Distribution Point on a Domain Controller?

Hi all,
I'm pretty new at SCCM and I'm having issues on a new DP on a DC.  We're running SCCM 2012 and the DC is a 2008R2 DC.  Whenever I try to install the DP role, I get an error saying "Distribution manager failed to connect to the distribution point.
 Check your firewall settings".  Another role when trying to send packages, I get the same error plus an error saying it can't find an NTFS drive or the drive may not have enough space. The drive does have enough space. I tried adding our site
servers to the top level of our domain with full access, added the sccm server to the domain admin group, but no luck. Any ideas? 

When you add a computer account to a security group you have to reboot the computer in order for the new permissions to be applied. That is why it is now working.
Using DCs as DPs is not a great idea but I have several customers that have them, on remote single-server sites.  
Gerry Hampson | Blog:
www.gerryhampsoncm.blogspot.ie | LinkedIn:
Gerry Hampson | Twitter:
@gerryhampson

Similar Messages

  • One distribution point serve mulitple domains.

    Hi,
    In my environment we have a CAS with 3 primary site servers. Each site server is under a different child domain. At one of our locations, we have servers from all 3 sites. I'd like to have only one DP for content, but would like to know if the DP will
    be able to serve content to servers across the other two domains or would those servers only be able to communicate with a DP that is in the same domain.
    I plan to do manual site assignment through the client push and then have one boundary for content location.
    Thanks
    Brian

    "In my environment we have a CAS with 3 primary site servers."
    Yuck, too late to change now, but this is totally not necessary.
    To answer your question, DP location and use has *nothing* to do with domains which is why having a site per domain is not needed in any way and is generally a bad thing to do. To put it even more generally, ConfigMgr does not care about domains, forests,
    or trusts for most of its operations so to base your site design on your domains is not a good thing.
    Your limitation isn't with domains, it's with your sites. Clients can roam to other sites and use DPs from those other sites, but that implies that they would also use the MP from the other site which in turn is responsible for providing DPs to a client.
    An MP will only provide a list of DPs for its own site. Thus, no, it's not possible with your configuration.
    Jason | http://blog.configmgrftw.com | @jasonsandys

  • New Site Server with Distribution Point & Software Update Point Roles not pulling SUGs

    I just set up a new server & installed the DP & SUP roles on it.  I am getting the following in the log this is just a small sample as its kind of repetative:
    Report state message 0x8000094F to MP SMS_Distribution_Point_Monitoring 3/28/2014 1:34:45 PM 6444 (0x192C)
    Report Body: <ReportBody><StateMessage MessageTime="20140328183445.000000+000" SerialNumber="0"><Topic ID="FPP00002" Type="901" IDType="0"/><State ID="2383" Criticality="0"/><UserParameters
    Flags="0" Count="2"><Param>FPP00002</Param><Param>["Display=\\FPPSCCM02.FPP.WUCON.WUSTL.EDU\"]MSWNET:["SMS_SITE=FPP"]\\FPPSCCM02.FPP.WUCON.WUSTL.EDU\</Param></UserParameters></StateMessage></ReportBody>
     SMS_Distribution_Point_Monitoring 3/28/2014 1:34:45 PM 6444 (0x192C)
    Report status message 0x8000094F to MP SMS_Distribution_Point_Monitoring 3/28/2014 1:34:45 PM 6444 (0x192C)
    Status message has been successfully sent to MP from remote DP SMS_Distribution_Point_Monitoring 3/28/2014 1:34:45 PM 6444 (0x192C)
    Retry 10 times SMS_Distribution_Point_Monitoring 3/28/2014 1:34:45 PM 6444 (0x192C)
    Start to evaluate all packages ... SMS_Distribution_Point_Monitoring 3/28/2014 1:34:45 PM 6444 (0x192C)
    Start to evaluate package 'FPP00002' version 0 ... SMS_Distribution_Point_Monitoring 3/28/2014 1:34:45 PM 6444 (0x192C)
    Report status message 0x4000094C to MP SMS_Distribution_Point_Monitoring 3/28/2014 1:34:45 PM 6444 (0x192C)
    Status message has been successfully sent to MP from remote DP SMS_Distribution_Point_Monitoring 3/28/2014 1:34:45 PM 6444 (0x192C)
    Failed to evaluate package FPP00002, Error code 0x80070002 SMS_Distribution_Point_Monitoring 3/28/2014 1:34:45 PM 6444 (0x192C)
    Report state message 0x8000094F to MP SMS_Distribution_Point_Monitoring 3/28/2014 1:34:45 PM 6444 (0x192C)
    Report Body: <ReportBody><StateMessage MessageTime="20140328183445.000000+000" SerialNumber="0"><Topic ID="FPP00002" Type="901" IDType="0"/><State ID="2383" Criticality="0"/><UserParameters
    Flags="0" Count="2"><Param>FPP00002</Param><Param>["Display=\\FPPSCCM02.FPP.WUCON.WUSTL.EDU\"]MSWNET:["SMS_SITE=FPP"]\\FPPSCCM02.FPP.WUCON.WUSTL.EDU\</Param></UserParameters></StateMessage></ReportBody>
     SMS_Distribution_Point_Monitoring 3/28/2014 1:34:45 PM 6444 (0x192C)
    Report status message 0x8000094F to MP SMS_Distribution_Point_Monitoring 3/28/2014 1:34:45 PM 6444 (0x192C)
    Status message has been successfully sent to MP from remote DP SMS_Distribution_Point_Monitoring 3/28/2014 1:34:45 PM 6444 (0x192C)
    Report status message 0x40000952 to MP SMS_Distribution_Point_Monitoring 3/28/2014 1:34:45 PM 6444 (0x192C)
    Status message has been successfully sent to MP from remote DP SMS_Distribution_Point_Monitoring 3/28/2014 1:34:45 PM 6444 (0x192C)
    DP monitoring finishes evaluation. SMS_Distribution_Point_Monitoring 3/28/2014 1:34:45 PM 6444 (0x192C)
    Failed to evaluate some packages after 10 retry SMS_Distribution_Point_Monitoring 3/28/2014 1:34:45 PM 6444 (0x192C)
    The Console shows for the DP that it's waiting for content and I don't see where I can create a Prestage Package
    # When I wrote this script only God & I knew what I was doing. # Now, only God Knows! don't retire technet http://social.technet.microsoft.com/Forums/en-US/e5d501af-d4ea-4c0f-97c0-dfcef0192888/dont-retire-technet?forum=tnfeedback

    D:\SMS_DP$\sms\logs\smsdpmon.log
    This is the 2nd server in our SCCM 2012 Sp1 Hierarchy.  It is set up with the following Site System Roles:
    Component Server
    Distribution Point
    Site System
    Software Update Point
    It is Prestaged Enabled.  My intent is that the client systems @ the location where this DP is located will use it to pull their Microsoft Updates from as well as content for any Applications we push to them rather than going over the WAN to the Primary
    Site Server.
    IN Distribution Point Configuration Status. the console shows "Failed to update package" & "Packaget Transfer Manager failed to update the package "yxz00040". Version 3 on Distribution Point server.my.domain.com review pkgxfermgr.log for more information
    about this failure."
    It also goes on toe list 2 possible causes and solutions
    Site servers does not have sufficient rights to the source directory.
    (Site server account is a member of local Administrators on Primary)
    Not enough disk space available
    (I have over 1TB of available space and primary site server has only 150GB available for entire content repository, both applications and sofware updates.)
    # When I wrote this script only God & I knew what I was doing. # Now, only God Knows! don't retire technet http://social.technet.microsoft.com/Forums/en-US/e5d501af-d4ea-4c0f-97c0-dfcef0192888/dont-retire-technet?forum=tnfeedback

  • SCCM 2012 Distribution Point in workgroup

    I am trying to install a SCCM 2012 SP1 DP on a Windows 2008 workgroup server.
    Some parts are working but during installation I get errors....
    The question is: is it supported what I am trying to do, a workgroup (not part of a domain) server using as DP in SCCM 2012 SP1 ?

    Distribution Points must be domain members
    http://eskonr.com/2013/08/sccm-configmgr-2012-manage-workgroup-computers-for-deploymentremote-tools-etc/
    You can manage workgroup clients though.  
    Gerry Hampson | Blog:
    www.gerryhampsoncm.blogspot.ie | LinkedIn:
    Gerry Hampson | Twitter:
    @gerryhampson

  • ConfigMgr 2012 R2 Distribution Point IIS no directories created

    I have an issue where I removed the DP role from my Primary Site Server, and am unable to re-install it.
    Environment Server 2012 R2 all in one system (SQL, SSRS, and ConfigMgr installed locally).
    The logs state that BITS isn't installed, but I have removed and reinstalled it several times.  I have also changed the "Log On" account to verify that it isn't a permissions thing (I have since reverted the account to the default). 
    The process of creating the DP role allows for the ContentLib folder to be created on the drive, but the SMS_DP_PKG$, nor for the virtual folder creation in IIS.  Please help.
    From the logs:
    Error   
    Milestone          
    PS1 6/1/2014 11:36:31
    AM   
    SCCM.domain.org               
    SMS_DISTRIBUTION_MANAGER             
    2344       Failed to create virtual directory on
    the defined share or volume on distribution point "["Display=\\SCCM.domain.org\"]MSWNET:["SMS_SITE=PS1"]\\SCCM.domain.org\".   
    Possible cause: Distribution Manager requires that IIS base components be
    installed on the local Configuration Manager Site Server in order to create the
    virtual directory.  Distribution Manager also requires that IIS Web
    Services be installed on the Distribution Point Server that needs to support
    Background Intelligent Transfer Service (BITS).  Solution: Verify that IIS
    base components are installed on the local Configuration Manager Site Server,
    and IIS Web Services are installed on the Distribution Point Server.

    Hi,
    Please check Distmgr.log as Torsten said.
    Have you try to reboot the server after confirm all prerequisites has met?
    Could you distribute a content to the DP successfully?
    Best Regards,
    Joyce
    We
    are trying to better understand customer views on social support experience, so your participation in this
    interview project would be greatly appreciated if you have time.
    Thanks for helping make community forums a great place.

  • SCCM 2012 Distribution Points on Domain Controllers

    I want to install Distribution points on all of my remote servers. They are all domain controllers though. I know one of the prerequisites to host the DP role is to have the SCCM computer object apart of that servers local administrators group. Since they
    are domain controllers they dont have a local security policy and it is controlled by AD. I'm sure you can add the SCCM computer object to the domain admins group to solve this but my question is if this is considered a supported configuration?

    If you are using the DC as a Distribution point to install clients via Client Push, the "NT Authority\Authenticated Users" group must be added to the local group "Users" to the DC/DP.
    Clients are still able to get installed manually, but Client Push fails.
    Failed to correctly receive a WEBDAV HTTP request.. (StatusCode at WinHttpQueryHeaders: 401)
    Run elevated command prompt (net localgroup users "Authenticated Users" /add)
    Test Client Push - Should be successful.
    Reason: By default the local groups NT Authority\Interactive Users and
    NT Authority\Authenticated Users are removed from the Domain Controller. Clients that are using the DP for content cannot authenticate using the computer account.

  • SCCM 2012 R2 - Distribution Point untrusted domain - Not acknowledging Network Access Account (FYI)

    Hello!
    Scenario
    Built a single primary site server in one domain with multiple distribution points. All site servers are member of this one site.
    The distribution points in the primary site servers' domain function as expected. The distribution point deployed to an untrusted domain does not. The primary site server can see all objects in the domain, publishes successfully, and CCM client on the
    DP in the untrusted domain knows its part of the site, knows its AD site (according to locationservices.log). The DP role is installed properly, logs are populating, queries are being made for application lists and updates. nfortuantely authentication
    errors indicate that this software can'tbe downloaded.
    In essence the DP in the untrusted domain can't pull down content from the primary site server. The role uses BITS to download content from IIS on the primary site server, but the requests each throw a 401 error. Unauthorised. This should be an easy fix.
    Create a Network Access Account in the primary site server's domain, assign it to the site (Software Distribution setting), wait for the DP to pick up the setting and watch it retrieve its content. The DP in the untrusted domain is configured as a Pull DP,
    implying it has to use a Network Access Account to download content. It knows the content is available and makes every effort to download it.
    Problem
    The DP in the untrusted domain doesn't know a Network Access Account (NAA) has been defined for the site.
    The account does exist, created in the primary site server's domain and assigned to the site. Its not a password issue. IIS has not been set for Anonymous access as this isn't needed - the NAA should provide the credentials it requires to pull down content.
    A manual check using the URL of the package confirms the package is accessible from the DP when using the NAA's credentials. I've allowed enough time (i think) for the DP to acknowledge the NAA. For fun the DP role was removed, and the CCM agent removed. Both
    were reinstalled. A fresh install didn't detect the NAA.
    Solution
    After some soul searching and a little frustration, it came down to this: A Pull DP always uses the Network Access Account. If the DP can't find a Network Access account it will fail to pull down content. This is undisputed. Found an article that states
    the Pull DP always uses the CCM client configuration to do its dirty work. At that point the CCM client was checked. It had the classic problem of only displaying two Actions - Machine Policy Retrieval & Evaluation Cycle, User policy Retrieval & Evaluation
    Cycle. Most components were installed but not enabled. This is fairly common. Looked at the console, found the device, added the Approval column. Turns out it wasn't auto-approved. Reason being that the client is in an untrusted domain and clients in untrusted
    domains aren't approved automatically (by default).
    In this case something as simple as an Approving the client fixed these issues. 
    The DataTransferService.log highlights the issue:
    <![LOG[CDTSJob::JobError: DTS Job ID='{17E0B672-F699-434D-B063-87CC2ACF715C}' BITS Job ID='{38B81ADE-55B5-4BD7-A881-DBFF13943EDE}' ErrorCode=0x80190191]LOG]!><time="18:25:54.264+00" date="02-19-2015" component="DataTransferService"
    context="" type="1" thread="3136" file="dtsjob.cpp:3501">
    <![LOG[CDTSJob::JobError: DTS Job ID='{17E0B672-F699-434D-B063-87CC2ACF715C}' URL='http://PRIMARYSERVER.A.B.COM:80/SMS_DP_SMSPKG$/5af1680e-4a14-4dc5-8a60-bda7370e6d68'
    ProtType=1]LOG]!><time="18:25:54.264+00" date="02-19-2015" component="DataTransferService" context="" type="1" thread="3136" file="dtsjob.cpp:3504">
    <![LOG[Authentication required by the proxy, DTS Job ID='{17E0B672-F699-434D-B063-87CC2ACF715C}' BITS Job ID='{38B81ADE-55B5-4BD7-A881-DBFF13943EDE}'.]LOG]!><time="18:25:54.264+00" date="02-19-2015" component="DataTransferService"
    context="" type="3" thread="3136" file="dtsjob.cpp:3513">
    <![LOG[DTSJob {8814E9A1-3D26-4089-83CF-3C7D17BCEC6E} in state 'Cancelled'.]LOG]!><time="18:25:54.264+00" date="02-19-2015" component="DataTransferService" context="" type="1" thread="3688"
    file="dtsjob.h:166">
    <![LOG[DTS job {17E0B672-F699-434D-B063-87CC2ACF715C} BITS job
    {38B81ADE-55B5-4BD7-A881-DBFF13943EDE} encountered Access Denied error during download.  Will retry using Network Access Account.]LOG]!><time="18:25:54.264+00" date="02-19-2015" component="DataTransferService"
    context="" type="2" thread="3136" file="dtsjob.cpp:3652">
    <![LOG[DTSJob {8814E9A1-3D26-4089-83CF-3C7D17BCEC6E} cancelled by client.]LOG]!><time="18:25:54.280+00" date="02-19-2015" component="DataTransferService" context="" type="1" thread="3688"
    file="dtsjob.cpp:3205">
    <![LOG[No network access account info found.]LOG]!><time="18:25:54.327+00" date="02-19-2015" component="DataTransferService" context="" type="1"
    thread="3136" file="netaccessaccount.cpp:288">
    <![LOG[The network access account is not defined.]LOG]!><time="18:25:54.327+00" date="02-19-2015" component="DataTransferService" context=""
    type="1" thread="3136" file="netaccessaccount.cpp:858">
    <![LOG[DTSJob {17E0B672-F699-434D-B063-87CC2ACF715C} encountered error setting BITS job to use Network Access Account
    (0x00000000).]LOG]!><time="18:25:54.327+00" date="02-19-2015" component="DataTransferService" context="" type="3" thread="3136" file="dtsjob.cpp:1885">
    The IIS server logs u_ex150219.log captures the request:
    2015-02-19 123.11.12.13 GET /SMS_DP_SMSPKG$/5af1680e-4a14-4dc5-8a60-bda7370e6d68/sccm /windows6.1-kb3021917-x64.cab 80 - 9.10.11.12 Microsoft+BITS/7.7 -
    401 2 5 1509 2
    2015-02-19 123.11.12.13 GET /SMS_DP_SMSPKG$/5af1680e-4a14-4dc5-8a60-bda7370e6d68/sccm /windows6.1-kb3021917-x64.cab 80 - 9.10.11.12 Microsoft+BITS/7.7 -
    401 1 3221225581 1509 4
    2015-02-19 123.11.12.13 GET /SMS_DP_SMSPKG$/5af1680e-4a14-4dc5-8a60-bda7370e6d68/sccm /windows6.1-kb3021917-x64.cab 80 - 9.10.11.12 Microsoft+BITS/7.7 -
    401 1 3221225581 1509 3
    2 x Domains: DomainA and DomainX
    - Single domain forests
    - No trusts between domains/forests
    DomainA\PRIMARYSERVER
    - Primary Site Server, MP, DP, IIS, all roles
    DomainX\DP1
    - Distribution Point, IIS, etc
    - CCM client installed

    Based on the above, you are using a PullDP. If so, have you installed the client agent on this system? The client agent is required on PullDPs in untrusted domains so that they can acquire the NAA.
    Jason | http://blog.configmgrftw.com | @jasonsandys

  • A question and out CA 'domain controller' templates, and kerbros/KDC in general

    Hello All
    Can someone please help me with the following question. This may be two questions (so if you think I have to post separately please let me know).
    I was reading an MS article called "Active Directory Domain Controllers and Certificate auto-enrolment" which was very helpful but through up some questions too.
    for example the article talks about a 'template' called 'Directory E-mail Replication' what is this? in other words we have all heard of MS Exchange for corporate email, but the name of this template seems to suggest 'Domain Controllers' send e-mails to
    reach other? (over and above their normal AD replication) or is this template used for sending AD replication data via SMTP rather than RPC (which is something I have never heard of). Can someone please explain the purpose of this template, thanks very much.
    Also I want to understand the relationship (if any) between these Domain Controller PKI templates and Kerberos in general (can someone point me to a white paper of good blog article)
    For example my understanding at the moment if Kerberos is basically a 'symmetric'  key encryption system where by the KDC (Key Distribution Center) take care of administering all these symmetric key pairs, is this basic premise
    correct?
    I understand (at a very basic level) to concept of Kerberos TGT and TST (ticket granting ticket and ticket service ticket) and the fact the client cannot read the contents of either of these (rather the KDC is the trust anchor and deals with all the encryption
    and description of the keys to provide/proof identity authentication, and the client simply presents these tickets)
    Hopefully the above is correct (or on the right lines), what I do not understand is how this (Kerberos/KDC) relates to DC's and their 'Domain Controller' templates or how these Domain Controllers use the certificates generated from these templates for encryption
    (I presume to encrypt the AD sync traffic, but isn't this done via Kerberos).
    Also AD CA is optional component therefore my logic suggests there should be no relation to these Domain Controller templates and Kerberos
    As you can see I have some fundermental gaps in my knowleague and would really appreciate someone helping me out here
    Thanks very much
    AAnotherUser__
    AAnotherUser__

    Re the template Directory E-mail Replication.
    Yes, you are right - these are only used for (optional) AD replication via SMTP, and yes this is rather uncommon. I have only encountered this type of replication in a few environments with very specific - and historically grown - firewall and trust requirements.
    Re Kerberos and certificates:
    My favorite white paper is this:
    Windows Vista Smart Card Infrastructure. See especially the details of how Kerberos is used with smart cards as depicted in Figure 16 and the text below.
    When users use smartcards to logon to their computers they authenticate to DCs and DCs authenticate to them. So DCs also need certificates.
    See
    RFC 4556 for details of how public key cryptography is used to protect the Kerberos protocol.
    So in summary certificates are used for authentication and encryption.
    You are right that otherwise - if you don't use smart card logon for users - DC certificates are optional and not needed to do default Kerberos authentication.
    Another reason DC certificates are often deployed is for allowing LDAP browsers and other management tools to connect to AD via LDAPs.
    Elke

  • Group MSA account fail when Domain Controller in Test Domain Fails to start KdsSvc. Event ID 7023

    Yesterday, in my test domain, I created the KDS root key using the Add-KdsRootKey –EffectiveTime ((get-date).addhours(-10))
    command on a DC that is not the PDC Emulator because it was the server I was on at the time.  Today, when I tried to create gMSA accounts on the PDC emulator, I get:
    Event ID 7023 The Microsoft Key Distribution Service terminated with the following error: An Exception occurred in the service when handling the control request
    I turned on logging on to the KdsSvc and get 2 other errors:
    KdsSvc Event ID 4001: Group Key Distribution Service failed to start. Status 0x80070020
    KdsSvc Event ID 4007: Group Key Distribution Service cannot connect to the domain controller on local host.  Status 0x80070020.  Group Key Distribution Service cannot be started because of the error.  Please contact the administrator to resolve
    the issue.
    I took the opportunity to clean up AD, the Schema, and DNS, but the kds errors continues.  I am replicating successfully, DNS changes are reflected immediately, and when I run the get-KDSRootKey on the failing server, the key is returned.  The
    Get-KdsConfiguration matches the KDS config on the DC that originally ran to create the key.
    I have a pretty strict GPO pushed to my DCs but I am still able to create gMSAs on the other server.  I checked ADS&S and found the msKds-ProvRootKey so I know it is at the domain level, but there is so little documentation on the KdsSvc that I
    am not sure if it is working as planned.  I have tried unassigning several GPO configuration items but I am throwing darts at this point.  I have also uninstalled McAfee AV; IDS/IPS; Firewall.
    With that said, I have questions:
    Will gMSAs still work even though the domain pdc emulator cannot start the service?
    Is the KdsSvc supposed to start only on the server Add-KDSRootKey was originally created?
    What happens if the server the KdsSvc key was created fails and has to be removed from the domain?
    Is there any books or configuration items I can review to learn the KdsSvc better?
    Env:
    Windows Standard Server 2012 R2 x64
    Active Directory 2012 R2 Schema Updated from Windows 2008 R2
    All FSMO roles are on the PDC Emulator which is a Windows 2012 R2 DC
    DCDiag returns no errors or test failures
    Repadmin returns clean results (/showreps & /replsum)
    Windows 2008 R2 Root CA hierarchy (not DCs)
    W32tm services are running with less than 6/10's of a ms difference among the domain.

    Hi,
    For Windows Server 2012, the Windows PowerShell cmdlets default to managing the group Managed Service Accounts instead of the original standalone Managed
    Service Accounts.
    New-ADServiceAccount -name <ServiceAccountName> -DNSHostName <fqdn> -PrincipalsAllowedToRetrieveManagedPassword <group>
    -ServicePrincipalNames <SPN1,SPN2,…>
    Did you use the command abouve?
    Here is a good bolg:
    Windows Server 2012: Group Managed Service Accounts
    http://blogs.technet.com/b/askpfeplat/archive/2012/12/17/windows-server-2012-group-managed-service-accounts.aspx
    Hope this helps.

  • ISSUE: "This domain controller must register a DNS SRV resource record, which is required for replication to function correctly"

    so we currently have three domain controllers set up, two of them on 2012r2 and one of them on 2008r2. prior to any of these domain controllers being added to the domain there was only one, running on 2003r2. the 2003r2 server was up and running when the
    first 2012r2 was added and that's when running 'dcdiag /e /c /v' would yield an issue with "_ldap._tcp.9a5f3c17-e7ac-48f7-ab42-bf1ea621a6f5.domains._msdcs.cmedia.local" in the DNS portion of the diagnostics, specifically:
    TEST: Records registration (RReg)
    Network Adapter [00000010] Microsoft Hyper-V Network Adapter:
    Error:
    Missing SRV record at DNS server 192.168.22.4:
    _ldap._tcp.9a5f3c17-e7ac-48f7-ab42-bf1ea621a6f5.domains._msdcs.cmedia.local
    after adding the second 2012r2 to the domain, this issue is still there... adding the 2008r2 server to the domain and running BPA it gives the following:
    Title:
    This domain controller must register a DNS SRV resource record, which is required for replication to function correctly
    Severity:
    Error
    Date:
    7/3/2014 11:24:48 AM
    Category:
    Configuration
    Issue:
    The "DcByGuid" DNS service (SRV) resource record that advertises this server as an available domain controller in the domain and ensures correct replication is not registered. All domain controllers (but not RODCs) in the domain must register this record.
    Impact:
    Other member computers and domain controllers in the domain or forest will not be able to locate this domain controller. This domain controller will not be able to provide a full suite of services.
    Resolution:
    Ensure that "DcByGuid" is not configured in the "DnsAvoidRegisteredRecords" list, either through Group Policy or through the registry. Restart the Netlogon service. Verify that the DNS service (SRV) resource record "_ldap._tcp.9a5f3c17-e7ac-48f7-ab42-bf1ea621a6f5.domains._msdcs.cmedia.local", pointing to the local domain controller "CM-DC4-NY01.cmedia.local", is registered in DNS.
    More information about this best practice and detailed resolution procedures: http://go.microsoft.com/fwlink/?LinkId=126968
    I've tried scanning and then re-scanning every single entry in DNS Manager and do not see any reference to this specific GUID mentioned, nor do I see any other domain controllers referenced that should not be in there. The two 2012r2 and the 2008r2 domain
    controllers are the only ones listed in DNS Manager... the 2003r2 mentioned earlier failed and was removed.

    Just to chime in, I noticed that you said you have one 2008 R2 DC, and two 2012 DCs.
    I also noticed in the ipconfig /all that all DCs are pointint to themselves for DNS. We usually like to see them point to a partner, then itslelf as the second entry, w hether loopback or by its own IP.
    Based on that, what I suggest to level the playing field by choosing the WIndows 2008 R2 DC as the first DNS on all DCs and only administer DNS using that DC. The reason I chose that is because of the least common denominator is what we rather use so we
    don't invoke any new features in the newer 2012 DNS console that 2008 R2 may not understand.  After that's done, on each DC run (and you can use a PowerShell window to run this):
    Rename the system32\config\netlogon.dns and netlogon.dnb files by suffixing ".old" to the file.
    ipconfig /registerdns
    net stop netlogon
    net start netlogon
    Then re-run the dcdiag /e /c /v.
    Post your results, please.
    Ace Fekay
    MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
    Microsoft Certified Trainer
    Microsoft MVP - Directory Services
    Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php
    This posting is provided AS-IS with no warranties or guarantees and confers no rights.
    I thought the DNS entries were supposed to be the other way around? point to themselves first and a partner as secondary? regardless, as requested, I've changed it to what you've prescribed where they point to the 2008r2 server as the primary with themselves
    as the secondary. I've also followed the steps to what seems like refreshing the DNS? on each of the DCs. Here's the output from dcdiag /e /c /v
    Directory Server Diagnosis
    Performing initial setup:
    Trying to find home server...
    * Verifying that the local machine CM-DC1-NY01, is a Directory Server.
    Home Server = CM-DC1-NY01
    * Connecting to directory service on server CM-DC1-NY01.
    * Identified AD Forest.
    Collecting AD specific global data
    * Collecting site info.
    Calling ldap_search_init_page(hld,CN=Sites,CN=Configuration,DC=cmedia,DC=local,LDAP_SCOPE_SUBTREE,(objectCategory
    =ntDSSiteSettings),.......
    The previous call succeeded
    Iterating through the sites
    Looking at base site object: CN=NTDS Site Settings,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=cmedia
    ,DC=local
    Getting ISTG and options for the site
    * Identifying all servers.
    Calling ldap_search_init_page(hld,CN=Sites,CN=Configuration,DC=cmedia,DC=local,LDAP_SCOPE_SUBTREE,(objectClass=nt
    DSDsa),.......
    The previous call succeeded....
    The previous call succeeded
    Iterating through the list of servers
    Getting information for the server CN=NTDS Settings,CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites
    ,CN=Configuration,DC=cmedia,DC=local
    objectGuid obtained
    InvocationID obtained
    dnsHostname obtained
    site info obtained
    All the info for the server collected
    Getting information for the server CN=NTDS Settings,CN=CM-DC3-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites
    ,CN=Configuration,DC=cmedia,DC=local
    objectGuid obtained
    InvocationID obtained
    dnsHostname obtained
    site info obtained
    All the info for the server collected
    Getting information for the server CN=NTDS Settings,CN=CM-DC4-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites
    ,CN=Configuration,DC=cmedia,DC=local
    objectGuid obtained
    InvocationID obtained
    dnsHostname obtained
    site info obtained
    All the info for the server collected
    * Identifying all NC cross-refs.
    * Found 3 DC(s). Testing 3 of them.
    Done gathering initial info.
    Doing initial required tests
    Testing server: Default-First-Site-Name\CM-DC1-NY01
    Starting test: Connectivity
    * Active Directory LDAP Services Check
    Determining IP4 connectivity
    * Active Directory RPC Services Check
    ......................... CM-DC1-NY01 passed test Connectivity
    Testing server: Default-First-Site-Name\CM-DC3-NY01
    Starting test: Connectivity
    * Active Directory LDAP Services Check
    Determining IP4 connectivity
    * Active Directory RPC Services Check
    ......................... CM-DC3-NY01 passed test Connectivity
    Testing server: Default-First-Site-Name\CM-DC4-NY01
    Starting test: Connectivity
    * Active Directory LDAP Services Check
    Determining IP4 connectivity
    * Active Directory RPC Services Check
    ......................... CM-DC4-NY01 passed test Connectivity
    Doing primary tests
    Testing server: Default-First-Site-Name\CM-DC1-NY01
    Starting test: Advertising
    The DC CM-DC1-NY01 is advertising itself as a DC and having a DS.
    The DC CM-DC1-NY01 is advertising as an LDAP server
    The DC CM-DC1-NY01 is advertising as having a writeable directory
    The DC CM-DC1-NY01 is advertising as a Key Distribution Center
    The DC CM-DC1-NY01 is advertising as a time server
    The DS CM-DC1-NY01 is advertising as a GC.
    ......................... CM-DC1-NY01 passed test Advertising
    Starting test: CheckSecurityError
    * Dr Auth: Beginning security errors check!
    Found KDC CM-DC1-NY01 for domain cmedia.local in site Default-First-Site-Name
    Checking machine account for DC CM-DC1-NY01 on DC CM-DC1-NY01.
    * SPN found :LDAP/CM-DC1-NY01.cmedia.local/cmedia.local
    * SPN found :LDAP/CM-DC1-NY01.cmedia.local
    * SPN found :LDAP/CM-DC1-NY01
    * SPN found :LDAP/CM-DC1-NY01.cmedia.local/cmedia
    * SPN found :LDAP/a29d12f1-2869-44bf-8e43-adf7ddf33865._msdcs.cmedia.local
    * SPN found :E3514235-4B06-11D1-AB04-00C04FC2DCD2/a29d12f1-2869-44bf-8e43-adf7ddf33865/cmedia.local
    * SPN found :HOST/CM-DC1-NY01.cmedia.local/cmedia.local
    * SPN found :HOST/CM-DC1-NY01.cmedia.local
    * SPN found :HOST/CM-DC1-NY01
    * SPN found :GC/CM-DC1-NY01.cmedia.local/cmedia.local
    [CM-DC1-NY01] No security related replication errors were found on this DC! To target the connection to a
    specific source DC use /ReplSource:<DC>.
    ......................... CM-DC1-NY01 passed test CheckSecurityError
    Starting test: CutoffServers
    * Configuration Topology Aliveness Check
    * Analyzing the alive system replication topology for DC=ForestDnsZones,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the alive system replication topology for DC=DomainDnsZones,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the alive system replication topology for CN=Schema,CN=Configuration,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the alive system replication topology for CN=Configuration,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the alive system replication topology for DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    ......................... CM-DC1-NY01 passed test CutoffServers
    Starting test: FrsEvent
    * The File Replication Service Event log test
    ......................... CM-DC1-NY01 passed test FrsEvent
    Starting test: DFSREvent
    The DFS Replication Event Log.
    Skip the test because the server is running FRS.
    ......................... CM-DC1-NY01 passed test DFSREvent
    Starting test: SysVolCheck
    * The File Replication Service SYSVOL ready test
    File Replication Service's SYSVOL is ready
    ......................... CM-DC1-NY01 passed test SysVolCheck
    Starting test: FrsSysVol
    * The File Replication Service SYSVOL ready test
    File Replication Service's SYSVOL is ready
    ......................... CM-DC1-NY01 passed test FrsSysVol
    Starting test: KccEvent
    * The KCC Event log test
    Found no KCC errors in "Directory Service" Event log in the last 15 minutes.
    ......................... CM-DC1-NY01 passed test KccEvent
    Starting test: KnowsOfRoleHolders
    Role Schema Owner = CN=NTDS Settings,CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Confi
    guration,DC=cmedia,DC=local
    Role Domain Owner = CN=NTDS Settings,CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Confi
    guration,DC=cmedia,DC=local
    Role PDC Owner = CN=NTDS Settings,CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configur
    ation,DC=cmedia,DC=local
    Role Rid Owner = CN=NTDS Settings,CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configur
    ation,DC=cmedia,DC=local
    Role Infrastructure Update Owner = CN=NTDS Settings,CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN
    =Sites,CN=Configuration,DC=cmedia,DC=local
    ......................... CM-DC1-NY01 passed test KnowsOfRoleHolders
    Starting test: MachineAccount
    Checking machine account for DC CM-DC1-NY01 on DC CM-DC1-NY01.
    * SPN found :LDAP/CM-DC1-NY01.cmedia.local/cmedia.local
    * SPN found :LDAP/CM-DC1-NY01.cmedia.local
    * SPN found :LDAP/CM-DC1-NY01
    * SPN found :LDAP/CM-DC1-NY01.cmedia.local/cmedia
    * SPN found :LDAP/a29d12f1-2869-44bf-8e43-adf7ddf33865._msdcs.cmedia.local
    * SPN found :E3514235-4B06-11D1-AB04-00C04FC2DCD2/a29d12f1-2869-44bf-8e43-adf7ddf33865/cmedia.local
    * SPN found :HOST/CM-DC1-NY01.cmedia.local/cmedia.local
    * SPN found :HOST/CM-DC1-NY01.cmedia.local
    * SPN found :HOST/CM-DC1-NY01
    * SPN found :HOST/CM-DC1-NY01.cmedia.local/cmedia
    * SPN found :GC/CM-DC1-NY01.cmedia.local/cmedia.local
    ......................... CM-DC1-NY01 passed test MachineAccount
    Starting test: NCSecDesc
    * Security Permissions check for all NC's on DC CM-DC1-NY01.
    The forest is not ready for RODC. Will skip checking ERODC ACEs.
    * Security Permissions Check for
    DC=ForestDnsZones,DC=cmedia,DC=local
    (NDNC,Version 3)
    * Security Permissions Check for
    DC=DomainDnsZones,DC=cmedia,DC=local
    (NDNC,Version 3)
    * Security Permissions Check for
    CN=Schema,CN=Configuration,DC=cmedia,DC=local
    (Schema,Version 3)
    * Security Permissions Check for
    CN=Configuration,DC=cmedia,DC=local
    (Configuration,Version 3)
    * Security Permissions Check for
    DC=cmedia,DC=local
    (Domain,Version 3)
    ......................... CM-DC1-NY01 passed test NCSecDesc
    Starting test: NetLogons
    * Network Logons Privileges Check
    Verified share \\CM-DC1-NY01\netlogon
    Verified share \\CM-DC1-NY01\sysvol
    ......................... CM-DC1-NY01 passed test NetLogons
    Starting test: ObjectsReplicated
    CM-DC1-NY01 is in domain DC=cmedia,DC=local
    Checking for CN=CM-DC1-NY01,OU=Domain Controllers,DC=cmedia,DC=local in domain DC=cmedia,DC=local o
    n 3 servers
    Object is up-to-date on all servers.
    Checking for CN=NTDS Settings,CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuratio
    n,DC=cmedia,DC=local in domain CN=Configuration,DC=cmedia,DC=local on 3 servers
    Object is up-to-date on all servers.
    ......................... CM-DC1-NY01 passed test ObjectsReplicated
    Starting test: OutboundSecureChannels
    * The Outbound Secure Channels test
    ** Did not run Outbound Secure Channels test because /testdomain: was not entered
    ......................... CM-DC1-NY01 passed test OutboundSecureChannels
    Starting test: Replications
    * Replications Check
    * Replication Latency Check
    DC=ForestDnsZones,DC=cmedia,DC=local
    Latency information for 4 entries in the vector were ignored.
    4 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's
    no longer replicating this nc. 0 had no latency information (Win2K DC).
    DC=DomainDnsZones,DC=cmedia,DC=local
    Latency information for 4 entries in the vector were ignored.
    4 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's
    no longer replicating this nc. 0 had no latency information (Win2K DC).
    CN=Schema,CN=Configuration,DC=cmedia,DC=local
    Latency information for 4 entries in the vector were ignored.
    4 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's
    no longer replicating this nc. 0 had no latency information (Win2K DC).
    CN=Configuration,DC=cmedia,DC=local
    Latency information for 4 entries in the vector were ignored.
    4 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's
    no longer replicating this nc. 0 had no latency information (Win2K DC).
    DC=cmedia,DC=local
    Latency information for 4 entries in the vector were ignored.
    4 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's
    no longer replicating this nc. 0 had no latency information (Win2K DC).
    ......................... CM-DC1-NY01 passed test Replications
    Starting test: RidManager
    * Available RID Pool for the Domain is 16109 to 1073741823
    * CM-DC1-NY01.cmedia.local is the RID Master
    * DsBind with RID Master was successful
    * rIDAllocationPool is 4609 to 5108
    * rIDPreviousAllocationPool is 4609 to 5108
    * rIDNextRID: 4629
    ......................... CM-DC1-NY01 passed test RidManager
    Starting test: Services
    * Checking Service: EventSystem
    * Checking Service: RpcSs
    * Checking Service: NTDS
    * Checking Service: DnsCache
    * Checking Service: NtFrs
    * Checking Service: IsmServ
    * Checking Service: kdc
    * Checking Service: SamSs
    * Checking Service: LanmanServer
    * Checking Service: LanmanWorkstation
    * Checking Service: w32time
    * Checking Service: NETLOGON
    ......................... CM-DC1-NY01 passed test Services
    Starting test: SystemLog
    * The System Event log test
    A warning event occurred. EventID: 0x0000002F
    Time Generated: 07/08/2014 13:19:14
    Event String:
    Time Provider NtpClient: No valid response has been received from manually configured peer 0.ca.pool.ntp.org
    after 8 attempts to contact it. This peer will be discarded as a time source and NtpClient will attempt to discover a n
    ew peer with this DNS name. The error was: The peer is unreachable.
    Found no errors in "System" Event log in the last 60 minutes.
    ......................... CM-DC1-NY01 passed test SystemLog
    Starting test: Topology
    * Configuration Topology Integrity Check
    * Analyzing the connection topology for DC=ForestDnsZones,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the connection topology for DC=DomainDnsZones,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the connection topology for CN=Schema,CN=Configuration,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the connection topology for CN=Configuration,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the connection topology for DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    ......................... CM-DC1-NY01 passed test Topology
    Starting test: VerifyEnterpriseReferences
    ......................... CM-DC1-NY01 passed test VerifyEnterpriseReferences
    Starting test: VerifyReferences
    The system object reference (serverReference) CN=CM-DC1-NY01,OU=Domain Controllers,DC=cmedia,DC=local
    and backlink on
    CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=cmedia,DC=local are
    correct.
    The system object reference (serverReferenceBL)
    CN=CM-DC1-NY01,CN=Domain System Volume (SYSVOL share),CN=File Replication Service,CN=System,DC=cmedia,D
    C=local
    and backlink on
    CN=NTDS Settings,CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=chiefmed
    ia,DC=local
    are correct.
    The system object reference (frsComputerReferenceBL)
    CN=CM-DC1-NY01,CN=Domain System Volume (SYSVOL share),CN=File Replication Service,CN=System,DC=cmedia,D
    C=local
    and backlink on CN=CM-DC1-NY01,OU=Domain Controllers,DC=cmedia,DC=local are correct.
    ......................... CM-DC1-NY01 passed test VerifyReferences
    Starting test: VerifyReplicas
    ......................... CM-DC1-NY01 passed test VerifyReplicas
    Testing server: Default-First-Site-Name\CM-DC3-NY01
    Starting test: Advertising
    The DC CM-DC3-NY01 is advertising itself as a DC and having a DS.
    The DC CM-DC3-NY01 is advertising as an LDAP server
    The DC CM-DC3-NY01 is advertising as having a writeable directory
    The DC CM-DC3-NY01 is advertising as a Key Distribution Center
    The DC CM-DC3-NY01 is advertising as a time server
    The DS CM-DC3-NY01 is advertising as a GC.
    ......................... CM-DC3-NY01 passed test Advertising
    Starting test: CheckSecurityError
    * Dr Auth: Beginning security errors check!
    Found KDC CM-DC1-NY01 for domain cmedia.local in site Default-First-Site-Name
    Checking machine account for DC CM-DC3-NY01 on DC CM-DC1-NY01.
    * SPN found :LDAP/CM-DC3-NY01.cmedia.local/cmedia.local
    * SPN found :LDAP/CM-DC3-NY01.cmedia.local
    * SPN found :LDAP/CM-DC3-NY01
    * SPN found :LDAP/CM-DC3-NY01.cmedia.local/cmedia
    * SPN found :LDAP/5e9d1971-39ca-484c-922d-411c2364c96e._msdcs.cmedia.local
    * SPN found :E3514235-4B06-11D1-AB04-00C04FC2DCD2/5e9d1971-39ca-484c-922d-411c2364c96e/cmedia.local
    * SPN found :HOST/CM-DC3-NY01.cmedia.local/cmedia.local
    * SPN found :HOST/CM-DC3-NY01.cmedia.local
    * SPN found :HOST/CM-DC3-NY01
    * SPN found :HOST/CM-DC3-NY01.cmedia.local/cmedia
    * SPN found :GC/CM-DC3-NY01.cmedia.local/cmedia.local
    Checking for CN=CM-DC3-NY01,OU=Domain Controllers,DC=cmedia,DC=local in domain DC=cmedia,DC=local o
    n 2 servers
    Object is up-to-date on all servers.
    [CM-DC3-NY01] No security related replication errors were found on this DC! To target the connection to a
    specific source DC use /ReplSource:<DC>.
    ......................... CM-DC3-NY01 passed test CheckSecurityError
    Starting test: CutoffServers
    * Configuration Topology Aliveness Check
    * Analyzing the alive system replication topology for DC=ForestDnsZones,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the alive system replication topology for DC=DomainDnsZones,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the alive system replication topology for CN=Schema,CN=Configuration,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the alive system replication topology for CN=Configuration,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the alive system replication topology for DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    ......................... CM-DC3-NY01 passed test CutoffServers
    Starting test: FrsEvent
    * The File Replication Service Event log test
    ......................... CM-DC3-NY01 passed test FrsEvent
    Starting test: DFSREvent
    The DFS Replication Event Log.
    Skip the test because the server is running FRS.
    ......................... CM-DC3-NY01 passed test DFSREvent
    Starting test: SysVolCheck
    * The File Replication Service SYSVOL ready test
    File Replication Service's SYSVOL is ready
    ......................... CM-DC3-NY01 passed test SysVolCheck
    Starting test: FrsSysVol
    * The File Replication Service SYSVOL ready test
    File Replication Service's SYSVOL is ready
    ......................... CM-DC3-NY01 passed test FrsSysVol
    Starting test: KccEvent
    * The KCC Event log test
    Found no KCC errors in "Directory Service" Event log in the last 15 minutes.
    ......................... CM-DC3-NY01 passed test KccEvent
    Starting test: KnowsOfRoleHolders
    Role Schema Owner = CN=NTDS Settings,CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Confi
    guration,DC=cmedia,DC=local
    Role Domain Owner = CN=NTDS Settings,CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Confi
    guration,DC=cmedia,DC=local
    Role PDC Owner = CN=NTDS Settings,CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configur
    ation,DC=cmedia,DC=local
    Role Rid Owner = CN=NTDS Settings,CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configur
    ation,DC=cmedia,DC=local
    Role Infrastructure Update Owner = CN=NTDS Settings,CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN
    =Sites,CN=Configuration,DC=cmedia,DC=local
    ......................... CM-DC3-NY01 passed test KnowsOfRoleHolders
    Starting test: MachineAccount
    Checking machine account for DC CM-DC3-NY01 on DC CM-DC3-NY01.
    * SPN found :LDAP/CM-DC3-NY01.cmedia.local/cmedia.local
    * SPN found :LDAP/CM-DC3-NY01.cmedia.local
    * SPN found :LDAP/CM-DC3-NY01
    * SPN found :LDAP/CM-DC3-NY01.cmedia.local/cmedia
    * SPN found :LDAP/5e9d1971-39ca-484c-922d-411c2364c96e._msdcs.cmedia.local
    * SPN found :E3514235-4B06-11D1-AB04-00C04FC2DCD2/5e9d1971-39ca-484c-922d-411c2364c96e/cmedia.local
    * SPN found :HOST/CM-DC3-NY01.cmedia.local/cmedia.local
    * SPN found :HOST/CM-DC3-NY01.cmedia.local
    * SPN found :HOST/CM-DC3-NY01
    * SPN found :HOST/CM-DC3-NY01.cmedia.local/cmedia
    * SPN found :GC/CM-DC3-NY01.cmedia.local/cmedia.local
    ......................... CM-DC3-NY01 passed test MachineAccount
    Starting test: NCSecDesc
    * Security Permissions check for all NC's on DC CM-DC3-NY01.
    The forest is not ready for RODC. Will skip checking ERODC ACEs.
    * Security Permissions Check for
    DC=ForestDnsZones,DC=cmedia,DC=local
    (NDNC,Version 3)
    * Security Permissions Check for
    DC=DomainDnsZones,DC=cmedia,DC=local
    (NDNC,Version 3)
    * Security Permissions Check for
    CN=Schema,CN=Configuration,DC=cmedia,DC=local
    (Schema,Version 3)
    * Security Permissions Check for
    CN=Configuration,DC=cmedia,DC=local
    (Configuration,Version 3)
    * Security Permissions Check for
    DC=cmedia,DC=local
    (Domain,Version 3)
    ......................... CM-DC3-NY01 passed test NCSecDesc
    Starting test: NetLogons
    * Network Logons Privileges Check
    Verified share \\CM-DC3-NY01\netlogon
    Verified share \\CM-DC3-NY01\sysvol
    ......................... CM-DC3-NY01 passed test NetLogons
    Starting test: ObjectsReplicated
    CM-DC3-NY01 is in domain DC=cmedia,DC=local
    Checking for CN=CM-DC3-NY01,OU=Domain Controllers,DC=cmedia,DC=local in domain DC=cmedia,DC=local o
    n 3 servers
    Object is up-to-date on all servers.
    Checking for CN=NTDS Settings,CN=CM-DC3-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuratio
    n,DC=cmedia,DC=local in domain CN=Configuration,DC=cmedia,DC=local on 3 servers
    Object is up-to-date on all servers.
    ......................... CM-DC3-NY01 passed test ObjectsReplicated
    Starting test: OutboundSecureChannels
    * The Outbound Secure Channels test
    ** Did not run Outbound Secure Channels test because /testdomain: was not entered
    ......................... CM-DC3-NY01 passed test OutboundSecureChannels
    Starting test: Replications
    * Replications Check
    * Replication Latency Check
    DC=ForestDnsZones,DC=cmedia,DC=local
    Latency information for 4 entries in the vector were ignored.
    4 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's
    no longer replicating this nc. 0 had no latency information (Win2K DC).
    DC=DomainDnsZones,DC=cmedia,DC=local
    Latency information for 4 entries in the vector were ignored.
    4 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's
    no longer replicating this nc. 0 had no latency information (Win2K DC).
    CN=Schema,CN=Configuration,DC=cmedia,DC=local
    Latency information for 4 entries in the vector were ignored.
    4 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's
    no longer replicating this nc. 0 had no latency information (Win2K DC).
    CN=Configuration,DC=cmedia,DC=local
    Latency information for 4 entries in the vector were ignored.
    4 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's
    no longer replicating this nc. 0 had no latency information (Win2K DC).
    DC=cmedia,DC=local
    Latency information for 4 entries in the vector were ignored.
    4 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's
    no longer replicating this nc. 0 had no latency information (Win2K DC).
    ......................... CM-DC3-NY01 passed test Replications
    Starting test: RidManager
    * Available RID Pool for the Domain is 16109 to 1073741823
    * CM-DC1-NY01.cmedia.local is the RID Master
    * DsBind with RID Master was successful
    * rIDAllocationPool is 15109 to 15608
    * rIDPreviousAllocationPool is 15109 to 15608
    * rIDNextRID: 15110
    ......................... CM-DC3-NY01 passed test RidManager
    Starting test: Services
    * Checking Service: EventSystem
    * Checking Service: RpcSs
    * Checking Service: NTDS
    * Checking Service: DnsCache
    * Checking Service: NtFrs
    * Checking Service: IsmServ
    * Checking Service: kdc
    * Checking Service: SamSs
    * Checking Service: LanmanServer
    * Checking Service: LanmanWorkstation
    * Checking Service: w32time
    * Checking Service: NETLOGON
    ......................... CM-DC3-NY01 passed test Services
    Starting test: SystemLog
    * The System Event log test
    Found no errors in "System" Event log in the last 60 minutes.
    ......................... CM-DC3-NY01 passed test SystemLog
    Starting test: Topology
    * Configuration Topology Integrity Check
    * Analyzing the connection topology for DC=ForestDnsZones,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the connection topology for DC=DomainDnsZones,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the connection topology for CN=Schema,CN=Configuration,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the connection topology for CN=Configuration,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the connection topology for DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    ......................... CM-DC3-NY01 passed test Topology
    Starting test: VerifyEnterpriseReferences
    ......................... CM-DC3-NY01 passed test VerifyEnterpriseReferences
    Starting test: VerifyReferences
    The system object reference (serverReference) CN=CM-DC3-NY01,OU=Domain Controllers,DC=cmedia,DC=local
    and backlink on
    CN=CM-DC3-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=cmedia,DC=local are
    correct.
    The system object reference (serverReferenceBL)
    CN=CM-DC3-NY01,CN=Domain System Volume (SYSVOL share),CN=File Replication Service,CN=System,DC=cmedia,D
    C=local
    and backlink on
    CN=NTDS Settings,CN=CM-DC3-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=chiefmed
    ia,DC=local
    are correct.
    The system object reference (frsComputerReferenceBL)
    CN=CM-DC3-NY01,CN=Domain System Volume (SYSVOL share),CN=File Replication Service,CN=System,DC=cmedia,D
    C=local
    and backlink on CN=CM-DC3-NY01,OU=Domain Controllers,DC=cmedia,DC=local are correct.
    ......................... CM-DC3-NY01 passed test VerifyReferences
    Starting test: VerifyReplicas
    ......................... CM-DC3-NY01 passed test VerifyReplicas
    Testing server: Default-First-Site-Name\CM-DC4-NY01
    Starting test: Advertising
    The DC CM-DC4-NY01 is advertising itself as a DC and having a DS.
    The DC CM-DC4-NY01 is advertising as an LDAP server
    The DC CM-DC4-NY01 is advertising as having a writeable directory
    The DC CM-DC4-NY01 is advertising as a Key Distribution Center
    The DC CM-DC4-NY01 is advertising as a time server
    The DS CM-DC4-NY01 is advertising as a GC.
    ......................... CM-DC4-NY01 passed test Advertising
    Starting test: CheckSecurityError
    * Dr Auth: Beginning security errors check!
    Found KDC CM-DC1-NY01 for domain cmedia.local in site Default-First-Site-Name
    Checking machine account for DC CM-DC4-NY01 on DC CM-DC1-NY01.
    * SPN found :LDAP/CM-DC4-NY01.cmedia.local/cmedia.local
    * SPN found :LDAP/CM-DC4-NY01.cmedia.local
    * SPN found :LDAP/CM-DC4-NY01
    * SPN found :LDAP/CM-DC4-NY01.cmedia.local/cmedia
    * SPN found :LDAP/37830012-1f10-43c9-a0ff-2a0e8a912187._msdcs.cmedia.local
    * SPN found :E3514235-4B06-11D1-AB04-00C04FC2DCD2/37830012-1f10-43c9-a0ff-2a0e8a912187/cmedia.local
    * SPN found :HOST/CM-DC4-NY01.cmedia.local/cmedia.local
    * SPN found :HOST/CM-DC4-NY01.cmedia.local
    * SPN found :HOST/CM-DC4-NY01
    * SPN found :HOST/CM-DC4-NY01.cmedia.local/cmedia
    * SPN found :GC/CM-DC4-NY01.cmedia.local/cmedia.local
    Checking for CN=CM-DC4-NY01,OU=Domain Controllers,DC=cmedia,DC=local in domain DC=cmedia,DC=local o
    n 2 servers
    Object is up-to-date on all servers.
    [CM-DC4-NY01] No security related replication errors were found on this DC! To target the connection to a
    specific source DC use /ReplSource:<DC>.
    ......................... CM-DC4-NY01 passed test CheckSecurityError
    Starting test: CutoffServers
    * Configuration Topology Aliveness Check
    * Analyzing the alive system replication topology for DC=ForestDnsZones,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the alive system replication topology for DC=DomainDnsZones,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the alive system replication topology for CN=Schema,CN=Configuration,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the alive system replication topology for CN=Configuration,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the alive system replication topology for DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    ......................... CM-DC4-NY01 passed test CutoffServers
    Starting test: FrsEvent
    * The File Replication Service Event log test
    ......................... CM-DC4-NY01 passed test FrsEvent
    Starting test: DFSREvent
    The DFS Replication Event Log.
    Skip the test because the server is running FRS.
    ......................... CM-DC4-NY01 passed test DFSREvent
    Starting test: SysVolCheck
    * The File Replication Service SYSVOL ready test
    File Replication Service's SYSVOL is ready
    ......................... CM-DC4-NY01 passed test SysVolCheck
    Starting test: FrsSysVol
    * The File Replication Service SYSVOL ready test
    File Replication Service's SYSVOL is ready
    ......................... CM-DC4-NY01 passed test FrsSysVol
    Starting test: KccEvent
    * The KCC Event log test
    Found no KCC errors in "Directory Service" Event log in the last 15 minutes.
    ......................... CM-DC4-NY01 passed test KccEvent
    Starting test: KnowsOfRoleHolders
    Role Schema Owner = CN=NTDS Settings,CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Confi
    guration,DC=cmedia,DC=local
    Role Domain Owner = CN=NTDS Settings,CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Confi
    guration,DC=cmedia,DC=local
    Role PDC Owner = CN=NTDS Settings,CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configur
    ation,DC=cmedia,DC=local
    Role Rid Owner = CN=NTDS Settings,CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configur
    ation,DC=cmedia,DC=local
    Role Infrastructure Update Owner = CN=NTDS Settings,CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN
    =Sites,CN=Configuration,DC=cmedia,DC=local
    ......................... CM-DC4-NY01 passed test KnowsOfRoleHolders
    Starting test: MachineAccount
    Checking machine account for DC CM-DC4-NY01 on DC CM-DC4-NY01.
    * SPN found :LDAP/CM-DC4-NY01.cmedia.local/cmedia.local
    * SPN found :LDAP/CM-DC4-NY01.cmedia.local
    * SPN found :LDAP/CM-DC4-NY01
    * SPN found :LDAP/CM-DC4-NY01.cmedia.local/cmedia
    * SPN found :LDAP/37830012-1f10-43c9-a0ff-2a0e8a912187._msdcs.cmedia.local
    * SPN found :E3514235-4B06-11D1-AB04-00C04FC2DCD2/37830012-1f10-43c9-a0ff-2a0e8a912187/cmedia.local
    * SPN found :HOST/CM-DC4-NY01.cmedia.local/cmedia.local
    * SPN found :HOST/CM-DC4-NY01.cmedia.local
    * SPN found :HOST/CM-DC4-NY01
    * SPN found :HOST/CM-DC4-NY01.cmedia.local/cmedia
    * SPN found :GC/CM-DC4-NY01.cmedia.local/cmedia.local
    ......................... CM-DC4-NY01 passed test MachineAccount
    Starting test: NCSecDesc
    * Security Permissions check for all NC's on DC CM-DC4-NY01.
    The forest is not ready for RODC. Will skip checking ERODC ACEs.
    * Security Permissions Check for
    DC=ForestDnsZones,DC=cmedia,DC=local
    (NDNC,Version 3)
    * Security Permissions Check for
    DC=DomainDnsZones,DC=cmedia,DC=local
    (NDNC,Version 3)
    * Security Permissions Check for
    CN=Schema,CN=Configuration,DC=cmedia,DC=local
    (Schema,Version 3)
    * Security Permissions Check for
    CN=Configuration,DC=cmedia,DC=local
    (Configuration,Version 3)
    * Security Permissions Check for
    DC=cmedia,DC=local
    (Domain,Version 3)
    ......................... CM-DC4-NY01 passed test NCSecDesc
    Starting test: NetLogons
    * Network Logons Privileges Check
    Verified share \\CM-DC4-NY01\netlogon
    Verified share \\CM-DC4-NY01\sysvol
    ......................... CM-DC4-NY01 passed test NetLogons
    Starting test: ObjectsReplicated
    CM-DC4-NY01 is in domain DC=cmedia,DC=local
    Checking for CN=CM-DC4-NY01,OU=Domain Controllers,DC=cmedia,DC=local in domain DC=cmedia,DC=local o
    n 3 servers
    Object is up-to-date on all servers.
    Checking for CN=NTDS Settings,CN=CM-DC4-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuratio
    n,DC=cmedia,DC=local in domain CN=Configuration,DC=cmedia,DC=local on 3 servers
    Object is up-to-date on all servers.
    ......................... CM-DC4-NY01 passed test ObjectsReplicated
    Starting test: OutboundSecureChannels
    * The Outbound Secure Channels test
    ** Did not run Outbound Secure Channels test because /testdomain: was not entered
    ......................... CM-DC4-NY01 passed test OutboundSecureChannels
    Starting test: Replications
    * Replications Check
    * Replication Latency Check
    DC=ForestDnsZones,DC=cmedia,DC=local
    Latency information for 4 entries in the vector were ignored.
    4 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's
    no longer replicating this nc. 0 had no latency information (Win2K DC).
    DC=DomainDnsZones,DC=cmedia,DC=local
    Latency information for 4 entries in the vector were ignored.
    4 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's
    no longer replicating this nc. 0 had no latency information (Win2K DC).
    CN=Schema,CN=Configuration,DC=cmedia,DC=local
    Latency information for 4 entries in the vector were ignored.
    4 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's
    no longer replicating this nc. 0 had no latency information (Win2K DC).
    CN=Configuration,DC=cmedia,DC=local
    Latency information for 4 entries in the vector were ignored.
    4 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's
    no longer replicating this nc. 0 had no latency information (Win2K DC).
    DC=cmedia,DC=local
    Latency information for 4 entries in the vector were ignored.
    4 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's
    no longer replicating this nc. 0 had no latency information (Win2K DC).
    ......................... CM-DC4-NY01 passed test Replications
    Starting test: RidManager
    * Available RID Pool for the Domain is 16109 to 1073741823
    * CM-DC1-NY01.cmedia.local is the RID Master
    * DsBind with RID Master was successful
    * rIDAllocationPool is 15609 to 16108
    * rIDPreviousAllocationPool is 15609 to 16108
    * rIDNextRID: 15609
    ......................... CM-DC4-NY01 passed test RidManager
    Starting test: Services
    * Checking Service: EventSystem
    * Checking Service: RpcSs
    * Checking Service: NTDS
    * Checking Service: DnsCache
    * Checking Service: NtFrs
    * Checking Service: IsmServ
    * Checking Service: kdc
    * Checking Service: SamSs
    * Checking Service: LanmanServer
    * Checking Service: LanmanWorkstation
    * Checking Service: w32time
    * Checking Service: NETLOGON
    ......................... CM-DC4-NY01 passed test Services
    Starting test: SystemLog
    * The System Event log test
    Found no errors in "System" Event log in the last 60 minutes.
    ......................... CM-DC4-NY01 passed test SystemLog
    Starting test: Topology
    * Configuration Topology Integrity Check
    * Analyzing the connection topology for DC=ForestDnsZones,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the connection topology for DC=DomainDnsZones,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the connection topology for CN=Schema,CN=Configuration,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the connection topology for CN=Configuration,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the connection topology for DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    ......................... CM-DC4-NY01 passed test Topology
    Starting test: VerifyEnterpriseReferences
    ......................... CM-DC4-NY01 passed test VerifyEnterpriseReferences
    Starting test: VerifyReferences
    The system object reference (serverReference) CN=CM-DC4-NY01,OU=Domain Controllers,DC=cmedia,DC=local
    and backlink on
    CN=CM-DC4-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=cmedia,DC=local are
    correct.
    The system object reference (serverReferenceBL)
    CN=CM-DC4-NY01,CN=Domain System Volume (SYSVOL share),CN=File Replication Service,CN=System,DC=cmedia,D
    C=local
    and backlink on
    CN=NTDS Settings,CN=CM-DC4-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=chiefmed
    ia,DC=local
    are correct.
    The system object reference (frsComputerReferenceBL)
    CN=CM-DC4-NY01,CN=Domain System Volume (SYSVOL share),CN=File Replication Service,CN=System,DC=cmedia,D
    C=local
    and backlink on CN=CM-DC4-NY01,OU=Domain Controllers,DC=cmedia,DC=local are correct.
    ......................... CM-DC4-NY01 passed test VerifyReferences
    Starting test: VerifyReplicas
    ......................... CM-DC4-NY01 passed test VerifyReplicas

  • Certificate Authority cannot find domain controller

    I recently started working for a company that has an offline CAROOT server and an online CASUB server. Prior to my arrival, the old 2008 DCs were replaced with new 2012 DCs, in a proper upgrade. After the new DCs worked, the old ones were demoted, shut down
    and eventually deleted.
    Unfortunately, it looks like one of the things that was missed was the re-jigging of the certificate authority to the new domain controller(s), such that after a few months, the CDP Locations have expired (they point at the correct location, the CASUB server).
    When I check the Manage AD Containers entry, I can see that the RootCA is now showing as "Untrusted Root" and all the entries in the CDP Container show as Expired.
    Is there an easy way to repair this (the old DCs can not be spun up again, they are gone), or will I need to set up an all new certificate infrastructure?
    We use certificates to determine what workstations are allowed on the network infrastructure (the Cisco switch ports exa, while workstations currently have unexpired certificates, they can still access the network, but when they start to expire, we will
    have workstations unable to connect to the network.
    I am fairly new to managing certificates and authorities.

    Hi Michael,
    the CDP Locations have expired (they point at the correct location, the CASUB server).
    You can publish a new CRL by right click on Revoked Certificates container.
    More information for you:
    How to Publish New Certificate Revocation List (CRL) from Offline Root CA to Active Directory and Inetpub
    http://social.technet.microsoft.com/wiki/contents/articles/19160.how-to-publish-new-certificate-revocation-list-crl-from-offline-root-ca-to-active-directory-and-inetpub.aspx
    Specify CRL Distribution Points
    https://technet.microsoft.com/en-us/library/cc753296.aspx
    Best Regards,
    Amy
    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

  • Provision Search in SharePoint Foundation 2013 without Domain Controller / Active Directory - Domain accounts

    Hi,
    I have successfully setup SharePoint Foundation 2013 as single server farm with SQL Server Standard database in a DMZ environment using local accounts since DMZ doesn't have an Active Directory and hence Domain accounts using powershell as described
    in https://theblobfarm.wordpress.com/2012/12/03/installing-sharepoint-2013-without-a-domain-controller 
    When I run Farm configuration wizard to provision search service application, I get an error:
    ERROR: "The service application(s) for the service "Search Service Application" could not be provisioned because of the following error: I/O error occurred."
    The log file logged the details of this error as:
    ERROR: "Failed to create file share Analytics_e441aa1c-1a8d-4f0a-a079-58b499eb4c50 at D:\SharePoint Search\Office Server\Analytics_e441aa1c-1a8d-4f0a-a079-58b499eb4c50 (System.ArgumentException: The SDDL string contains an invalid sid or a sid
    that cannot be translated."
    After investigation, I found that potentially the error could be because the timer service is trying to setup a network share for analytics component (as part of provisioning search). It is trying to setup that share with a domain account that happens to
    be a local user instead in this case and fails with error “System.ArgumentException: The SDDL string contains an invalid sid or a sid that cannot be translated”.
    I got some pointer from the below thread
    https://social.technet.microsoft.com/Forums/en-US/c8e93984-f4e5-46da-8e8a-c5c79ea1ff62/error-creating-search-service-application-on-sharepoint-foundation-with-local-account?forum=sharepointadmin
    However, the above thread doesn't state that the solution worked.
    I have tried creating share manually for Analytics_<Guid> folder but it doesn't work since every time farm configuration wizards is run it creates a new Analytics_<Guid> folder.
    Since, I have setup SharePoint Foundation 2013 on a production environment I cannot test and trial various solutions.
    Can some please guide me on how to successfully provision search for SharePoint Foundation 2013 setup as a single server farm with SQL Server Standard database in a DMZ environment using local accounts (without Active Directory - domain accounts).
    Thanks in advance.
    Himanshu

    Microsoft documentation doesn't always specifically call out all products (Project Server isn't there, either). But it does apply. You'll need to stand up at least one Domain Controller, or allow port access back to a DC.
    Preferably, set up SharePoint on the internal network and use a reverse proxy (which will terminate client connections at the reverse proxy) present in the DMZ.
    Trevor Seward
    Follow or contact me at...
    &nbsp&nbsp
    This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

  • Windows Domain Controller on Windows Server 2012 R2: Hyper-V roaming profiles not loading due to slow connection

    I have racked my brain and done everything that I know to do for about two weeks now.  I am setting up a new system at our fire department and I am having the worst luck with getting the workstations to login to the domain controller with roaming
    profiles.  It keeps telling me that the roaming profile could not be loaded because of a slow connection.  These are workstations that are connected directly to the switch that the DC is connected to.  I have tried multiple connections regarding
    the layout (DC into the router, router into the switch).  The router is a Cisco RV220W.  I have two VLANS, one for public and one for private domain.  The Private VLAN has DHCP turned off since I am providing it through the DC.  I currently
    have a connection from the Private VLAN going to the unmanaged switch that the workstations and server are plugged into.
    The server is a Dell PowerEdge R420 that has 6 NIC ports (1 dual port and 1 quad port).  I have a virtual switch setup on Hyper-V for an external port (let's say Card 2 Port 3) that is assigned to the WS 2012R2 Domain Controller.  The DC can see
    the internet fine and the workstations can connect to the shared folders on the server.  I can retrieve files by just using the computer name or FQDN.  The DC is also running DNS and DHCP.  The DNS has the _msdcs setup from when I installed
    the active directory role.  I have attempted to assign static IP addresses to the workstations:
    IP:                     10.0.0.80
    Subnet:             255.255.255.0
    IPV4 Gateway:  10.0.0.1
    IPV4 DNS:        10.0.0.12
    I've attempted "append the specific DNS suffix", I've "registered the connection in DNS", I've used "use this connections suffix in DNS registration".
    The server is assigned:
    IP:                     10.0.0.12
    Subnet:             255.255.255.0
    IPV4 Gateway:  10.0.0.1
    IPV4 DNS:         10.0.0.12
    The DNS entries have forwarders that forward to my ISP DNS servers for lookup
    I've enabled and disabled DHCP, I've installed a new VM just to create another DC to make sure that I didn't goof up when I created it.
    I've lost my patience with this project and am sinking fast.  Can someone please offer some advice as to what I've done wrong?  I've created this exact scenario at work many times but, I've never done it with Windows Server 2012.  Is this
    possibly something to do with the Dell PowerEdge server (Generation 12) with the SR-IOV?  I am going to attempt to work on it some more tomorrow when I get over there.  I think there may be an issue with the SR-IOV not being enabled on the machine
    through the Dell Bios.  Would the SR-IOV really cause the workstations to report a slow connection?  When I login at the domain controller the roaming profiles and folder redirection work fine so, I know the GPO settings are correct.  I don't
    have "ignore slow connections" or any of those GPO's set.  I need to get it working the correct way so, I didn't want to fool the server when there is another underlying problem.  Any help that someone can offer, I am more than willing
    to listen.  If you need more information, please ask.
    Thanks,
    Jay

    So, I've managed to research this some more since Thursday and I've come to the conclusion that Hyper-V does a horrible job of supporting Qualcomm NIC cards. That's the only thing I can conclude as far as where the issue is originating. I've read many
    post and walkthroughs but nothing that has helped. The issue wasn't with any settings in the domain controller. The issue was that there really is a slow connection originating at the domain controller that is a VM and has network connectivity through the
    virtual switch from Hyper-V. So, next question is, how do I get the DC to have better connectivity through the NIC that Hyper-V won't give it? If hyper-v would allow passthrough, this would be so much simpler. VM-ware is looking really good at this point.
    Im disappointed in MS right now.

  • Cannot Login to Read Only Domain Controller

    One of my Read Only Domain Controller Servers shut down unexpectedly due to a power outage and now I cannot login to it anymore. When the server powered on again, it came up with an error regarding on of the hard drives failing (RAID1)
    I get a message Access is Denied when I try to login with one of my domain admin accounts. As it is a RODC, there are no local accounts for me to use. The RODC is running on Windows Server 2008 R2. The server is also running as a DHCP/Print/File server for
    the office so these are not working as well.
    I checked my PDC and it is coming up with the following error in the event viewer
    Log Name: System
    Source: Security-Kerberos
    Event ID: 4
    Level: Error
    The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server rodc01$. The target name used was domain/rodc01.domain.local. This indicates that the target server failed to decrypt
    the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Please ensure that the target SPN is registered on, and only registered on, the account
    used by the server. This error can also happen when the target service is using a different password for the target service account than what the Kerberos Key Distribution Center (KDC) has for the target service account. Please ensure that the service on the
    server and the KDC are both updated to use the current password. If the server name is not fully qualified, and the target domain (domain.local) is different from the client domain (domain.local), check if there are identically named server accounts in these
    two domains, or use the fully-qualified name to identify the server.
    I have tried to reset the computer password with netdom but I get the following error
    netdom resetpwd /server:rodc01 /userd:administrator /passwordd:*
    The machine account password for the local machine could not be reset.
    Logon Failure: The target account name is incorrect.
    The command failed to complete successfully.
    If I try to reset the password using the IP address instead, I get the following error
    netdom resetpwd /server:192.168.10.1 /userd:administrator /passwordd:*
    The machine account password for the local machine could not be reset.
    Access is denied.
    The command failed to complete successfully.
    I checked my AD and DNS and the rodc object  is present
    If I run repadmin /replsum on the PDC I get the message for the faulty RODC server
    Experienced the following operational errors trying to retrieve replication information:
            8341 – rodc01.domain.local
    Any advice is appreciated
    Thanks

    Logon to the server in Directory Services Restore Mode (DSRM) using the password you supplied during DCPROMO and verify that the Active Directory database isn't corrupted on the RODC - You will most likely see indications on this in the Directory
    Services log.
    Enfo Zipper
    Christoffer Andersson – Principal Advisor
    http://blogs.chrisse.se - Directory Services Blog

  • The KDC encountered duplicate names while processing a Kerberos authentication request in a Domain controller server

    HI
    we have a sharepoint farm and in domain controller server, this error is in event viewer
    Log Name:      System
    Source:        Microsoft-Windows-Kerberos-Key-Distribution-Center
    Date:          9/15/2014 10:44:15 PM
    Event ID:      11
    Task Category: None
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      XXXAPP01.xxxportal.com
    Description:
    The KDC encountered duplicate names while processing a Kerberos authentication request. The duplicate name is HTTP/XXXWFE01.xxxportal.com (of type DS_SERVICE_PRINCIPAL_NAME). This may result in authentication failures or downgrades to NTLM. In order to prevent
    this from occuring remove the duplicate entries for HTTP/XXXWFE01.xxxportal.com in Active Directory.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-Kerberos-Key-Distribution-Center" Guid="{3FD9DA1A-5A54-46C5-9A26-9BD7C0685056}" EventSourceName="KDC" />
        <EventID Qualifiers="49152">11</EventID>
        <Version>0</Version>
        <Level>2</Level>
        <Task>0</Task>
        <Opcode>0</Opcode>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2014-09-15T19:44:15.000000000Z" />
        <EventRecordID>131824</EventRecordID>
        <Correlation />
        <Execution ProcessID="0" ThreadID="0" />
        <Channel>System</Channel>
        <Computer>XXXAPP01.xxxportal.com</Computer>
        <Security />
      </System>
      <EventData>
        <Data Name="Name">HTTP/XXXWFE01.xxxportal.com</Data>
        <Data Name="Type">DS_SERVICE_PRINCIPAL_NAME</Data>
        <Binary>
        </Binary>
      </EventData>
    </Event>
    adil

    Hi adil,
    Service principal names (SPNs) are stored as a property of the associated account object in Active Directory
    Domain Services (AD DS). I noticed that you have used setpn –X to identify the duplicate SPN. Please refer to following articles and check if help you to solve this issue.
    Event ID 11 — Service Principal
    Name Configuration
    Event ID 11 in the System log of domain controllers
    Please also refer to following article and check if can help you.
    The problem with duplicate SPNs
    Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft
    does not guarantee the accuracy of this information.
    If any update, please feel free to let me know.
    Hope this helps.
    Best regards,
    Justin Gu

Maybe you are looking for