Binding Mac OS X to Active Directory Domain

Question 1:
I've just binding a Mac (Windows File Service) to a W2K3 Domain controller. After that I will configure the Mac share point using W2K3 Domain's account. From Mac Workgroup Manager I can't find the Active Directory account, the opposite from W2K3 Explorer I can't adding Active Directory users or groups to Mac sharing object. Do I missed some steps for Active Directory Binding?
Question 2:
Why I can't unbind my Mac (Windows File Service) from W2K3 Active Directory clearly? I should using Force Unbind, after that I cannot rebinding againt to that Active Directory. Is there any missing of my Mac component or driver?

thought I might add...
i keep getting folders in Trash aswell named recovered, there are a couple of them. I think this may be if the machine is dropping off the network. (but not sure)
different models   Mac OS X (10.4.8)  

Similar Messages

  • Connecting Mac to Active Directory Domain

    I understand there is an AD Plug-in available? Where can I find this and is there a good article or can somebody point me in the right direction to having my powerbook join our corporate active directory domain for authentication.
    Thanks in advance
    Mike

    Mac OS 10.4 supports active directory out of the box. Open up /Applications/Utilities/Directory Access and click active directory and configure. Enter the name of the forest and domain you want to join and your computer id then click bind. You will be prompted for an admin password to join the domain. When you have joined click OK to go back to Directory Access and click on authentication. Make sure /Actuve Directory/All Domains is listed. If not add it. You should now be able to log onto your machine with your AD user account.

  • Joining 10.8.5 with existing account to Active Directory domain

    Hi-
    I have a MacBook Pro that I am using as a test computer to figure out how to introduce the growing population of Mac's into our Active Directory environment in our small company. This comptuer is running OSX 10.8.5
    There is a test account in AD that I will be using to connect to the windows domain. I am able to get the Laptop binded to AD, and have no problem authenticating, and seeing all the network resources required.
    Here is the part that has me stumped:
    Is there any way to take my existing "local" account that was configured when I began using my MBP without Active Directory and continue to use it, but logon to the laptop using my Active Directory account?
    Perhaps copy all the settings and preferences from the local account ontop of the AD account on the laptop?
    I have been using this laptop as my personal machine for many months and have quite a few customizations made to my deskop preferences, icon layouts, etc. This will be same case with all of the users that will soon be authenticating on the domain. We need this for centralized management of network shares, password policies, and number of other security features.
    There is some limited information on the web, but nothing that I have tried really works, here's some of what i found and the difficulty that resulted.
    http://community.spiceworks.com/how_to/show/37886-convert-mac-local-user-into-ac tive-directory-network-user
    - The script mentioned in step 3 was not able to copy local account to the destination folder.
    http://robotcloud.screenstepslive.com/s/2459/m/5322/l/112415-convert-local-accou nts-to-network-mobile-accounts
    - The sudo mv /Users/USERNAME /Users/DIRUSERNAME command was not able to make the "DIRUSERNAME" directory, and did not have any effect if this directory already existed due to a prior logon.
    I'm just looking for some help making it so that my users can retain their desktop layouts that they are used to, but logon to the domain using AD credentials.
    Seems simple, but is pretty difficult to get done.
    Thanks in advance for any help....
    -Aaron

    This might help:
    http://www.afp548.com/article.php?story=20060517222656622&query=radius

  • Lion Server 10.7.4 VPN service not using my Active Directory domain for authentication

    I have Lion Server 10.7.4 setup on a Mac Mini and I have enabled the VPN service for both L2TP and PPTP. The Mac Mini is joined to my Windows Domain at a functional level of Server 2008 R2. I have set the authentication paths to point to my domain in Directory Utility.
    What I would like to have happen is for my laptop to be able to VPN into my office network remotely using domain credentials and not local account credentials on the Mac Mini itself. This is a process I have done numerous times on Windows boxes, but for some reason the only way I can get the VPN to work on this instance of Lion Server 10.7.4 is by authenticating using local accounts only.
    Does Lion Server 10.7.4 only authenticate VPN users based on it's local account schema? Or can it truly authenticate against an active directory domain?
    Any suggestions or help is greatly appreciated. Thanks,

    Hi g-pirtle,
    Yes, I had already done that a few days ago. I was able to add the desired AD group to the allowed users/groups for the VPN service. Thats exactly what is so weird about this...it allows me to search for and add an AD user or group to the list of allowed users/groups, but then when I actually try to use a domain account to authenticate to the VPN is just gives me the "cannot authenticate" error. Very strange.
    I wondered if for some reason Apple is only allowing local accounts to be authenticated against. Sounds crazy, but I cannot for the life of me get this to work. I also wondered if Kerberizing the server would help, but when I go to join a Kerberos realm in Open Directory inside of Server Admin, it just has no realm listed in the drop down menu.
    Other than that, all other aspects of the Mac Mini being joined to the AD domain seems to be good. I'm really stumped here...
    Thanks again,

  • AFP only works for Active Directory "Domain Admins"

    I have purchased a new XServe to add to our Active Directory domain as a member server. It all seems to work right except that only users in AD who are members of the "Domain Admins" group seem to function properly under AFP.
    The Mac Clients can connect to our Windows boxes just fine and AD login's seem to work for loggin in any clients. I've created a shared volume on the XServe and when I try to access it via AFP with any user account that doesn't have Administrator rights I get "Invalid Login or Password" on the Mac Client.
    Anyone got any ideas, this is driving me crazy.

    Post to the appropriate server forum or AD forum where people dealing with these products hang out.

  • Migrating to new Active Directory Domain

    Hey people,
    I have a OSX Server here at a school which I need to move from an old Active Directory domain to a new one. We are having a restructure of our IT System and 90% of our equipment is PC but have a few macs on site for the specific tasks that we need them to do.
    The OSX server was set-up 2yrs ago by some consultant which charged an arm and leg, so its up to me this time round to configure it. It is not a vital part of the IT system so a rebuild is possible, but the quicker it can moved across the better.
    So my question is. Is it easier to "modify" the settings on the OSX Server to the new domain? i.e. change field names in Server Admin. or rebuild the server from scratch?
    Our configuration is Apple clients authenticate to AD, but grab all their settings and OSX group membership from the OSX server. I have here a guide called "Leveraging Active Directory on OSX" would this be useful if I need to rebuild the server? I am fairly confident that I wont run into too many problems, but things like kerberos settings, etc may confuse me. Any help would be excellent!

    Hi,
    perform homogeneous system copy if you migrate from one server to other.
    find document at service.sap.com/systemcopy
    if you just add you local system to domain then look following
    Domain name change for an existing SAP System
    regards,
    kaushal

  • Working with XServe in Active Directory Domain

    I'm starting to lose my mind. Is anyone else working with an XServe in a strictly Active Directory domain? Im essentially using it as an FTP and SMB file server. All sorts of weird stuff happens out of the blue like, all of a sudden today I can no longer log in to the Local Admin account no matter what I do (I've reset the password, tried logging in automatically). Root account no longer lets me in...the only way I can get in is to log in as a Domain admin YET, if I log into the server through Workgroup Manager or Server Admin with the credentials for Local Admin, I get in just fine. What gives? It feels like there's major permissions screwiness going on...
    And earlier, file sharing permissions just weren't working no matter what permissions I gave to who. It is driving me nuts.
    Anyway, if anyone has ANY wisdom to impart re: using XServe to manage files, FTP, etc... in Active Directory I would love to hear it: tips, stories, experiences, resources, how to's etc...
    Thanks

    This area is more for the XServe hardware, you need to post in the Mac OS X Server software section, as the OS can run on more than just hardware, hence the software category.

  • Laptop (Running Windows 8.1) no longer able to print and now see message Active Directory Domain Services is not available

    Have a very recent Lenovo Ideapad Laptop running Windows 8.1. Connected via USB port to HP LaserJet Pro CM1415 frw Color MFP Printer. Was able to print fine nearly 2 weeks ago, but something recently happened - either a new windows or office 2013 update
    or perhaps I blew away a certain file by mistake. I can see the printer installed but cannot print to it from anything (Word, Notepad, IE, Firefox etc.). The one thing to note is that usually when I plug or unplug a USB related device, Windows 8.1 recognizes
    this and makes a certain chime noise, but with the printer USB cable it never makes that noise - making me think that it never fully recognizes the printer. Also when I select the printer (from within the control panel) and right click for properties (via
    admin rights) It never lets me fully connect to it.
    I have tried all the usual remedies - remove, install all drivers, reinstall printer, Windows update, start/stop print spooler and all other printer related services,  etc. Its really annoying because this printer was working fine nearly 2
    weeks ago. Looking for any advice now. Thanks.
    -Chris

    Hi Chris,
    à
    I have tried all the usual remedies - remove, install all drivers, reinstall printer, Windows update, start/stop print spooler and all other printer related services, etc.
    I noticed that you had reinstalled the printer. Just a confirmation, when un-install this printer, please check
    if this printer still exist in registry. For more details, please refer to following KB.
    Registry entries for printing
    If printer entry still exist in registry, please delete that printer entry and re-install this printer again,
    then check if this issue still exists. (Please backup registry entries before operating registry. It will help us to avoid unexpected issue.)
    àand now see
    message Active Directory Domain Services is not available
    By the way, would you please let me know where/when get this
    Active Directory Domain Services is not available error message? Or provide a screenshot of it?
    (Please hide all protected or private information) Please check if all services are running correctly on the computer. Meanwhile, please refer to following article and check if can help you.
    Printer
    Problem: Active Directory Domain Services is currently unavailable – Why does windows say no printers are installed?
    Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft
    does not guarantee the accuracy of this information.
    If any update, please feel free to let me know.
    Hope this helps.
    Best regards,
    Justin Gu

  • How to install Small Business Server 2008 in an existing Active Directory domain

    It is shown on this page:
    http://support.microsoft.com/kb/884453, "How to install Small Business Server 2003 in an existing Active Directory domain".
    Is it possible to do this with SBS2008 ?
    If "YES", are there any published information about the procedure ?

    Yes, it is. Thank you very much.
    But there is something that confuses me - I want to migrate from Win2003Std to SBS2008. And also, I want to keep the existing Win2003Std as a second DC for a long time.
    But it is written in the shown article:
    ... After the migration is finished, you must remove the Source Server from the network within 21 days. ...
    Is this rule mandatory for the scenarios where the Source Server is Std, not SBS ? As I know, I can have more than one DC(Win2003Std/Win2008Std) together with SBS2003. But what about SBS2008 ?

  • Provision Search in SharePoint Foundation 2013 without Domain Controller / Active Directory - Domain accounts

    Hi,
    I have successfully setup SharePoint Foundation 2013 as single server farm with SQL Server Standard database in a DMZ environment using local accounts since DMZ doesn't have an Active Directory and hence Domain accounts using powershell as described
    in https://theblobfarm.wordpress.com/2012/12/03/installing-sharepoint-2013-without-a-domain-controller 
    When I run Farm configuration wizard to provision search service application, I get an error:
    ERROR: "The service application(s) for the service "Search Service Application" could not be provisioned because of the following error: I/O error occurred."
    The log file logged the details of this error as:
    ERROR: "Failed to create file share Analytics_e441aa1c-1a8d-4f0a-a079-58b499eb4c50 at D:\SharePoint Search\Office Server\Analytics_e441aa1c-1a8d-4f0a-a079-58b499eb4c50 (System.ArgumentException: The SDDL string contains an invalid sid or a sid
    that cannot be translated."
    After investigation, I found that potentially the error could be because the timer service is trying to setup a network share for analytics component (as part of provisioning search). It is trying to setup that share with a domain account that happens to
    be a local user instead in this case and fails with error “System.ArgumentException: The SDDL string contains an invalid sid or a sid that cannot be translated”.
    I got some pointer from the below thread
    https://social.technet.microsoft.com/Forums/en-US/c8e93984-f4e5-46da-8e8a-c5c79ea1ff62/error-creating-search-service-application-on-sharepoint-foundation-with-local-account?forum=sharepointadmin
    However, the above thread doesn't state that the solution worked.
    I have tried creating share manually for Analytics_<Guid> folder but it doesn't work since every time farm configuration wizards is run it creates a new Analytics_<Guid> folder.
    Since, I have setup SharePoint Foundation 2013 on a production environment I cannot test and trial various solutions.
    Can some please guide me on how to successfully provision search for SharePoint Foundation 2013 setup as a single server farm with SQL Server Standard database in a DMZ environment using local accounts (without Active Directory - domain accounts).
    Thanks in advance.
    Himanshu

    Microsoft documentation doesn't always specifically call out all products (Project Server isn't there, either). But it does apply. You'll need to stand up at least one Domain Controller, or allow port access back to a DC.
    Preferably, set up SharePoint on the internal network and use a reverse proxy (which will terminate client connections at the reverse proxy) present in the DMZ.
    Trevor Seward
    Follow or contact me at...
    &nbsp&nbsp
    This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

  • Is it possible to modify the timeout of the userID on my active directory domain when off network?

    My work Macbook Pro is using a domain account from my office.  When I travel and the domain controller is not reachable it takes 30 to 60 secs longer to log into my system because it has to wait for the active directory domain controller search to timeout before it will use cached credentials (i.e. a mobile account).  Does anyone know how to modify my system settings to reduce the timeout or even eliminate the delay all together?  I am running the latest version of Yosemite. 
    Thanks,
    Mike

    Here is the modified VI, saved in LabVIEW 2012. Follow these steps to patch your system:
    1. Close LabVIEW 2012.
    2. Backup the following file: LabVIEW 2012\resource\Framework\Providers\VILibrary\libFra​me_OpenPageRef.vi
    3. Replace it with the version attached to this post.
    4. Restart LabVIEW 2012.
    Now you should no longer experience the 30 second timeout when the class property page loads. I set the timeout to "-1", so it should wait as long as necessary to open the page.
    Note that if you ever repair or reinstall LabVIEW 2012, you'll need to patch this file again. Also, I wouldn't try patching any version other than 2012, since there may be other changes made to this VI across LabVIEW upgrades.
    Darren Nattinger, CLA
    LabVIEW Artisan and Nugget Penman
    Attachments:
    libFrame_OpenPageRef.vi ‏24 KB

  • Failed to install Active directory domain services

    Hi,
    I've installed the AD Domain Services on Windows2008R2 by following this guide http://technet.microsoft.com/en-gb/library/cc755059%28WS.10%29.aspx. After click 'Install', step 6, it showed failed to install but there is no clue why it was failed, at all.
    Here is a log I copied from C:\Windows\logs\ServerManager.log
    2204: 2011-01-05 12:57:54.333 [InstallationProgressPage]  Loading progress page...
    2204: 2011-01-05 12:57:54.411 [InstallationProgressPage]  Begining Sync operation...
    2204: 2011-01-05 12:57:54.458 [Sync]                     
    Sync Graph of changed nodes
    ==========
    name     : Active Directory Domain Services
    state    : Changed
    rank     : 1
    sync tech: CBS
    guest[1] : Active Directory Domain Controller
    guest[2] : Identity Management for UNIX
    ant.     : empty
    pred.    : empty
    provider : null
    name     : Active Directory Domain Controller
    state    : Changed
    rank     : 4
    sync tech: CBS
    ant.     : .NET Framework 3.5.1
    pred.    : Active Directory Domain Services, .NET Framework 3.5.1
    provider : Provider
    2204: 2011-01-05 12:57:54.458 [Sync]                      Calling sync provider of Active Directory Domain Controller ...
    2204: 2011-01-05 12:57:54.473 [Provider]                  Sync:: guest: 'Active Directory Domain Controller', guest deleted?: False
    2204: 2011-01-05 12:57:54.473 [Provider]                  Begin installation of 'Active Directory Domain Controller'...
    2204: 2011-01-05 12:57:54.473 [Provider]                  Install: Guest: 'Active Directory Domain Controller', updateElement: 'DirectoryServices-DomainController'
    2204: 2011-01-05 12:57:54.473 [Provider]                  Installation queued for 'Active Directory Domain Controller'.
    2204: 2011-01-05 12:57:54.473 [CBS]                       installing 'DirectoryServices-DomainController ' ...
    2204: 2011-01-05 12:57:55.020 [CBS]                       ...parents that will be auto-installed: 'NetFx3 '
    2204: 2011-01-05 12:57:55.020 [CBS]                       ...default children to turn-off: '<none>'
    2204: 2011-01-05 12:57:55.036 [CBS]                       ...current state of 'DirectoryServices-DomainController': p: Staged, a: Staged, s: UninstallRequested
    2204: 2011-01-05 12:57:55.036 [CBS]                       ...setting state of 'DirectoryServices-DomainController' to 'InstallRequested'
    2204: 2011-01-05 12:57:55.051 [CBS]                       ...current state of 'NetFx3': p: Installed, a: Installed, s: InstallRequested
    2204: 2011-01-05 12:57:55.051 [CBS]                       ...skipping 'NetFx3' because it is already in the desired state.
    2204: 2011-01-05 12:57:55.098 [CBS]                       ...'DirectoryServices-DomainController' : applicability: Applicable
    2204: 2011-01-05 12:57:55.114 [CBS]                       ...'NetFx3' : applicability: Applicable
    2204: 2011-01-05 12:57:55.770 [CbsUIHandler]              Initiate:
    2204: 2011-01-05 12:57:55.770 [InstallationProgressPage]  Installing...
    2204: 2011-01-05 12:58:49.176 [CbsUIHandler]              Error: -2147021879 :
    2204: 2011-01-05 12:58:49.176 [CbsUIHandler]              Terminate:
    2204: 2011-01-05 12:58:49.254 [InstallationProgressPage]  Verifying installation...
    2204: 2011-01-05 12:58:49.270 [CBS]                       ...done installing 'DirectoryServices-DomainController '. Status: -2147021879 (80070bc9)
    2204: 2011-01-05 12:58:49.270 [Provider]                  Skipped configuration of 'Active Directory Domain Controller' because install operation failed.
    2204: 2011-01-05 12:58:49.270 [Provider]                 
    [STAT] ---- CBS Session Consolidation -----
    [STAT] For
              'Active Directory Domain Controller'[STAT] installation(s) took '54.7870005' second(s) total.
    [STAT] Configuration(s) took '0.0003053' second(s) total.
    [STAT] Total time: '54.7873058' second(s).
    2204: 2011-01-05 12:58:49.270 [Provider] Error (Id=0) Sync Result - Success: False, RebootRequired: True, Id: 110
    2204: 2011-01-05 12:58:49.286 [Provider] Error (Id=0) Sync Message - OperationKind: Install, MessageType: Error, MessageCode: -2147021879, Message: <null>, AdditionalMessage: The requested operation failed. A system reboot is required to roll back changes
    made
    2204: 2011-01-05 12:58:49.286 [InstallationProgressPage]  Sync operation completed
    2204: 2011-01-05 12:58:49.286 [InstallationProgressPage]  Performing post install/uninstall discovery...
    2204: 2011-01-05 12:58:49.286 [Provider]                  C:\Windows\system32\ServerManager\Cache\CbsUpdateState.bin does not exist.
    2204: 2011-01-05 12:58:49.286 [CBS]                       IsCacheStillGood: False.
    2204: 2011-01-05 12:58:49.786 [CBS]                       >>>GetUpdateInfo--------------------------------------------------
    2204: 2011-01-05 12:59:46.520 [CBS] Error (Id=0) Function: 'ReadUpdateInfo()->Update_GetInstallState' failed: 80070bc9 (-2147021879)
    2204: 2011-01-05 12:59:46.520 [CBS]                       <<<GetUpdateInfo--------------------------------------------------
    2204: 2011-01-05 12:59:46.598 [DISCOVERY]                 hr: -2147021879 -> reboot required.
    2204: 2011-01-05 12:59:46.739 [InstallationProgressPage]  About to load finish page...
    2204: 2011-01-05 12:59:46.739 [InstallationFinishPage]    Loading finish page
    2204: 2011-01-05 12:59:46.801 [InstallationFinishPage]    Finish page loaded
    I also checked the event viewer, here are the event properties occurred during the installation:
    Initiating changes to turn on update DirectoryServices-DomainController of package DirectoryServices-DomainController-Package. Client id: RMT
    Update Directoryservices-DomainController of package DirectoryServices-DomainController-Package failed to be turned on. Status: 0x80070bc9
    Installation failed. A restart is required.
    Roles:
    Active Directory Domain Services
    Error: The server needs to be restarted to undo the changes
    Please help.
    Thanks,
    balrogz

    Another thing to check is to ensure the server service is up and running.
    http://blogs.dirteam.com/blogs/paulbergson/archive/2014/04/29/can-t-add-the-role-quot-active-directory-domain-services-quot-to-my-2008-r2-server.aspx
    Paul Bergson
    MVP - Directory Services
    MCITP: Enterprise Administrator
    MCTS, MCT, MCSE, MCSA, Security, BS CSci
    2012, 2008, Vista, 2003, 2000 (Early Achiever), NT4
    Twitter @pbbergs http://blogs.dirteam.com/blogs/paulbergson
    Please no e-mails, any questions should be posted in the NewsGroup.
    This posting is provided AS IS with no warranties, and confers no rights.

  • Cannot add Active Directory Domain Services role on - DirectoryServices-DomainController . Status: -2147021879 (80070bc9)

    Hi everyone,
    I've been banging my head against this for a while and hope someone can help me.
     Running Windows Server 2008 R2 Standard with Service Pack 1.
    When I try to add the Active Directory Domain Services role to the server it gets to about 90% complete and then dies.
    The ServerManager.log shows the following information, I have run the System Readiness Tool - output below - with no errors found.
    At a loss on what to do next. The only other links I've found suggest rebuilding the server which I would really like to avoid...
    Help appreciated,
    John
    ServerManager.log (extract)
    ==========
    name : Active Directory Domain Services
    state : Changed
    rank : 1
    sync tech: CBS
    guest[1] : Active Directory Domain Controller
    guest[2] : Identity Management for UNIX
    ant. : empty
    pred. : empty
    provider : null
    name : Active Directory Domain Controller
    state : Changed
    rank : 4
    sync tech: CBS
    ant. : .NET Framework 3.5.1
    pred. : Active Directory Domain Services, .NET Framework 3.5.1
    provider : Provider
    8720: 2012-01-18 10:54:41.853 [Sync] Calling sync provider of Active Directory Domain Controller ...
    8720: 2012-01-18 10:54:41.853 [Provider] Sync:: guest: 'Active Directory Domain Controller', guest deleted?: False
    8720: 2012-01-18 10:54:41.853 [Provider] Begin installation of 'Active Directory Domain Controller'...
    8720: 2012-01-18 10:54:41.853 [Provider] Install: Guest: 'Active Directory Domain Controller', updateElement: 'DirectoryServices-DomainController'
    8720: 2012-01-18 10:54:41.853 [Provider] Installation queued for 'Active Directory Domain Controller'.
    8720: 2012-01-18 10:54:41.853 [CBS] installing 'DirectoryServices-DomainController ' ...
    8720: 2012-01-18 10:54:42.399 [CBS] ...parents that will be auto-installed: 'NetFx3 '
    8720: 2012-01-18 10:54:42.399 [CBS] ...default children to turn-off: 'WCF-HTTP-Activation '
    8720: 2012-01-18 10:54:42.415 [CBS] ...current state of 'DirectoryServices-DomainController': p: Staged, a: Staged, s: UninstallRequested
    8720: 2012-01-18 10:54:42.415 [CBS] ...setting state of 'DirectoryServices-DomainController' to 'InstallRequested'
    8720: 2012-01-18 10:54:42.430 [CBS] ...current state of 'NetFx3': p: Installed, a: Installed, s: InstallRequested
    8720: 2012-01-18 10:54:42.430 [CBS] ...skipping 'NetFx3' because it is already in the desired state.
    8720: 2012-01-18 10:54:42.430 [CBS] ...current state of default child 'WCF-HTTP-Activation': p: Installed, a: Installed, s: InstallRequested
    8720: 2012-01-18 10:54:42.430 [CBS] ...skipped child 'WCF-HTTP-Activation' because it is already installed
    8720: 2012-01-18 10:54:42.461 [CBS] ...'DirectoryServices-DomainController' : applicability: Applicable
    8720: 2012-01-18 10:54:42.461 [CBS] ...'NetFx3' : applicability: Applicable
    8720: 2012-01-18 10:54:42.539 [CbsUIHandler] Initiate:
    8720: 2012-01-18 10:54:42.539 [InstallationProgressPage] Installing...
    8720: 2012-01-18 10:54:42.758 [InstallationProgressPage] Verifying installation...
    8720: 2012-01-18 10:54:42.758 [InstallationProgressPage] Installing...
    8720: 2012-01-18 10:55:03.740 [CbsUIHandler] Error: -2147021879 :
    8720: 2012-01-18 10:55:03.740 [CbsUIHandler] Terminate:
    8720: 2012-01-18 10:55:03.787 [InstallationProgressPage] Verifying installation...
    8720: 2012-01-18 10:55:03.802 [CBS] ...done installing 'DirectoryServices-DomainController '. Status: -2147021879 (80070bc9)
    8720: 2012-01-18 10:55:03.818 [Provider] Skipped configuration of 'Active Directory Domain Controller' because install operation failed.
    8720: 2012-01-18 10:55:03.818 [Provider]
    [STAT] ---- CBS Session Consolidation -----
    [STAT] For
    'Active Directory Domain Controller'[STAT] installation(s) took '21.9535541' second(s) total.
    [STAT] Configuration(s) took '0.0007754' second(s) total.
    [STAT] Total time: '21.9543295' second(s).
    8720: 2012-01-18 10:55:03.818 [Provider] Error (Id=0) Sync Result - Success: False, RebootRequired: True, Id: 110
    8720: 2012-01-18 10:55:03.818 [Provider] Error (Id=0) Sync Message - OperationKind: Install, MessageType: Error, MessageCode: -2147021879, Message: <null>, AdditionalMessage: The requested operation failed. A system reboot is required to roll back changes made
    8720: 2012-01-18 10:55:03.818 [InstallationProgressPage] Sync operation completed
    8720: 2012-01-18 10:55:03.818 [InstallationProgressPage] Performing post install/uninstall discovery...
    8720: 2012-01-18 10:55:03.833 [Provider] C:\Windows\system32\ServerManager\Cache\CbsUpdateState.bin does not exist.
    8720: 2012-01-18 10:55:03.833 [CBS] IsCacheStillGood: False.
    8720: 2012-01-18 10:55:04.333 [CBS] >>>GetUpdateInfo--------------------------------------------------
    8720: 2012-01-18 10:55:34.784 [CBS] Error (Id=0) Function: 'ReadUpdateInfo()->Update_GetInstallState' failed: 80070bc9 (-2147021879)
    8720: 2012-01-18 10:55:34.784 [CBS] <<<GetUpdateInfo--------------------------------------------------
    8720: 2012-01-18 10:55:34.815 [DISCOVERY] hr: -2147021879 -> reboot required.
    8720: 2012-01-18 10:55:34.831 [InstallationProgressPage] About to load finish page...
    8720: 2012-01-18 10:55:34.831 [InstallationFinishPage] Loading finish page
    8720: 2012-01-18 10:55:34.831 [InstallationFinishPage] Finish page loaded
    CheckSUR.log
    =================================
    Checking System Update Readiness.
    Binary Version 6.1.7601.21645
    Package Version 13.0
    2012-01-18 10:33
    Checking Windows Servicing Packages
    Checking Package Manifests and Catalogs
    Checking Package Watchlist
    Checking Component Watchlist
    Checking Packages
    Checking Component Store
    Summary:
    Seconds executed: 220
    No errors detected

    Hi John,
    Thanks for posting.
    Performed some research and some results say that this problem can be caused by HD Write Caching.
    To disable Write Caching:
    1. Go to Device Manager.
    2.Click the plus sign (+) next to the Disk Drives branch to expand it.
    3.Right-click the drive on which you want to enable or disable disk write caching, and then click Properties.
    4.Click the Disk Properties tab.
    5.Click to select or clear the Write Cache Enabled check box as appropriate.
    6.Click OK.
    If no luck, Please check if any erros can be found in Event log, Dcpromoui.Log and Dcpromo.log
    The following articles maybe helpful to you:
    Known Issues for Installing and Removing AD DS
    http://technet.microsoft.com/en-us/library/cc754463(v=WS.10).aspx
    You cannot install Active Directory Domain Services
    http://support.microsoft.com/kb/975142
    Thanks
    ZHANG

  • SCVMM 2008 R2 - "The SQL Server service account does not have permission to access Active Directory Domain Services (AD DS)."

    I know this question has been asked before, but never for R2, that I can tell, and the posted fixes aren't working. I have just installed SCVMM 2008 R2 on a Windows Server 2008 R2 server, using a remote SQL 2008 SP1 database. When I attempt to connect to SCVMM, I get the following error:
    "The SQL Server service account does not have permission to access Active Directory Domain Services (AD DS).
    Ensure that the SQL Server service is running under a domain account or a computer account that has permission to access AD DS. For more information, see "Some applications and APIs require access to authorization information on account objects" in the Microsoft Knowledge Base at http://go.microsoft.com/fwlink/?LinkId=121054.
    ID: 2607"
    What I've seen online is that this is usually becuase the domain account SCVMM is running as does not have the proper permissions on the SQL database. Here's what I've confirmed:
    1) My SCVMM service account is a local admin on the SCVMM server
    2) My SCVMM service account is a dbowner on the SCVMM database in SQL
    3) My SQL service account is a dbowner on the SCVMM database in SQL
    4) My SQL service account is a domain user (even made it a domain admin, just in case, and it still "doesn't have access to AD DS," which is obviously untrue)
    5) Neither service account is locked out
    Has anyone run in to this? It says in Technet that remote SQL 2008 is supported, as long as the SQL management studio is installed to the SCVMM server, and I installed and patched before I began the SCVMM installation. I just don't know what else to try - I have no errors in event logs, no issues during the installation itself...
    Andrew Topp

    That answer was very unhelpful fr33m4n. The individual mentions that they've received the error that points to the KB article. I currently receive the same error -- there seems to be no resolution. I've run the Microsoft VBS script to add TAUG to the WAAG
    as suggested by 331951, and that made absolutely no difference.
    1) My SCVMM service account is a local admin on the SCVMM server
    2) My SCVMM service account is a dbowner on the SCVMM database in SQL
    3) My SQL service account is a dbowner on the SCVMM database in SQL
    4) My SQL service account is a domain user (even made it a domain admin, just in case, and it still
    "doesn't have access to AD DS," which is obviously untrue)
    The user is also a member of WAAG, the machines have delegated authority to each other. Is there any other solution?

  • Windows 2012 R2 Active Directory Domain Services and Remote Desktop services Role on the same server.

    Findings: 
    Currently, Windows 2012 R2   AD DS role and RDS With Broker services can only seem to coexist properly in a new domain not an existing domain. Any attempt to add to an existing domain causes internal database user access denied issues and any attempt to
    adjust rights and circumvent is dubious at best.
    The escalation technician said it best. Out of 50 clients that want to do this, they end up not being able to help 5 right off the bat for whatever reason. As for the other 40 they might be able to help by running reports, adjusting rights and trying to add
    the roles until it works.  This can end up being a 20 day process. Basically they are playing whack-a-mole with user rights and permissions until something sticks.
    We tried creating an OU where any other domain policies would not be inherited to see if that was the issue, a fresh install with different sequence of adding the Roles, no effect.
    Given the errors I witnessed when running procmon and then trying to add the roles, the NT System and the Windows Internal database user had access denied issues on 100+ registry keys when trying to add the roles. After that the system is not behaving normally.
    The errors displayed almost mirror the errors that would occur on Windows 2012 when those two roles would be added which of course is officially NOT supported on that system.
    This blog needs serious revision:
    http://blogs.msdn.com/b/rds/archive/2013/07/09/what-s-new-in-remote-desktop-services-for-windows-server-2012-r2.aspx
    This is the excerpt from that blog: Single server RDS deployment including Active Directory. We now support running our RD Connection Broker role service on the same physical instance as an Active Directory Domain Controller.  In addition, we published
    guidelines for how RD Session Host could be used without the RD Connection Broker.
    Microsoft Support was curteous and helpful and they were the ones who advised cutting our losses, which mirrored my hunch after seeing what was transpiring in the system.  They refunded my money for the support call. 
    For me, it was an opportunity to find out if there was any way to configure Windows 2012 R2 in the Same manner that it was setup as Windows 2008 R2 and lay that to rest. The coexistence is poorly implemented. It is as if there was a reaction from all the deprecation
    of bread and butter features such as shadowing in TS and the coexistence of AD DS and RDS to where those features were re-added haphazardly. (I have no complaints on shadowing on Windows 2012 R2 it works, just do not like having to go to server manager to
    use it).
    I opted for virtualizing the Domain controller to eliminate the incompatibility issues and that is what I will be doing from now on. I found free solutions for backing up and reporting for virtual machines as well as the suggested procedures for configruing
    a Domain controller as a virtual machine on a Hyper-V environment and I will be sticking to those. Thus far the setup has been operational.
    I am not allergic to virtualization, but for really small setups it adds additional time and considerations but if that is how it has to be done, so be it. Windows 2008 R2 days are numbered and since we can usually squeeze 5-7 years on quality server equipment,
    buying a Windows 2008 R2 setup now is a borderline disservice in my opinion.
    Hopefully someone finds this useful and saves some time.

    Hi,
    Thank you for posting in Windows Server Forum.
    Do you need any other assistance?
    Based on your description, you are describing your story of successfully implementing RDS server with AD role and more regarding all RDS related scenario. For shadowing feature, you can use with command also. Below is the syntax to shadow a session.
    mstsc /v:<ServerName> /shadow:<SessionID>
    Hope it helps!
    Thanks.
    Dharmesh Solanki
    TechNet Community Support

Maybe you are looking for