. Also, clear the IP6 Forwarders from the DNS server.


0

The Time synchronization Integration Service should be disabled on all domain members that are virtual machines running under Hyper-V, not just the DC. Your PDCe should be configured to sync time with a reliable external time source. On boot up, the virtual machines will get their time from the Hyper-V host (because they have no RTC of their own) and from ...


0

The standard setup is to disable the time service on the domain controller and set it up to get an external time. https://technet.microsoft.com/en-us/library/cc784553(v=ws.10).aspx Describes the steps. This is pretty imperative as otherwise you alck any decent time source (no, computers have lousy clocks). If you do that properly, you break the host/client ...


0

As Murisonic comments, there is no definitive answer to this, all I can say is that the DHCP role is supported on a DC. On the plus side less VM's less overhead, possible slight performance because DNS and DHCP are on the same servers. I can't really think of any downsides so I would go ahead. Also have a look at the IP address Management (IPAM) role for ...


0

I have occasionally had issues transferring roles but this was normally due to the state of the DC I was transferring from (USN rollback failure normally). As long as replication is functioning and there are no other issues with your AD health then you should be fine. If you do get errors though the operation will fail but remain with the original host. If ...


2

The answer to your question is not related to DNS. When you create an Active Directory domain, amongst other things, you need to specify the domain name and the domain NetBIOS name. The domain name is the FQDN of your domain (acme.local). The domain NetBIOS name is by default (and usually never changed) the first part of your FQDN (acme) and also referred ...


0

Do you have more Sites there? Then you have to check the Site and Services Configuration. Site and Service Configuration


0

i suspect it could come from a misconfigured DNS primary suffix on the workstations (or a DNS suffix set up on a network connection). Just to clarify, i am not talking about search suffix. Could you confirm that those two properties are correct on a client? System -> Computer Name -> Change Settings -> Change... -> More... -> Primary DNS suffix of this ...


0

Too many unknowns for a comment... What version OS are the DNS severs? the clients? Do the failing clients all belong to one domain, or is the problem cross domains? Does the problem also occur machines with static addresses? Are you in the process of moving clients from oldDom to newDom? What else is unique about 50% of the clients that do not have DNS ...


0

First 2 DC seems to be a network issue, are you able to connect the DC Check the role server (PDC) first and resolve the issue then check other 2 DC's to fix the replication issues If DC's are not replicated more then tombstone time period the need a rebuild to resolve the issue


0

If you are using Windows 2012 then you should be able to use a Group Managed Service account to accomplish this. http://blogs.technet.com/b/askpfeplat/archive/2012/12/17/windows-server-2012-group-managed-service-accounts.aspx


7

This is probably to do with your DHCP setup. One of the options DHCP can provide is a domain-name, which is meant to inform the client what the likely correct suffix to append is when looking up unqualified hostnames (i.e. how it knows that when you say ping britannic, you probably mean ping britannic.vms.iqx.co.uk). domain-search is a related option which ...



Top 50 recent answers are included