35
votes
Accepted
What causes a workstation to lose trust with the domain controller?
You probably already know this, but bear with me.
Computers have passwords in AD, just like users. We don't know our computer's password, and it changes regularly via built-in logic.
The short ...
- 18.6k
19
votes
Accepted
Are all domain controllers on a small network considered equivalent/equal?
Yes and no, sort of.
Active Directory replication in general is multi-master. You can create or change an object on any writable domain controller, and that change will be replicated to all other ...
- 55.3k
19
votes
Accepted
Is there any difference between Domain controller and Active directory?
Just to put it another way that might be helpful is to say that Active Directory is a directory service for Windows domain networks and the Domain Controller is what serves that service on your ...
- 1,354
17
votes
Why should you not restore a DC that was backed up 6 months ago?
There is a thing called tombstone lifetime in Active Directory. When you delete an object in Active Directory it is not immediately gone, it is converted to a tombstone and this information is ...
- 2,949
16
votes
Accepted
What does a domain controller (DC) use a certificate for?
Replication between domain controllers will still take place over RPC, even after installing SSL certificates. The payload is encrypted, but not with SSL.
If you use SMTP replication, that ...
- 55.3k
15
votes
Accepted
Encrypting SMB traffic with Samba
The smb.conf manual page needs to be updated! It refers to the old Samba-specific encryption mechanism that applies to SMB1 only and is done via unix extensions. This can be used by smbclient.
...
- 396
15
votes
Search Active Directory for computers logged in, in the last 30 days
Get-ADComputer -Filter * -Properties *
Only get the properties that you intend to use... it's more efficient. Retrieving all the properties of all computers in the domain when you don't really need ...
- 55.3k
12
votes
Accepted
Server 2012 R2 Active Directory Domain SRV dns records suddenly disappeared
1. Restart the Netlogon service on one of the Domain Controllers
OR
2. Run DCDiag /fix
OR
3. Manually create the records from the netlogon.dns file from one of the Domain Controllers
- 109k
12
votes
How bad is it to run Exchange 2016 on a Windows 2012 R2 domain controller for a small organization with assuredly fewer than 25 users?
Assuming a virtualized environment, just install Exchange onto its own VM. When you phrase a question with "how bad is it", you know that what you're doing is against best practices... So the best ...
- 196k
11
votes
Accepted
GPO with SAMBA as DC
You create the group policy on one of the windows workstations:
Download and install the Windows RSAT tools (link is for Win7, it's easy to find them for 8) on one of the windows workstations.
Logged ...
- 12.9k
11
votes
Accepted
In AWS, why is an EC2 behind NAT gateway in private zone said to be safer than one in public subnet?
If an instance has a Public / Elastic IP I can directly target it with an attack. Maybe you left some unneeded ports open in the Security Group that I can exploit.
If it doesn’t have a Public / ...
- 24.3k
10
votes
Accepted
How bad is it to run Exchange 2016 on a Windows 2012 R2 domain controller for a small organization with assuredly fewer than 25 users?
For a small organization it MIGHT be ok. One of the main reasons to run Exchange on its own server is that Exchange is deliberately designed to try to as much RAM as possible to improve performance. ...
- 342
10
votes
What causes a workstation to lose trust with the domain controller?
Extending on Katherine's answer:
A workstation will lose trust with the domain controller if its account has been overwritten. It is entirely possible (with the right permissions) to add a computer ...
- 111
10
votes
How can I verify AD replication between two DCs works
To ensure two DCs replicate with each other, you can follow the guide Forcing Replication.
You first want to ensure that both clean DCs replicate with each other.
Open Active Directory Sites and ...
- 4,605
9
votes
Accepted
How can I verify AD replication between two DCs works
Have you tried DCDIAG? It has lots of tests including Checks for timely replication and any replication errors between domain controllers
Here is a link to Dcdiag information:
https://technet....
- 3,254
8
votes
Windows Server 2012 - Can't join computer to the domain
This is almost certainly a DNS issue. Make sure that your clients are configured to use a resolver that is able to resolve queries for your AD domain.
- 109k
8
votes
Accepted
w32time in domain polling from wrong Domain Controller
From the MS Documentation I can see that computers in a domain should get their time from the PDC domain controller
Not an accurate statement. Domain members need not sync time with the PDCe ...
- 55.3k
8
votes
Accepted
Setting Up multiple domain in LDAP server
The answer to that is dependent on how you want to use the LDAP server.
If you want to have three complete separate LDAP trees, you would configure multiple databases in the cn=config configuration ...
- 98k
8
votes
Accepted
Raising Domain Functional Level
Yes you can without issue.
Raising those level will give you more options, please refer to that documentation
To quote the article;
Windows Server 2012R2
Supported Domain Controller Operating System:
...
- 16.5k
7
votes
Accepted
PC's think its on a domain
This is probably to do with your DHCP setup. One of the options DHCP can provide is a domain-name, which is meant to inform the client what the likely correct suffix to append is when looking up ...
- 937
7
votes
Accepted
Any way to query LDAP binds on domain controller?
If you're trying to be as thorough as possible, keep in mind that LDAP is not the only service a domain controller offers. You could have a 100 Linux servers that are configured to use that domain ...
- 55.3k
7
votes
How to kick users from Windows Server 2012 R2
For the database you could issue these commands providing the accounts connecting to the database do not have db_owner privileges:
ALTER DATABASE <dbname> SET OFFLINE WITH ROLLBACK IMMEDIATE;
...
- 1,985
7
votes
Accepted
no internet time tab on domain controller, Windows Server 2016
However, my computer is a domain controller which should provide the time for clients. Could it be that my domain controller is anyhow configured as both at a time, server and client?
The Domain ...
- 109k
7
votes
Accepted
VCenter has failed, DHCP server is down
Add the DHCP role to the physical DC. Authorize the DHCP server. Create an appropriate scope with appropriate options.
You'll need to create a Scope appropriate for your network with the appropriate ...
- 109k
7
votes
Backing up DC for a catastrophic case
A system state restore could work, but the only method supported by Microsoft is a full system image recovery. This includes system state.
A complete forest recovery is complex, so you need to ...
- 35k
7
votes
Backing up DC for a catastrophic case
I'm trying to make the backup as small as possible...
This is a common approach and it's the wrong approach.
You're protecting one of the company's most important information technology assets. ...
- 109k
7
votes
What device is used for a Domain Controller?
As here already mentioned, you can run Domain controller either on baremetal or as VM. I prefer VM, as it gives you more flexibility and as DC require “low” CPU and RAM you don’t waste hardware ...
- 8,928
6
votes
Colossal Failure After Domain Rename
Oddly enough you're not the first person to do this.
Dell even has a guide on how to register your DC back into DNS.
You really should review everything though, a domain controller is the key part of ...
- 5,587
6
votes
Accepted
Check if a Domain Controller has been cloned
PS GetSid from Sysinternals will show if the SIDS match.
https://technet.microsoft.com/en-us/sysinternals/bb897417.aspx
If they match then that's the answer, if they are different then it won't show ...
- 1,621
6
votes
Accepted
ADFS without domain
I didn't know the answer to your question off the top of my head, since after managing 5000+ user workstations and 30 servers without AD I kind of feel like any network larger than two workstations ...
- 18.6k
Only top scored, non community-wiki answers of a minimum length are eligible