Domain Controller Setup

I work for a small utility company, and our General Manager has requested that I setup a domain environment.  I have two servers, both will be running Windows Server 2012 R2 Standard.  We will not be running Exchange. I have never done this
before, so I just wanted to ask the pros out there a few questions.  
My first question is, how should I RAID the two servers?  What partitions need to be created for a smooth running environment?  Also, should my second server be the file/printer sharing server?  I'm am searching the web looking for information
too, so any help would be greatly appreciated.  Thank you!

hi wbppd,
please find this technet article I think it will help you in installing domain :
http://social.technet.microsoft.com/wiki/contents/articles/22622.building-your-first-domain-controller-on-2012-r2.aspx
also this video will help you:
https://www.youtube.com/watch?v=50VhoeG_6rY#aid=P-dMJtBrsxE
regarding the RAID configuration most of Administrators preferred to use RAID1 in DCs but no problem in using any other RAID configuration.
regarding your 2nd server, it is recommended to have at least two domain controllers in your domain, so if it will be DC it is not recommended to be used in file/printer server, but it is doable
Hamed Abdelraof, System Supervisor RayaContactCenter, Egypt

Similar Messages

  • Install Domain Controller, Active Directory, RemoteApps on Single Server?

    Have a server that I want to experiment with RemoteApps.   Documentation I have read state you need to have a Domain Controller setup with AD on one server, and have a second server to install all the RemoteApps requirements. Is this true or can
    this all be done on one server.
    If I need a separate server for the Domain Controller and Active Directory, can I assume that a low end server would be sufficient?  Or would using Hyper-V with a single hardware server and create two virtual machines: one as the DC/AD, and the other
    to run Remote Apps be a possible solution.  Any advice?

    it really depends to be honest. I'd probably go something like this though:
    One Small physical server to act as a domain controller - you could put DHCP on this too
    One or Two physical, quite powerful servers to act as Hyper-V hosts - these can be domain joined. 
    Then for your VM's create the following:
    1 x additional domain controller
    For remote desktop services:
    1 x Remote Desktop Session Host
    1 x Connection Broker
    1 x Gateway and web server
    For additional services
    1 or 2 x Exchange
    1 x sharepoint
    1 x IIS
    but it really depends what you want to achieve. 
    The benefit from Virtual machines is that you can keep separate virtual servers for separate applications. 
    If you have two hosts you could then replicate the virtual machines between them if you wanted some layer of fault tolerance. 
    Hope this helps you a bit more. And thanks for positive blog feedback - its appreciated. 
    Regards,
    Denis Cooper
    MCITP EA - MCT
    Help keep the forums tidy, if this has helped please mark it as an answer
    My Blog
    LinkedIn:

  • How to reset Windows 2008 R2 Domain Controller "Administrator" password?

    Hello Everyone,
    I have lost Administrator password for the following system:
    Windows 2008 R2
    Domain Controller setup on same machine
    Stand alone server - no workstations or other servers invovled
    I still have the "Directory Service Restore Password" but I don't think that helps me for lost Administrator password. I beleive I need to boot from an .iso file to gain access. I already tried "Offline NT Password & Registery Editor" and it has set
    Administrator password to (blank) but that is not allowing me access as it seems that I have to login to domain controller Administrator. So, how can I reset that password?
    Thanks

    It wasn't difficult to reset the domain password and I think Microsoft's policy of not providing an easy forward way is to create an
    illusion of security which is not there. Linux systems that are much more secure that MSFT software allow easy password reset when physical access is there so why not include the same tools in System Repair tools or using F8?
    Anyhow, this guide helped me reset the password in 5 minutes. Read the bottom of it to find the scripted / automatic version of the process:
    http://www.petri.co.il/reset_domain_admin_password_in_windows_server_2003_ad.htm
    Thanks,

  • Integrating a Domain controller into a small office setup

    So this is where I am:
    I am trying to integrate a windows 2012 server which I can use as my domain controller in our office and run active directory from it, then eventually group policy, wsus, microsoft deployments and windows deployment toolkits etc.
    However because our current Mitel 3300 phone system sets the phone DHCP I don't want to mess the current network arrangement up.
    This is the internal structure:
    Our internet router's IP address 172.16.21.1
    Mitel 3300 Box IP address 192.168.10.10
    Default gateway 192.168.0.1
    So our IP phones sit on the subnet of 192.168.10.xxx and our PC's grab IP's such as 192.168.0.xxx up to 192.168.0.254.
    What should I set my DHCP settings on the Domain controller to see the PC's on the current network, and or the DNS settings as I am fairly new to this.
    If I havent explained anything properly please let me know and I will provide more info, thanks.
    Jan

    are all devices on the same backbone with two different subnets on it?
    Are phone and computer both DHCP clients i.e. no have static addresses?
    In server 2012 r2 DHCP you have the ability to rules  so the phones can get ip addresses from the phone system and the computers can get ip addresses for the Domain controller.
    Are you sure the phone system is DHCP for both and not your firewall? with two network adapters? or phone system one and firewall another dhcp?
    typically if you phone system is giving out DHCP it would need two ip addresses and interfaces to be able to host both subnets.

  • Lack of Connectivty to Domain Controller - Domain Controller Access Issues Requires Repeated Reauthentication

    Sorry if my attempt to be thorough in my description may result in excessive and unnecessary information. 
    I'm running into some problems with a single server running WS 2012 R2 as a domain controller (AD and DNS) and I’m trying to figure out what the cause is. 
    The network has ~10 computers on it connected through a cable business gateway (running DHCP) which feeds 2 switches and a wireless router acting as a switch. (I also turned on remote services, but the end users aren’t using that until I get certificates
    setup.)
    For 6+ months everyone had access to the shared files and databases on each workstation without issue. 
    In the last month users would occasionally have to re-enter their credentials to get access to shared server folders despite being on a domain account already. 
    Last week one of the computers intermittently cannot gain access to the shared folders– entering the correct credentials just results in the credentials being requested again and again: There’s an error icon at the bottom saying that “there are currently
    no logon servers available to service the logon request”.  While access is rejected I’m still able to ping the DC both via its name and IPV4 address. 
    (Pinging via its name results in an IPv6 address in the response.) 
    Other network connectivity appears intact (able to browse the web, perform network discovery.)
    Things that ‘seem’ to allow access on this computer until the next failure:
    Entering a different domain username and password into the windows credentials request has allowed access a couple of times.
    Disconnecting and reconnecting the network cable allowed the original username to be used to log on (at least once.)
    After removing it from and then rejoining it to the domain (a few hours ago) it experienced the problem once more. Also, logging on with domain credentials created a TEMP user folder instead of the folder with the domain username. 
    Looking at the event logs, I notice there are quite a few warnings and errors reported regarding DC access on many of the computers; maybe this is normal?
    Most Problematic Computer:
    Event ID 8016:  System failed to register host A or AAAA resource records. (With an unknown Ipv6 and the server’s ipv4 address in the DNS server list.) 
    Event ID 131:  NtpClient unable to set a domain peer to use as a time source because of DNS resolution error on ‘Server.domain.local’ 
    ‘No such host is known.”
    Event ID 5719:  NETLOGON. This computer was not able to setup a secure session with a domain controller in the domain due …..: there are currently no logon servers available to service the logon request.
    And then pairs of: Event 1500: The Group Policy settings for the computer were processed successfully. There were no changes detected since the last successful processing of Group Policy. & Event 1054:
     The processing of Group Policy failed. Windows could not obtain the name of a domain controller. This could be caused by a name resolution failure. Verify your Domain Name System (DNS) is configured and working correctly.
    Event 1030:  The processing of Group Policy failed. Windows attempted to retrieve new Group Policy settings for this user or computer. Look in the details tab for error code and description. Windows will automatically retry this operation
    at the next refresh cycle. Computers joined to the domain must have proper name resolution and network connectivity to a domain controller for discovery of new Group Policy objects and settings. An event will be logged when Group Policy is successful.
    On the server I’ve run DCDIAG and DCDIAG /test:DNS and those all appeared to pass.
    Ipconfig/all from the server:
       Connection-specific DNS Suffix 
       Description . . . . . . . . . . . : Intel(R) Ethernet Connection I217-LM
       Physical Address. . . . . . . . . : FC-4D-D4-F2-A1-83
       DHCP Enabled. . . . . . . . . . . : No
       Autoconfiguration Enabled . . . . : Yes
       IPv6 Address. . . . . . . . . . . : 2601:8:a182:1100:b155:a0b0:892d:9ed5(Pref
    erred)
       Link-local IPv6 Address . . . . . : fe80::b155:a0b0:892d:9ed5%13(Preferred)
       IPv4 Address. . . . . . . . . . . : 10.1.10.42(Preferred)
       Subnet Mask . . . . . . . . . . . : 255.255.255.0
       Default Gateway . . . . . . . . . : fe80::abd:43ff:fe9a:ab47%13
     10.1.10.1
       DHCPv6 IAID . . . . . . . . . . . : 234638804
       DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1B-3F-7D-B9-68-05-CA-24-31-C4
       DNS Servers . . . . . . . . . . . : ::1
    127.0.0.1
       NetBIOS over Tcpip. . . . . . . . : Enabled
    Ipconfig/all from the problematic computer:
    Wireless LAN adapter Wi-Fi:
       Connection-specific DNS Suffix 
    . : wp.comcast.net
       Description . . . . . . . . . . . : Intel(R) Centrino(R) Wireless-N 6150
       Physical Address. . . . . . . . . : 40-25-C2-63-C2-B8
       DHCP Enabled. . . . . . . . . . . : Yes
       Autoconfiguration Enabled . . . . : Yes
       IPv6 Address. . . . . . . . . . . : 2601:8:a182:1100:8f5:1606:d0a8:6b25(Prefe
    rred)
       Temporary IPv6 Address. . . . . . : 2601:8:a182:1100:283e:f9e8:4841:6c50(Pref
    erred)
       Link-local IPv6 Address . . . . . : fe80::8f5:1606:d0a8:6b25%3(Preferred)
       IPv4 Address. . . . . . . . . . . : 10.1.10.31(Preferred)
       Subnet Mask . . . . . . . . . . . : 255.255.255.0
       Lease Obtained. . . . . . . . . . : Tuesday, March 10, 2015 9:19:02 AM
       Lease Expires . . . . . . . . . . : Tuesday, March 17, 2015 1:23:15 PM
       Default Gateway . . . . . . . . . : fe80::abd:43ff:fe9a:ab47%3
    10.1.10.1
       DHCP Server . . . . . . . . . . . : 10.1.10.1
       DHCPv6 IAID . . . . . . . . . . . : 54535618
       DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1B-15-6B-AA-F0-DE-F1-9C-07-D4
       DNS Servers . . . . . . . . . . . : 2001:558:feed::1
    2001:558:feed::2
                    10.1.10.42
       NetBIOS over Tcpip. . . . . . . . : Enabled
    Any thoughts? I was assuming it was a Domain Controller/DNS error, but I don't know where to check next.  Could a failing piece of hardware be the culprit? 
    Thanks,
     -JT

    Hi,
    According to the error you have posted.
    A Netlogon 5719 event indicates that the client component of Netlogon was unable to locate a DC for the domain it was trying to perform an operation against.
    Most of the time this is caused by network issues or name resolution (DNS/WINS) issues, you could refer to:
    Netlogon 5719 and the Disappearing Domain [Controller]
    http://blogs.technet.com/b/instan/archive/2008/09/18/netlogon-5719-and-the-disappearing-domain.aspx
    Did you refer to this KB article?
    Event ID 5719 is logged when you start a Domain Member
    http://support.microsoft.com/kb/938449
    Regards.
    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

  • Provision Search in SharePoint Foundation 2013 without Domain Controller / Active Directory - Domain accounts

    Hi,
    I have successfully setup SharePoint Foundation 2013 as single server farm with SQL Server Standard database in a DMZ environment using local accounts since DMZ doesn't have an Active Directory and hence Domain accounts using powershell as described
    in https://theblobfarm.wordpress.com/2012/12/03/installing-sharepoint-2013-without-a-domain-controller 
    When I run Farm configuration wizard to provision search service application, I get an error:
    ERROR: "The service application(s) for the service "Search Service Application" could not be provisioned because of the following error: I/O error occurred."
    The log file logged the details of this error as:
    ERROR: "Failed to create file share Analytics_e441aa1c-1a8d-4f0a-a079-58b499eb4c50 at D:\SharePoint Search\Office Server\Analytics_e441aa1c-1a8d-4f0a-a079-58b499eb4c50 (System.ArgumentException: The SDDL string contains an invalid sid or a sid
    that cannot be translated."
    After investigation, I found that potentially the error could be because the timer service is trying to setup a network share for analytics component (as part of provisioning search). It is trying to setup that share with a domain account that happens to
    be a local user instead in this case and fails with error “System.ArgumentException: The SDDL string contains an invalid sid or a sid that cannot be translated”.
    I got some pointer from the below thread
    https://social.technet.microsoft.com/Forums/en-US/c8e93984-f4e5-46da-8e8a-c5c79ea1ff62/error-creating-search-service-application-on-sharepoint-foundation-with-local-account?forum=sharepointadmin
    However, the above thread doesn't state that the solution worked.
    I have tried creating share manually for Analytics_<Guid> folder but it doesn't work since every time farm configuration wizards is run it creates a new Analytics_<Guid> folder.
    Since, I have setup SharePoint Foundation 2013 on a production environment I cannot test and trial various solutions.
    Can some please guide me on how to successfully provision search for SharePoint Foundation 2013 setup as a single server farm with SQL Server Standard database in a DMZ environment using local accounts (without Active Directory - domain accounts).
    Thanks in advance.
    Himanshu

    Microsoft documentation doesn't always specifically call out all products (Project Server isn't there, either). But it does apply. You'll need to stand up at least one Domain Controller, or allow port access back to a DC.
    Preferably, set up SharePoint on the internal network and use a reverse proxy (which will terminate client connections at the reverse proxy) present in the DMZ.
    Trevor Seward
    Follow or contact me at...
    &nbsp&nbsp
    This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

  • Windows Domain Controller on Windows Server 2012 R2: Hyper-V roaming profiles not loading due to slow connection

    I have racked my brain and done everything that I know to do for about two weeks now.  I am setting up a new system at our fire department and I am having the worst luck with getting the workstations to login to the domain controller with roaming
    profiles.  It keeps telling me that the roaming profile could not be loaded because of a slow connection.  These are workstations that are connected directly to the switch that the DC is connected to.  I have tried multiple connections regarding
    the layout (DC into the router, router into the switch).  The router is a Cisco RV220W.  I have two VLANS, one for public and one for private domain.  The Private VLAN has DHCP turned off since I am providing it through the DC.  I currently
    have a connection from the Private VLAN going to the unmanaged switch that the workstations and server are plugged into.
    The server is a Dell PowerEdge R420 that has 6 NIC ports (1 dual port and 1 quad port).  I have a virtual switch setup on Hyper-V for an external port (let's say Card 2 Port 3) that is assigned to the WS 2012R2 Domain Controller.  The DC can see
    the internet fine and the workstations can connect to the shared folders on the server.  I can retrieve files by just using the computer name or FQDN.  The DC is also running DNS and DHCP.  The DNS has the _msdcs setup from when I installed
    the active directory role.  I have attempted to assign static IP addresses to the workstations:
    IP:                     10.0.0.80
    Subnet:             255.255.255.0
    IPV4 Gateway:  10.0.0.1
    IPV4 DNS:        10.0.0.12
    I've attempted "append the specific DNS suffix", I've "registered the connection in DNS", I've used "use this connections suffix in DNS registration".
    The server is assigned:
    IP:                     10.0.0.12
    Subnet:             255.255.255.0
    IPV4 Gateway:  10.0.0.1
    IPV4 DNS:         10.0.0.12
    The DNS entries have forwarders that forward to my ISP DNS servers for lookup
    I've enabled and disabled DHCP, I've installed a new VM just to create another DC to make sure that I didn't goof up when I created it.
    I've lost my patience with this project and am sinking fast.  Can someone please offer some advice as to what I've done wrong?  I've created this exact scenario at work many times but, I've never done it with Windows Server 2012.  Is this
    possibly something to do with the Dell PowerEdge server (Generation 12) with the SR-IOV?  I am going to attempt to work on it some more tomorrow when I get over there.  I think there may be an issue with the SR-IOV not being enabled on the machine
    through the Dell Bios.  Would the SR-IOV really cause the workstations to report a slow connection?  When I login at the domain controller the roaming profiles and folder redirection work fine so, I know the GPO settings are correct.  I don't
    have "ignore slow connections" or any of those GPO's set.  I need to get it working the correct way so, I didn't want to fool the server when there is another underlying problem.  Any help that someone can offer, I am more than willing
    to listen.  If you need more information, please ask.
    Thanks,
    Jay

    So, I've managed to research this some more since Thursday and I've come to the conclusion that Hyper-V does a horrible job of supporting Qualcomm NIC cards. That's the only thing I can conclude as far as where the issue is originating. I've read many
    post and walkthroughs but nothing that has helped. The issue wasn't with any settings in the domain controller. The issue was that there really is a slow connection originating at the domain controller that is a VM and has network connectivity through the
    virtual switch from Hyper-V. So, next question is, how do I get the DC to have better connectivity through the NIC that Hyper-V won't give it? If hyper-v would allow passthrough, this would be so much simpler. VM-ware is looking really good at this point.
    Im disappointed in MS right now.

  • JRE 1.7 / Java Plug-in - Long delay in retrieving the applet File(JAR) due to a request to the Domain Controller(on port 53)

    Description:
    A specific group of users/customers (using Windows7 OS with IE and FireFox web browsers) are facing problems with retrieving the applet File, after they upgraded the JRE on the system(PC) to JRE 1.7.0_25-b17 from JRE version 1.6.0_29-b11.
    With JRE 1.7.0_25-b17 it is noticed that when the Java plugin requests for the applet File; it sends a request to the Domain Controller of the user, which causes a delay of 2 to 5 minutes and sometimes hangs. The problem occurs consistently.
    The current temporary workaround for this group of users is to use JRE version 1.6.0_29-b11.
    Problem analysis:
    To investigate the problem the below steps were executed:
    1) Collected the Java console outputbelow details from the user's system. (The complete output is not posted due to lengthy content, though can be added further to this post if required.)
    (a) Works fine with JRE version 1.6.0_29-b11. Kindly refer to Java console output in the code ‘section A’ towards the end of this post.
    (b) The problem occurs with problem with JRE version 1.7.0_25-b17. Kindly refer to Java console output in the code ‘section B’ towards the end of this post. The step where the problem is observed, is indicated as(##<comment>##).
    2) The network settings in the user's browser was checked. Internet Options > Connections > LAN setting
    The configured option is 'Use automatic configuration script' and the value is http://www.userAppX.com/proxy.pac
    This configuration remains the same irrespective of the JRE version in use.
    3) The network settings in the Java Control Panel was checked.
    The used/selected option is "Use browser settings", although values for 'Use proxy server' and 'use automatic proxy configuration script' are filled-in as 'user-proxy.com' and 'http://www.userAppX.com/proxy.pac' respectively.
    This configuration remains the same irrespective of the JRE version in use.
    4) The proxy PAC file was checked and debugging was done for the request 'https://myAppletHost.com/download/...'. The FindProxyForUrl function (including the conditions defined in it, for the hostname and domain checks) returns PROXY user-proxy.com:80
    5) The user also tried the below
    a. Changed the option in the network settings in the browser to 'Proxy server' with Address 'user-proxy.com' and Port '80'
    b. Restarted the browser.
    c. Tried with Java Plug-in 1.6.0_29, JRE version 1.6.0_29-b11. There was no problem and no request to the Domain Controller of the user.
    d. Tried with Java Plug-in 10.40.2.43, JRE version 1.7.0_40-b43. The problem occurs with the delay and a request to the Domain Controller of the user is observed.
    Kindly refer to Java console output in the code ‘section C’ towards the end of this post.
    6) The user also tried setting the below property in the Java Control panel; restarted the browser, and try with JRE 1.7.0_40-b43. The problem stil persists.
    -Djava.net.preferIPv4Stack=true
    7) The Global Policy Management of the Domain Controller was verified by the user. It has GPO for proxy setting but nothing related to Java security.
    Questions:
    The problem seems be specific to a particular (user) environment setup, and the user faces the problem when using JRE 1.7.
    We would like to know if the issue is in the (user) environment setup or in JRE 1.7.
    Could you please help with information/ideas/suggestions to identify the root cause and solution for this problem?
    Section A:
    Java Plug-in 1.6.0_29
    Using JRE version 1.6.0_29-b11 Java HotSpot(TM) Client VM
    User home directory = C:\Users\userA
    basic: Plugin2ClassLoader.addURL parent called for https://myAppletHost.com/download/myApplet.jar
    network: Connecting https://myAppletHost.com/download/myApplet.jar with proxy=HTTP @ user-proxy.com/194.xxx.xx.xx:80
    network: Server https://myAppletHost.com/download/myApplet.jar requesting to set-cookie with "BCSI-CS-b1bb5056c5b0e83f=2; Path=/"
    network: Server https://myAppletHost.com/download/myApplet.jar requesting to set-cookie with "BCSI-CS-b1bb5056c5b0e83f=2; Path=/"
    security: Loading Root CA certificates from C:\Program Files (x86)\Java\jre6\lib\security\cacerts
    security: Loaded Root CA certificates from C:\Program Files (x86)\Java\jre6\lib\security\cacerts
    security: Loading SSL Root CA certificates from C:\Program Files (x86)\Java\jre6\lib\security\cacerts
    security: Loaded SSL Root CA certificates from C:\Program Files (x86)\Java\jre6\lib\security\cacerts
    security: Loading certificates from Deployment session certificate store
    security: Loaded certificates from Deployment session certificate store
    security: Loading certificates from Internet Explorer ROOT certificate store
    security: Loaded certificates from Internet Explorer ROOT certificate store
    security: Checking if certificate is in Deployment denied certificate store
    network: Connecting https://myAppletHost.com/download/myApplet.jar with cookie "JSESSIONID=0000IK4bEMoqXH10zsl88rwvoRI:175oe9tjd; BCSI-CS-b1bb5056c5b0e83f=2"
    network: Downloading resource: https://myAppletHost.com/download/myApplet.jar
                    Content-Length: 403.293
                    Content-Encoding: null
    Dump system properties ...
    https.protocols = TLSv1,SSLv3
    java.vm.info = mixed mode, sharing
    java.vm.name = Java HotSpot(TM) Client VM
    java.vm.specification.name = Java Virtual Machine Specification
    java.vm.specification.vendor = Sun Microsystems Inc.
    java.vm.specification.version = 1.0
    java.vm.vendor = Sun Microsystems Inc.
    java.vm.version = 20.4-b02
    javaplugin.nodotversion = 160_29
    javaplugin.version = 1.6.0_29
    javaplugin.vm.options =
    os.arch = x86
    os.name = Windows 7
    os.version = 6.1
    trustProxy = true
    deployment.proxy.auto.config.url = http://www.userAppX.com/proxy.pac
    deployment.proxy.bypass.local = false
    deployment.proxy.http.host = user-proxy.com
    deployment.proxy.http.port = 80
    deployment.proxy.override.hosts =
    deployment.proxy.same = false
    deployment.proxy.type = 3
    deployment.security.SSLv2Hello = false
    deployment.security.SSLv3 = true
    deployment.security.TLSv1 = true
    deployment.security.mixcode = ENABLE
    Section B:
    Java Plug-in 10.25.2.17
    Using JRE version 1.7.0_25-b17 Java HotSpot(TM) Client VM
    User home directory = C:\Users\userA
    basic: Added progress listener: sun.plugin.util.ProgressMonitorAdapter@12adac5
    basic: Plugin2ClassLoader.addURL parent called for https://myAppletHost.com/download/myApplet.jar
    network: Connecting https://myAppletHost.com/download/myApplet.jar with proxy=HTTP @ user-proxy.com/194.xxx.xx.xx:80
    network: Server https://myAppletHost.com/download/myApplet.jar requesting to set-cookie with "BCSI-CS-2d4ce94a2ae7b460=2; Path=/"
    network: Connecting http://10.x.x.xx:53/ with proxy=DIRECT
                    (##THE ABOVE REQUEST CAUSES THE DELAY OR HANGS##)
    network: Server https://myAppletHost.com/download/myApplet.jar requesting to set-cookie with "BCSI-CS-2d4ce94a2ae7b460=2; Path=/"
    security: Loading Root CA certificates from C:\Program Files (x86)\Java\jre7\lib\security\cacerts
    security: Loaded Root CA certificates from C:\Program Files (x86)\Java\jre7\lib\security\cacerts
    security: Loading SSL Root CA certificates from C:\Program Files (x86)\Java\jre7\lib\security\cacerts
    security: Loaded SSL Root CA certificates from C:\Program Files (x86)\Java\jre7\lib\security\cacerts
    security: Loading certificates from Deployment session certificate store
    security: Loaded certificates from Deployment session certificate store
    security: Loading certificates from Internet Explorer ROOT certificate store
    security: Loaded certificates from Internet Explorer ROOT certificate store
    network: Connecting https://myAppletHost.com/download/myApplet.jar with proxy=HTTP @ user-proxy.com/194.xxx.xx.xx:80
    network: Server https://myAppletHost.com/download/myApplet.jar requesting to set-cookie with "BCSI-CS-2d4ce94a2ae7b460=2; Path=/"
    network: Server https://myAppletHost.com/download/myApplet.jar requesting to set-cookie with "BCSI-CS-2d4ce94a2ae7b460=2; Path=/"
    network: Connecting https://myAppletHost.com/download/myApplet.jar with cookie "JSESSIONID=0000UQuXWY5tjxjpwcKHlfJKe_8:175oe9j45; BCSI-CS-2d4ce94a2ae7b460=2"
    network: ResponseCode for https://myAppletHost.com/download/myApplet.jar : 200
    network: Encoding for https://myAppletHost.com/download/myApplet.jar : null
    network: Server response: (length: -1, lastModified: Thu Feb xx yy:yy:yy CET 2013, downloadVersion: null, mimeType: text/plain)
    network: Downloading resource: https://myAppletHost.com/download/myApplet.jar
                    Content-Length: -1
                    Content-Encoding: null
    Section C:
    Java Plug-in 10.40.2.43
    Using JRE version 1.7.0_40-b43 Java HotSpot(TM) Client VM
    User home directory = C:\Users\userA
    basic: Plugin2ClassLoader.addURL parent called for https://myAppletHost.com/download/myApplet.jar
    network: Connecting https://myAppletHost.com/download/myApplet.jar with proxy=HTTP @ user-proxy.com/194.xxx.xx.xx:80
    network: Server https://myAppletHost.com/download/myApplet.jar requesting to set-cookie with "BCSI-CS-1d67c8b6508ca09c=2; Path=/"
    network: Connecting http://10.x.x.xx:53/ with proxy=DIRECT
                    (##THE ABOVE REQUEST CAUSES THE DELAY OR HANGS##)
    network: Checking for update at: https://javadl-esd-secure.oracle.com/update/blacklist
    network: Checking for update at: https://javadl-esd-secure.oracle.com/update/blacklisted.certs
    network: Checking for update at: https://javadl-esd-secure.oracle.com/update/baseline.version
    network: Connecting https://javadl-esd-secure.oracle.com/update/blacklist with proxy=HTTP @ user-proxy.com/194.xxx.xx.xx:80
    network: Connecting https://javadl-esd-secure.oracle.com/update/baseline.version with proxy=HTTP @ user-proxy.com/194.xxx.xx.xx:80
    network: Connecting https://javadl-esd-secure.oracle.com/update/blacklisted.certs with proxy=HTTP @ user-proxy.com/194.xxx.xx.xx:80
    security: Loading Root CA certificates from C:\Program Files (x86)\Java\jre7\lib\security\cacerts
    security: Loaded Root CA certificates from C:\Program Files (x86)\Java\jre7\lib\security\cacerts
    security: Loading SSL Root CA certificates from C:\Program Files (x86)\Java\jre7\lib\security\cacerts
    security: Loaded SSL Root CA certificates from C:\Program Files (x86)\Java\jre7\lib\security\cacerts
    Dump system properties ...
    https.protocols = TLSv1,SSLv3
    java.vm.info = mixed mode, sharing
    java.vm.name = Java HotSpot(TM) Client VM
    java.vm.specification.name = Java Virtual Machine Specification
    java.vm.specification.vendor = Oracle Corporation
    java.vm.specification.version = 1.7
    java.vm.vendor = Oracle Corporation
    java.vm.version = 24.0-b56
    javaplugin.nodotversion = 10402
    javaplugin.version = 10.40.2.43
    os.arch = x86
    os.name = Windows 7
    os.version = 6.1
    trustProxy = true
    active.deployment.proxy.auto.config.url = http://www.userAppX.com/proxy.pac
    active.deployment.proxy.bypass.local = false
    active.deployment.proxy.http.host = user-proxy.com
    active.deployment.proxy.http.port = 80
    active.deployment.proxy.same = false
    active.deployment.proxy.type = 3
    deployment.browser.path = C:\Program Files (x86)\Internet Explorer\iexplore.exe
    deployment.proxy.auto.config.url = http://www.userAppX.com/proxy.pac
    deployment.proxy.bypass.local = false
    deployment.proxy.http.host = user-proxy.com
    deployment.proxy.http.port = 80
    deployment.proxy.override.hosts =
    deployment.proxy.same = false
    deployment.proxy.type = 3                                                                                                                                                                                                                                                            
    deployment.security.SSLv2Hello = false
    deployment.security.SSLv3 = true
    deployment.security.TLSv1 = true
    deployment.security.TLSv1.1 = false
    deployment.security.TLSv1.2 = false
    deployment.security.authenticator = true
    deployment.security.disable = false
    deployment.security.level = HIGH
    deployment.security.mixcode = ENABLE
    PS:
    Since the JRE 1.7.0_25-b17 update, it is noticed that when the Java plugin requests for the applet File; it sends a request to the Domain Controller of the user, which causes a delay of 2 to 5 minutes and sometimes hangs.
    The problem occurs consistently, and also with JRE 1.7.0_45-b18.
    Java Plug-in 10.45.2.18
    Using JRE version 1.7.0_45-b18 Java HotSpot(TM) Client VM
    User home directory = C:\Users\userA
    c:   clear console window
    f:   finalize objects on finalization queue
    g:   garbage collect
    h:   display this help message
    l:   dump classloader list
    m:   print memory usage
    o:   trigger logging
    q:   hide console
    r:   reload policy configuration
    s:   dump system and deployment properties
    t:   dump thread list
    v:   dump thread stack
    x:   clear classloader cache
    0-5: set trace level to <n>
    cache: Initialize resource manager: com.sun.deploy.cache.ResourceProviderImpl@134a33d
    basic: Added progress listener: sun.plugin.util.ProgressMonitorAdapter@1971f66
    basic: Plugin2ClassLoader.addURL parent called for https://myAppletHost.com/download/myApplet.jar
    network: Connecting https://myAppletHost.com/download/myApplet.jar with proxy=HTTP @ user-proxy.com/194.xxx.xx.xx:80
    network: Server https://myAppletHost.com/download/myApplet.jar requesting to set-cookie with "BCSI-CS-f797d4d262467220=2; Path=/"
    network: Connecting http://10.x.x.xx:53/ with proxy=DIRECT
    network: Connecting http://10.x.x.xx:53/ with proxy=DIRECT
                    (##THE ABOVE REQUEST CAUSES THE DELAY AND SOMETIMES HANGS##)

    My organization is experiencing very similar problems.  We have resolved it through several steps.
    We upgraded the client to Java 8 and we saw in the console that the hanging connection with the Domain Controller no longer occurs.  This may be all that is necessary for your environment as well. 

  • Can I move a Virtual Domain Controller from one host(Win Server 2008 R2) to another (Win Server 2012 R2) ? Are there any issues?

    Can I move a Virtual Domain Controller from one host(Win Server 2008 R2) to another (Win Server 2012 R2) ? Are there any issues?

    I also had this error: "Setup cannot continue. Your computer will now restart, and your previous version of Windows will be restored."
    trying to do a in-place upgrade of a Domain Controller Windows 2008 R2 to Windows 2012 R2.
    The problem was the separated System Reserved Partition. After I removed using this instructions:
    http://jacobackerman.blogspot.com/2012/12/how-to-remove-system-reserved-partition.html
    The upgrade ran ok, and now have my DC as Windows 2012 R2.
    Hope that helps!.

  • How to restrict users working on Windows 7 clients from accessing Windows Explorer and other systems in the network through Group Policy with a domain controller running on Windows Server 2008 r2

    Dear All,
    We are having an infrastructure setup of around 500 client computers managed through group policy.
    Recently the domain controllers have been migrated from Windows Server 2003 to Server 2008 R2.
    Since this account requires extremely strict environment, we need to figure the solution for restricting the users from access anything locally.
    It would be great if you can assist me with the following query.
    How to restrict users logged on Windows 7 clients from accessing Windows Explorer and browsing other systems in the network through Group Policy with a domain controller running on Windows Server 2008 r2 ?
    Can we disable Network Tab on the left hand pane ?
    explorer.exe is blocked already, but users are able to enter the Windows Explorer by clicking on the name which is visible on the Start Menu.

    >   * explorer.exe is blocked already, but users are able to enter the
    >     Windows Explorer by clicking on the name which is visible on the
    >     Start Menu.
    You cannot block explorer.exe when you do not replace the shell - the
    desktop you see effectively IS explorer.exe...
    Your requirement sounds like you need a custom shell:
    http://gpsearch.azurewebsites.net/#2812
    Martin
    Mal ein
    GUTES Buch über GPOs lesen?
    NO THEY ARE NOT EVIL, if you know what you are doing:
    Good or bad GPOs?
    And if IT bothers me - coke bottle design refreshment :))

  • The processing of Group Policy failed because of lack of network connectivity to a domain controller

    We are setting up a new AD environment  with one AD/DC running DNS services,  and a secondary DNS server configured with secondary zone. The problem is that none of the machines in the the domain are getting GPO.
    When I run a gpupdate /force from a machine, I get the following output:
    "Updating Policy...
    User Policy update has completed successfully.
    Computer policy could not be updated successfully. The following errors were enc
    ountered:
    The processing of Group Policy failed because of lack of network connectivity to
     a domain controller. This may be a transient condition. A success message would
     be generated once the machine gets connected to the domain controller and Group
     Policy has succesfully processed. If you do not see a success message for sever
    al hours, then contact your administrator.
    To diagnose the failure, review the event log or run GPRESULT /H GPReport.html f
    rom the command line to access information about Group Policy results."
    While the system event log outputs the following:
    "The processing of Group Policy failed because of lack of network connectivity to a domain controller. This may be a transient condition. A success message would be generated once the machine gets connected to the domain controller and Group Policy
    has succesfully processed. If you do not see a success message for several hours, then contact your administrator." 
    All the machines that were joined to the domain are able to resolve in forward and reverse lookups, ping the DC and ping each other so  I dont understand how the error can be resolved.
    Here are few things I have tried:
    1. I came across this KB which checked ok for me: http://support.microsoft.com/kb/241515
    2. Made a copy of the default GPO, applied to a OU with one machine, and made sure to remove any GPO links from above
    3. Enabled the following  two local Group policies on a test member:
    GP slow link detection
    Startup policy processing wait time
    4. Modified firewall to allow everything on both member and DC
    5. Verified DSN logs, SRV records, access to sysvol ( added authenticated users to sysvol)
    I have yet to figure out the reason for this issue. Has anyone seen anything like this before?

    1. I checked the NIC, it only has one IP. and I followed your article. I set the primary DNS to its own IP and the secondary DNS to the loopback ip
    2. This is a new DC and DNS server. I dont have old records yet. I also check the DNS event logs. No errors
    3. I made sure the member server is pointing only to the only DC/DNS server
    4. Here is the output from the dcdiag....  everything passed except, the Netlogons part. I'm not sure what means or how to fix it yet:
          Starting test: NetLogons
             * Warning BUILTIN\Administrators did not have the "Access this
             computer
             "*   from network" right.
             [hostname] An net use or LsaPolicy operation failed with error
             1, Incorrect function..
             ......................... hostname failed test NetLogons
    Complete output:
    > hostname
    Server:  hostname.domain.local
    Address:  X.X.X.95
    > ^C
    C:\Windows\system32>
    C:\Windows\system32>nslookup
    > set type=all
    >
    >
    >
    > _ldap._tcp.dc._msdcs.domainname
    _ldap._tcp.dc._msdcs.domain.local SRV service location:
              priority       = 0
              weight         = 100
              port           = 389
              svr hostname   = hostname.domain.local
    hostname.domain.local      internet address = X.X.X.95
    > ^C
    C:\Windows\system32>cd ..
    C:\Windows>cd SYSVOL
    C:\Windows\SYSVOL>cd sysvol
    C:\Windows\SYSVOL\sysvol>dir
     Volume in drive C has no label.
     Volume Serial Number is F624-CDB2
     Directory of C:\Windows\SYSVOL\sysvol
    10/29/2014  08:25 PM    <DIR>          .
    10/29/2014  08:25 PM    <DIR>          ..
    10/29/2014  08:25 PM    <JUNCTION>     domain.local [C:\Windows\SYSVOL\domain]
                   0 File(s)              0 bytes
                   3 Dir(s)  63,971,037,184 bytes free
    C:\Windows\SYSVOL\sysvol>dcdiag
    Directory Server Diagnosis
    Performing initial setup:
       Trying to find home server...
       Home Server = hostname
       * Identified AD Forest.
       Done gathering initial info.
    Doing initial required tests
       Testing server: Default-First-Site-Name\hostname
          Starting test: Connectivity
             ......................... hostname passed test Connectivity
    Doing primary tests
       Testing server: Default-First-Site-Name\hostname
          Starting test: Advertising
             ......................... hostname passed test Advertising
          Starting test: FrsEvent
             ......................... hostname passed test FrsEvent
          Starting test: DFSREvent
             ......................... hostname passed test DFSREvent
          Starting test: SysVolCheck
             ......................... hostname passed test SysVolCheck
          Starting test: KccEvent
             ......................... hostname passed test KccEvent
          Starting test: KnowsOfRoleHolders
             ......................... hostname passed test
             KnowsOfRoleHolders
          Starting test: MachineAccount
             ......................... hostname passed test MachineAccount
          Starting test: NCSecDesc
             ......................... hostname passed test NCSecDesc
          Starting test: NetLogons
             * Warning BUILTIN\Administrators did not have the "Access this
             computer
             "*   from network" right.
             [hostname] An net use or LsaPolicy operation failed with error
             1, Incorrect function..
             ......................... hostname failed test NetLogons
          Starting test: ObjectsReplicated
             ......................... hostname passed test
             ObjectsReplicated
          Starting test: Replications
             ......................... hostname passed test Replications
          Starting test: RidManager
             ......................... hostname passed test RidManager
          Starting test: Services
             ......................... hostname passed test Services
          Starting test: SystemLog
             A warning event occurred.  EventID: 0x000003F6
                Time Generated: 03/04/2015   18:23:06
                Event String:
                Name resolution for the name ctldl.windowsupdate.com timed out after
     none of the configured DNS servers responded.
             ......................... hostname passed test SystemLog
          Starting test: VerifyReferences
             ......................... hostname passed test VerifyReferences
       Running partition tests on : ForestDnsZones
          Starting test: CheckSDRefDom
             ......................... ForestDnsZones passed test CheckSDRefDom
          Starting test: CrossRefValidation
             ......................... ForestDnsZones passed test
             CrossRefValidation
       Running partition tests on : DomainDnsZones
          Starting test: CheckSDRefDom
             ......................... DomainDnsZones passed test CheckSDRefDom
          Starting test: CrossRefValidation
             ......................... DomainDnsZones passed test
             CrossRefValidation
       Running partition tests on : Schema
          Starting test: CheckSDRefDom
             ......................... Schema passed test CheckSDRefDom
          Starting test: CrossRefValidation
             ......................... Schema passed test CrossRefValidation
       Running partition tests on : Configuration
          Starting test: CheckSDRefDom
             ......................... Configuration passed test CheckSDRefDom
          Starting test: CrossRefValidation
             ......................... Configuration passed test CrossRefValidation
       Running partition tests on : emcdsm
          Starting test: CheckSDRefDom
             ......................... emcdsm passed test CheckSDRefDom
          Starting test: CrossRefValidation
             ......................... emcdsm passed test CrossRefValidation
       Running enterprise tests on : domain.local
          Starting test: LocatorCheck
             ......................... domain.local passed test LocatorCheck
          Starting test: Intersite
             ......................... domain.local passed test Intersite
    C:\Windows\SYSVOL\sysvol>

  • Domain Controller cannot access \\domain\netlogon causing Auth issues

    Hi everyone, I have been spent all day trying to figure out what is going on here, I have a Domain controller (only DC in the environment) that is acting funny
    I first noticed when I was attempting to RDP into a server in my domain I was getting "access denied" (but I could log in as a local admin). So when I looked at the Domain Controller, I ran a DCDiag DNS test and got some an AUTH error, but am not
    able to figure out how to fix this.
    Another thing I notice is when I am signed into the domain Controller (GP2010-a), I cannot browse to
    \\contoso.com\netlogon or any similar share.
    Here is the kicker, other servers on this domain, server3, server4, server5 etc... THEY CAN access
    \\contoso.com\netlogon It is ONLY the Domain controller and Server2 that CANNOT access this share. The other servers also allow me to RDP into them fine, it is only 1 server that is affected by this strange behavior.
    I have checked for no IP conflicts and as far as I can tell all the DNS records are correct.
    Regarding the DYNAMIC ip warning, we have a reservation that assigns the IP
    thanks for any input here as i'm really stuck,
    Directory Server Diagnosis
    Performing initial setup:
       Trying to find home server...
       Home Server = GP2010-A
       * Identified AD Forest.
       Done gathering initial info.
    Doing initial required tests
       Testing server: Default-First-Site-Name\GP2010-A
          Starting test: Connectivity
             ......................... GP2010-A passed test Connectivity
    Doing primary tests
       Testing server: Default-First-Site-Name\GP2010-A
          Starting test: DNS
             DNS Tests are running and not hung. Please wait a few minutes...
             ......................... GP2010-A passed test DNS
       Running partition tests on : ForestDnsZones
       Running partition tests on : DomainDnsZones
       Running partition tests on : Schema
       Running partition tests on : Configuration
       Running partition tests on : contoso
       Running enterprise tests on : contoso.com
          Starting test: DNS
             Test results for domain controllers:
                DC: GP2010-A.contoso.com
                Domain: contoso.com
                   TEST: Authentication (Auth)
                      Error: Authentication failed with specified credentials
                   TEST: Basic (Basc)
                      Warning: Adapter 00:0D:3A:00:0D:01 has dynamic IP address
                      (can be a misconfiguration)
             Summary of test results for DNS servers used by the above domain
             controllers:
                DNS server: 128.8.10.90 (d.root-servers.net.)
                   1 test failure on this DNS server
                   PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 128.8.10.90              
                DNS server: 2001:500:1::803f:235 (h.root-servers.net.)
                   1 test failure on this DNS server
                   PTR record query for the 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa failed on the DNS server 2001:500:1::803f:235              
                DNS server: 2001:500:2::c (c.root-servers.net.)
                   1 test failure on this DNS server
                   PTR record query for the 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa failed on the DNS server 2001:500:2::c              
                DNS server: 2001:500:2d::d (d.root-servers.net.)
                   1 test failure on this DNS server
                   PTR record query for the 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa failed on the DNS server 2001:500:2d::d              
                DNS server: 2001:500:2f::f (f.root-servers.net.)
                   1 test failure on this DNS server
                   PTR record query for the 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa failed on the DNS server 2001:500:2f::f              
                DNS server: 2001:500:3::42 (l.root-servers.net.)
                   1 test failure on this DNS server
                   PTR record query for the 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa failed on the DNS server 2001:500:3::42              
                DNS server: 2001:500:84::b (b.root-servers.net.)
                   1 test failure on this DNS server
                   PTR record query for the 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa failed on the DNS server 2001:500:84::b              
                DNS server: 2001:503:ba3e::2:30 (a.root-servers.net.)
                   1 test failure on this DNS server
                   PTR record query for the 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa failed on the DNS server 2001:503:ba3e::2:30              
                DNS server: 2001:503:c27::2:30 (j.root-servers.net.)
                   1 test failure on this DNS server
                   PTR record query for the 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa failed on the DNS server 2001:503:c27::2:30              
                DNS server: 2001:7fd::1 (k.root-servers.net.)
                   1 test failure on this DNS server
                   PTR record query for the 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa failed on the DNS server 2001:7fd::1              
                DNS server: 2001:7fe::53 (i.root-servers.net.)
                   1 test failure on this DNS server
                   PTR record query for the 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa failed on the DNS server 2001:7fe::53              
                DNS server: 2001:dc3::35 (m.root-servers.net.)
                   1 test failure on this DNS server
                   PTR record query for the 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa failed on the DNS server 2001:dc3::35              
             Summary of DNS test results:
    Auth Basc Forw Del  Dyn  RReg Ext
                Domain: contoso.com
                   GP2010-A                     FAIL WARN PASS PASS PASS PASS n/a 
             ......................... contoso.com failed test DNS

    Hi,
    TEST: Basic (Basc)
                      Warning: Adapter 00:0D:3A:00:0D:01 has dynamic IP address
                      (can be a misconfiguration)
    Do you have any NIC conifgured to get dynamic IP on your DC which is having issue? If yes, please disable that NIC. Also, please provide me the result of the below
    1) On your DC which is having issue, run "ipconfig /all"
    2) Repadmin /showrepl
    Thanks,
    Umesh.S.K
    Thanks, there is only 1 nic card. It is getting a dhcp address because this is an AZURE Hyper-v machine and I have set an IP reservation for it. I have no way to hardcode the IP because it gets shut off/on all the time
    C:\Users\Administrator>repadmin /showrepl
    Repadmin: running command /showrepl against full DC localhost
    Default-First-Site-Name\GP2010-A
    DSA Options: IS_GC
    Site Options: (none)
    DSA object GUID: 007c755c-f56c-4e51-a211-fd4431f63927
    DSA invocationID: 007c755c-f56c-4e51-a211-fd4431f63927

  • Best pracices for setting up Domain controller for our remote European offices

    Hi,,
    We have about 17 remote site across Europe (HQ in UK), I want to start revoking the offices local DC's and host them in a couple of Cloud servers in Germany with local NAS boxes for file storage. I will have MPLS network between the offices to the Cloud
    DC.
    Now what would be the best practices and tips for this situation in respect to the DC's. How can I prioritize the remote offices to use the Cloud DC/DNS and not our DC at our HQ in the UK. Would it be better to have a sub-domain created (europe.company.co.uk)
    for the other offices.
    Any suggestions on this setup for the DC

    Hiya,
    on the conceptual level. The reason for having local DC's, is that if the local sites internet line is offline, people are still able to authenticate and access local resources. From that point of view, you might as well just run with your HQ DC's only. Note:
    the cloud does offer availability on their services, that might not be matched by your HQ in terms of double internet lines.
    That said.
    The DNS server of the clients as well as the sites & services of Active Directory. Your clients will use the nearest domain controller available from sites and services information.
    Managing Intersite Replication
    http://technet.microsoft.com/en-us/library/cc794799%28v=ws.10%29.aspx

  • Best Practices for Setting up a Windows 2012 R2 STD Domain Controller in a Remote Site

    So I'm looking for an article or writeup similar to the "Adding Domain Controllers in Remote Sites" TechNet article but for Windows Server 2012 STD R2.  Here is my scenario:
    1.  I want to setup the domain controller at Site A where the primary domain controller is located.  The primary domain controller is Windows Server 2008 R2. 
    2.  Once the DC is setup I plan on leaving it on our network for a few days before shipping it to remote Site B for installation
    Other key items:
    1.  The remote Site B will have a different IP range than Site A but will be connected to Site A via a single VPN tunnel.  All the DCs that replicate with each other are on the same domain. 
    2.  The 2012 DC that I setup for Site B (same domain in same forest) will be a DHCP, DNS, and WSUS server all replicating to the primary DC at Site A
    Questions:
    1.  What items can I setup while it's at Site A without effecting or conflicting with the existing network and domain controller?  Can I setup a scope once the DHCP role is added? 
    2.  All of our DCs replicate through Sites and Services, do I have to manually add this to our primary DC for the new DC going to remote Site B?  Or when does this happen automatically when I promote the DC? 
    All and all I'm just looking for a list of Best Practices for 2012 or a Step by Step Guide.  Any help would be appreciated. 

    Hi,
    Thanks for your posting.
    When you install AD DS in the hub or staging site, disconnect the installed domain controller, and then ship the computer to the remote site, you are disconnecting a viable domain controller from the replication topology.
    For more and detail information, please refer to:
    Best Practices for Adding Domain Controllers in Remote Sites
    http://technet.microsoft.com/en-us/library/cc794962(v=ws.10).aspx
    Regards.
    Vivian Wang

  • Install Active Directory Domain Controller on Windows server 2008 enterprise, dont login on Sql Server 2008 R2

    I install Active Directory Domain Controller on Windows server 2008 enterprise and dont login on Sql Server 2008 R2. Before install ADDC, I have logon SQL Server 2008r2 Success, After when i install ADDC is don't logon on SQL Server 2008r2 -->not success.
    I have uninstalled ADDC but i still can't login on SQL server 2008r2.
    please help me. it  is very very disaster!
    I think is loss account SQL server 2008r2!

    Hello,
    I stronly recommend you post the detail error message to us while you try to connect to SQL Server instance, it's useful for us to do further investigation.
    Microsoft recommends that you do not install SQL Server 2008 R2 on a domain controller, there are some limitations:
    You cannot run SQL Server services on a domain controller under a local service account or a network service account.
    After SQL Server is installed on a computer, you cannot change the computer from a domain member to a domain controller. You must uninstall SQL Server before you change the host computer to a domain controller.
    After SQL Server is installed on a computer, you cannot change the computer from a domain controller to a domain member. You must uninstall SQL Server before you change the host computer to a domain member.
    SQL Server failover cluster instances are not supported where cluster nodes are domain controllers.
    SQL Server Setup cannot create security groups or provision SQL Server service accounts on a read-only domain controller. In this scenario, Setup will fail.
    On Windows Server 2003, SQL Server services can run under a domain account or a local system account.
    So, I would suggest you try to open up Windows Services list and changed the account for SQL Server service.
    Regards,
    Elvis Long
    TechNet Community Support

Maybe you are looking for

  • Question on retrieving data from a JTable

    I have created a custom table model by following some examples. I will problably remove this though and just use the default model. I just wanted to find out a couple of things about the code. If the cells update automatically, why is there a setValu

  • How do I record live drums only while bassist plays along?

    If the bassist is going direct into the mixer or the interface, how can i record a live drum track while the bassist plays, but is not recorded, yet heard by himself and the drummer ? Message was edited by: Geoff J

  • HTMLDB 1.5 to 2.0???

    How does one migrate an HTLMDB developed application version 1.5 to HTMLDB Version 2.0 environment? The import of the 1.5 version is being rejected by 2.0... L.J.

  • REP-0066 Error???

    Hi all, When I run the Oracle report in the Reports Runtime Iam getting this error message: Rep-0066 Error Executing CA utility REP-3335 Unhandled Internal CA Error. calaa1 Iam using Oracle 3.0. I would appreciate any suggestions to my query. TIA sg

  • Web Form Cancel Edit button changes value of List View item when clicked

    I have a web form, I shows 3 buttons, Edit, Save, And cancel. When the user presses the edit button it enables editing. When the user makes an edit and presses the save button it saves the changes. When the user presses the cancel button, it does can