Active Directory Time Change Impact 2008 R2

October 24, 2012, 7:27 am

≫ Next: How to restore an Active Directory server?

≪ Previous: workstation "A" record should be register in a particular folder in DNS console

all,

due to a faulty NTP server we are running ahead of time (2 minutes ) in our Forest .

Now we need to fix the problem and go back in time.

Does anyone see any impact on log dependent applications (SQL /Exchange) ?

Eg. transaction log time vs future and past

thanks for your opinion

↧

How to restore an Active Directory server?

October 22, 2012, 11:41 pm

≫ Next: Windows Password Vulnerability

≪ Previous: Active Directory Time Change Impact 2008 R2

Hi,

Unfortunately our Active Directory Server down due to the Hard Disk failure. We are going to install new hard disk. We need to bring back the AD in its previous position. At present our backup domain controller is supporting our users. I need to get back AD as early as possible.

The following services are running on it.

1. Backup Exec software 2. Kaspersky Security Centre 3. Firewall software 4. Printer Drivers.

We used to take backup on tape drives daily, weekly and monthly.

Can any one suggest me what is the best way to get back AD without any issues?

Regards,

Ram.

↧

Windows Password Vulnerability

October 24, 2012, 7:11 am

≫ Next: Add DC to existing forest

≪ Previous: How to restore an Active Directory server?

Hi,

I've realized that one can login to a machine that is joined to the domain and extract all the passwords in clear text using some tool(the users that once logged to the machine).

I thought windows passwords are encrypted such that no one can extract to clear text, i have checked the accounts to ensure reversible encryption is not enabled.

How can i protect myself from this.

Meshack

↧

Add DC to existing forest

October 18, 2012, 9:30 am

≫ Next: Replication isssue - Sysvol not replicationing "after" 2008 Schema upgrade

≪ Previous: Windows Password Vulnerability

Hi Guys,

Here is the scenario am facing:

We used to have two domain controllers for same domain, AD1 and AD2. Few months ago, AD2 was totally removed. FSMO roles were transferred to AD2. Everything is running smoothly on the network (GP, Logins, New users on AD, Exchange Services, etc...)

Now, we have a requirement to migrate AD2 a new server (AD3) running Windows 2008 R2. Here is the problem and some information:

AD2 functional level is Windows 2003 (highest possible level)
Metadata cleanup was used to remove AD1 from the sites.
adprep /forestprep was executed on AD2 and result was "Forest-Wide information has already been updated"
While running dcpromo on the new server to be AD3, we are having error that we need to run adprep /forestprep but we have executed it successfully many time.

Any ideas to be able to setup this new AD3 server?

Thank you,

Goldenberg

↧

Replication isssue - Sysvol not replicationing "after" 2008 Schema upgrade

October 24, 2012, 6:20 pm

≫ Next: About Lingering Objects. I am not sure to understand something

≪ Previous: Add DC to existing forest

Hi-

We are having issues with one of our DC's - after a recent Schema upgrade to 2008.

1. Started out by running this:

E:\support\adprep>adprep32.exe /forestprep

--> Adprep successfully updated the forest-wide information.

After running "C:\Software\AD\adprep>adprep32.exe /rodcprep"...

Adprep completed with errors. Not all partitions are updated. See the ADPrep.log in the C:\WINDOWS\debug\adprep\logs\20121024191148 directory for more information.

To successfully update all partititions, the current logged on user needs to be
a member of Enterprise Admins group. If that is not the case, please correct the problem, and then restart Adprep.

--> We thought we were going to add RODC to our environment later - but, then decided to ignore these errors move on...

Lastly - run on domain and GP...

E:\support\adprep>adprep32 /domainprep /gpprep
Running domainprep ...

Adprep successfully updated the domain-wide information.

Adprep successfully updated the Group Policy Object (GPO) information.

Our problem DC:

C:\>dcdiag /q
         Unable to connect to the NETLOGON share! (\\server\netlogon)
         [DC] An net use or LsaPolicy operation failed with error 1203, No ne
twork provider accepted the given network path..
         ......................... DC failed test NetLogons
         Warning: DsGetDcName returned information for \\server.Auxiant.local,
when we were trying to reach DC.
         Server is not responding or is not considered suitable.
         ......................... DC failed test Advertising
         There are warning or error events within the last 24 hours after the
         SYSVOL has been shared. Failing SYSVOL replication problems may cause
         Group Policy problems.
         ......................... DC failed test frsevent

We tried using these steps - maybe we did not wait long enough?

-Stop the File Replication Service on the failing DC
-Set the "BurFlags" Value in the following registry key to "D2"(DWORD):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore\Process at Startup

-Start the File Replication Service.

After that the Sysvol Folder should be reinitialized with the contents of the other DC's.

Then we set the value back to 0 and restarted again since we did nto see results.

And we have run this command but are not sure if we can interpret all the info:

repadmin /showrepl /all /verbose

Our Event logs show this last mesg for NTFRS...

Event Type: Warning
Event Source: NtFrs
Event Category: None
Event ID: 13565
Date: 10/24/2012
Time: 7:51:46 PM
User: N/A
Computer: DC
Description:
File Replication Service is initializing the system volume with data from another domain controller. Computer DC cannot become a domain controller until this process is complete. The system volume will then be shared as SYSVOL.

To check for the SYSVOL share, at the command prompt, type:
net share

When File Replication Service completes the initialization process, the SYSVOL share will appear.

The initialization of the system volume can take some time. The time is dependent on the amount of data in the system volume, the availability of other domain controllers, and the replication interval between domain controllers.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Can anyone help or should we just wait?

Thanks much.

-P

↧

About Lingering Objects. I am not sure to understand something

October 25, 2012, 4:26 am

≫ Next: GC subfolder under _msdcs in child domain missing

≪ Previous: Replication isssue - Sysvol not replicationing "after" 2008 Schema upgrade

Hello,

I have a root domain and several child domains.

I have an event 1988 only on my root domain controllers; nothing on my child DCs.

Event Type: Error

Event Source: NTDS Replication

Event Category: Replication

Event ID: 1988

Date: 25/10/2012

Time: 11:06:19

User: NT AUTHORITY\ANONYMOUS LOGON

Computer: <Root DC>

Source DC (Transport-specific network address):

c83afrfa-er75-4258-*****-*********._msdcs.root.domain.local

Object:

CN=Child_DC_NetbiosName(DC2)\0ADEL:95d5016b-db2c-....-....-....,CN=Deleted Objects,DC=CHILD,DC=root,DC=domain,DC=local

Object GUID:

95d5016b-db2c-....-....-....,

I am not sure to understand this error as :

- It seems that the Source GUID is the name of a child DC (DC1).

I dont understand the DN of the Object seen as a lingered object. Why does it show the name of another child domain ?

Why do I only have the 1988 event on root DC and not on child DCs ?

If I run the following command :

Repadmin /removelingeringobjects DC1_Netbiosname <GUID_Source DC of the event>(c83afrfa-er75-4258*****) DC=CHILD,DC=root,DC=domain,DC=local /advisory_mode

I have this error :

DsReplicaVerifyObjectsW() failed with status 8440 (0x20f8):
Can't retrieve message string 8440 (0x20f8), error 1815.

Thanks a lot for your help

↧

GC subfolder under _msdcs in child domain missing

October 25, 2012, 9:01 am

≫ Next: Can I log domain policy infractions like 'john.doe failed to set appropriate password'?

≪ Previous: About Lingering Objects. I am not sure to understand something

In our DNS Manager console, we are told that the gc and domains subfolders are supposed to be under _msdcs in the child domain (ct.er.lcl).We do have these subfolders under _msdcs in the forest root domain (er.lcl).

Is that true ? If so, how can we get these subfolders under the _msdcs in the child domain? We have a 2008 Active-Directory Integrated zone. Zone replication scope is Replicate to all DNS servers in this forest.

Thanks,

Charlie

↧

Can I log domain policy infractions like 'john.doe failed to set appropriate password'?

October 25, 2012, 9:27 am

≫ Next: A warning event occurred. EventID: 0x80000746 This is the replication status for the following directory partiti

≪ Previous: GC subfolder under _msdcs in child domain missing

I'm trying to configure Tivoli Identity Manager AD adapter to provision accounts into AD.

In doing so, I get an error from the adapter stating:

CTGIMD810E The adapter returned an error status for a add request.
Status code: failure ; Adapter error message: Create user failed. Failed while setting User Password

I have set verbose logging on security event, LDAP, directory events on the DC and am getting A LOT of events now but nothing seems to correlate with this failed attempt to create a user. We use NetIQ Sentinel and I'm searching the logs for the user name of the failed user account, the service account, the IP from where the request is coming from. Nothing.

Is it even possible to log this type of event?

↧

A warning event occurred. EventID: 0x80000746 This is the replication status for the following directory partiti

October 25, 2012, 8:57 am

≫ Next: How authenticate user in trusted doamin without authenticate user in user's own domain

≪ Previous: Can I log domain policy infractions like 'john.doe failed to set appropriate password'?

Hi folks...

this is totally practice lab in virtual box

i am using 3 Domain controller one is primary and another one is secondary in same site third one is child domain in another site

After running DCDIAG on a primary domain controller I can see errors relating to the replication ...

in the log if is there any problem guide me to the resolve the problem So please help me t

C:\Users\Administrator>dcdiag

Directory Server Diagnosis

Performing initial setup:
   Trying to find home server...
   Home Server = NY-DC2-2K8
   * Identified AD Forest.
   Done gathering initial info.

Doing initial required tests

   Testing server: NewYorkSite\NY-DC2-2K8
      Starting test: Connectivity
         ......................... NY-DC2-2K8 passed test Connectivity

Doing primary tests

   Testing server: NewYorkSite\NY-DC2-2K8
      Starting test: Advertising
         ......................... NY-DC2-2K8 passed test Advertising
      Starting test: FrsEvent
         ......................... NY-DC2-2K8 passed test FrsEvent
      Starting test: DFSREvent
         There are warning or error events within the last 24 hours after the
         SYSVOL has been shared. Failing SYSVOL replication problems may caus
         Group Policy problems.
         ......................... NY-DC2-2K8 failed test DFSREvent
      Starting test: SysVolCheck
         ......................... NY-DC2-2K8 passed test SysVolCheck
      Starting test: KccEvent
         A warning event occurred. EventID: 0x80000746
            Time Generated: 10/25/2012   08:43:09
            Event String:
            This is the replication status for the following directory partiti
on this directory server.
         ......................... NY-DC2-2K8 passed test KccEvent
      Starting test: KnowsOfRoleHolders
         ......................... NY-DC2-2K8 passed test KnowsOfRoleHolders
      Starting test: MachineAccount
         ......................... NY-DC2-2K8 passed test MachineAccount
      Starting test: NCSecDesc
         ......................... NY-DC2-2K8 passed test NCSecDesc
      Starting test: NetLogons
         ......................... NY-DC2-2K8 passed test NetLogons
      Starting test: ObjectsReplicated
         ......................... NY-DC2-2K8 passed test ObjectsReplicated
      Starting test: Replications
         ......................... NY-DC2-2K8 passed test Replications
      Starting test: RidManager
         ......................... NY-DC2-2K8 passed test RidManager
      Starting test: Services
         ......................... NY-DC2-2K8 passed test Services
      Starting test: SystemLog
         A warning event occurred. EventID: 0x000727AA
            Time Generated: 10/25/2012   07:45:41
            Event String:
            The WinRM service failed to create the following SPNs: WSMAN/NY-DC
2K8.abc.com; WSMAN/NY-DC2-2K8.
         ......................... NY-DC2-2K8 passed test SystemLog
      Starting test: VerifyReferences
         ......................... NY-DC2-2K8 passed test VerifyReferences

   Running partition tests on : ForestDnsZones
      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test
         CrossRefValidation

   Running partition tests on : DomainDnsZones
      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test
         CrossRefValidation

   Running partition tests on : Schema
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation

   Running partition tests on : Configuration
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidatio

   Running partition tests on : abc
      Starting test: CheckSDRefDom
         ......................... abc passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... abc passed test CrossRefValidation

   Running enterprise tests on : abc.com
      Starting test: LocatorCheck
         ......................... abc.com passed test LocatorCheck
      Starting test: Intersite
         ......................... abc.com passed test Intersite

Thanks in advance...

↧

How authenticate user in trusted doamin without authenticate user in user's own domain

October 25, 2012, 10:00 am

≫ Next: Recently added secondary domain controller, dcdiag errors

≪ Previous: A warning event occurred. EventID: 0x80000746 This is the replication status for the following directory partiti

We have 2 domain D1 and D2, had one way trust let D2 trust D1.

We want to build a web form to let user in D1(D1-user) to authenticate (D1-user) by using D2 domain controller.

And D1-user only can provide user principal name and password to D2

Is NPS server the only way?

Thanks

Below is detail.

1. We have 2 domains. D1 and D2.

2. D2 outgoing trust D1(one way trust)

3. There is a web server in D2 domain(D2-web)

4. D2-web host a web form allow user to input user principal name and password

Can we authenticate users in D1(D1-user) through web form on D2-web? and we can not let D2-web talk to D1 domain controller.

↧

Recently added secondary domain controller, dcdiag errors

October 25, 2012, 1:43 pm

≫ Next: Rollback and Recovery options for Domain Functional Level 2003 -> 2008R2

≪ Previous: How authenticate user in trusted doamin without authenticate user in user's own domain

Hiya,

I recently just added a secondary domain controller.

Parent DC is Windows Server 2003, the secondary DC is Windows Server 2008 R2.

When I run DCDIAG on Windows Server 2003 I get the following error messages

Domain Controller Diagnosis

Performing initial setup:
   Done gathering initial info.

Doing initial required tests
   
   Testing server: Default-First-Site-Name\AXIOMSRV
      Starting test: Connectivity
         ......................... AXIOMSRV passed test Connectivity

Doing primary tests
   
   Testing server: Default-First-Site-Name\AXIOMSRV
      Starting test: Replications
         [Replications Check,AXIOMSRV] A recent replication attempt failed:
            From AXIOMSRV2 to AXIOMSRV
            Naming Context: DC=ForestDnsZones,DC=axiom,DC=lan
            The replication generated an error (1908):
            Win32 Error 1908
            The failure occurred at 2012-10-25 21:06:32.
            The last success occurred at 2012-10-25 20:54:37.
            1 failures have occurred since the last success.
            Kerberos Error.
            A KDC was not found to authenticate the call.
            Check that sufficient domain controllers are available.
         [Replications Check,AXIOMSRV] A recent replication attempt failed:
            From AXIOMSRV2 to AXIOMSRV
            Naming Context: CN=Schema,CN=Configuration,DC=axiom,DC=lan
            The replication generated an error (1908):
            Win32 Error 1908
            The failure occurred at 2012-10-25 21:06:32.
            The last success occurred at 2012-10-25 20:54:37.
            1 failures have occurred since the last success.
            Kerberos Error.
            A KDC was not found to authenticate the call.
            Check that sufficient domain controllers are available.
         [Replications Check,AXIOMSRV] A recent replication attempt failed:
            From AXIOMSRV2 to AXIOMSRV
            Naming Context: CN=Configuration,DC=axiom,DC=lan
            The replication generated an error (1908):
            Win32 Error 1908
            The failure occurred at 2012-10-25 21:06:31.
            The last success occurred at 2012-10-25 20:54:37.
            1 failures have occurred since the last success.
            Kerberos Error.
            A KDC was not found to authenticate the call.
            Check that sufficient domain controllers are available.
         ......................... AXIOMSRV passed test Replications
      Starting test: NCSecDesc
         ......................... AXIOMSRV passed test NCSecDesc
      Starting test: NetLogons
         ......................... AXIOMSRV passed test NetLogons
      Starting test: Advertising
         ......................... AXIOMSRV passed test Advertising
      Starting test: KnowsOfRoleHolders
         ......................... AXIOMSRV passed test KnowsOfRoleHolders
      Starting test: RidManager
         ......................... AXIOMSRV passed test RidManager
      Starting test: MachineAccount
         ......................... AXIOMSRV passed test MachineAccount
      Starting test: Services
         ......................... AXIOMSRV passed test Services
      Starting test: ObjectsReplicated
         ......................... AXIOMSRV passed test ObjectsReplicated
      Starting test: frssysvol
         ......................... AXIOMSRV passed test frssysvol
      Starting test: frsevent
         There are warning or error events within the last 24 hours after the

         SYSVOL has been shared.  Failing SYSVOL replication problems may cause

         Group Policy problems. 
         ......................... AXIOMSRV failed test frsevent
      Starting test: kccevent
         ......................... AXIOMSRV passed test kccevent
      Starting test: systemlog
         ......................... AXIOMSRV passed test systemlog
      Starting test: VerifyReferences
         ......................... AXIOMSRV passed test VerifyReferences
   
   Running partition tests on : ForestDnsZones
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom
   
   Running partition tests on : DomainDnsZones
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom
   
   Running partition tests on : Schema
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom
   
   Running partition tests on : Configuration
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom
   
   Running partition tests on : axiom
      Starting test: CrossRefValidation
         ......................... axiom passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... axiom passed test CheckSDRefDom
   
   Running enterprise tests on : axiom.lan
      Starting test: Intersite
         ......................... axiom.lan passed test Intersite
      Starting test: FsmoCheck
         ......................... axiom.lan passed test FsmoCheck

When I run DCDIAG on Windows Server 2008 R2 I get the following error messages

Directory Server Diagnosis

Performing initial setup:

Trying to find home server...

Home Server = AXIOMSRV2

* Identified AD Forest.
Done gathering initial info.

Doing initial required tests

Testing server: Default-First-Site-Name\AXIOMSRV2

Starting test: Connectivity

......................... AXIOMSRV2 passed test Connectivity

Doing primary tests

Testing server: Default-First-Site-Name\AXIOMSRV2

Starting test: Advertising

......................... AXIOMSRV2 passed test Advertising

Starting test: FrsEvent

There are warning or error events within the last 24 hours after the

SYSVOL has been shared. Failing SYSVOL replication problems may cause

Group Policy problems.
......................... AXIOMSRV2 passed test FrsEvent

Starting test: DFSREvent

......................... AXIOMSRV2 passed test DFSREvent

Starting test: SysVolCheck

......................... AXIOMSRV2 passed test SysVolCheck

Starting test: KccEvent

......................... AXIOMSRV2 passed test KccEvent

Starting test: KnowsOfRoleHolders

......................... AXIOMSRV2 passed test KnowsOfRoleHolders

Starting test: MachineAccount

......................... AXIOMSRV2 passed test MachineAccount

Starting test: NCSecDesc

Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have

Replicating Directory Changes In Filtered Set
access rights for the naming context:

DC=ForestDnsZones,DC=axiom,DC=lan
Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have

Replicating Directory Changes In Filtered Set
access rights for the naming context:

DC=DomainDnsZones,DC=axiom,DC=lan
......................... AXIOMSRV2 failed test NCSecDesc

Starting test: NetLogons

......................... AXIOMSRV2 passed test NetLogons

Starting test: ObjectsReplicated

......................... AXIOMSRV2 passed test ObjectsReplicated

Starting test: Replications

......................... AXIOMSRV2 passed test Replications

Starting test: RidManager

......................... AXIOMSRV2 passed test RidManager

Starting test: Services

......................... AXIOMSRV2 passed test Services

Starting test: SystemLog

A warning event occurred. EventID: 0x000003F6

Time Generated: 10/25/2012 21:05:24

Event String:

Name resolution for the name dns.msftncsi.com timed out after none of the configured DNS servers responded.

A warning event occurred. EventID: 0x00000018

Time Generated: 10/25/2012 21:06:55

Event String:

Time Provider NtpClient: No valid response has been received from domain controller axiomsrv.axiom.lan after 8 attempts to contact it. This domain controller will be discarded as a time source and NtpClient will attempt to discover a new domain controller from which to synchronize. The error was: The client fails authenticating a response with a bad signature.

......................... AXIOMSRV2 passed test SystemLog

Starting test: VerifyReferences

......................... AXIOMSRV2 passed test VerifyReferences

Running partition tests on : ForestDnsZones

Starting test: CheckSDRefDom

......................... ForestDnsZones passed test CheckSDRefDom