New answers tagged

0

The solution is to add the “channel access permissions” for the security log. • Ensure the computer account of the collector is in the “Event Log Readers” builtin local security group. • Configure Event Collection on the computer to be monitored - Add the SID (S-1-5-20) of the Network Service account to the Channel Access permissions of the Security ...


0

First you need to authorize DHCP https://social.technet.microsoft.com/Forums/office/en-US/0f666c60-ae59-4ea1-b233-80c2e5f01ac5/unable-to-authorize-dhcp-server-under-active-directory?forum=winserverNIS https://technet.microsoft.com/en-in/library/cc781697(v=ws.10).aspx


3

OK, the problem is that the client has an APIPA address (169.254.139.214), which means that it isn't getting an ip address from DHCP. I can see in your screenshots that the DHCP server has a red arrow, which means it hasn't been authorized, which means it won't assign ip addressing information to clients. You need to authorize the DHCP server and then things ...


3

The command is accurate because it will search for computers whose password has not changed in the number of days that you specify. (By default, computers change their own passwords every 30 days as long as they're connected to the domain.) Source This information is replicated amongst domain controllers, in the pwdLastSet attribute, so assuming ...


1

I'm asking because during inavailability dc-A (FSMO owner) dc-B and dc-C wont replicate with each other. Not accurate. They aren't needed. If a connection stops working to one site due to network issues, the ISTG will create a connection to the other site. You may want to read the following: How Active Directory Replication Topology Works - ...


0

I think the following recommendation is probably what's tripping it but we've never followed this recommendation and never had any serious issues. We do however use write protective hardware, battery backed raid controllers and such, "To ensure durability of Active Directory writes, do not deploy a virtual domain controller’s database files (the Active ...


2

You may have better luck promoting to DC from media, as described in this MS TechNet article Basically, you will move all necessary data in one go with a packed file, instead of establishing all those connections over your high latency connections. After promotion there will be need of regular replication, which will be retried continuously and, hopefully, ...


0

There are several ways you could achieve this. Personally, using Windows Server 2012 R2, I would add an action to Event ID 4624 to trigger either an alert or email to any address.


0

The removal of certificates worked in my case too for clearing off the pre-requisite failure. I'm pasting a powershell command in case the GUI does not work PS C:\WINDOWS\system32> Remove-WindowsFeature -Name AD-Certificate


0

I recommend moving DNS services to a Linux system. Windows Domains are not the same thing as Internet domains, but I see clients confuse this all the time. And, the less exposed your Windows environment is exposed to the Internet, the happier you'll be.


2

You can demote your DC and run sysprep with generalize option. "C:\Windows\System32\Sysprep\sysprep.exe". Demoting will reset Windows security database, sysprepping will regenerate all SIDs. Time needed for this will be approximatelly the same as rebuilding it from scratch. Somehow it doesn't look like the migration problem is with your new domain if it's ...


2

The easiest, cleanest thing to do would be to wipe the server and start from scratch.


3

With only one valid certificate depending on the existing CA after this week, I would do the following: Spin up an entirely new parallel PKI infrastructure (however complicated you care to make it) Generate a new cert to replace the one remaining and migrate the application to use the new cert Decommission the old CA entirely. If the two certs that are ...


0

Sorry, but it doesn't work that way. What you seem to want, doesn't actually exist as a Windows feature. You can only shadow sessions on RDS servers. You can't shadow sessions on random Windows workstations simply because they are connected to the domain. With group and pro/enterprise licenes on all your windows desktops, you can enable RDP access, but ...


5

A forest is a security boundary. A domain is a management boundary. With modern delegation, fine-grained password policies, and item-level targeting in GPO, its entirely possible to create management boundaries within a single domain as well. There's no "right" answer. Evaluate your situation and choose whichever is most appropriate based on your ...



Top 50 recent answers are included