Active Directory Diagnostics not running in PerfMon

Hello all!
I am trying to run Active Directory Diagnostics in Performance Monitor to address an lsass issue in which lsass consumes too much CPU.
I opened PerfMon from an elevated Command Prompt and expanded the tree: Data Collector Sets -> System -> Active Directory Diagnostics. I right-clicked Active Directory Diagnostics and selected "Start." The diagnostic is supposed
to run for 300 seconds and then generate a report. Problem is, nothing happened after that. If I right-click Active Directory Diagnostics again, the "Start" option is greyed out.
Under Reports -> System -> Active Directory Diagnostics, there are no items to show.
I consulted the following Microsoft Document:
http://support.microsoft.com/kb/971714 and found the following file path where the reports should be located: %systemdrive%\Perflogs\ADDS\<var>date report generation run</var>\*. But there is no ADDS folder and the Admin folder that
is there is empty.
Has anyone seen this before? If so, how did you resolve it?
Thanks.

Have you tried reload the AD DS perf counters?
http://technet.microsoft.com/en-us/library/cc961948.aspx
Enfo Zipper
Christoffer Andersson – Principal Advisor
http://blogs.chrisse.se - Directory Services Blog

Similar Messages

Setup encountered a problem while validating the state of Active Directory: Could not find information about the local site

Have an existing ex2010 sp3 organization.
Could not run ex2013cu1 setup from my newly built 2012 server, getting the error in the subject line. I used the command line to run the AD preparation steps successfully from my 2012 DC/GC, then tried to run setup again from the new 2012 server and
still get the same error. The error itself in the log is pretty useless:
[05/07/2013 01:19:13.0137] [0] **********************************************
[05/07/2013 01:19:13.0137] [0] Starting Microsoft Exchange Server 2013 Cumulative Update 1 Setup
[05/07/2013 01:19:13.0137] [0] **********************************************
[05/07/2013 01:19:13.0152] [0] Local time zone: (UTC-08:00) Pacific Time (US & Canada).
[05/07/2013 01:19:13.0152] [0] Operating system version: Microsoft Windows NT 6.2.9200.0.
[05/07/2013 01:19:13.0152] [0] Setup version: 15.0.620.29.
[05/07/2013 01:19:13.0152] [0] Logged on user: DOMAIN\ADMINISTRATOR.
[05/07/2013 01:19:13.0168] [0] The registry key, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ExchangeServer\V15\Setup, wasn't found.
[05/07/2013 01:19:13.0168] [0] The registry key, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ExchangeServer\V15\Setup, wasn't found.
[05/07/2013 01:19:13.0215] [0] Command Line Parameter Name='sourcedir', Value='\\h1\f$\junk\installers\server\Exchange\2013cu1'.
[05/07/2013 01:19:13.0215] [0] Command Line Parameter Name='mode', Value='Install'.
[05/07/2013 01:19:13.0215] [0] RuntimeAssembly was started with the following command: '/sourcedir:\\SERVER\f$\junk\installers\server\Exchange\2013cu1 /mode:Install'.
[05/07/2013 01:19:13.0215] [0] The registry key, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ExchangeServer\V15\Setup, wasn't found.
[05/07/2013 01:19:13.0793] [0] Finished loading screen CheckForUpdatesPage.
[05/07/2013 01:19:38.0762] [0] Finished loading screen UpdatesDownloadsPage.
[05/07/2013 01:19:40.0496] [0] Starting file's copying...
[05/07/2013 01:19:40.0496] [0] Setup copy files from '\\SERVER\f$\junk\installers\server\Exchange\2013cu1\Setup\ServerRoles\Common' to 'C:\Windows\Temp\ExchangeSetup'
[05/07/2013 01:19:40.0700] [0] Finished loading screen CopyFilesPage.
[05/07/2013 01:19:40.0840] [0] Disk space required: 1292445007 bytes.
[05/07/2013 01:19:40.0840] [0] Disk space available: 23767240704 bytes.
[05/07/2013 01:19:59.0762] [0] File's copying finished.
[05/07/2013 01:19:59.0965] [0] Finished loading screen InitializingSetupPage.
[05/07/2013 01:20:02.0934] [0] Setup is choosing the domain controller to use
[05/07/2013 01:20:09.0325] [0] Setup is choosing a local domain controller...
[05/07/2013 01:20:11.0794] [0] [ERROR] Setup encountered a problem while validating the state of Active Directory: Could not find information about the local site. This can be caused by incorrect configuration of subnets or sites or by replication latency.
See the Exchange setup log for more information on this error.
[05/07/2013 01:20:11.0794] [0] [ERROR] Could not find information about the local site. This can be caused by incorrect configuration of subnets or sites or by replication latency.
[05/07/2013 01:20:11.0809] [0] Setup will use the domain controller ''.
[05/07/2013 01:20:11.0809] [0] Setup will use the global catalog ''.
[05/07/2013 01:20:11.0825] [0] Exchange configuration container for the organization is 'CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=domain,DC=local'.
[05/07/2013 01:20:11.0919] [0] Exchange organization container for the organization is 'CN=DOMAIN,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=domain,DC=local'.
[05/07/2013 01:20:11.0966] [0] Setup will search for an Exchange Server object for the local machine with name 'WEX1'.
[05/07/2013 01:20:12.0028] [0] No Exchange Server with identity 'WEX1' was found.
[05/07/2013 01:20:12.0044] [0] The following roles have been unpacked:
[05/07/2013 01:20:12.0044] [0] The following datacenter roles are unpacked:
[05/07/2013 01:20:12.0044] [0] The following roles are installed:
[05/07/2013 01:20:12.0059] [0] The local server does not have any Exchange files installed.
[05/07/2013 01:20:12.0075] [0] Server Name=WEX1
[05/07/2013 01:20:12.0137] [0] Setup will use the path '\\SERVER\f$\junk\installers\server\Exchange\2013cu1' for installing Exchange.
[05/07/2013 01:20:12.0137] [0] The installation mode is set to: 'Install'.
[05/07/2013 01:20:27.0591] [0] An Exchange organization with name 'DOMAIN' was found in this forest.
[05/07/2013 01:20:27.0591] [0] Active Directory Initialization status : 'False'.
[05/07/2013 01:20:27.0591] [0] Schema Update Required Status : 'False'.
[05/07/2013 01:20:27.0591] [0] Organization Configuration Update Required Status : 'False'.
[05/07/2013 01:20:27.0591] [0] Domain Configuration Update Required Status : 'False'.
[05/07/2013 01:20:27.0841] [0] Applying default role selection state
[05/07/2013 01:20:27.0872] [0] Setup is determining what organization-level operations to perform.
[05/07/2013 01:20:27.0872] [0] Because the value was specified, setup is setting the argument OrganizationName to the value DOMAIN.
[05/07/2013 01:20:27.0872] [0] Setup will run from path 'C:\Windows\Temp\ExchangeSetup'.
[05/07/2013 01:20:27.0888] [0] InstallModeDataHandler has 0 DataHandlers
[05/07/2013 01:20:27.0888] [0] RootDataHandler has 1 DataHandlers
[05/07/2013 01:20:27.0903] [0] Setup encountered a problem while validating the state of Active Directory: Could not find information about the local site. This can be caused by incorrect configuration of subnets or sites or by replication latency. See
the Exchange setup log for more information on this error.
[05/07/2013 01:20:27.0935] [0] [ERROR] Setup encountered a problem while validating the state of Active Directory: Could not find information about the local site. This can be caused by incorrect configuration of subnets or sites or by replication latency.
See the Exchange setup log for more information on this error.
[05/07/2013 01:21:04.0154] [0] The registry key, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ExchangeServer\V15\Setup, wasn't found.
[05/07/2013 01:21:04.0154] [0] End of Setup
[05/07/2013 01:21:04.0154] [0] **********************************************

Hi,
The cause is clearly described in the log:
[05/07/2013 01:20:11.0794] [0] [ERROR] Setup encountered a problem while validating the state of Active Directory: Could not find information about the local site. This can be caused by incorrect configuration of subnets or sites or by replication latency.
See the Exchange setup log for more information on this error.
[05/07/2013 01:20:11.0794] [0] [ERROR] Could not find information about the local site. This can be caused by incorrect configuration of subnets or sites or by replication latency.
I'd suggest you check NIC settings and AD configuration.
Hope it is helpful.
Fiona Liao
TechNet Community Support

Event ID 31138 "during the active directory update not -uc enabled agents were found"

Hi All,
I have Lync standard 2013 server on-premise and Exchange Office 365. I have enabled my users for Voice.
When I add a user to a response group I get the warning that the user is not enterprise voice enabled. This is strange as the user is enterprise enabled and can make and receive calls.
I also have Event ID 31138 on my Front End server.
"during the active directory update not -uc enabled agents were found
The following agents are specified as agents but are not UC enabled:
sip:[email protected]"
Any thoughts?

Hi,
Did you change the default SIP Domain before?
If yes. You may need to remove agent from database. As the agents of a Response Group are added to the rgsconfigdatabase, within the database you will find a table called dbo.Agents. When open it you will see an overview of theagents which are member
of the groups. You can do the following steps to remove an agent from this table:
Right click on the dbo.Agents table and select the option Edit Top 200 rows
Search for the user and remove the specific record.
More details:
http://troubleshootinglync.blogspot.com/2013/05/event-id-31137-unable-to-removeadd.html
Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there.
Please make sure that you completely understand the risk before retrieving any suggestions from the above link.
Best Regards,
Eason Huang
Eason Huang
TechNet Community Support

Active Directory client not dynamically updating DNS

Hi,
There has been some other issues mentioned on other threads regarding the Active Directory Plugin within Lion, it does appear to be flaky.
I just wanted to make sure that the issue I'm having is not down to a mis-config by myself.
We have several Macs running 10.7.1 and are bound into Active directory (Windows 2008 r2) however, it appears that the DNS records for these machines are not being dynamically created within AD. (All Zones are AD intergrated) All 10.6.x clients seem to work fine and records are created and updated dynamically as IPs change etc.
Is anybody else having this issue? If not, any ideas why this is happening?
Thanks in advance.

Hi!
I'm having exactly the same problem and nobody seems to have an answer.
Regarding the reply you got, this has nothing to do with Lion Server. We're talking about Lion clients bound to an AD (Windows Server 2008 R2, in my case) not dynamically registering their DNS entries.
I also noticed that the DHCP entries for those clients are missing the "Name" property, which is already symptomatic of something going wrong.
Anyone?

Lync on websearch only but updates from active directory are not processed.

Hello,
I use "websearch only" for "addressbookavailability". This is working fine on all client.
I have a problem with changes in active directory. When we change for example "job title" of someone then the old "job title" stays present on lync client. When i do a reset of the client of a new installation the new "job title"
is present.
Although we use "websearch only" for some changes it seems that the local address book of lync is still used.
Does someone know how i can force a lync client to also query active directory for this.
I know that the lync server updates every night but on many clients the local address book is not updated.
Regards

You still can force the Addressbook replication by running update-csuserdatabase and update-csadressbook. I suggest you delete the .slab files from Lync share web folder 0000000\000000 folder and then run above command. that will create brand new set of
files. the delete the sip folder from client PC and then restart the client to force download the local copy. see if that fix your issue.
http://thamaraw.com
Hello,
I'm sure this option will work. But this means that we have to do this on a regulary basis.
Is there no option to "force" lync client to query Active Directory all the time ? Not only for users.

Active Directory users not made member of Local Network group

Hi all,
I've just done a clean install from 10.6 Server to 10.8.4.
The issue I seem to be having is a mismatch between what Groups in Server.app is reporting as members (who happen to be users or groups from our Active Directory domains) of a Local Network group and what dseditgroup reports as members of the same network.
The Setup:
In Groups in Server.app under Local Network Group I have created a group call "AccessServer"
Members in that group are:
     - AD-Domain User Group (so should be all users in the domain)
     - MacOS X "netaccounts" group (again, should capture all users that connect through the network I've used this in the past/10.6 very handy)
     - AD User 1
     - AD User 2
     - AD User 3
The Server is bound to the AD Domain, All-Domains is not selected and a Search Path is added for each Domain needed and set at the top of the search order.
The Behaviour:
AD User 1 can access AFP and other services as expected.
AD User 2 and 3 cannot.
Another user within AD-Domain User Group or netaccounts can access AFP and other services as expected
Yet other users within AD-Domain User Group or netaccounts cannot
Furthermore:
If I REMOVE AD User 1 (a working user) *and* the AD Domain Group and netaccounts Group. I can still login with that account!
Diagnosis:
I tried checking group membership with dseditgroup, the results match the behaviour, not the setup.
>dseditgroup -o checkmember -m ADUser1 accessserver
yes ADUser1 is a member of accessserver
>dseditgroup -o checkmember -m ADUser2 accessserver
no ADUser2 is NOT member of accessserver
>dseditgroup -o checkmember -m ADDomainUser/netacc accessserver
yes ADDomainUser/netacc is a member of accessserver
>dseditgroup -o checkmember -m n accessserver
no ADUser2 is NOT member of accessserver
When non-member users try to connect I get a message in the logs of (IP/DNS values anonymized):
2013-06-25 3:04:36.794 PM sshd[5217]: error: PAM: authentication error for illegal user ----- from ----.mala.bc.ca via x.x.
I get the same results even after removing the user from the Groups screen!
Failed Solutions
- As we are a large AD I've tried specifying specific Active Direcotry servers that might better be able to find the users in question and authenticate.
- I've let the system just sit, in hopes delayed replication would solve the problem overnight.
- I've deleted and recreated the groups.

Upon further investigation we have discovered:
a) the main behaviour that is causing the problem is best described as AD users that are added to a Local or Network OS X group... either individually or through a Domain group.... are not actually recognized as members of that OS X group even though the GUI or CLI tool have added them and acknowledge them as being in the list.
b) This is NOT limited only to MacOS X Server 10.8. The same behaviour is occuring on a long-running 10.6 server as well.
c) The problem remains whether we nest AD groups to capture a large bunch of users, or add users individually. If the user is part of the mysteriously denied set, how they are added to the OD or local group is irrelevant, including if added from the command line.
d) Which users are allowed and which are not is unclear and appears generally random. We have found 3 'classes' of users:
          1 - those that are successfully becoming members every time.
          2 - those that are intermittent members. Members on one server or another, or in one case even go from being reported as a member (by dseditgroup), to not being a member, to being a member again within the span of only a minute or two.
          3 - those that are never successfully admitted as a member.
So the problem is both Apple's and Windows in that:
Apple: Is allowing a group and/or user to be added and implying then membership in the group even though that membership is not being honoured in some way and there is no feedback or communication of that fact aside from generic 'denied' or 'illegal user' errors.
Windows: Is passing along membership through its groups and users, but not completely, for reasons that are, at this point, a mystery.
Really hoping people have some ideas on this. This system of nested groups or individual user access is something we have of course being using for many years. So this is a major setback.

"Domain Users" group in Active Directory does not belong to any Group Membership in LC

Active Directory user belonging to "Domain Users" group does not belong to any Group Membership in LC, why does it not belong to "Domain Users" group?
Any way to correct this issue, without changing group membership on AD side?
If Active Directory user is member of "Domain Admins" or "Users" then these show same group membership in LC.
Thanks.

If you want to use the Domain Users group for the purpose of representing all the users then you can use the "All principals in domain xxx" group which is created by UM.
Coming back to Domain Users group. For determining group membership in AD UM uses "member" attribute of the group object. "Domain Users" group is treated differently by AD. It is the default primary group for all the users and normally members of the primary group are not specified using the member attribute.So when we sync the data from AD "Domain Users" membership does not get completed.

Active Directory binding not working

Hi
I'm trying to bind to my active directory at work.
On tiger I used the following settings
serverdomain.ad
the servers name is machine
Which worked fine.
On leopard when I use either serverdomain.ad or machine.serverdomain.ad I get the following error message
(loosely translated from swedish)
An unknown combination of domain and treecollection was used. You should use a complete DNS-name for the domain and tree collection (i.e something.company.se)
Does anyone know what I should use..the FQDN is machine.serverdomain.ad - shouldnt that work?

The answer was dns.. my client was using the correct nameserver.
The binding worked after that..although I'm not sure its autenticating as it should

Active Directory plugin not correctly creating users home directories

Is there a trick to getting the Active Directory plugin in 10.4.7 to correctly create home directories for AD users? It is creating them with the root owning everything in it, and this is unacceptable.
Our setup: We have a Active Directory network (Windows Server 2003 SP1 as DCs), and are trying to integrate some of our Mac clients to user AD single-sign logins. We are not using OS X Server at all.
We do not user any sort of network home directories, as our users always use the same computers.
We just want a user to have a local home directory created when they log on for the first time. Unfortunately, the directories are being created with the wrong permissions.
One thing that may be the problem: the UID that are assigned to the AD users on the Mac clients are very high (> 60000000000). There is an error in the log that a UID that high cannot be added to the lastlog db, so that may be another symptom of the problem.
Is there a way to fix this wihout changing anything on the domain?

Is there a trick to getting the Active Directory plugin in 10.4.7 to correctly create home directories for AD users? It is creating them with the root owning everything in it, and this is unacceptable.
Our setup: We have a Active Directory network (Windows Server 2003 SP1 as DCs), and are trying to integrate some of our Mac clients to user AD single-sign logins. We are not using OS X Server at all.
We do not user any sort of network home directories, as our users always use the same computers.
We just want a user to have a local home directory created when they log on for the first time. Unfortunately, the directories are being created with the wrong permissions.
One thing that may be the problem: the UID that are assigned to the AD users on the Mac clients are very high (> 60000000000). There is an error in the log that a UID that high cannot be added to the lastlog db, so that may be another symptom of the problem.
Is there a way to fix this wihout changing anything on the domain?

IDM / Active Directory : Attributes not geting updated

I am trying to update attributes in my Active Directory Resource, via IDM. But, they are not getting updated.
Before we installed the IDM system in our organization, the Active Directory's "*Department*" field contained previous (old) information.
Now, we want to use IDM to update this information for ALL our employees.
I used the "*Default*" syntax in the IDM User Form, as follows :
*<Field name = 'global.department'>*
*<Display class='Text'>*
*<Property name='Title' value='Department'/>*
*</Display>*
*<Default>*
*<s>Sales Department</s>*
*</Default>*
*</Field>*
Next, I mapped this attribute to the Active Directory "*Department*" field.
However, the new value "*Sales Department*" is not being sent to Active Directory. The old values still remain.
When I tried to do the update directly in AD...........I simply DELETED the old value. And then, I went to IDM to update the employee's account (thereby, I tried to PUSH the new value into AD). But, it did not work. Instead, IDM displayed the following info :
Old value : "empty space"
New value : "old data"
The new data........"*Sales Department*"..........was not being sent to AD.
Next, I simply repeated the update process in AD. But this time, I erased the old data, and wrote "*Sales Department*". Then it worked. AD accepted the new data, and also sent it BACK to idm.
I found this very strange
*(a) why does AD not get updated with the new value from IDM?*
*(b) why does AD reject the new value if the field itself (in AD) is left blank?*
*(c) how can I UPDATE all the employees in Active directory with the new DEFAULT data : "Sales Department"*

MichaelSt wrote:
I want IDM to update AD (meaning, the data-flow is from IDM to AD), not the other way round.
Using "*accounts[AD].department*" means that IDM will take its data FROM active directory. I want AD to take info FROM idmSorry but that's incorrect. The global namespace simply maps an attribute to the equivalent accounts[...].attribute name. So global.department would translate to accounts[AD].department and accounts[LDAP].department and accounts[Some Resource].department. (Incidentally, global.department would get set by the first resource IDM reads with a department attribute so it is very possible to read the attribute from AD. AD may simply not be the first one that IDM comes across.)
Setting the individual resource value, as redindian suggested, is a perfectly valid way of pushing attributes to the resource. (Assuming of course you have the attribute marked as writable in the resource configuration.) So technically if you so desired, you could set different values for accounts[LDAP].department and accounts[AD].department and accounts[Some Resource].department which you cannot do if you use the global namespace.
I do this all the time for some of my attributes. For example, some of my resources (usually the really old legacy ones) require an upper case email address while others require lower case addresses. I set different values for accounts[Legacy Resource].email and accounts[Newer Resource].email when I want to push the attribute down to the resource. I also avoid the global namespace like the plague. I've had so many problems with it mapping data incorrectly that it's just easier to set the individual attributes directly.
The attributes set in the accounts[Resource] namespace is a perfectly valid way to both reference attributes on a resource as well as set them.
As has been suggested, don't use a default but rather use an expansion.

Win7 PC w/ new Active Directory user not able to logon to Win 2K Domain

Hello Friends,
I'm having an issue where our Windows 2000 domain controller does not seem to be on speaking terms with a newly created user on a Windows 7 pro machine.
Here's what I know:
User & Computer are both in AD and work! I've logged in with the new user (Donna) on several machines and other users can log into the computer.
DNS appears to be configured properly on the Win7 workstation (pointed to DC)
DNS is running on the DC and doesn't appear to have any issues.
DCDIAG looks good, all passes except BASC, that failed.
Locally, I've added the domain account to the machine in the users control panel
Removing the account and the computer from the domain didn't work (I've also renamed the computer)
I thought about just renaming the current account that is working to the new user, however, I've always had issues after doing so.
Any thoughts?

Did you get any of these logs ?
529
Logon failure. A logon attempt was made with an unknown user name or a known user name with a bad password.
530
Logon failure. A logon attempt was made user account tried to log on outside of the allowed time.
531
Logon failure. A logon attempt was made using a disabled account.
532
Logon failure. A logon attempt was made using an expired account.
533
Logon failure. A logon attempt was made by a user who is not allowed to log on at this computer.
534
Logon failure. The user attempted to log on with a type that is not allowed.
535
Logon failure. The password for the specified account has expired.
536
Logon failure. The Net Logon service is not active.
537
Logon failure. The logon attempt failed for other reasons.
Arnav Sharma | http://arnavsharma.net/ Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading
the thread.

Active Directory does not exist or cannot be contacted

Hi: We have a server 2008R2 x64 bit. The DC is an server 2008sp2. Single domain.local On trying to install Exchange 2010 we get a series of errors:
1. AD doesn't exist or cannot be contacted
2. must be a member of organization Management role or enterprise admins
3. The credential for machine|Administrator is not on bind
4. The user is not logged on to a windows domain.
DCDiag >> no errors. Have read through a lot of posts with these errros but most apply to server 2003 where there were tools used not available in 2008. Help is greatly appreciated. Chris

Hello Chris,
Are you installing Exchange 2010 on the same server that is a domain controller? if this is a different member server, please post the complete ipconfig /all
Make sure the domain controller is a global catalog server
make sure DNS is functioning well dcdiag /test:dns
You donot need to manually add admin to all these groups as exhange 2010 will do this automatically as long as the account you are using is and administrator and a member of the schema/enterprise admins group
Isaac Oben MCITP:EA, MCSE

Active Directory groups not being managed when added to an OD group?

Hi all,
Hopefully someone out there might be able to help with this. I have a magic triangle of authentication working and when I add an AD group to an OD group, some work and some don't.
For example if I add a AD User to an OD group it works. If I add the "Domain Users" AD group to my OD group, it works - everyone on our network is managed (because everyone is in the Domain Users AD group). But if I remove "Domain Users" and add the "Students" AD security group, they are not managed. If I add "Staff' AD group, some staff are managed and some are not (I have confirmed that they are added to the group).
Is there a trick to having AD security groups work in OD groups every time. (Note they are not distribution groups)
Thanks,
Gavin

If the group was added to SharePoint and then users were added to the group try waiting a day. The claims token in SharePoint lifetime is fairly long. So when new users are added to an existing AD group SharePoint will not recognize the new membership
in the Claims token for 12 -24 hours. If you add a user today they should be able to log in tomorrow. Take a look at the following Blog post. I think this is your issue.
http://www.andrewjbillings.com/sharepoint-2013-claims-authentication-ad-group-changes-not-reflected/
Paul Stork SharePoint Server MVP
Principal Architect: Blue Chip Consulting Group
Blog: http://dontpapanic.com/blog
Twitter: Follow @pstork
Please remember to mark your question as "answered" if this solves your problem.

Active Directory Groups Not Working in Sharepoint

We are trying to manage permissions with AD groups but thus far permissions are not working. We have a site and are able to search for, find, and add AD groups. However, users in this group still get access denied. If users are added explicitly
to the site or to a SharePoint group their permissions work correctly. The UPS has been synced many times without issues and this problem has been occurring for weeks. Is this a problem with SharePoint or AD? Any ideas how to resolve it?
Also, I don't know if this is relevant but the site is also configured for anonymous access. If a user accesses the site anonymously they are granted read access, if they try to access the site while logged in with their account they get access denied.

If the group was added to SharePoint and then users were added to the group try waiting a day. The claims token in SharePoint lifetime is fairly long. So when new users are added to an existing AD group SharePoint will not recognize the new membership
in the Claims token for 12 -24 hours. If you add a user today they should be able to log in tomorrow. Take a look at the following Blog post. I think this is your issue.
http://www.andrewjbillings.com/sharepoint-2013-claims-authentication-ad-group-changes-not-reflected/
Paul Stork SharePoint Server MVP
Principal Architect: Blue Chip Consulting Group
Blog: http://dontpapanic.com/blog
Twitter: Follow @pstork
Please remember to mark your question as "answered" if this solves your problem.

Synchronization with Active Directory issue - Error ID 1004

I found the Application Event Log error below.
Error ID 1004: The resource 'D:\SharePoint 2010\14.0\Service\Microsoft.ResourceManagement.Service.exe' does not exist.
This means, the Network Service account does not have rights to the %programfiles%\Microsoft Office Servers\14.0 folder so,
the User Profile Synchronisation with Active Directory does not run properly.
The solution is to grant read access to the Network Service account to the ...\14.0 folder.
https://support2.microsoft.com/kb/2473430?wa=wsignin1.0
But I cannot find %programfiles%\Microsoft
Office Servers\14.0 folder. Instead
there is a folder in D drive: 'D:\SharePoint 2010\14.0 and I granted read access to the Network Service account to this
folder and ran Full synchronization but still not a joy.
Could you please advise me?
Thanks

Thanks Victoria,
I granted full access to the user
NETWORK SERVICE:, which
is listed in the error message on the folder D:\SharePoint 2010\14.0.
Then reset IIS and ran a full
synchronization, but there are still some user accounts who are a member of an AD group (this AD group has contribute right to the Intranet) and when
I check permission for those users, it seems they don't inherit permission from that AD group.
For example :
AD group name: TeamMembers
TeamMembers has contribute
permission.
user1, user2, user3 and user4 are members of TeamMembers
user1 and user2 have contribute
permissionGiven through the "TeamMembers"
group.
user3 and user4 have no permission!!!
I don't know what the problem is. I don't have access to Active Directory but the people who have access to say all users are members of that AD group.
Could you please advise?
Thanks

Active Directory Diagnostics not running in PerfMon

Similar Messages

Maybe you are looking for