CCE Web Administration - Active Directory issue when managing agent attributes

I am experiencing an issue when managing agents (supervisors specifically) in CCE Web Admin. When attempting to add / remove / modify an Attribute for a supervisor agent we are getting an error that the supervisor must have a valid active directory account. (Screenshot attached) The agents that this is affecting are correctly configured in ICM as a supervisor and ICM was able to successfully move their AD account into the 'Config' AD Security Group. From looking at the logs on the AWS it appears that the Web Admin tool is attempting to lookup their account in AD via UPN by appending their username to the domain name.
Log Snippet:
exception=com.cisco.ccbu.api.jaxb.error.ApiException: supervisorUserInfo.userName: Could not find user. Check if a domain account exists for [email protected]
This isn't going to work for some users in our account because we have multiple suffixes in our domain. (Our domain is a single forest and I'm not aware of a requirement to have a single suffix.)
I'm curious why it wouldn't use samaccountname which is what I believe ICM Configuration Manager is using. Has anyone else experienced this issue?

Lo and behold, my AD sync started working.
Though I have added the site to my local intranet sites, I'm not very confident whether this was the actual solution. I've performed several actions configuring my farm before I started troubleshooting this issue again, so it might be another action that
solved this.
Alemaitre: can you try the following please:
See if the SharePoint Web Service site is started in IIS. If not, start it, see if that works.
Instead of adding the site to your Trusted Sites, try Local Intranet Sites (click Advanced to add sites besides using auto-discovery)
Turn the Security Level for the zone all the way down.
Turn off Compression for your site in IIS, do an iisreset, see if that works.
I've also had to remove a host header from my MySite portal (running on port 8080 here), unlikely for this to be the cause but it's just one of the things I did this morning :-)
Should I think of anything else, I'll let you know.
Bonne chance.

Similar Messages

User synchronization issue between Active Directory and Solution manager.

Requirement:
Synchronize the users between Active directory and solution manager system.
What we did:
1. Created RFC connection (LDAP_RFC) for LDAP connector.
2. Created new LDAP connector that utilize the RFC (LDAP_RFC).
3. Created new logical LDAP Server(CUA).Here we have to maintain the connection
details to the physical directory.
4. We maintained the communication user that is used by the LDAP connector to bind the LDAP Directory Server.
5. In transaction LDAPMAP specific SAP data fields, we mapped to the desired
directory attributes.
6. Testing from LDAP transaction working fine. We are able to see the attributes and
values from Active directory.
Issue:
When executed the program RSLDAPSYNC_USER for user synchronization from t-code se38 with below selection .
LDAP Server = CUA (created earlier)
LDAP Connector = LDAP_RFC (RFC connection created created ealier)
In the tab: (Object that exist both in the directory and in the Database:)
Selected: Compare Time Stamp.
In the tab: (Objects the only exist in the Directory.)
Selected : Create in Database.
In the tab(Objects that only Exist in the Database:
Selected: Ignore Object.
Result from the report shows that connection to LDAP server is fine and 0(zero) objects in Directory.
The program does not create any new user in the Solution Manager system.
Any help on this issue greatly appreciated.
Thanks & Regards,
Harish

where did you see this error ? is there anymore details.
i think the account you are using for Sync does not have Replicate Directory Changes permission in AD. follow below article and give Replicate directory changes permission.
http://technet.microsoft.com/en-us/library/hh296982(v=office.15).aspx
Thanks, Noddy

SMS_AD_SECURITY_GROUP_DISCOVERY_AGENT - Active Directory Security Group Discovery Agent reported warnings for 524 object(s). DDRs were generated for 0 object(s) that had warning(s) while reading non-critical properties.

Hi, can anyone help me troubleshoot the following please:
Active Directory Security Group Discovery Agent reported warnings for 524 object(s). DDRs were generated for 0 object(s) that had warning(s) while reading non-critical properties. DDRs were not generated for 524 object(s) that had warnings while reading
critical properties.
Possible cause: OU name or Security Group name may contain at least a Unicode character which has conversion problem between Unicode and your system ANSI locale(e.g. Korean characters in English System Locale). The site server might not have access to
some properties of this object. The container specified might not have the properties available.
Solution: Please verify the Active Directory schema for properties that are not replicated or locked. Refer to the discovery logs for more information.
Does the error relate to 524 security groups? There are several invalid search paths listed in adsgdis.log, are these related?
Thanks,
Dale

You'll have to examine the log to determine exactly which objects its referring to. Although this is in the context of group discovery, group discovery still creates DDRs for computer objects within those groups so it could be either groups or computers.
This is not a search path issue though as it's clear that the discovery process found 524 different objects, but as stated, it could not properly read criticial properties of those objects and thus did not create DDRs for them.
As mentioned, reading the log in detail will list the objects individually and the reason it could not create a DDR for it.
Jason | http://blog.configmgrftw.com

Cisco ISE 1.3 Active Directory issue

Hi Folks
I am having an issue with our Cisco ISE and would love some feedback or a solution. I have to ISE configured to use our Active Directory setup and so far it appears to be functional. I could connect to AD retrieve groups and use AD for authentication. The issue I am experiencing is that when I try to go to the 'Administration > Identity Management > External Sources page and select our AD instance from the left hand side window the screen locks up and refuses to load. Any advice?

hi
i also had this issue (and one of my collegue also) when using Firefox (version 34 and 35)
i managed to create the AD server using IE 10 for example, and after it appears correctly with Firefox
it was before ise1.3patch 1, but i have seen no corrected issue in patch1 release note for this problem
guillaume

Active Directory Issues 10.7.4 & 10.7.5

Hi
I'm having problems with all my 10.7.4 & 10.7.5 mac's. They're losing their connection to AD. When I got to unbind I get the follwing error:
Unable to access domain controller
This computer is unable to access the domain controller for an unknown reason. Warning: If you click force unbind you will leave an unused computer account in the directory.
I then get an option to ok or force unbind. If I force unbind if I force unbind I get the following error:
An unknown error occurred
An unknown error occurred
Helpful, I'm sure you'll agree! If I go in to Console I can see the following to errors:
02/10/2012 16:01:25.682 Directory Utility: An instance 0x7f8f02b30f30 of class ODCUnbindFromADAction was deallocated while key value observers were still registered with it. Observation info was leaked, and may even become mistakenly attached to some other object. Set a breakpoint on NSKVODeallocateBreak to stop here in the debugger. Here's the current observation info:
<NSKeyValueObservationInfo 0x7f8f02b56970> (
<NSKeyValueObservance 0x7f8f02b568c0: Observer: 0x7f8f01cea980, Key path: progressStatus, Options: <New: NO, Old: NO, Prior: NO> Context: 0x0, Property: 0x7f8f02b569a0>
and...
02/10/2012 16:03:32.463 Directory Utility: -[SFAuthorization obtainWithRights:::::] failed with error Error Domain=NSOSStatusErrorDomain Code=-60007 "The operation couldn’t be completed. (OSStatus error -60007.)" (The authorization was denied since no user interaction was possible. )
When users are curently logged in they lose access to SSH sessions, and network drives etc... they have had issues with saving work and subsiqently losing it!
When I go in to opendirectyd.log I see the following:
2012-10-02 15:37:42.208 BST - opendirectoryd (build 172.17) launched...
2012-10-02 15:37:42.265 BST - Logging level limit changed to 'error'
2012-10-02 15:37:42.902 BST - Initialize trigger support
2012-10-02 15:37:42.904 BST - Registered node with name '/Active Directory' as hidden
2012-10-02 15:37:42.904 BST - Registered node with name '/Configure' as hidden
2012-10-02 15:37:42.905 BST - Discovered configuration for node name '/Contacts' at path '/Library/Preferences/OpenDirectory/Configurations//Contacts.plist'
2012-10-02 15:37:42.905 BST - Registered node with name '/Contacts'
2012-10-02 15:37:42.906 BST - Registered node with name '/LDAPv3' as hidden
2012-10-02 15:37:42.939 BST - Registered node with name '/Local' as hidden
2012-10-02 15:37:42.964 BST - Registered node with name '/NIS' as hidden
2012-10-02 15:37:42.965 BST - Discovered configuration for node name '/Search' at path '/Library/Preferences/OpenDirectory/Configurations//Search.plist'
2012-10-02 15:37:42.965 BST - Registered node with name '/Search'
2012-10-02 15:37:43.024 BST - Discovered configuration for node name '/Active Directory/NUCA-AD' at path '/Library/Preferences/OpenDirectory/Configurations/Active Directory/NUCA-AD.plist'
2012-10-02 15:37:43.024 BST - Registered subnode with name '/Active Directory/NUCA-AD'
2012-10-02 15:37:43.024 BST - Registered placeholder subnode with name '/Active Directory/NUCA-AD/All Domains'
2012-10-02 15:37:43.040 BST - Discovered configuration for node name '/LDAPv3/nuca-mon1.nuca.ac.uk' at path '/Library/Preferences/OpenDirectory/Configurations/LDAPv3/nuca-mon1.nuca.ac.uk. plist'
2012-10-02 15:37:43.040 BST - Registered subnode with name '/LDAPv3/nuca-mon1.nuca.ac.uk'
2012-10-02 15:37:43.108 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/legacy.bundle'
2012-10-02 15:37:43.307 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/search.bundle'
2012-10-02 15:37:44.311 BST - '/Search' has registered, loading additional services
2012-10-02 15:37:44.311 BST - Initialize augmentation support
2012-10-02 15:37:44.352 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/SystemCache.bundle'
2012-10-02 15:37:44.423 BST - Successfully registered for Kernel identity service requests
2012-10-02 15:37:44.482 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/PlistFile.bundle'
2012-10-02 15:37:44.566 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/FDESupport.bundle'
2012-10-02 15:37:45.461 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/ConfigurationProfiles.bundle'
2012-10-02 15:37:45.463 BST - Registered subnode with name '/Local/Default'
2012-10-02 15:37:45.556 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/ldap.bundle'
2012-10-02 15:37:45.600 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/AppleODClient.bundle'
2012-10-02 15:37:45.645 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/ActiveDirectory.bundle'
2012-10-02 15:37:45.654 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/Kerberosv5.bundle'
2012-10-02 15:37:45.858 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/NetLogon.bundle'
2012-10-02 15:37:45.858 BST - Registered subnode with name '/Active Directory/NUCA-AD/nuca.ac.uk' as hidden
2012-10-02 15:37:45.859 BST - Unregistered placeholder node with name '/Active Directory/NUCA-AD/All Domains'
2012-10-02 15:37:45.860 BST - Registered subnode with name '/Active Directory/NUCA-AD/All Domains'
2012-10-02 15:37:45.861 BST - Registered subnode with name '/Active Directory/NUCA-AD/Global Catalog' as hidden
2012-10-02 15:37:57.468 BST - failed to retrieve password for credential
2012-10-02 15:37:59.051 BST - failed to retrieve password for credential
2012-10-02 15:38:04.052 BST - failed to retrieve password for credential
2012-10-02 15:38:14.054 BST - failed to retrieve password for credential
2012-10-02 15:38:29.056 BST - failed to retrieve password for credential
2012-10-02 15:38:49.076 BST - failed to retrieve password for credential
2012-10-02 15:39:11.505 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/configure.bundle'
2012-10-02 15:39:11.900 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/keychain.bundle'
Interestingly enough, the problem doesn't seem to effect users runing 10.6.8 or my iMac which is running 10.8.2. I've spoken to network manager and he can't see anything strange going on, on the network.
I've also spoekn to our AD guy and nothing has changed.
This is now the second time it's happend, I've managed to get everyone working (before it happened again) by deleting the AD plist in /Library/Preferences/OpenDirectory/Configurations/Active\ Directory/ then rebinding via a scipt pushed out via ARD
If anyone can offer any assitance I'd be most gratful as I'm about to be shot by our users! as it's the start of our new academic year!
Thanks!
Paul

It's been a few weeks now, and (touch wood) it's not happended again on mass. We have had a few individual ones, but nothing major.
We still don't quite know exactly what happened, but trouble shooting found the following:
Our time server wasn't working corrctly centrifys ADCheck tool showed it as having a firewall (even though it didn't) our AD guy fixed that problem (sorry not sure exactly what he did)
We checked the AD kerberos ticket from a machine that lost it's connection to AD, on another mac that worked and found that it couldn't connect as the password was wrong. It seems that by default Active Directory ticket wants to change it's password every 14, and when trying to it's failing so I set it to 0
We had tried to set the server the AD plugin see's to a specific DC but this wasnt happening due to subnets not being configured in AD sites and Services
Some of the Mac's did not like being set to GMT in the time zone and the time was an hour out, people where able to login though! So I've now set them to Eurpoe\London and they're now picking up the correct time and even picked up the daylight savings over the weekend.
Our DNS is still not great but we are in the process of sorting out our subnets and when we do the consolodation we'll also asign reservations for all the mac's in the hope that apeases DDNS
Thanks Paul

Not able to connect to Active Directory through Topology manager of ODI

Hi,
We are trying to connect to Active Directory though ODI Topology manager.
The details given are :
+1. Using LDAP(JNDI) driver:+
username : CN=Administrator
JDBC Driver name : com.sun.jndi.ldap.LdapCtxFactory
JDBC URL : ldap://ten.mydomain.com:636/dc=oracle,dc=com
I am getting the error as shown below:
java.sql.SQLException: No suitable driver
 at java.sql.DriverManager.getDriver(Unknown Source)
 at com.sunopsis.sql.SnpsConnection.u(SnpsConnection.java)
 at com.sunopsis.sql.SnpsConnection.a(SnpsConnection.java)
 at com.sunopsis.sql.SnpsConnection.testConnection(SnpsConnection.java)
 at com.sunopsis.sql.SnpsConnection.testConnection(SnpsConnection.java)
*2. Sunopsis JDBC driver for LDAP:*
Username: cn=Administrator
JDBC Driver Name : com.sunopsis.ldap.jdbc.driver.SnpsLdapDriver
JDBC Driver URL :
jdbc:snps:ldap?ldap_url=ldap://ten.mydomain.com:636/&ldap_password=abcd1234&ldap_basedn=dc=oracle,dc=com
We also tried with URL : jdbc:snps:ldap?ldap_url=ldap://ten.mydomain.com:636/&ldap_basedn=dc=oracle,dc=com
We are getting an error as shown below:
Java.sql.SQLException: A NamingException occured saying: Request: 1 cancelled with this explanation: Request: 1 cancelled and this remaining name: null
 at com.sunopsis.ldap.jdbc.driver.i.e(i.java)
 at com.sunopsis.ldap.jdbc.driver.i.a(i.java)
 at com.sunopsis.ldap.jdbc.driver.SnpsLdapConnection.<init>(SnpsLdapConnection.java)
Did I misconfigure something? Do I need to install a seperate Driver for this?
Please help me out in this.
Thanks in advance for any help.

For LDAP default user Root is having all the priviledge to access all the Ldap data.
Go to physical architecture and insert a new dataserver
user - cn=root,dc=css,dc=hyperion,dc=com [ change this according to your requirememnt for you it will be *cn=Administrator ,dc=oracle,dc=com* ]
password - null
JDBC
jdbc driver : com.sunopsis.ldap.jdbc.driver.SnpsLdapDriver
jdbc url : jdbc:snps:ldap?ldap_url=ldap://<server name :port/&ldap_password=KLLEJMNLKFLBKLKODDGPGPDB&ldap_basedn=dc=css,dc=hyperion,dc=com
[ for you it will be *jdbc:snps:ldap?ldap_url=ldap://ten.mydomain.com:636/&ldap_password=<encoded password>ldap_basedn=dc=oracle,dc=com* ]
Here the Default Ldap password for ROOT is SECURITY and if its changed or you are using for some other user . Please use that .
you also need to encode the password using this command
java -cp C:\OraHome_1\oracledi\drivers\snpsldapo.jar com.sunopsis.ldap.jdbc.driver.SnpsLdapEncoder <enter password here>
Later test the connection and you should be able to connect successfully.
Thanks

Pulling "cn=Users" account data from Active Directory issue

I'm using the following general syntax:
ldapsearch -h <active directory server> -p 389 -D "CN=Administrator,CN=Users,dc=ORACLE,dc=COM" -b "DC=ORACLE,DC=COM" -s base objectclass=*
What I get is only "cn=System" output. Any ideas to get the "cn=Users" data?? I can authenticate users in other ways using the Oracle LDAP tools through the same "active directory server". So it's not a matter of it not existing in the Active Directory Server. Also, there is no password right now for the "Administrator" account; so it's not a matter of including/excluding the "-w" option.
Any suggestions??
Thanks.

I recommend you to post this here:
Forums Home » Oracle Technology Network (OTN) » Products » Application Server » Oracle Internet Directory
Identity Manager
Joel Pérez
http://otn.oracle.com/experts

Active directory issue regarding time (DST) - Cant bind any Macs to 2000 AD

I am working with a new server at a small mostly Windows based school district. I am here to do a small AD/OD integration with nothing out of the normal. They are using Windows 2000 server and 10.4.11 with all the current software updates. I tested binding to their AD several months back and it ran without a hitch. Now, today when I attempted to bind their new Intel Xserve running 10.4.11 to their AD, it fails yielding the "Active directory only permits slight variations between the clocks..." error message.
I have seen this before and the message has always been very descriptive in describing the problem (time is off on one end or the other). The issue here is that the machines are all running within a second or two of each other. I verified this my self several times on all the AD servers, each mac client and the mac server. I also checked other normal pitfalls and could not find anything. I can reproduce this error on 10.4.11 server, 10.4.11 client and 10.5.2 client (my laptop) so its not any specific install of OS X, its something in AD.
Is there any chance that this has something to do with the recent changes to daylight savings time? The on-staff admin at the district manually moved the time ahead one hour on Monday morning to bring the windows system up to the current time. As I stated before, this district uses 2000 server. MS does not support 2000 any more and has not issued any updates regarding the recent daylight savings time changes. I have done a ton of searching and I have not been able to find any other mention of such an issue as I would assume that it would be rather wide spread.
Any help would be appreciated. Thanks!

Hi
You can extend the time difference from the default 5 minutes to 10 minutes. This is done on the AD Server either using the GMM or the DMM. This might help with the issue you are seeing.
Failing that you could point the AD to an internet based time server along with everything else on the network OR make everything on the network use the AD as the time server.
Apologies if you have already tried this, Tony

Web-controller Active Directory authentication

We have a 10.5.7 xserve as our Podcast Producer server. The server is tied to Active Directory for authentication. I just recently installed the web controller. When I authenticate with a local server account, I get in just fine. But, when I try to authenticate to the web controller with an AD account it fails.
Now I know that since 10.5.6 in Podcast Capture I have had to select "single sign-on" in the app's preferences. Does anyone know if there is something similar in the web controller?

I figured it out. May not be the perfect solution, but it works until 10.5.8.
In /Library/Preferences/com.apple.pcastserverd.plist
Find the following:
<key>httpauthtype</key>
<array>
<string>basic</string>
<string>digest</string>
<string>kerberos</string>
</array>
Change to:
<key>httpauthtype</key>
<array>
<string>basic</string>
</array>
Restart PCP:
sudo launchctl unload /System/Library/LaunchDaemons/com.apple.pcastserverd.plist
sudo launchctl load /System/Library/LaunchDaemons/com.apple.pcastserverd.plist
Log into your server with an AD account at https://server.domain:8143

Is it possible to modify the timeout of the userID on my active directory domain when off network?

My work Macbook Pro is using a domain account from my office. When I travel and the domain controller is not reachable it takes 30 to 60 secs longer to log into my system because it has to wait for the active directory domain controller search to timeout before it will use cached credentials (i.e. a mobile account). Does anyone know how to modify my system settings to reduce the timeout or even eliminate the delay all together? I am running the latest version of Yosemite.
Thanks,
Mike

Here is the modified VI, saved in LabVIEW 2012. Follow these steps to patch your system:
1. Close LabVIEW 2012.
2. Backup the following file: LabVIEW 2012\resource\Framework\Providers\VILibrary\libFrame_OpenPageRef.vi
3. Replace it with the version attached to this post.
4. Restart LabVIEW 2012.
Now you should no longer experience the 30 second timeout when the class property page loads. I set the timeout to "-1", so it should wait as long as necessary to open the page.
Note that if you ever repair or reinstall LabVIEW 2012, you'll need to patch this file again. Also, I wouldn't try patching any version other than 2012, since there may be other changes made to this VI across LabVIEW upgrades.
Darren Nattinger, CLA
LabVIEW Artisan and Nugget Penman
Attachments:
libFrame_OpenPageRef.vi ‏24 KB

Identity services engine Active directory issue

Hi Folks
We have two ISE instances running in a virtual machine environment on a Cisco UCS . Both ISE’s are running version 1.1.4 and have been patched to the latest engine patch for that version (patch 11). The primary is setup to be the administration primary and the monitoring secondary and the secondary ISE is setup as the administration secondary and the monitoring primary.
The Cisco UCS is connected to a pair of Nexus 5548 switches and they are connected to our core switches both Cisco 6500’s.
At the moment both ISE's can connect to Active Directory (test connection) but only the secondary can join. The error message I am getting on the priimary is:
Cannot open file /var/centrifydc/previous/kset.domain: No such file or directory
due to unexpected configuration or network error.
Please try the --verbose option or run adinfo --diag to diagnose the problem.
Join to domain staff.local , zone null failed.
Has anyone seen this error before? I have compared the configs of the two instances and found no differences in configuration. One major difference I did find was that the primary is running Red Hat and the secondary is running Ubuntu.

Duplicate post.
Go HERE.

Odd Active directory issue

Some background. The company I work for is almost all PC, however, our graphic designers run mac, for obvious reasons. I'm the only I.S. tech with any mac experience at all, so it has fallen on me to get them all officially on the domain now.
I'm using my G3 ibook as a testbed for this, and so far, rather easily I have used the directory access module to get myself on the domain, and authenticated. I can smb\\______ to any server or network share resource I need. However, when I click on the network icon in finder, I am presented with a list of our domain resources (about 50). From there, I select the main device domain which should contain all the PC's/printers/fileservers for my company (around 5500). Despite all my best attempts, I cannot get finder to show more than the first 2200 or so items.
Here's the odd thing. I installed a demo of AdmitMAC (which we are not able to purchase for these users, i'm told now) and I am able to see all 5500 items in finder. Any ideas?
IbookG3 600 - 512 - 30GB - Airport Mac OS X (10.3.9)
Asus K8VSE - AMD64 3200+ - 1024DDR Windows XP Pro

This most likely isn't related to Active Directory but rather the Mac OS X SMB client. They are related but don't do the same thing.
I suspect the reason that the ADmitMac client worked for you is that it either has a more robust SMB browsing mechanism or it's better able to work with your network's Master Browser workstations. Windows machines (or most modern SMB clients) can nominate the most robust machines on the network to be Master Browsers for the network, which then pass the network list to the other computers. Domain controllers typically assume this role when a domain is present.
Sorry that this isn't a solution but maybe it will give you some insight into what's happening.
1 GHz Powerbook G4 Mac OS X (10.4.6)

IPhone/Active Directory Issue

I was helping a co-worker sync their 3G iPhone to my company's Microsoft Exchange 2004 server so she can receive company emails. Everything was setup fine and verified. Later in the day, I get a call saying she can't log into her Mac, which is on our network. I checked Active Directory and noticed that her account was locked, so I unlocked it. A few minutes later, she called again with the same issue. This problem persisted a few more times within a 30 minute window.
We finally decided to delete her company email account off the phone and was no longer was locked out of her machine. My question is why would adding her company email account on her iPhone lock up her account on our network and cease right after we removed the account?

I'm having the same problem. I have change mail to POP back to exchange, from push (15min to 1 hr) to Fetch, Fetch to manual, and SSL on to off. The funny thing is that this wan't not a problem until I change my network password. It connected fine previously without any locking of the email account.
I'm not changing my password at all during all of this and after the SA unlocks my account (done about 30 times over 2 weeks now) it connects and pulls down mail right away.
Is there a setting on the exchannge server that can help debug this?
CMB

Active directory issue

This is the replication status for the following directory partition on this directory server.
Directory partition:
DC=ForestDnsZones,DC=shankarpack,DC=com
This directory server has not received replication information from a number of directory servers within the configured latency interval.
Latency Interval (Hours):
24
Number of directory servers in all sites:
1
Number of directory servers in this site:
1
The latency interval can be modified with the following registry key.
Registry Key:
HKLM\System\CurrentControlSet\Services\NTDS\Parameters\Replicator latency error interval (hours)
To identify the directory servers by name, use the dcdiag.exe tool.
You can also use the support tool repadmin.exe to display the replication latencies of the directory servers. The command is "repadmin /showvector /latency <partition-dn>".

sir, i means that secondary domain server is down due to system motherboard issue.so guide to me that how remove all setting of the secondary domain from primary domain. (shankarpack.com).
errors are :
Active Directory Domain Services could not resolve the following DNS host name of the source domain controller to an IP address. This error prevents additions, deletions and changes in Active Directory Domain Services from replicating between one or more
domain controllers in the forest. Security groups, group policy, users and computers and their passwords will be inconsistent between domain controllers until this error is resolved, potentially affecting logon authentication and access to network resources.
Source domain controller:
AVS1
Failing DNS host name:
f0c8f1a9-50fd-4785-8ca4-29b1d824b251._msdcs.shankarpack.com
NOTE: By default, only up to 10 DNS failures are shown for any given 12 hour period, even if more than 10 failures occur. To log all individual failure events, set the following diagnostics registry value to 1:
Registry Path:
HKLM\System\CurrentControlSet\Services\NTDS\Diagnostics\22 DS RPC Client
User Action:
1) If the source domain controller is no longer functioning or its operating system has been reinstalled with a different computer name or NTDSDSA object GUID, remove the source domain controller's metadata with ntdsutil.exe, using the steps outlined
in MSKB article 216498.
2) Confirm that the source domain controller is running Active Directory Domain Services and is accessible on the network by typing "net view \\<source DC name>" or "ping <source DC name>".
3) Verify that the source domain controller is using a valid DNS server for DNS services, and that the source domain controller's host record and CNAME record are correctly registered, using the DNS Enhanced version of DCDIAG.EXE available on http://www.microsoft.com/dns
dcdiag /test:dns
4) Verify that this destination domain controller is using a valid DNS server for DNS services, by running the DNS Enhanced version of DCDIAG.EXE command on the console of the destination domain controller, as follows:
dcdiag /test:dns
5) For further analysis of DNS error failures see KB 824449:
http://support.microsoft.com/?kbid=824449
Additional Data
Error value:
11004 The requested name is valid, but no data of the requested type was found.
This is the replication status for the following directory partition on this directory server.
Directory partition:
DC=ForestDnsZones,DC=shankarpack,DC=com
This directory server has not received replication information from a number of directory servers within the configured latency interval.
Latency Interval (Hours):
24
Number of directory servers in all sites:
1
Number of directory servers in this site:
1
The latency interval can be modified with the following registry key.
Registry Key:
HKLM\System\CurrentControlSet\Services\NTDS\Parameters\Replicator latency error interval (hours)
To identify the directory servers by name, use the dcdiag.exe tool.
You can also use the support tool repadmin.exe to display the replication latencies of the directory servers. The command is "repadmin /showvector /latency <partition-dn>".
This server is the owner of the following FSMO role, but does not consider it valid. For the partition which contains the FSMO, this server has not replicated successfully with any of its partners since this server has been restarted. Replication errors are
preventing validation of this role.
Operations which require contacting a FSMO operation master will fail until this condition is corrected.
FSMO Role: DC=shankarpack,DC=com
User Action:
1. Initial synchronization is the first early replications done by a system as it is starting. A failure to initially synchronize may explain why a FSMO role cannot be validated. This process is explained in KB article 305476.
2. This server has one or more replication partners, and replication is failing for all of these partners. Use the command repadmin /showrepl to display the replication errors. Correct the error in question. For example there maybe problems with IP connectivity,
DNS name resolution, or security authentication that are preventing successful replication.
3. In the rare event that all replication partners being down is an expected occurance, perhaps because of maintenance or a disaster recovery, you can force the role to be validated. This can be done by using NTDSUTIL.EXE to seize the role to the same server.
This may be done using the steps provided in KB articles 255504 and 324801 on http://support.microsoft.com.
The following operations may be impacted:
Schema: You will no longer be able to modify the schema for this forest.
Domain Naming: You will no longer be able to add or remove domains from this forest.
PDC: You will no longer be able to perform primary domain controller operations, such as Group Policy updates and password resets for non-Active Directory Domain Services accounts.
RID: You will not be able to allocation new security identifiers for new user accounts, computer accounts or security groups.
Infrastructure: Cross-domain name references, such as universal group memberships, will not be updated properly if their target object is moved or renamed.

Synchronization with Active Directory issue - Error ID 1004

I found the Application Event Log error below.
Error ID 1004: The resource 'D:\SharePoint 2010\14.0\Service\Microsoft.ResourceManagement.Service.exe' does not exist.
This means, the Network Service account does not have rights to the %programfiles%\Microsoft Office Servers\14.0 folder so,
the User Profile Synchronisation with Active Directory does not run properly.
The solution is to grant read access to the Network Service account to the ...\14.0 folder.
https://support2.microsoft.com/kb/2473430?wa=wsignin1.0
But I cannot find %programfiles%\Microsoft
Office Servers\14.0 folder. Instead
there is a folder in D drive: 'D:\SharePoint 2010\14.0 and I granted read access to the Network Service account to this
folder and ran Full synchronization but still not a joy.
Could you please advise me?
Thanks

Thanks Victoria,
I granted full access to the user
NETWORK SERVICE:, which
is listed in the error message on the folder D:\SharePoint 2010\14.0.
Then reset IIS and ran a full
synchronization, but there are still some user accounts who are a member of an AD group (this AD group has contribute right to the Intranet) and when
I check permission for those users, it seems they don't inherit permission from that AD group.
For example :
AD group name: TeamMembers
TeamMembers has contribute
permission.
user1, user2, user3 and user4 are members of TeamMembers
user1 and user2 have contribute
permissionGiven through the "TeamMembers"
group.
user3 and user4 have no permission!!!
I don't know what the problem is. I don't have access to Active Directory but the people who have access to say all users are members of that AD group.
Could you please advise?
Thanks

CCE Web Administration - Active Directory issue when managing agent attributes

Similar Messages

Maybe you are looking for