Hot answers tagged

10

No, this is not possible if the OU is located at the root level in the parent domain (there is instead no issue if the OU is located in a subtree). Reference: http://support.microsoft.com/en-us/kb/240147. The KB article is very old and only mentions Windows 2000, but the limitation still applies as of Windows Server 2012 R2. Oddly, the official guide ...


5

A forest is a security boundary. A domain is a management boundary. With modern delegation, fine-grained password policies, and item-level targeting in GPO, its entirely possible to create management boundaries within a single domain as well. There's no "right" answer. Evaluate your situation and choose whichever is most appropriate based on your ...


2

You can demote your DC and run sysprep with generalize option. "C:\Windows\System32\Sysprep\sysprep.exe". Demoting will reset Windows security database, sysprepping will regenerate all SIDs. Time needed for this will be approximatelly the same as rebuilding it from scratch. Somehow it doesn't look like the migration problem is with your new domain if it's ...


2

The easiest, cleanest thing to do would be to wipe the server and start from scratch.


2

You may have better luck promoting to DC from media, as described in this MS TechNet article Basically, you will move all necessary data in one go with a packed file, instead of establishing all those connections over your high latency connections. After promotion there will be need of regular replication, which will be retried continuously and, hopefully, ...


2

you can use NTDSUSTIL and try a Metadata clean up. if there are any references in AD to your failed DC then the Metadata clean up can remove them. check out the link below https://technet.microsoft.com/en-us/library/cc816907(v=ws.10).aspx


2

You assign a full address (/128) in a quad-A record. The /64 is a range of addresses for you to allocate from. For example: 2604:4301:a:103/64 is my range, and I can use any address between 2604:4301:a:103:: (the :: is shorthand for all-zeros) and 2604:4301:a:103:FFFF:FFFF:FFFF:FFFF.


2

It might be more accurate to ask, "Is there any situation where one would want to log in as the local administrator account on a domain-joined server, and not a domain account?" I never log in as the local administrator account of a domain-joined server. I prefer to give it a complex password and then disable it, but my current colleagues prefer to give ...


1

Welcome to the club. Getting domain joins to work can be a black art, sometimes... Samba needs an OS-level user for the machine, too. This user needs to have the format name$, where name is the machine name which you're trying to join, and $ is exactly that -- a dollar sign. If you use winbindd this happens automatically, but if you don't then you need to ...


1

How do you propose that you would assign a subnet to an AAAA record? :) Per the RFC: The AAAA resource record type is a record specific to the Internet class that stores a single IPv6 address.


1

No, nothing unexpected will happen, since the system uses the SYSTEM principal and you aren't planning to delete that. However, what you are planning to do won't stop an administrator from modifying or removing the object. Administrators always have the SeTakeOwnershipPrivilege privilege, which allows them to set the owner of any object to themselves (or a ...



Only top voted, non community-wiki answers of a minimum length are eligible