Tag Info

New answers tagged

0

The query is a simple LDAP-Query, so you can use the negation operator: just place a ! in front of the item, and the outcome will be negated. So in your case: (&(objectCategory=computer)(!userAccountControl:1.2.840.113556.1.4.803:=2)) I tested this query in my AD. Without the exclemation mark, i get only 4 computer accounts which are disabled. With ...


4

Remember that you are not deleting a computer but a computer account Just like deleting a user doesnt eject then from the building, deleting the computer account will just mean the computer can no longer access the domain. Domain logins will fail because the domain controller won't talk to it. Computers need those accounts, with the right password, to ...


0

It sounds like your DNS configuration is the problem. On the DC use the DC's actual ip address as the preferred DNS server and use 127.0.0.1 as the secondary DNS server. On the client use the DC's actual ip address as the primary DNS server and leave the secondary DNS server blank.


1

The easiest way to fix this problem without powershell is: Pull/Disable network connection Login using cached domain credentials or a local account Make sure you have local admin credentials that can be used to login off domain. Create them now if they do not exist. If you don't, you will be locked out once you leave the domain. Plug network connection ...


1

If you have no possible network access to the DC you are out of luck. If your network still has access do the below. Open Powershell as an administrator Reconnect the network cable Run Test-ComputerSecureChannel -Credential Domain\Username -Repair at the powershell command prompt. Additional Note: The Domain\Username needs to have enough AD Permissions ...


1

You will not be able to reestablish trust with domain with connection disabled. You can however reset computer password (trust password) on the Domain Controller if you can get access.


1

As long as the client has access to the DC for authentication, the easiest ways are: Reset-ComputerMachinePassword (run cmdlet in powershell with admin rights) netdom.exe resetpwd /s:<server> /ud:<user> /pd:* Remove the client from the domain and rejoin it.


1

If your user has administrative rights i would create a local user and login with this user to reestable the domain trust with valid domain credentials.


1

You've got a couple of options: 1) if you're sure your files are intact, get that machine to boot by replacing hardware. 2) If not so sure; restore that machine from backup (you're basically performing a disaster recovery at this point) to alternate hardware. Depending on your bare-metal product, this could be good fun. You cannot however, copy those ...


0

There is not a problem with having 2 MS Active Directory domains on the same LAN switches, even if they have the same DNS and netbios names as the existing one. AS LONG AS there is no extra DHCP server AND no domain controller is using the DNS server from the other domain. ie, before making your server a domain controller run the command nslookup -type=ALL ...


0

Use VMs. If you make sure to use a hypervisor the allows you to put all the guests on their own network segment, the dhcp requests/responses won't cross the virtual switch boundry.


1

Apparently, the fax machine must be shared on the fax server, exactly the same way as if you're sharing a printer to the network users. Sharing the fax machine will insure that users are able to access it. Done that and I'm happily delegating the fax work to our secretary now.


0

You mean you want to change the host name of the servers and the FQDN for the entire domain? The renaming of a domain is no easy process and there are many variables that can occur and cause issues once it is completed. If there aren't many workstations you may be better off setting up a new DC from scratch with a new domain and then joining the ...


1

When the DC boots up it goes across the WAN to pull down the DNS zone from the DNS server in the central office - That isn't technically correct. When booting up, a DC will inbound replicate all AD partitions, including AD integrated DNS zones (which are AD partitions when the zone is AD integrated), so the booting DC isn't technically pulling a copy of the ...


3

When the DC boots up it goes across the WAN to pull down the DNS zone from the DNS server in the central office. AD integrated DNS server replicate the DNS zone information through Active Directory replication, as the zone information is actually stored in Active Directory. When the DC boots up it replicates all AD information, including the DNS zones ...


1

You can't apply GPO to a non-domain computer, but you can use System Center Config Manager, Intune, or PowerShell Desired State Config to name a few first-party options.


1

The server is a domain controller. Once you dcpromo it becomes a domain controller. You will need to reverse the process, removing it as a domain controller and removing the Active directory role. Once that is done you can activate and promote it back to being a domain controller. I've done this before and it worked without any problems.


1

So I contacted Microsoft for this, they were very puzzled as well, we never figured out why the time zone change by it self or which process was causing this behavior, but they gave me a work around that fixed my problem, I'm going to post here for future referencing (copy/pasting from Microsoft communication with me) Regarding the current issue, if it is ...


5

To be a little more technically precise: Each DC that doesn't hold the PDC Emulator role will sync with the DC that does hold the PDC Emulator role. Every other domain joined computer will sync with whichever DC authenticates it, which is not necessarily the PDCe. You do not need to manually configure any non-PDCe DC or member computer.


1

No, they will automatically synch with the PDC assuming it's the PDC emulator for the root domain in your forest (if you only have one domain you're good). Do NOT manually synch time for domain members, as long as the DC with the PDCe FSMO is syncing externally you should be set* *if the Hypervisor your running on is old or the Hyper-V server is really ...


-1

Yes this can be done as Windows Server 2008 R2 server does not see and recognise the member server OS version. Even Linux OS can join to Windows Server 2008 R2 Domain. The only issue that will prevent you from joining 2012 R2 to server 2008 R2 is the forest and domain functional level. If you have the functional level to Windows 2012 R2 then you will be able ...


2

nltest /dsgetdc:domain.com /server:dcname Will have the TIMESERV flag if it is advertising. You probably need to run: w32tm /query /status /verbose /computer:dcname To get more information about the problem. Potential causes include it may be synchronizing from the hardware/cmos clock, or using the time synchronization of the Hyper-V ...


1

Integration Services comes pre-installed in a number of supported guest Operating Systems. In others you need to upgrade or install Integration Services after the guest OS installation. To the question Should integration services always be installed on a Hyper-V VM? the answer is most probably yes. The question I think you're really asking is whether or ...


0

As it turns out, it is one thing to find out what your time source is. It's another thing to make sure the time source being used actually works. As with most tech issues, the solution is simple once someone else tells you the steps. I will recap here what everyone told me and what was required to actually get the time source working. As joeqwery ...


2

Generally: NO. Some services at times may be inconvenient (time for a DC was the only case I knew) but the drivers alone are good for performance. Have you ever looked at the hardware simulated for a network card? It is SLOW. The enlightened drivers are the way to go. And they are in any decent OS anyway. This includes recent versions of Linux (Hyper-V ...


2

Add a domain controller (or take a clone of one of the existing ones) Move it to your test network, fire it up. Seize all of the FSMO roles. Use ntdsutil to clean up the old DCs that it can no longer contact.


3

Microsoft has a scenario of transfering FSMO roles from a "dead" server. It means you dont need approval from old fsmo holder or negotiation. New server simply states that now he holds fsmo roles. According to this scenario, you can simply turn off vswbcdc1 and seize roles by svrwbc To seize an operations master role Open a Command Prompt as an ...



Top 50 recent answers are included