AD account logging to a remote domain controller for authentication

Hi,
I have a weird issue with an AD account using a different logonserver when authenticating to AD. A domain admin account uses the local site domain controller but another account is using a remote domain controller as logonserver. I'm using both account
to logon to the same server (CRM 2011). But when I issue the command "set l' from the command line, they shows different logonserver value.
My issue is the crm account is pointing to a remote domain controller (windows 2012 R2) which I don't want and should use the local site domain controller (windows 2008 R2). The reason being is that the CRM server is on a test network (isolated) and
when we test an upgrade of CRM addon product called Experlogix, the upgrade requires to get authenticated by AD but it fails and I think the logonserver is the issue. When the crm account is used on the test server it points not to the local site domain controller
but to the remote dc which is not in the test server.
Thanks for your help!!!
AA

Start by checking that your are sites and subnets are well configured.
Use dssite.msc and make sure that:
You have AD sites that represent your physical sites
All the subnets in use are created and moved to the correct AD site
Your DCs belong to the correct AD site
You can read more about the DC Locator process here: http://social.technet.microsoft.com/wiki/contents/articles/24457.how-domain-controllers-are-located-in-windows.aspx
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile

Similar Messages

Unable to find domain controller for the specified domain. Please explicitly specify the domain controller.

Im getting error "Unable to find domain controller for the specified domain. Please explicitly specify the domain controller." when I try to create an AD connection for my User Profile Service. The entire sharepoint environment is installed
on one server. That server has everyting on it, AD, SQL, Sharepoint, and its the domain controller. I cant figure out why this will not identify?Trevor Fielder

Hi,
Did you get this error when clicking on the Populate Containers button?
If yes, please make sure that you have provide the domain credentials in the account name and password
boxes below when entering the domain information. The account must be granted the replicating directory changes permission on the domain.
You can refer to this blog:
http://www.harbar.net/articles/sp2010ups.aspx
Xue-Mei Chang

ACL migration Error : 1210 could not find a domain controller for domain "Test Domain" (Old Domain)

Hi
We are migrating from old domain to new domain. Before live migration, we are trying to check the ACE/ACL migration through SubInACL. We are running the SubInACL on a cluster, which is a member of the Old Domain (Test Domain). We are able to resolve and
ping both Old Domain and the New domain from this cluster machine. We have created a network share on this cluster, which is accessible to all Domain Users of the Old Domain. Both Domains have two way forest level trust. we are trying to migrate
the ACL of this share (\\ClusterMachine\testshare$) to the new domain using SubInACL. We are trying to run the below command to get it done.
subinacl /outputlog=C:\Users\Administrator\Desktop\Migrationlog.txt /subdirectories
\\ClusterMachine\testshare$\*.* /migratetodomain=OldDomain=NewDomain=mappingfile.txt
Mapping file contains : Domain Users=NewDomain_Users
But we are geeting the Error that "1210 could not find a domain controller for domain "Test Domain". Error finding domain name : 1210 the format of the specified computer name is invalid. Current Object "\\ClusterMachine\testshare$"
will not be processed."

Hello,
how in detail is DNS set up in each domain?
Any problems when using nslookup to verify?
Best regards
Meinolf Weber
MVP, MCP, MCTS
Microsoft MVP - Directory Services
My Blog: http://blogs.msmvps.com/MWeber
Disclaimer: This posting is provided AS IS with no warranties or guarantees and confers no rights.
Twitter:

Charm: No Domain Controller for SB5

Hi,
I configured Charm in solution Manager 4.0, created a satellite system SB5 in smsy and run the batch to get the info to charm. now i have it in /tmwflow/cmsconf but when i synchronize the project in solar_admin_project we get the error No Domain Controller for SB5.
The STMS is configured correctly in SB5
The RFC dests are OK also from SMSY i can see the dommain controller without any problem and distribution routes also.
Any advise
Thanks
Ahmed

Thanks Pascal,
I was able to fix the problen but adding a domain link between solution manager and satellite systems.
Ahmed

Best pracices for setting up Domain controller for our remote European offices

Hi,,
We have about 17 remote site across Europe (HQ in UK), I want to start revoking the offices local DC's and host them in a couple of Cloud servers in Germany with local NAS boxes for file storage. I will have MPLS network between the offices to the Cloud
DC.
Now what would be the best practices and tips for this situation in respect to the DC's. How can I prioritize the remote offices to use the Cloud DC/DNS and not our DC at our HQ in the UK. Would it be better to have a sub-domain created (europe.company.co.uk)
for the other offices.
Any suggestions on this setup for the DC

Hiya,
on the conceptual level. The reason for having local DC's, is that if the local sites internet line is offline, people are still able to authenticate and access local resources. From that point of view, you might as well just run with your HQ DC's only. Note:
the cloud does offer availability on their services, that might not be matched by your HQ in terms of double internet lines.
That said.
The DNS server of the clients as well as the sites & services of Active Directory. Your clients will use the nearest domain controller available from sites and services information.
Managing Intersite Replication
http://technet.microsoft.com/en-us/library/cc794799%28v=ws.10%29.aspx

Can account SUPPORT_388945a0 be deleted from domain controller?

Hi Guys,
I see that there have an account "SUPPORT_388945a0" has been created on domain controller automatically. Can we delete it safety?
Thanks,
OCS User

Actually that statement is incorrect. AD (or more specific the DSA/DC) can request that a set of default accounts and groups are to be created, this is for example used when you introduce a DC with a new NT version in a domain (This is independent on DFL/FFL)
their is different “default” accounts and groups defined for example Windows 2000 and Windows Server 2008 R2.
The introduced DSA with a new NT version calls the operational attribute runSamUpgradeTasks, the conditions for this operation and the accounts and groups will create in the domain are outlined here:
http://msdn.microsoft.com/en-us/library/dd240061(v=prot.13).aspx
Enfo Zipper
Christoffer Andersson – Principal Advisor
"Awinish" wrote in message news:f873aab8-5b07-42b8-90b8-7392b5cbcebf...
This can't be automatically, as there is no way AD can create account until its been automated using script or some other tools. I have seen few groups created automatically during application installation,would suggest don't delete it immediately, might
create an issue, if used for authentication as an service. Disable it & then check the impact to proceed further.
Regards
MVP-Directory Services
Awinish Vishwakarma|
CHECK MY BLOG
Disclaimer: This posting is provided AS-IS with no warranties or guarantees and confers no rights.
Enfo Zipper Christoffer Andersson – Principal Advisor

Secondary Domain Controller Not Authenticating Domain Users

Hi.
I have a primary domain controller running Win Srv 2012 in USA and i added a secondary domain controller 2012 in the same domain from a different location India, through VPN.so that India user accounts can authenticate by the secondary DC instead of primary
DC USA
Installation & replication of AD went fine
India domain users login is damn slow.
When i ran the command echo %logonserver% from a india client machine,it displays the USA Primary DC name which means its authenticating the users from USA primary DC.
Preferred DNS for india client machine is Secondary DC IP and alternate is Primary DC IP USA.
Please find the dcdiag results below and any help much appreciated
Performing initial setup:
Trying to find home server...
Home Server = server2
* Identified AD Forest.
Done gathering initial info.
Doing initial required tests
Testing server: INDIA\server2
Starting test: Connectivity
......................... server2 passed test Connectivity
Doing primary tests
Testing server: INDIA\server2
Starting test: Advertising
Warning: DsGetDcName returned information for \\server1.tst.mycompany.com, when we were trying to reach
server2.
SERVER IS NOT RESPONDING or IS NOT CONSIDERED SUITABLE.
......................... server2 failed test Advertising
Starting test: FrsEvent
......................... server2 passed test FrsEvent
Starting test: DFSREvent
There are warning or error events within the last 24 hours after th
replication problems may cause Group Policy problems.
......................... server2 failed test DFSREvent
Starting test: SysVolCheck
......................... server2 passed test SysVolCheck
Starting test: KccEvent
......................... server2 passed test KccEvent
Starting test: KnowsOfRoleHolders
......................... server2 passed test KnowsOfRoleHolders
Starting test: MachineAccount
......................... server2 passed test MachineAccount
Starting test: NCSecDesc
......................... server2 passed test NCSecDesc
Starting test: NetLogons
Unable to connect to the NETLOGON share! (\\server2\netlogon)
[server2] An net use or LsaPolicy operation failed with error 67,
......................... server2 failed test NetLogons
Starting test: ObjectsReplicated
......................... server2 passed test ObjectsReplicated
Starting test: Replications
......................... server2 passed test Replications
Starting test: RidManager
......................... server2 passed test RidManager
Starting test: Services
......................... server2 passed test Services
Starting test: SystemLog
A warning event occurred. EventID: 0xA004001B
Time Generated: 02/22/2015 17:10:30
Event String: Intel(R) 82574L Gigabit Network Connection
A warning event occurred. EventID: 0x000727A5
Time Generated: 02/22/2015 17:11:24
Event String: The WinRM service is not listening for WS-Manageme
An error event occurred. EventID: 0x0000271A
Time Generated: 02/22/2015 17:11:24
Event String:
The server {9BA05972-F6A8-11CF-A442-00A0C90A8F39} did not regist
A warning event occurred. EventID: 0xA004001B
Time Generated: 02/22/2015 17:12:41
Event String: Intel(R) 82574L Gigabit Network Connection
A warning event occurred. EventID: 0x000003F6
Time Generated: 02/22/2015 17:19:36
Event String:
Name resolution for the name mycompany.com timed out after none
A warning event occurred. EventID: 0x00001796
Time Generated: 02/22/2015 17:28:54
Event String:
Microsoft Windows Server has detected that NTLM authentication i
his server. This event occurs once per boot of the server on the first time
A warning event occurred. EventID: 0x000727A5
Time Generated: 02/22/2015 17:33:35
Event String: The WinRM service is not listening for WS-Manageme
A warning event occurred. EventID: 0x00001796
Time Generated: 02/22/2015 17:35:54
Event String:
Microsoft Windows Server has detected that NTLM authentication i
his server. This event occurs once per boot of the server on the first time
......................... server2 failed test SystemLog
Starting test: VerifyReferences
......................... server2 passed test VerifyReferences
Running partition tests on : ForestDnsZones
Starting test: CheckSDRefDom
......................... ForestDnsZones passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... ForestDnsZones passed test CrossRefValida
Running partition tests on : DomainDnsZones
Starting test: CheckSDRefDom
......................... DomainDnsZones passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... DomainDnsZones passed test CrossRefValida
Running partition tests on : Schema
Starting test: CheckSDRefDom
......................... Schema passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... Schema passed test CrossRefValidation
Running partition tests on : Configuration
Starting test: CheckSDRefDom
......................... Configuration passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... Configuration passed test CrossRefValidat
Running partition tests on : tst
Starting test: CheckSDRefDom
......................... tst passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... tst passed test CrossRefValidation
Running enterprise tests on : tst.mycompany.com
Starting test: LocatorCheck
......................... tst.mycompany.com passed test LocatorChec
Starting test: Intersite
......................... tst.mycompany.com passed test Intersite

Hi.
I have a primary domain controller running Win Srv 2012 in USA and i added a secondary domain controller 2012 in the same domain from a different location India, through VPN.so that India user accounts can authenticate by the secondary DC instead of primary
DC USA
Installation & replication of AD went fine
India domain users login is damn slow.
When i ran the command echo %logonserver% from a india client machine,it displays the USA Primary DC name which means its authenticating the users from USA primary DC.
Preferred DNS for india client machine is Secondary DC IP and alternate is Primary DC IP USA.
Firstly make sure that you have configured sites and subnets correctly. According to your information which you have two locations, you should have at least 2 sites and 2 subnets associated to them. If you have forgotten to configure subnets of India in your
site and services and assigned them to the India site you are experiencing this issue. Also make sure if clients in India has appropriate network connectivity to the domain controllers in India.
Mahdi Tehrani |
|
www.mahditehrani.ir
Please click on Propose As Answer or to mark this post as
and helpful for other people.
This posting is provided AS-IS with no warranties, and confers no rights.
How to query members of 'Local Administrators' group in all computers?

Pricing for VM running WS 2012 E R2 primarily as domain controller for ~5 clients

Hi
I am starting a small medical clinic, with only about 6 client PCs. However, I would like a domain network structure for security purposes moving forward rather than a workgroup.
I'm looking at either purchasing a modest server (ie HP Proliant ml310) with windows server 2012 essentials r2 and using it locally (total cost ~$1500) or using a Windows Azure virtual machine to run the domain controller over a VPN. We already use
office 365 e3, so don't really need a local server for email, storage etc. I already have an old synology NAS that could be used for disk images etc that we would lose out on with the hosted server solution.
Can someone verify my calculations for monthly cost estimate I tried using the calculator --1 small VM + 225 GB storage for the OS came to $65/month
Would I be able to run it on the small virtual machine or would I need to go up to medium just for the OS? If the later is the case it would definitely not be cost effective.
Thanks for the help
TM

hi tdiddy,
Thanks for posting!
About VM and azure storage pricing , I suggest you could refer to this pricing details page and calculations fee:
http://azure.microsoft.com/en-us/pricing/details/virtual-machines/
http://azure.microsoft.com/en-us/pricing/details/storage/
Also, for this billing question Please contact azure billing support team via
http://www.windowsazure.com/en-us/support/contact/
Hope it helps.
Regards,
Will
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click
HERE to participate the survey.

[Forum FAQ] How to sync time with a Domain Controller for a standalone server

As we all known, if a computer belongs to an Active Directory domain, it will sync the time automatically by using the Windows Time service that is available on Domain Controllers.
While a standalone server will synchronize with its local hardware time and Windows time server. (Figure 1)
Figure 1.
Under some circumstances, a standalone server is necessary in a product environment. We can sync the time of this standalone server with the Domain Controller using
the steps below:
1. Modified the value of the AnnounceFlags:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config
Under this entry we can see the default value of AnnounceFlags is 10 (Decimal), we configure the value as 5 (Decimal). (Figure 2)
Figure 2.
2. Confirm the value of the registry key below is set to 0:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer
Figure 3.
3. Configure the standalone server to synchronize with a specific time source (Domain Controller).
In our test, we configured our Domain Controller (192.168.10.200) as the time source. Used the following commands:
w32tm /config /syncfromflags:manual /manualpeerlist:192.168.10.200
4. Sync the time with the Domain Controller using the command below:
w32tm /config /update
From the figure below (Figure 4), you can see the after we did all the steps above, the time on the standalone server was synced with the Domain Controller.
Figure 4.
(Note: Peerlist is a separated list of DNS servers, or IP Addresses for the time servers)
More information:
Windows Time Service Tools and Settings
http://technet.microsoft.com/en-us/library/cc773263(WS.10).aspx#w2k3tr_times_tools_dyax
Please click to vote if the post helps you. This can be beneficial to other community members reading the thread.

Thank you for the instruction! I am sure it is one of the scenarios that majority of administrators will run into. So I suggest to write a wiki about it and publish it for this month's TechNet Guru in Windows Server section. This month's TechNet Guru can
be found here:
Calling All Wise Men! Windows
Server Gurus Needed! Apply Within! No One Turned Away!
Thanks for your informative post. :)
Regards.
Mahdi Tehrani |
|
www.mahditehrani.ir
Please click on Propose As Answer or to mark this post as
and helpful for other people.
This posting is provided AS-IS with no warranties, and confers no rights.
How to query members of 'Local Administrators' group in all computers?

Replace WS2003 domain controller for WS2012 domain controller

Hi, I think that is a common problem but I haven't found anythink exactly like this, only something similar, but I have a lot of doubts yet.
The thing is that I have a network with two domain controllers:
WS2003 - 192.168.0.1, who is the first domain controller I created and is also a file sharing server
WS2008R2 - 192.168.0.8, who is a new domain controller I added one year ago.
Now, I want to replace the first one, keeping the second. One.
I thinking of removing the first one and replace it with a new machine (WS2012) with the same IP and name host. I need the same host because clients are pointing to it to get the shared files.
My main fear is that clients get some error related with trust relationship and I will have to rejoin them one by one to the domain.
As I have another domain controller, Will the global catalog of the new machine be synchronized automaticly with the WS2008R2 domain controller?
Do I need to demote the old domain controller before add the new one?
Thanks a lot

Hi Tomas,
As pointed by Burakm you should have an additional file server and should avoid using a Domain controller which has priviledged access, to share files. This puts you at a security risk.
Regarding the requirement of old host name:
Here is something that would let you keep a different servername and IP, yet allow your users to connect to the old hostname and access the share. Use CNAME records of old server to point it to the new hostname.
How to Configure Windows Machine to Allow File Sharing with DNS Alias
You might also look for Distributed File System Shares.
http://blogs.technet.com/b/josebda/archive/2009/06/26/how-many-dfs-n-namespaces-servers-do-you-need.aspx
NOTE- You can't run in-place upgrade of a 2003 to 2012 DC.
Regards,
Satyajit
Please “Vote As Helpful”
if you find my contribution useful or “Mark As Answer” if it does answer your question. That will encourage me - and others - to take time out to help you.

What happens if Domain Controller server authentication certificate expires?

Dear People,
We have got two Domain controller servers and accordingly two Azman servers. we
have got two certificates issued for each Domain controllers to our two Azman servers. Both these certificates are going to expire in next few days. We have few Web
& Desktop applications for which we authorize a large pool of users with the help of these two Azman servers.
Now, Issue is, Domain Controller certificates are going to expire soon on both Azman servers. Can somebody tell me, what could be impact of expiration of these certificates?
will all the application be down after that? Should I must go for renewal of certificates? Please help me as soon as possible otherwise I will be in big trouble. Thanks.

Hi,
Based on my research, Domain Controller Authentication certificate is used for client authentication, server authentication and smart card logon.
You need to renew the certificates before they expire, otherwise problems about smart card logon and SSL connection will occur.
More information for you:
Processing Domain Controller Certificates
http://technet.microsoft.com/en-us/library/cc787009(v=WS.10).aspx
Best Regards,
Amy

Changing Domain Controller for Exchange 2013

Folks
I have an Exchange 2013 running on Server 2012.
Old DC on Server 2008.
I want to decommission the 2008 server. I have build a 2012 DC and for the life of can not work out how to change the DC that my exchange box uses????
Using Set-ADServerSettings cmdlet only seems to change the server for that current session?? reboot and back to the old DC...
When I use the Se-ExchangeServer cmdlet, I get domain controller cant be found. I have set the execution policy on the dc to unrestricted and still Domain controlleer cant be found..
New dc is a GC..
Any ideas would be good.
-graham

First, the behavior observed for the cmdlet Set-ADServerSettings is normal. The values for the domain controllers
designated are " per session". For example:
The PreferredServer parameter
specifies the FQDN of the domain controller to be used for this session.
http://technet.microsoft.com/en-us/library/dd298063(v=exchg.150).aspx
+++
What parameters, exactly, did you use for Set-ExchangeServer? What was the entire command?
If the domain controller(s) were found for "Set-ADServerSettings"
and... if Exchange is functioning OK in general, the domain controllers should be accessible.
+++
Are you in a position where you could shut down the older server (during off hours for example) and see if Exchange can
find - and use - the newer DC?
Will you only have one DC after decommission of the old one?
Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you.

What is the difference between using the command "dsmgmt" and the "Managed By" tab when adding users to the local administrators Account on a Read-Only Domain Controller?

When I use the
"dsmgmt" command to add a user to the local administrators account of a RODC I can actually see the user when I use the "Show Role Administrators" parameter. However, I can't see the members of the
group added to the "Managed By" tab of the RODC object in AD. Even though, the users added using
"dsmgmt" and by the "Managed By" tab can all log in locally and have admin rights to the RODC. Are there any differences between these two ways of adding users to the local administrators account?

Hi,
For groups, managedBy is an administrative convenience to designate “group admins”. Whatever principal listed in
managedBy gets permission to update a group’s membership (the actual security is updated on the group’s AD object to allow this).
In Win2008 and later managedBy also became the way you delegated local administration on an RODC, allowing branch admins to install patches, manage shares, etc. (http://technet.microsoft.com/en-us/library/cc755310(WS.10).aspx).
On the RODC, this is updating the RepairAdmin registry value within RODCRoles.
So the difference between them should be only the way they do the same thing.
For more details, please refer to the below article:
http://blogs.technet.com/b/askds/archive/2011/06/24/friday-mail-sack-wahoo-edition.aspx
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Preparing virtual domain controller for cloning fails because DC not in cloneable domain controllers group

Hi I am running a virtulized server 2012R2 DC DC02TL.test.local in a lab environment. I want to clone the DC. I am following this tutorial.
http://blogs.technet.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-00-48-12-metablogapi/0020.clone3_5F00_49D67345.png
I put the DC into the Group of clonable Dcs but somehow the CMDLet
New-ADDCCloneConfigFile
does not seem to recognize that the DC is in that group and fails. I tried to reboot the DC, but no luck.

https://support.microsoft.com/kb/2745013?wa=wsignin1.0
This link may help you.
Darshana Jayathilake

Unable to log onto domain controller with user account

Hi,
I am able to log onto my DC as domain admin. I cannot log on as myself. I do not see what I am missing in the GPO to make this happen? I am part of a server admin group and would like the server admin group to be able to log on to the domain controller to
maintain the server.
Any suggestions?
Wave~Chaser

Log on to this DC and run rsop.msc and check the following policies:
Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Allow log on locally
Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Deny log on locally
Add your self to Allow log on locally
(in default domain controller policy - as I mentioned above) and make sure your user account not belong to any group that have Deny log on locally.
Please take a moment to Vote as Helpful and/or Mark as Answer where applicable. Thanks.

AD account logging to a remote domain controller for authentication

Similar Messages

Maybe you are looking for