Active Directory Logon / Site Link Bridge Issue

Dear NC,
i have an issue with users in different Locations, to explain easyest here is a little network diagram:
So, as one can see, i have 4 Locations, one is the Headquarter.
The Target Goal is: Users in Location C must Logon with Domaincredentials from Sub.domain.tld from Location A.
Location HQ, A and B are fully routed, Location C has only a route to Location B.
Every Location has at least one writable DC with GC ans DNS Server installed.
I have the following site links:
HQ<>A
HQ<>B
A<>B
B<>C
and also a Site Link Bridge with "A<>B" and "B<>C".
Unfortunatly Users cannot logon in Location C with sub.domain.tld Domaincredentials from Location A.
Need a bit help, thx :-)
-Bernd

Hi Bernd,
I am sorry that I am a little confused here, would you please clarify what do you mean by “Users in Location C must Logon with Domaincredentials from Sub.domain.tld from Location A”?
From what I understand, you have two domains:
domain.tld and sub.domain.tld, and you want that user accounts in
sub.domain.tld (location A) can logon from domain.tld (location C), am I right?
If that is your goal, please make sure the following conditions are true:
During the logon process, specify the right domain name which is like
@sub.domain.tld.
The GC in location C is available to identify the appropriate Domain Controller for authentication process.
There is no network connectivity issues between location A and C, because after GC located a DC in location A, the logon process will take place between location A and C.
In addition, every site should have good network connectivity with at least another site to keep AD replication healthy. If there are critical errors in your HQ site, we should try
to resolve them.
Here is a related article below for your reference:
What Is the Global Catalog?
http://technet.microsoft.com/en-us/library/cc728188(v=WS.10).aspx
Please feel free to let us know if there are any further requirements.
Amy Wang

Similar Messages

  • Active Directory problems/client log in issues

    We have a Windows 2003 Active Directory Server running DNS, DHCP, and Active Directory.
    We have a xserve g5 file server that serves the files for our school.
    Our xserve will not join the kerberos domain on the 2003 Server. We have unbound, rebound, rebooted, repaired permisions, run the kron scrips, did a file system check, all that stuff. We have even done a check disk on the 2003 server. Any ideas as to what could be causing this?
    On top of that our Mac users are unable to log in using active directory. Our pc users are able to log in but there profile mount does not mount. We have no ideas left as to what do do. Please help

    Hi Leif
    I guess it would have been impossible to bind the
    server without having done that first?
    That is true, but I have had experience where the reverse pointer was not created due to a problem with DHCP reserved pools on the AD Server.
    Having said that, it seems the DNS reverse (PTR
    records) might not always be setup by AD setup
    wizards depending on what is chosen at setup time
    ("small" or "big" AD?).
    Exactly right. Forward lookup no problem, bound no problem, imported test users from AD user base, mcx etc, clients bind OK but can’t log in, tell-tale jiggle on the log in window everytime with the added ‘AFP or SMB is on another server etc’ message. Issuing host command reveals no reverse pointer for the ODM, you can never be too certain when it comes to DNS, its a good tip to test and test again and is saves a lot of problems later on.

  • Active directory member;range=0-999 issue

    Has anyone else run into a problem with active directory and
    it returning the member attribute with the range attached? I am
    running into this problem as discussed in a microsoft article (see
    below). The data comes back fine and I get all the records I need.
    BUT... the problem is the column name is returned as
    "member;range=0-999" instead of just member as in a normal active
    directory query. The problem is it has that semicolon in the column
    name so trying to loop through the query or get to that data keeps
    breaking it. So it is there, I just can't get to it. I have tried
    escaping the semicolon or aliasing the column name, but I just keep
    running into problems. I am hoping someone else has run up against
    this or knows ways to get around invalid column names in a query.
    If I have a resultset for a query that has a bad column name, how
    can I get to that data?
    When an Active Directory server returns the values of the
    member attribute as the result of a directory search query, its
    behavior varies depending on whether the total number of attribute
    values for that object exceed the maximum limit on values
    retrieved. For example, if a distribution list on a Windows 2000
    Server contains 1000 or fewer member values, a search query will
    return all of the values in a single call. However, if the list
    contains 2497 member values, the first call to the search query
    function will return the member attribute with no values, and an
    additional member;range=0-999 attribute that contains the first
    1000 member values. To retrieve the next group of member values,
    the search query should be repeated using a range specifier that
    begins at the attribute number one past the number of the previous
    group returned. In this example, the search query function would
    request the member;range=1000-* values, which would return the
    member;range=1000-* attribute with no values and a
    member;range=1000-1999 attribute with the next 1000 values. This
    process is repeated until the last group of values is retrieved.
    The end range on the last group retrieved from the server would be
    indicated by an asterisk (*) in the returned attribute name.

    I found I was able so solve this using the method found at
    the following address:
    http://www.bennadel.com/index.cfm?dax=blog:357.view

  • Route mail and Active Directory Sites and Services configuration

    Folks,
    I have a problem in the internal email routing. My network is spread across various regions and the branch offices are connected together in a mpls network (full mesh). Every region has its own Exchange Server with all roles installed and the smtp connection
    to the outside world is linked to two Exchange servers in the headquarter server farm.
    The problem is that internally I often see emails going across the Exchange Servers in the branch offices where there is low bandwidth (from 3 to 5 Mbps), thus email are sent first to these servers instead of going immediately to the Exchange hosting
    the mailboxes of the intended recipients. This happens also with inbound emails.
    This causes slowness in the email system and sometimes also the network with these branch offices suffers from packet loss or very high latency.
    I know that Exchange is a site-aware application and uses the Active Directory topology for message routing and to communicate with the services that are running on other Exchange 2013 computers. For this reason I have checked the Active Directory Sites
    and Services and surprisingly I have found that there are no sites, no subnets, nothing has been defined but the default settings, included the Inter-Sites transport which contains the default DEFAULTIPSITELINK.
    Apart from the fact that clients use logon servers which are not supposed to use in the far remote offices, I am concerned of changing the Exchange Infrastructure whilst the email system is running and I would like to ask your opinion about my next steps:
    1) Create subnets for every office
    2) Create sites and then link them to the subnets done in point 1
    3) Delete the DEFAULTIPSITELINK and create new site links based on the costs (network speed) in order to determine the best routing server. I have 5 remote offices with 5 different network bandwidth, so I'll have to create 5 IP site links: high cost for
    link with slow network, low cost for fast network.
    4) (Optional) Configure the Exchange-specific cost using the Set-AdSiteLink cmdlet to the AD IP site links created previously
    Apart from the valid questions on why the previous Exchange Administrator have forgotten to set up the Active Directory (Topology) Sites and Services...
    ...And why have chosen to install all Exchange Roles to each server when there was no reason to do that (there are two servers connected to the external smtp gateways in the headquarter, so in my opinion the Exchange Servers in the remote branch offices
    should have had only the mailbox and the cas role)...
    As a matter of fact, my idea is to go further and create the sites,subnets and the ip site link. If I still notice a wrong email flow, I can configure an ad-hoc Exchange-specific cost using the Set-AdSiteLink cmdlet. Does this sound reasonable to you guys
    or I am taking the wrong decisions?
    Thanks

    Thank you very much for your link. This is exactly the page I have read just before posting my question here. It is not easy for me to understand why this has been setup this way by a Microsoft certified engineer.
    There are specific rules to follow when Active Directory and Exchange are located in multiple sites and I am not a skilled Exchange Administrator... he keeps saying that it is correct and also tells that if I go forward with my ideas there is the
    risk to increase the level of complexity. I prefer more complexity than default setting, and as a consequence of that, connectivity problems!
    Hopefully everything goes well. I will post my results here once I have done the changes
    Regards

  • Snow Leopard and Windows 2003 Active Directory Binding Issues

    Ok I have a new imac 27" with snow leopard (completely patched).
    I am attempting to join it to an active directory domain.
    First the prequel:
    * I have opened full traffic to and from the machine and our domain controllers
    * I have enabled full logging on the firewall and there are no blocked packets
    * I have used wireshark to watch the traffic on the mac and there appear to be no anomalies (packets being sent out but not getting a response, dns requests that aren't answered, etc)
    * I have enabled full KDC logging on the domain controller in question and there are no errors in any of the event logs on either domain controller.
    * The domain admin account in question has Enterprise, Schema and Domain Admin rights
    * I have tried it both with and without an existing computer account and with every conceivable combination of caps and no caps on domain name, user and computer names.
    I am getting the following error at the very end of the process:
    "Unable to add server. Credential operation failed because an invalid parameter was provided (5102)"
    I enabled debugging on Directory Services and will post a log in a reply.
    Anyone have any ideas? I have been banging my head on this for a week with no luck.

    Here is the log with the Active Directory: entries grepped... the full log is far too large to reply to here, if you think you need it let me know and I can email it to you it is 548kb
    obviously machine names, usernames and ip addresses have been munged.
    2011-02-09 12:13:32 EST - T\[0x0000000100404000\] - Active Directory: copyNodeInfo called for /Active Directory
    2011-02-09 12:13:36 EST - T\[0x0000000100404000\] - Active Directory: copyNodeInfo called for /Active Directory
    2011-02-09 12:13:41 EST - T\[0x0000000100404000\] - Active Directory: copyNodeInfo called for /Active Directory
    2011-02-09 12:13:46 EST - T\[0x0000000100404000\] - Active Directory: copyNodeInfo called for /Active Directory
    2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: Bind Step 1 - Searching for Forest/Domain information
    2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: subdomain.domain.tld - Start checking servers for site "any"
    2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: Total Servers "any" LDAP - 2, Kerberos - 2, kPasswd - 2
    2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: Adding Server - "dc3.subdomain.domain.tld"
    2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: Adding Server - "dc1.subdomain.domain.tld"
    2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: subdomain.domain.tld - Finished checking servers for domain
    2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: DomainConfiguration reachabilityNotification - Node: subdomain.domain.tld - resolves - enabled
    2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: Bind Step 2 - Finding nearest Domain controllers
    2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: Bind Step 3 - Verifying credentials
    2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: subdomain.domain.tld - Start checking servers for site "any"
    2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: Total Servers "any" LDAP - 2, Kerberos - 2, kPasswd - 2
    2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: Adding Server - "dc3.subdomain.domain.tld"
    2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: Adding Server - "dc1.subdomain.domain.tld"
    2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: subdomain.domain.tld - Finished checking servers for domain
    2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: DomainConfiguration reachabilityNotification - Node: subdomain.domain.tld - resolves - enabled
    2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: EstablishConnectionUsingReplica - Node subdomain.domain.tld - New connection requested
    2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: FindSuitableReplica - Node subdomain.domain.tld - Attempting Replica connect to dc3.subdomain.domain.tld.
    2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: watchReachability watching socket = 21, xxx.xxx.164.71 -> xxx.xxx.174.77
    2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: VerifiedServerConnection - Verified server connectivity - dc3.subdomain.domain.tld.
    2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: CheckWithSelect - good socket to host dc3.subdomain.domain.tld. from poll and verified LDAP
    2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: FindSuitableReplica - Node subdomain.domain.tld - Established connection to dc3.subdomain.domain.tld.
    2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: kadmEntry port is nil, will use default 464
    2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: populateKerberosToDomain - Bailing no domain cache for
    2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: Password verify for [email protected] succeeded - cache MEMORY:vyvyIt4
    2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: Switching active cache to MEMORY:vyvyIt4
    2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: Secure BIND Session Success with server dc3.subdomain.domain.tld.:389 using cache MEMORY:vyvyIt4 user [email protected]
    2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: Processing Site Search with found IP
    2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: No site name available
    2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: subdomain.domain.tld - Start checking servers for site "any"
    2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: Total Servers "any" LDAP - 2, Kerberos - 2, kPasswd - 2
    2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: Adding Server - "dc3.subdomain.domain.tld"
    2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: Adding Server - "dc1.subdomain.domain.tld"
    2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: subdomain.domain.tld - Finished checking servers for domain
    2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: Updating Mappings from inSchema.........
    2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: Updated schema for node name subdomain.domain.tld
    2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: Configuration naming context = cn=Partitions,CN=Configuration,DC=subdomain,DC=domain,DC=tld
    2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: Top domain set as <cn=subdomain,cn=partitions,cn=configuration,dc=subdomain,dc=domain,dc=tld>
    2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: Updating domain hierarchy cache
    2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: Updating policies from domain subdomain.domain.tld
    2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: Updated policies for node name subdomain.domain.tld
    2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: Bind Step 4 - Searching for existing computer
    2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: EstablishConnectionUsingReplica - Node subdomain.domain.tld - New connection requested
    2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: watchReachability watching socket = 18, xxx.xxx.164.71 -> xxx.xxx.174.77
    2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: VerifiedServerConnection - Verified server connectivity - dc3.subdomain.domain.tld.
    2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: establishConnectionUsingReplica - Node subdomain.domain.tld - Previous replica = dc3.subdomain.domain.tld. responded
    2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: kadmEntry port is nil, will use default 464
    2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: populateKerberosToDomain - Bailing no domain cache for
    2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: Password verify for [email protected] succeeded - cache MEMORY:zXpbfEi
    2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: Switching active cache to MEMORY:zXpbfEi
    2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: Secure BIND Session Success with server dc3.subdomain.domain.tld.:389 using cache MEMORY:zXpbfEi user [email protected]
    2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: Doing Computer search for Ethernet address - 10:9a:dd:56:1b:1d
    2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: Bind Step 4 - no mapping for Ethernet MAC address
    2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: Doing DN search for account - machinename
    2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: stopWatching socket = 21, xxx.xxx.164.71 -> xxx.xxx.174.77
    2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: LDAP connection closed - dc3.subdomain.domain.tld.:389 - cache MEMORY:vyvyIt4 user [email protected]
    2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: Destroying cache name MEMORY:vyvyIt4 user [email protected]
    2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: Closing All Connections
    2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: stopWatching socket = 18, xxx.xxx.164.71 -> xxx.xxx.174.77
    2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: LDAP connection closed - dc3.subdomain.domain.tld.:389 - cache MEMORY:zXpbfEi user [email protected]
    2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: Destroying cache name MEMORY:zXpbfEi user [email protected]
    2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: Bind Step 5 - Bind/Join computer to domain
    2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: EstablishConnectionUsingReplica - Node subdomain.domain.tld - New connection requested
    2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: watchReachability watching socket = 18, xxx.xxx.164.71 -> xxx.xxx.174.77
    2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: VerifiedServerConnection - Verified server connectivity - dc3.subdomain.domain.tld.
    2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: establishConnectionUsingReplica - Node subdomain.domain.tld - Previous replica = dc3.subdomain.domain.tld. responded
    2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: kadmEntry port is nil, will use default 464
    2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: populateKerberosToDomain - Bailing no domain cache for
    2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: Password verify for [email protected] succeeded - cache MEMORY:10xG6op
    2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: Switching active cache to MEMORY:10xG6op
    2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: Secure BIND Session Success with server dc3.subdomain.domain.tld.:389 using cache MEMORY:10xG6op user [email protected]
    2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: Looking for existing Record of machinename
    2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: Doing DN search for account - machinename
    2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: EstablishConnectionUsingReplica - Node subdomain.domain.tld - New connection requested
    2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: watchReachability watching socket = 21, xxx.xxx.164.71 -> xxx.xxx.174.77
    2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: VerifiedServerConnection - Verified server connectivity - dc3.subdomain.domain.tld.
    2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: establishConnectionUsingReplica - Node subdomain.domain.tld - Previous replica = dc3.subdomain.domain.tld. responded
    2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: kadmEntry port is nil, will use default 464
    2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: populateKerberosToDomain - Bailing no domain cache for
    2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: Switching active cache to MEMORY:10xG6op
    2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: Secure BIND Session Success with server dc3.subdomain.domain.tld.:389 using cache MEMORY:10xG6op user [email protected]
    2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: KerberosID Found for account CN=MACHINENAME,CN=Computers,DC=subdomain,DC=domain,DC=tld - MACHINENAME$
    2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: Existing record found @ CN=MACHINENAME,CN=Computers,DC=subdomain,DC=domain,DC=tld with [email protected].
    2011-02-09 12:13:50 EST - T\[0x0000000102481000\] - Active Directory: Setting Computer Password FAILED for existing record......
    2011-02-09 12:13:50 EST - T\[0x0000000102481000\] - Active Directory: Computer password change date is 2011-02-04 18:21:01 -0500
    2011-02-09 12:13:50 EST - T\[0x0000000102481000\] - Active Directory: Schtldled computer password change every 1209600 seconds - starting 2011-02-09 12:13:50 -0500
    2011-02-09 12:13:50 EST - T\[0x0000000102481000\] - Active Directory: Closing All Connections
    2011-02-09 12:13:50 EST - T\[0x0000000102481000\] - Active Directory: stopWatching socket = 21, xxx.xxx.164.71 -> xxx.xxx.174.77
    2011-02-09 12:13:50 EST - T\[0x0000000102481000\] - Active Directory: LDAP connection closed - dc3.subdomain.domain.tld.:389 - cache MEMORY:10xG6op user [email protected]
    2011-02-09 12:13:50 EST - T\[0x0000000102481000\] - Active Directory: stopWatching socket = 18, xxx.xxx.164.71 -> xxx.xxx.174.77
    2011-02-09 12:13:50 EST - T\[0x0000000102481000\] - Active Directory: LDAP connection closed - dc3.subdomain.domain.tld.:389 - cache MEMORY:10xG6op user [email protected]
    2011-02-09 12:13:50 EST - T\[0x0000000102481000\] - Active Directory: Destroying cache name MEMORY:10xG6op user [email protected]
    2011-02-09 12:13:50 EST - T\[0x00000001026AA000\] - Active Directory: Failed to changed computer password in Active Directory domain
    2011-02-09 12:13:50 EST - T\[0x0000000102481000\] - Active Directory: copyNodeInfo called for /Active Directory
    2011-02-09 12:13:51 EST - T\[0x0000000102481000\] - Active Directory: copyNodeInfo called for /Active Directory
    Message was edited by: aelana

  • Active Directory replication and login errors (Plz HELP !!)

    Hi All,
    We have one forest domain (XXXX.LOCAL)and lots of child domains (XXX.XXXX.LOCAL).
    We are facing issue that child domains are not able to login with forest administrator account and there are also lots of replication errors.
    Exchange OWA gives error of not able to find particular XXX.XXX.local child domain.
    dcdiag from child domain is :
    C:\Windows\system32>
    C:\Windows\system32>nltest.exe /dsregdns
    Flags: 0
    Connection Status = 1311 0x51f ERROR_NO_LOGON_SERVERS
    The command completed successfully
    C:\Windows\system32>nltest.exe /dsregdns
    Flags: 0
    Connection Status = 1311 0x51f ERROR_NO_LOGON_SERVERS
    The command completed successfully
    C:\Windows\system32>
    C:\Windows\system32>dcdiag
    Directory Server Diagnosis
    Performing initial setup:
       Trying to find home server...
       Home Server = PMA-DC01
       * Identified AD Forest.
       Done gathering initial info.
    Doing initial required tests
       Testing server: HEC-CITY\PMA-DC01
          Starting test: Connectivity
             ......................... PMA-DC01 passed test Connectivity
    Doing primary tests
       Testing server: HEC-CITY\PMA-DC01
          Starting test: Advertising
             Warning: PMA-DC01 is not advertising as a time server.
             ......................... PMA-DC01 failed test Advertising
          Starting test: FrsEvent
             ......................... PMA-DC01 passed test FrsEvent
          Starting test: DFSREvent
             There are warning or error events within the last 24 hours after the
             SYSVOL has been shared.  Failing SYSVOL replication problems may cause
             Group Policy problems.
             ......................... PMA-DC01 failed test DFSREvent
          Starting test: SysVolCheck
             ......................... PMA-DC01 passed test SysVolCheck
          Starting test: KccEvent
             ......................... PMA-DC01 passed test KccEvent
          Starting test: KnowsOfRoleHolders
             [PMA-DC02] DsBindWithSpnEx() failed with error -2146893022,
             The target principal name is incorrect..
             Warning: PMA-DC02 is the PDC Owner, but is not responding to DS RPC
             Bind.
             [PMA-DC02] LDAP bind failed with error 8341,
             A directory service error has occurred..
             Warning: PMA-DC02 is the PDC Owner, but is not responding to LDAP
             Bind.
             Warning: PMA-DC02 is the Rid Owner, but is not responding to DS RPC
             Bind.
             Warning: PMA-DC02 is the Rid Owner, but is not responding to LDAP
             Bind.
             Warning: PMA-DC02 is the Infrastructure Update Owner, but is not
             responding to DS RPC Bind.
             Warning: PMA-DC02 is the Infrastructure Update Owner, but is not
             responding to LDAP Bind.
             ......................... PMA-DC01 failed test KnowsOfRoleHolders
          Starting test: MachineAccount
             ......................... PMA-DC01 passed test MachineAccount
          Starting test: NCSecDesc
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             Fatal Error: Cannot retrieve SID
             ......................... PMA-DC01 failed test NCSecDesc
          Starting test: NetLogons
             ......................... PMA-DC01 passed test NetLogons
          Starting test: ObjectsReplicated
             ......................... PMA-DC01 passed test ObjectsReplicated
          Starting test: Replications
             [Replications Check,Replications Check] Inbound replication is
             disabled.
             To correct, run "repadmin /options PMA-DC01 -DISABLE_INBOUND_REPL"
             [Replications Check,PMA-DC01] Outbound replication is disabled.
             To correct, run "repadmin /options PMA-DC01 -DISABLE_OUTBOUND_REPL"
             ......................... PMA-DC01 failed test Replications
          Starting test: RidManager
             ......................... PMA-DC01 failed test RidManager
          Starting test: Services
                w32time Service is stopped on [PMA-DC01]
             ......................... PMA-DC01 failed test Services
          Starting test: SystemLog
             A warning event occurred.  EventID: 0x00000010
                Time Generated: 04/21/2014   19:16:04
                Event String:
                Unable to Connect: Windows is unable to connect to the automatic upd
    ates service and therefore cannot download and install updates according to the
    set schedule. Windows will continue to try to establish a connection.
             An error event occurred.  EventID: 0x0000168E
                Time Generated: 04/21/2014   19:44:42
                Event String:
                The dynamic registration of the DNS record '_kerberos._tcp.dc._msdcs
    .PMA.XXXX.LOCAL. 600 IN SRV 0 100 88 PMA-DC01.PMA.XXXX.LOCAL.' failed on the fol
    lowing DNS server:
             An error event occurred.  EventID: 0x0000168E
                Time Generated: 04/21/2014   19:44:43
                Event String:
                The dynamic registration of the DNS record '_kerberos._tcp.PMA.XXXX.
    LOCAL. 600 IN SRV 0 100 88 PMA-DC01.PMA.XXXX.LOCAL.' failed on the following DNS
     server:
             An error event occurred.  EventID: 0x0000168E
                Time Generated: 04/21/2014   19:44:43
                Event String:
                The dynamic registration of the DNS record '_kerberos._tcp.HEC-LAHOR
    E._sites.PMA.XXXX.LOCAL. 600 IN SRV 0 100 88 PMA-DC01.PMA.XXXX.LOCAL.' failed on
     the following DNS server:
             An error event occurred.  EventID: 0x0000168E
                Time Generated: 04/21/2014   19:44:43
                Event String:
                The dynamic registration of the DNS record '_kerberos._udp.PMA.XXXX.
    LOCAL. 600 IN SRV 0 100 88 PMA-DC01.PMA.XXXX.LOCAL.' failed on the following DNS
     server:
             An error event occurred.  EventID: 0x0000168E
                Time Generated: 04/21/2014   19:44:43
                Event String:
                The dynamic registration of the DNS record '_kpasswd._tcp.PMA.XXXX.L
    OCAL. 600 IN SRV 0 100 464 PMA-DC01.PMA.XXXX.LOCAL.' failed on the following DNS
     server:
             An error event occurred.  EventID: 0x0000168E
                Time Generated: 04/21/2014   19:44:43
                Event String:
                The dynamic registration of the DNS record '_kpasswd._udp.PMA.XXXX.L
    OCAL. 600 IN SRV 0 100 464 PMA-DC01.PMA.XXXX.LOCAL.' failed on the following DNS
     server:
             An error event occurred.  EventID: 0x0000168E
                Time Generated: 04/21/2014   19:44:43
                Event String:
                The dynamic registration of the DNS record '_kerberos._tcp.HEC-LAHOR
    E._sites.dc._msdcs.PMA.XXXX.LOCAL. 600 IN SRV 0 100 88 PMA-DC01.PMA.XXXX.LOCAL.'
     failed on the following DNS server:
             An error event occurred.  EventID: 0x00000C8A
                Time Generated: 04/21/2014   19:44:51
                Event String:
                This computer could not authenticate with \\LHR-DC01.XXXX.LOCAL, a W
    indows domain controller for domain XXXX, and therefore this computer might deny
     logon requests. This inability to authenticate might be caused by another compu
    ter on the same network using the same name or the password for this computer ac
    count is not recognized. If this message appears again, contact your system admi
    nistrator.
             An error event occurred.  EventID: 0xC00A0038
                Time Generated: 04/21/2014   19:46:02
                Event String:
                The Terminal Server security layer detected an error in the protocol
     stream and has disconnected the client. Client IP: 10.87.193.37.
             An error event occurred.  EventID: 0x40000004
                Time Generated: 04/21/2014   19:52:41
                Event String:
                The Kerberos client received a KRB_AP_ERR_MODIFIED error from the se
    rver pma-dc02$. The target name used was PMA\PMA-DC02$. This indicates that the
    target server failed to decrypt the ticket provided by the client. This can occu
    r when the target server principal name (SPN) is registered on an account other
    than the account the target service is using. Please ensure that the target SPN
    is registered on, and only registered on, the account used by the server. This e
    rror can also happen when the target service is using a different password for t
    he target service account than what the Kerberos Key Distribution Center (KDC) h
    as for the target service account. Please ensure that the service on the server
    and the KDC are both updated to use the current password. If the server name is
    not fully qualified, and the target domain (PMA.XXXX.LOCAL) is different from th
    e client domain (PMA.XXXX.LOCAL), check if there are identically named server ac
    counts in these two domains, or use the fully-qualified name to identify the ser
    ver.
             A warning event occurred.  EventID: 0x8000001C
                Time Generated: 04/21/2014   19:53:42
                Event String:
                When generating a cross realm referal from domain XXXX.LOCAL the KDC
     was not able to find the suitable key to verify the ticket. The ticket key vers
    ion in the request was 25 and the available key version was 22. This most common
     reason for this error is a delay in replicating the keys. In order to remove th
    is problem try forcing replication or wait for the replication of keys to occur.
             An error event occurred.  EventID: 0x40000004
                Time Generated: 04/21/2014   20:13:25
                Event String:
                The Kerberos client received a KRB_AP_ERR_MODIFIED error from the se
    rver pma-dc02$. The target name used was LDAP/4a166db9-c39c-4069-99e7-8a233ce2c0
    be._msdcs.XXXX.LOCAL. This indicates that the target server failed to decrypt th
    e ticket provided by the client. This can occur when the target server principal
     name (SPN) is registered on an account other than the account the target servic
    e is using. Please ensure that the target SPN is registered on, and only registe
    red on, the account used by the server. This error can also happen when the targ
    et service is using a different password for the target service account than wha
    t the Kerberos Key Distribution Center (KDC) has for the target service account.
     Please ensure that the service on the server and the KDC are both updated to us
    e the current password. If the server name is not fully qualified, and the targe
    t domain (PMA.XXXX.LOCAL) is different from the client domain (PMA.XXXX.LOCAL),
    check if there are identically named server accounts in these two domains, or us
    e the fully-qualified name to identify the server.
             An error event occurred.  EventID: 0x40000004
                Time Generated: 04/21/2014   20:13:25
                Event String:
                The Kerberos client received a KRB_AP_ERR_MODIFIED error from the se
    rver pma-dc02$. The target name used was ldap/pma-dc02.pma.XXXX.LOCAL. This indi
    cates that the target server failed to decrypt the ticket provided by the client
    . This can occur when the target server principal name (SPN) is registered on an
     account other than the account the target service is using. Please ensure that
    the target SPN is registered on, and only registered on, the account used by the
     server. This error can also happen when the target service is using a different
     password for the target service account than what the Kerberos Key Distribution
     Center (KDC) has for the target service account. Please ensure that the service
     on the server and the KDC are both updated to use the current password. If the
    server name is not fully qualified, and the target domain (PMA.XXXX.LOCAL) is di
    fferent from the client domain (PMA.XXXX.LOCAL), check if there are identically
    named server accounts in these two domains, or use the fully-qualified name to i
    dentify the server.
             ......................... PMA-DC01 failed test SystemLog
          Starting test: VerifyReferences
             ......................... PMA-DC01 passed test VerifyReferences
       Running partition tests on : DomainDnsZones
          Starting test: CheckSDRefDom
             ......................... DomainDnsZones passed test CheckSDRefDom
          Starting test: CrossRefValidation
             ......................... DomainDnsZones passed test
             CrossRefValidation
       Running partition tests on : PMA
          Starting test: CheckSDRefDom
             ......................... PMA passed test CheckSDRefDom
          Starting test: CrossRefValidation
             ......................... PMA passed test CrossRefValidation
       Running partition tests on : ForestDnsZones
          Starting test: CheckSDRefDom
             ......................... ForestDnsZones passed test CheckSDRefDom
          Starting test: CrossRefValidation
             ......................... ForestDnsZones passed test
             CrossRefValidation
       Running partition tests on : Schema
          Starting test: CheckSDRefDom
             ......................... Schema passed test CheckSDRefDom
          Starting test: CrossRefValidation
             ......................... Schema passed test CrossRefValidation
       Running partition tests on : Configuration
          Starting test: CheckSDRefDom
             ......................... Configuration passed test CheckSDRefDom
          Starting test: CrossRefValidation
             ......................... Configuration passed test CrossRefValidation
       Running enterprise tests on : XXXX.LOCAL
          Starting test: LocatorCheck
             ......................... XXXX.LOCAL passed test LocatorCheck
          Starting test: Intersite
             ......................... XXXX.LOCAL passed test Intersite
    C:\Windows\system32>

    There are a number of things that can cause this, such as:
    DNS is misconfigured to support a parent-child-additional tree forest.
    Incorrect DNS zone replication scope for the design, which points back to the point #1.
    AD Sites are misconfigured for the physical environment. For example if you have a hub and spoke physical environment, you can't use the default settings that bridge all sites (BASL) and must individually configure them.
    Incorrect DNS settings on the DCs.
    Multi-homed DCs.
    Time service is not configured properly and/or syncing from the VM host, which should be configured otherwise (Microsoft, VMware and Citrix have KBs explaining this).
    Default security settings at either the parent, child or both domains, have been altered.
    Firewalls between DCs, such as perimeter firewalls, or installed antivirus protection features if not excluded on DCs properly, will cause this, too.
    That's the short list. If you can describe some of the points above, it may help us pinpoint where the issue may be.
    Some links that may help understand some of the bullet points:
    AD Site Design, DNS & the DC Locator Process, and Auto Site Link Bridging, or Bridge All Site Links (BASL)
    http://blogs.msmvps.com/acefekay/2013/02/24/ad-site-design-and-auto-site-link-bridging-or-bridge-all-site-links-basl/
    DNS Design Options in a Multi-Domain Forest - How to create a Parent-Child DNS Delegation, and How to Configure DNS to create a new Tree in the Forest
    Published by Ace Fekay, MCT, MVP DS on Oct 1, 2010 at 12:22 PM
    http://msmvps.com/blogs/acefekay/archive/2010/10/01/dns-parent-child-dns-delegation-how-to-create-a-dns-delegation.aspx
    Configuring the Windows Time Service for Windows 2000, 2003, 2008 and newer, explanation of the time service hierarchy, and more
    Published by Ace Fekay, MCT, MVP DS on Sep 18, 2009 at 8:14 PM  3050  1 
    http://msmvps.com/blogs/acefekay/archive/2009/09/18/configuring-the-windows-time-service-for-windows-server.aspx
    Ace Fekay
    MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
    Microsoft Certified Trainer
    Microsoft MVP - Directory Services
    Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php
    This posting is provided AS-IS with no warranties or guarantees and confers no rights.

  • DNS and Active Directory error 4000 server 2008

    Hello all,
    My network skills aren't very good and I'm facing a dilemma. First off we have two Windows servers on the network. The newest is 2008 Standard (named Vader) and the other is 2000 (dells3). Obviously I'd like to get rid of the 2000, but the people in charge
    of my budget haven't given me the option to do so and it's the only back up we have.
    Earlier in the week we had lots of problems. One of our nas boxes locked everyone out who was mapped to it and it would only let me log in through the web portal. Two of our Macs our marketing department uses suddenly locked up and wouldn't let them back
    in (both were part of the Active Directory). A second nas box won't let certain people map to it and for awhile I had issues logging into Vader itself.
    I believe all of these problems are connected to some issues on Vader and possibly in conduction with dells3. In Server Manager under DNS I get error 4000 "The DNS server was unable to open Active Directory. 
    This DNS server is configured to obtain and use information from the directory for this zone and is unable to load the zone without it.  Check that the Active Directory is functioning properly and reload the zone. The event data is the error code."
    Then under Active Directory Domain Services I get error 2042 "It has been too long since this machine last replicated with the named source machine. The time between replications with this source has exceeded
    the tombstone lifetime. Replication has been stopped with this source."
    Followed by more text I can post if needed.
    Under File Services error 1202 "The DFS Replication service failed to contact domain controller  to access configuration information. Replication is stopped. The service will try again during the
    next configuration polling cycle, which will occur in 60 minutes. This event can be caused by TCP/IP connectivity, firewall, Active Directory Domain Services, or DNS issues."
    And finally if I try to open Active Directory Domains and Trusts "The configuration information describing this enterprise is not available. The server is not operational."
    I'm not sure where to start or what to post that might help. Any and all help is appreciated.
    Edit: Also I can only add dells3 as the DNS on Vader in the DNS Manager if I try to add Vader to itself I get an error.

    It's the other way around.  Overall, I'm advising ripping the 2008 server out of AD and adding it back . Let's look at this as a series of steps:
    1.) You do a force demote of the 2008 server because it's tombstoned.  This means the 2008 server is no longer a DC. You are doing a force because it doesn't have the ability to replicate.  If it could replicate, we'd just do a graceful demotion
    and be done with it.
    2.) Once the 2008 server is demoted, we go to the 2000 server which holds the only good copy of AD.  From that server we run a metadata cleanup using the ntdsutil utility.  We use that utility to clean out references to the 2008 server which is
    no longer a DC.
    3.) Once you have a clean AD, you can then promote the 2008 server back into Active Directory.  Make sure Vader is pointing to Dells3 as its primary DNS server before promoting or you'll run into issues.
    Hopefully that clarifies things. 

  • Active Directory Time Errors

    Hi everyone. Putting this here as I could not find a better forum. My company's Macs are bound to a Mac OS X Server, but it's the Active Directory binding that is the issue.
    We have a number of Macs, running 10.6.8, that starting sometime recently, began to have login issues. When connected to the network, users could not log in. These are mobile accounts authenticating against a Windows 2008 Active Directory server.
    I started by checking whether binding was still valid. It was not. So I attempt to unbind, and there get an "Active Directory Time Error." It appears that usually, this means that the time on the client and the time reported by the AD server are out of sync. But they're not. I can force unbind, and on attempting to rebind, I get the time error again.
    In nearly every case, these commands in Terminal resolve the issue:
    $ sudo rm -rdfv /Library/Preferences/DirectoryService
    $ sudo rm -rdfv /var/db/dslocal/nodes/default/config
    $ sudo killall -USR1 DirectoryService
    (then restart)
    This didn't happen all at once, the issue has been popping up in one 10.6 machine after another. (We also have a number of 10.8 and 10.9 machines, which so far seem unaffected.)
    Does anyone have any inkling what factors could be causing this to keep happening?

    Not sure how you've confirmed that the times are not skewed; I'd (still) look for a problem with the ntp servers (one ntp server with a rogue time within a pool can play havoc with a network, for instance), and whether the local ntp clients are all reporting as being locked.  See the ntpdc -c peers command, among other commands.

  • Active directory SYSVOL replication issues

    Hello. 
    I have 2 domain controllers, both of them on the same site DC1 & DC2. I have added a new site with a DC3. When I have added DC3 to the domain, I have realized, SYSVOL was not initialized correctly. I went back to DC1 and found out, there's following
    error in the event viewer:
    Error: 4012 on DC1
    The DFS Replication service stopped replication on the folder with the following local path: C:\Windows\SYSVOL\domain. This server has been disconnected from other partners for 99 days, which is longer than the time allowed by the MaxOfflineTimeInDays parameter
    (60). DFS Replication considers the data in this folder to be stale, and this server will not replicate the folder until this error is corrected.
    Error: 2213 on DC2
    The DFS Replication service stopped replication on volume C:. This occurs when a DFSR JET database is not shut down cleanly and Auto Recovery is disabled. To resolve this issue, back up the files in the affected replicated folders, and then use the ResumeReplication
    WMI method to resume replication. 
    This indicates a DFS replication issue between DC1 & DC2 and probably this would be the reason, why the SYSVOL was not properly initialized on DC3. 
    How can I restore correct DFS replication between DC1 & DC2? I've read
    this article, but it's not clear to me, which of the 2 domain controllers has a good version of SYSVOL + I can not find a decent step-by-step article for reconnecting Windows 2012 domain controller.
    Any idea, how I can proceed further here?

    Here's a complete documentation with resolution of my issue. I have created this documentation for my own purposes in our WIKI, so I will paste it here (I hope, it will help somebody else in the future):
    The Problem
    We have bought a new server for our domain. This server (NEWDC01) was promoted to be a domain
    controller in the DOMAIN. After the promotion, I have added a single computer to the domain. When I have logged on the client to the domain, I realized, this computer is not using the new domain controller (NEWDC01)
    for authentication, but DC02 domain controller instead. This is not intended. Local clients should use local domain controllers for authentication (assuming, the Active directory sites & services are configured properly). Further investigation revealed,
    there are some replication errors on OLDDC01 & OLDDC02 servers. First I need to solve these replication errors. Then I can
    add the NEWDC01 server to domain properly.
    Analysis
    There are several errors related to DFSR replication on both domain controllers:
    Error: 4012 on OLDDC01
    The DFS Replication service stopped replication on the folder with the following local path: C:\Windows\SYSVOL\domain.
    This server has been disconnected from other partners for 99 days, which is longer than the time allowed by the MaxOfflineTimeInDays parameter (60). DFS Replication considers the data in this folder to be stale, and this server will not replicate the folder
    until this error is corrected.
    Error: 2213 on OLDDC02
    The DFS Replication service stopped replication on volume C:. This occurs when a DFSR JET database
    is not shut down cleanly and Auto Recovery is disabled. To resolve this issue, back up the files in the affected replicated folders, and then use the ResumeReplication WMI method to resume replication.
    In order to have active directory in a healthy condition, one must ensure, there’s a successful
    replication between existing domain controllers up and running. If the replication does not work correctly, you can expect bunch of issues.
    group policies and logon scripts are not applied correctly, or as intended
    when you want to add a new domain controller to the domain, it will not work as expected (although, you will not see any specific errors after the
    server is promoted to be a domain controller)
    Active directory backup
    I have scheduled an AD backup on OLDDC01 server using the ‘Windows Backup’ solution to make sure,
    I can restore the AD / SYSVOL, in case something goes wrong. The backup is scheduled to be executed every day.
    Active directory restore
    In this particular case, I will talk only about SYSVOL restore. As indicated above, we must get
    rid of the DFSR event viewer errors which you can find in event viewer. One of them is indicating, that the JET database was not shut down cleanly and autorecovery was disabled. The other error indicates, the SYSVOL volume is no longer replicated. I am not
    sure, what is the reason, why the AD’s in the domain stopped to replicate. Probably it was an unclean server shutdown. The DFSR service stopped to replicate the SYSVOL share and I was not aware about that. When the replication did not run for more than ~99
    days, the SYSVOL share was excluded from the DFSR replications.
    Find out the most accurate SYSVOL share in the domain
    I have compared the content of the SYSVOL directories on both OLDDC01 and OLDDC02 servers: C:\Windows\SYSVOL\domain\Policies.
    Both directories have 37 subdirectories. Each subdirectory corresponds to one group policy. This means, that the content is approximately the same, thus I can’t tell, which version is most recent. I do most of the GPO changes on OLDDC01, so I made a conclusion,
    that this server contains the most recent version of the SYSVOL share.
    There are 2 types of SYSVOL restores, you can do:
    Authoritative restore
    Non-authoritative restore
    Non-authoritative restore
    This is a more simple kind of a restore. You can perform this kind of restore, when you are sure,
    that one of the domain controllers is authoritative (e.g. you presume, the SYSVOL share is intact and working properly). If you can identify such a working server, you can perform non-authoritative restore of the active directory on a broken domain controller.
    Authoritative restore
    In this case, you can designate a specific domain controller to be authoritative. You set a special
    flag on this server, which will prohibit to overwrite it’s state from another domain controllers, when the replication is enabled on the server again. After you designate one server to be authoritative, you need to update all the another domain controllers
    using the non-authoritative procedure.
    In this article, you can find, how to perform authoritative vs. non authoritative AD resotre:
    http://support.microsoft.com/kb/2218556.
    In my case, I was not sure, which of the domain controllers had a more recent copy of AD, so I
    have decided to make OLDDC01 authoritative (check the link above). Once this has been done, I have made a non-authoritative update on OLDDC02 server.
    Everything was almost ready. The last step, I needed to execute was, I needed to fix the ‘JET’
    event viewer error on SRVBK1. In the event log entry on the bottom, you can find following:
    Recovery Steps
    1. Back up the files in all replicated folders on the volume. Failure to do
    so may result in data loss due to unexpected conflict resolution during the recovery of the replicated folders.
    2. To resume the replication for this volume, use the WMI method ResumeReplication
    of the DfsrVolumeConfig class. For example, from an elevated command prompt, type the following command:
    wmic /namespace:\\root\microsoftdfs path dfsrVolumeConfig
    where volumeGuid="D37A9FC3-8B1D-11E2-93E8-806E6F6E6963" call ResumeReplication
    For more information, see http://support.microsoft.com/kb/2663685.
    Final words
    After I have executed this command, the replication was again started between OLDDC01 and OLDDC02
    servers. After I have started up the NEWDC01 server, I have realized, it has automatically replicated the contents of the SYSVOL share - almost immediately after the server was started up. I have again tried to login with the local client into DOMAIN domain
    and now I see, that local client is using local Domain controller for authentication.
    Everything seems to be OK now.

  • Active Directory : Replication Issue - "Disconnected" sub-domain from the Forest

    Hello everyone,
    I'm managing a multi-domain forest (with 7 sub-domain).  All are working fine except for one.  Throught repadmin (Repadmin /replsum /bysrc /bydest /sort:delta), I noticed I got both domain controllers of a subdomain (there are only 2 DCs in that
    subdomain), who hadn't replicated with the rest of the forest for more than 60 days.
    According to my research, it's usually recommended to Depromote and repromote the problematic DC to avoid the issue of lingering objects.  In this case, it's both DC of a sub-domain.  Of course, on the others DCs in the forest, I got the event
    ID 2012 "it has been too long since this machine last replicated with the named source machine....". 
     HKLM\System\CurrentControlSet\Services\NTDS\Parameters\Allow Replication With Divergent and Corrupt Partner
    to a value of 1. 
    As I understand it, this may cause lingering objects to appear (they can be removed with repadmin /removelingeringobjects command with the DSA GUID, naming context, etc..).  So far, I haven't used that registry key yet because of the associated risks.
    I didn't noticed any other issue so far.  Users in the problematic sub-domain are fine, and the problematic sub-domain seems to be able to pull replication data from the others DCs in the forests. (at least, I'm not getting any error in the A.D. Sites
    and Services)
    I added two new DCs for the affected sub-domains, so the number of DCs for that domain went from 2 to 4 DCs.  The two old DCs that hadn't replicated for 60 days are windows Server 2003 and the two new DCs are Server 2008 R2. 
    Unfortunately (and I was half expecting this, but did it anyway since I must eventually replace the old DCs), that didn't solve my issue, since the rest of the forest "doesn't see" the two new DCs of the sub-domain.  By that, I mean that I
    cannot add an Active Directory Domain Services Connection in Sites & Services console (from a DC in another domain of the forest or even the root domain).  I see all the DCs, including the two old DCs that are server 2003, but not the new ones. 
    I believe it's because the others DCs doesn't pull/replicate the information from the old DCs anymore, so they aren't "aware" of the two new DCs for that problematic sub-domain.
    I was wondering what is the best course of action. Is it worthwhilte to use the registry key force replication with the old DCs ?  (and hopefully, the new DCs will get their AD Services connection/replication vector created, so I can depromote
    the old DCs.
    Since the Old DCs from the problematic sub-domain seems to be able to pull the replication from the rest of the forest, does the risk of Lingering object isn't that great ?
    Or is it too risky and I must create a new sub-domain and migrate one way or another the users ? (which would be time-consuming)
    Thanks in advance,
    Adam

    Thanks for the reply.  One of the link had another link to a good article about the use of repadmin :
    So, I ran the command "repadmin /removinglingerobjects " on one of the problematic DCs ().
    For clarity purpose, let's say I used the domain :
    domain = main domain
    subdomain = the domain whose DC are problematic (all of them).
    AnotherSubDomain = Just another subdomain I used as a "reference" DC to cleanup the appropriate partition.
    Command (the DSA guid is from a DC "clean" in another domain)
    repadmin /removelingeringobjects adrec01.mysubdomain.domain.ca C4081E00-921A-480D-9FDE-C4C34F96E7AC dc=ANOTHERsubdomain,dc=domain,dc=ca /advisory_mode
    I got the following message in the event viewer :
    Active Directory Domain Services has completed the verification of lingering objects on the local domain controller in advisory mode. All objects on this domain controller have had their existence verified on the following source domain controller.
    Source domain controller:
    c4081e00-921a-480d-9fde-c4c34f96e7ac._msdcs.mydomain.ca
    Number of objects examined and verified:
    0
    Objects that have been deleted and garbage collected on the source domain controller yet still exist on this domain controller have been listed in past event log entries. To permanently delete the lingering objects, restart this procedure without using the
    advisory mode option.
    How should I interpret the message "number of objects examined and verified 0".  Does it mean it just didn't find any object to compare ? (which would be odd IMHO)  Or there is another problem ?
    Thanks in advance,
    Adam

  • Active directory issue

    This is the replication status for the following directory partition on this directory server. 
    Directory partition:
    DC=ForestDnsZones,DC=shankarpack,DC=com 
    This directory server has not received replication information from a number of directory servers within the configured latency interval. 
    Latency Interval (Hours): 
    24 
    Number of directory servers in all sites:

    Number of directory servers in this site:

    The latency interval can be modified with the following registry key. 
    Registry Key: 
    HKLM\System\CurrentControlSet\Services\NTDS\Parameters\Replicator latency error interval (hours) 
    To identify the directory servers by name, use the dcdiag.exe tool. 
    You can also use the support tool repadmin.exe to display the replication latencies of the directory servers.   The command is "repadmin /showvector /latency <partition-dn>".

    sir, i means that secondary domain server is down due to system motherboard issue.so guide to me that how remove all setting of the secondary domain from primary domain. (shankarpack.com).
    errors are :
    Active Directory Domain Services could not resolve the following DNS host name of the source domain controller to an IP address. This error prevents additions, deletions and changes in Active Directory Domain Services from replicating between one or more
    domain controllers in the forest. Security groups, group policy, users and computers and their passwords will be inconsistent between domain controllers until this error is resolved, potentially affecting logon authentication and access to network resources. 
    Source domain controller: 
     AVS1 
    Failing DNS host name: 
     f0c8f1a9-50fd-4785-8ca4-29b1d824b251._msdcs.shankarpack.com 
    NOTE: By default, only up to 10 DNS failures are shown for any given 12 hour period, even if more than 10 failures occur.  To log all individual failure events, set the following diagnostics registry value to 1: 
    Registry Path: 
    HKLM\System\CurrentControlSet\Services\NTDS\Diagnostics\22 DS RPC Client 
    User Action: 
     1) If the source domain controller is no longer functioning or its operating system has been reinstalled with a different computer name or NTDSDSA object GUID, remove the source domain controller's metadata with ntdsutil.exe, using the steps outlined
    in MSKB article 216498. 
     2) Confirm that the source domain controller is running Active Directory Domain Services and is accessible on the network by typing "net view \\<source DC name>" or "ping <source DC name>". 
     3) Verify that the source domain controller is using a valid DNS server for DNS services, and that the source domain controller's host record and CNAME record are correctly registered, using the DNS Enhanced version of DCDIAG.EXE available on http://www.microsoft.com/dns 
      dcdiag /test:dns 
     4) Verify that this destination domain controller is using a valid DNS server for DNS services, by running the DNS Enhanced version of DCDIAG.EXE command on the console of the destination domain controller, as follows: 
      dcdiag /test:dns 
     5) For further analysis of DNS error failures see KB 824449: 
       http://support.microsoft.com/?kbid=824449 
    Additional Data 
    Error value: 
     11004 The requested name is valid, but no data of the requested type was found. 
    This is the replication status for the following directory partition on this directory server. 
    Directory partition:
    DC=ForestDnsZones,DC=shankarpack,DC=com 
    This directory server has not received replication information from a number of directory servers within the configured latency interval. 
    Latency Interval (Hours): 
    24 
    Number of directory servers in all sites:

    Number of directory servers in this site:

    The latency interval can be modified with the following registry key. 
    Registry Key: 
    HKLM\System\CurrentControlSet\Services\NTDS\Parameters\Replicator latency error interval (hours) 
    To identify the directory servers by name, use the dcdiag.exe tool. 
    You can also use the support tool repadmin.exe to display the replication latencies of the directory servers.   The command is "repadmin /showvector /latency <partition-dn>".
    This server is the owner of the following FSMO role, but does not consider it valid. For the partition which contains the FSMO, this server has not replicated successfully with any of its partners since this server has been restarted. Replication errors are
    preventing validation of this role. 
    Operations which require contacting a FSMO operation master will fail until this condition is corrected. 
    FSMO Role: DC=shankarpack,DC=com 
    User Action: 
    1. Initial synchronization is the first early replications done by a system as it is starting. A failure to initially synchronize may explain why a FSMO role cannot be validated. This process is explained in KB article 305476. 
    2. This server has one or more replication partners, and replication is failing for all of these partners. Use the command repadmin /showrepl to display the replication errors.  Correct the error in question. For example there maybe problems with IP connectivity,
    DNS name resolution, or security authentication that are preventing successful replication. 
    3. In the rare event that all replication partners being down is an expected occurance, perhaps because of maintenance or a disaster recovery, you can force the role to be validated. This can be done by using NTDSUTIL.EXE to seize the role to the same server.
    This may be done using the steps provided in KB articles 255504 and 324801 on http://support.microsoft.com. 
    The following operations may be impacted: 
    Schema: You will no longer be able to modify the schema for this forest. 
    Domain Naming: You will no longer be able to add or remove domains from this forest. 
    PDC: You will no longer be able to perform primary domain controller operations, such as Group Policy updates and password resets for non-Active Directory Domain Services accounts. 
    RID: You will not be able to allocation new security identifiers for new user accounts, computer accounts or security groups. 
    Infrastructure: Cross-domain name references, such as universal group memberships, will not be updated properly if their target object is moved or renamed.

  • Inter site mail routing on AD site Link issue

    Hi All,
    1, we are facing issue between mail routing between two  AD site normal mail routed via AD site Link but when put an attachment it stuck in to site queue.
    we have two AD site Site "A" has exchange 2007 SP-3 and Site "B" has exchange 2010 SP-3.
    2, when we are migrating 2007 user's mailbox 2010 after mailbox migration user get a popup " Administrator has made  some changes ......................." after this when user restart his outlook client user can not connected as his mail server
    settings are still older.
    this is working properly for sites having Exchange, rest 2 sites not having any exchange, there we are getting this issue.
    Please help.......
    Thank You
    Vinod
    Vinod Kumar Dhiman

    Hi Vinod,
    Thank you for your question.
    We could run the following command to check if the issue persist:
    Set-SendConnector –Identity <SendConnectorname> -IgnoreStartTLS $false
    You could also send NDR to [email protected] for our troubleshooting.
    Ans:- between AD site mail rout via AD site Link and i have checked the size limit is "Unlimited"..
    Did you mean you have checked the limited of send connector?
    There are following limitation on Exchange server, we could check it by command:
    Global/Organizational Limit: Get-TransportConfig
    Send Connector: Get-SendConnector <send connector name>
    Receive Connector: Get-ReceivConnector<receive connector name>
    Active Directory SiteLink Limit:( you have check)
    Server Limits(transport rule: 15M in this case)
    User Level Limits: Get-Mailbox “User Name” | Format-Table Name,*Max*
    If there are any questions regarding this issue, please be free to let me know. 
    Best Regard,
    Jim
    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
    Jim Xu
    TechNet Community Support

  • Download issue when Windows 7 Pro joins a Windows Server 2008 Active Directory

    Hi,
    I purchased 2 new Dell OptiPlex 3010 desktop computers that came with Windows 7 Professional operating system with SP1. 
    There were no Microsoft updates installed yet.  After I added one of these Dell computers to the Windows Server 2008 Active Directory, I was not able to download several items. 
    Below are several examples:
    1) I downloaded the Norton anti-virus installation file.  This file is not the full installation of Norton; it is more of a file where you execute it and it will download the full installation from the Internet like from their Norton web
    site.  So when I executed this installation file, it does not download the full installation files. 
    It just hung at the screen saying “Downloading” and it will finally stop with an error (don’t remember the error message).
    Note: If I have the full Norton installation file then I am able to install it on this computer with no problems.
    2) I downloaded the Adobe Reader installation file.  This file is not the full installation of Adobe Reader; it is more of a file where you execute it and it will download the full installation from the Internet like from their Adobe web
    site.  So when I executed this installation file, it hung at the downloading part and then it will error out with a “Actionlist Not Found” message.
    Note: If I have the full Adobe Reader installation file then I am able to install it on this computer with no problems.
    3) I installed Microsoft Office 2010 Standard version on this computer. 
    I configured Microsoft Outlook to retrieve emails from my email provider (pop and smtp settings). 
    After configuring Microsoft Outlook, I was able to send emails through Microsoft Outlook successfully (and very quickly), but he was unable to retrieve my emails. The progress bar for the Receiving in the "Outlook Send/Receive Progress" box
    shows no progress. The Progress bar is not moving. There is a message at the bottom of Microsoft Outlook stating "Receiving message 1 of 6 (x.xx KB of x.xx MB)" and it is very slow. My new emails were not being retrieved at all. 
    I tried various pop and smtp servers that was available for my email provider, but all had the same effect.
    4) I can access certain web sites (e.g.
    www.yahoo.com, www.cnn.com) while I cannot access other web sites like
    www.usatoday.com, my web hosting email site.
    Note: I had a Dell computer with Windows XP Professional operating system and this computer does not have any of the above issues.
    The above are only a few examples that I have experienced. 
    If I removed this Dell OptiPlex 3010 computer from the Windows Server 2008 Active Directory then I still experience the same issue.
    So as another test, I setup the other new Dell OptiPlex 3010 with the same Windows 7 Professional OS with SP1. 
    This time, I did not join the Windows Server 2008 Active Directory and I was able to successfully download the full Norton installation files, download the full Adobe Reader installation files, download my emails from Microsoft Outlook 2010, etc. 
    But once I joined this computer to the Windows Server 2008 Active Directory then I am not able to download these files and emails at all.
    It seems like there might be some group policy or a security setting that is preventing these downloads so I disabled the group policy on the Windows Server 2008 AD and Windows 7 Profession OS, but it didn’t resolve the issue.
     I disabled all of the firewall programs on this Windows 7 Professional OS, but it still did not resolve the issue.
    Since the Windows Server 2008 AD did not have DHCP installed, I installed DHCP and setup a scope. 
    Then configured the Windows 7 Professional OS to obtain an IP address, but it didn’t resolve the issue.
    If I move this Windows 7 Professional computer to another network where it did not have any Active Directory; it just had a wireless router serving DHCP then everything works on the Windows 7 Pro computer.
    Any ideas what is the root cause when a Windows 7 Professional computer join a Windows Server 2008 AD?
    Thanks,
    wl_tech

    Hi,
    Could you please tell some information for the AD environment and how it connect to the internet?
    Regarding 3rd party installlers didn't work as expected, please also seek help in their offical website.
    For outlook not receiving emails, could you please take a look in
    Event Viewer and see if there are any special errors logged there?
    And when trying to access the website like
    www.usatoday.com, any special errors IE showed out?
    Best regards
    Michael Shao
    TechNet Community Support

  • Issue with Active Directory User Target Recon

    Hi ,
    I am facing an issue with Active Directory User Target Recon
    My environment is OIM 11g R2 with BP03 patch applied
    AD Connector is activedirectory-11.1.1.5 with bundle patch 14190610 applied
    In my Target there are around 28000 users out of which 14000 have AD account (includes Provisioned,Revoked,Disabled accounts)
    When i am running Active Directory User Target Recon i am not putting any filter cleared the batch start and batch size parameters and ran the recon job .Job ran successfully but it stopped after processing around 3000 users only.
    Retried the job two three times but every time it is stopping after processing some users but not processing all the users.
    Checked the log file oimdiagnostic logs and Connector server logs cannot see any errors in it.
    Checked the user profile of users processed can see AD account provisioned for users
    My query is why this job is not processing allthe users.Please point if i am missing some thing .
    thanks in advance

    Check the connector server load when you are running the recon. Last time I checked the connector, the way it was written is that it loads all the users from AD into the connector server memory and then sends them to OIM. So if the number was huge, then the connector server errored out and did not send data to OIM. We then did recon based on OUs to load/link all the users into OIM. Check the connector server system logs and check for memory usage etc.
    -Bikash

  • Active Directory Issues 10.7.4 & 10.7.5

    Hi
    I'm having problems with all my 10.7.4 & 10.7.5 mac's. They're losing their connection to AD. When I got to unbind I get the follwing error:
    Unable to access domain controller
    This computer is unable to access the domain controller for an unknown reason. Warning: If you click force unbind you will leave an unused computer account in the directory.
    I then get an option to ok or force unbind. If I force unbind if I force unbind I get the following error:
    An unknown error occurred
    An unknown error occurred
    Helpful, I'm sure you'll agree! If I go in to Console I can see the following to errors:
    02/10/2012 16:01:25.682 Directory Utility: An instance 0x7f8f02b30f30 of class ODCUnbindFromADAction was deallocated while key value observers were still registered with it. Observation info was leaked, and may even become mistakenly attached to some other object. Set a breakpoint on NSKVODeallocateBreak to stop here in the debugger. Here's the current observation info:
    <NSKeyValueObservationInfo 0x7f8f02b56970> (
    <NSKeyValueObservance 0x7f8f02b568c0: Observer: 0x7f8f01cea980, Key path: progressStatus, Options: <New: NO, Old: NO, Prior: NO> Context: 0x0, Property: 0x7f8f02b569a0>
    and...
    02/10/2012 16:03:32.463 Directory Utility: -[SFAuthorization obtainWithRights:::::] failed with error Error Domain=NSOSStatusErrorDomain Code=-60007 "The operation couldn’t be completed. (OSStatus error -60007.)" (The authorization was denied since no user interaction was possible. )
    When users are curently logged in they lose access to SSH sessions, and network drives etc... they have had issues with saving work and subsiqently losing it!
    When I go in to opendirectyd.log I see the following:
    2012-10-02 15:37:42.208 BST - opendirectoryd (build 172.17) launched...
    2012-10-02 15:37:42.265 BST - Logging level limit changed to 'error'
    2012-10-02 15:37:42.902 BST - Initialize trigger support
    2012-10-02 15:37:42.904 BST - Registered node with name '/Active Directory' as hidden
    2012-10-02 15:37:42.904 BST - Registered node with name '/Configure' as hidden
    2012-10-02 15:37:42.905 BST - Discovered configuration for node name '/Contacts' at path '/Library/Preferences/OpenDirectory/Configurations//Contacts.plist'
    2012-10-02 15:37:42.905 BST - Registered node with name '/Contacts'
    2012-10-02 15:37:42.906 BST - Registered node with name '/LDAPv3' as hidden
    2012-10-02 15:37:42.939 BST - Registered node with name '/Local' as hidden
    2012-10-02 15:37:42.964 BST - Registered node with name '/NIS' as hidden
    2012-10-02 15:37:42.965 BST - Discovered configuration for node name '/Search' at path '/Library/Preferences/OpenDirectory/Configurations//Search.plist'
    2012-10-02 15:37:42.965 BST - Registered node with name '/Search'
    2012-10-02 15:37:43.024 BST - Discovered configuration for node name '/Active Directory/NUCA-AD' at path '/Library/Preferences/OpenDirectory/Configurations/Active Directory/NUCA-AD.plist'
    2012-10-02 15:37:43.024 BST - Registered subnode with name '/Active Directory/NUCA-AD'
    2012-10-02 15:37:43.024 BST - Registered placeholder subnode with name '/Active Directory/NUCA-AD/All Domains'
    2012-10-02 15:37:43.040 BST - Discovered configuration for node name '/LDAPv3/nuca-mon1.nuca.ac.uk' at path '/Library/Preferences/OpenDirectory/Configurations/LDAPv3/nuca-mon1.nuca.ac.uk. plist'
    2012-10-02 15:37:43.040 BST - Registered subnode with name '/LDAPv3/nuca-mon1.nuca.ac.uk'
    2012-10-02 15:37:43.108 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/legacy.bundle'
    2012-10-02 15:37:43.307 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/search.bundle'
    2012-10-02 15:37:44.311 BST - '/Search' has registered, loading additional services
    2012-10-02 15:37:44.311 BST - Initialize augmentation support
    2012-10-02 15:37:44.352 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/SystemCache.bundle'
    2012-10-02 15:37:44.423 BST - Successfully registered for Kernel identity service requests
    2012-10-02 15:37:44.482 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/PlistFile.bundle'
    2012-10-02 15:37:44.566 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/FDESupport.bundle'
    2012-10-02 15:37:45.461 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/ConfigurationProfiles.bundle'
    2012-10-02 15:37:45.463 BST - Registered subnode with name '/Local/Default'
    2012-10-02 15:37:45.556 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/ldap.bundle'
    2012-10-02 15:37:45.600 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/AppleODClient.bundle'
    2012-10-02 15:37:45.645 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/ActiveDirectory.bundle'
    2012-10-02 15:37:45.654 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/Kerberosv5.bundle'
    2012-10-02 15:37:45.858 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/NetLogon.bundle'
    2012-10-02 15:37:45.858 BST - Registered subnode with name '/Active Directory/NUCA-AD/nuca.ac.uk' as hidden
    2012-10-02 15:37:45.859 BST - Unregistered placeholder node with name '/Active Directory/NUCA-AD/All Domains'
    2012-10-02 15:37:45.860 BST - Registered subnode with name '/Active Directory/NUCA-AD/All Domains'
    2012-10-02 15:37:45.861 BST - Registered subnode with name '/Active Directory/NUCA-AD/Global Catalog' as hidden
    2012-10-02 15:37:57.468 BST - failed to retrieve password for credential
    2012-10-02 15:37:59.051 BST - failed to retrieve password for credential
    2012-10-02 15:38:04.052 BST - failed to retrieve password for credential
    2012-10-02 15:38:14.054 BST - failed to retrieve password for credential
    2012-10-02 15:38:29.056 BST - failed to retrieve password for credential
    2012-10-02 15:38:49.076 BST - failed to retrieve password for credential
    2012-10-02 15:39:11.505 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/configure.bundle'
    2012-10-02 15:39:11.900 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/keychain.bundle'
    Interestingly enough, the problem doesn't seem to effect users runing 10.6.8 or my iMac which is running 10.8.2. I've spoken to network manager and he can't see anything strange going on, on the network.
    I've also spoekn to our AD guy and nothing has changed.
    This is now the second time it's happend, I've managed to get everyone working (before it happened again) by deleting the AD plist in /Library/Preferences/OpenDirectory/Configurations/Active\ Directory/ then rebinding via a scipt pushed out via ARD
    If anyone can offer any assitance I'd be most gratful as I'm about to be shot by our users! as it's the start of our new academic year!
    Thanks!
    Paul

    It's been a few weeks now, and (touch wood) it's not happended again on mass. We have had a few individual ones, but nothing major.
    We still don't quite know exactly what happened, but trouble shooting found the following:
    Our time server wasn't working corrctly centrifys ADCheck tool showed it as having a firewall (even though it didn't) our AD guy fixed that problem (sorry not sure exactly what he did)
    We checked the AD kerberos ticket from a machine that lost it's connection to AD, on another mac that worked and found that it couldn't connect as the password was wrong. It seems that by default Active Directory ticket wants to change it's password every 14, and when trying to it's failing so I set it to 0
    We had tried to set the server the AD plugin see's to a specific DC but this wasnt happening due to subnets not being configured in AD sites and Services
    Some of the Mac's did not like being set to GMT in the time zone and the time was an hour out, people where able to login though! So I've now set them to Eurpoe\London and they're now picking up the correct time and even picked up the daylight savings over the weekend.
    Our DNS is still not great but we are in the process of sorting out our subnets and when we do the consolodation we'll also asign reservations for all the mac's in the hope that apeases DDNS
    Thanks Paul

Maybe you are looking for

  • Error -50 when trying to update to iOS 5

    I'm trying to update my 3GS to ios5 but keep getting an error -50 message while iTunes is backing up my phone. It says if I continue my phone will be wiped? Any help would be great.

  • Webservice returning string (but I need XML for XSLT Tranformation)

    Hello everybody, I have configured an ip with a webservice. So far so good - everything works fine. Now I want to transform the output of the webservice with xslt. The webservice returns the data as a String in form of XML. e.g.     <!XML> <!String>

  • What is the rainbow pinwheel and how do I get rid if it?

    What is the rainbow pinwheel and how can I stop it from freezing a video?

  • LSO - impart qualification with quantity scale

    Hi experts, I have a problem here that I'd like to share with you. We are building a qualification and training catalogs for LSO, and one of the areas would like that a group of trainings summed would impart one qualification. The problem is that the

  • How to post idoc from r/3 to xi

    hi experts i have one doubt abt posting idoc from r/3 to xi how to post for vendor master idoc for sales order idoc for purchase order idoc for delivery idoc          is there any inbuilt posting prgms r there or we have to write the prms. please cle