Join Remote Computers to AD Domain

Hi
We have nearly 60 computers in 4 different cities in different retail outlets in each city. We use them as point of sale. We want them to be part of AD domain that is working in our head office. All these 60 computers have internet connectivity. Some have
good connectivity and some have connectivity for just basic browsing.
Do we need to create VPN for them to join the HO AD domain? Even with VPN, we dont want to bring all their internet traffic to HO. We want them to connect to HO for just AD replication etc.
The main benefit we need is that our systems will be locked down and we will not have to reformat them every second month.
Your guidelines are needed.

If the computers are accessible only via the Internet, you only have a few options and you have already eliminated one of them. Also for clarification, client computers don't do AD replication. They will cache logon information for users that have used the
system as well as copy GPOs, etc...
1) Usually you could use VPN for connectivity, but as you said, you dont want to backhall all the internet traffic to your corporate network, so that option is out.
2) You can use Direct Access if these clients are new enough. This provides a persistent, VPN like access, but only corporate traffic is sent over the tunnel (AD authentication, server access, etc..) and internet traffic is set directly to the local point
of presence. http://technet.microsoft.com/en-us/windows/directaccess.aspx
Mark B. Cooper, President and Founder of PKI Solutions Inc., former Microsoft Senior Engineer and subject matter expert for Microsoft Active Directory Certificate Services (ADCS). Known as “The PKI Guy” at Microsoft for 10 years.

Similar Messages

Join remote computers in a branch office over vpn(GRE)

Hi
I have a problem with joining computers located in a branch office described in the following, It would be grateful if anyone help me.
I have a FG1240B firewall as edge firewall in my network and a FG60C in branch office, these firewalls can see each other with assigned IPs, in the other hand I established a GRE tunnel between them to increase security and making direct site to site connection.
The tunnel interfaces have it's own IPs. Routes between two LANs are created and computers in branch can see HQ's servers such as DC and Additional DC, it should be noted all services are opened to two side and even branch's computers can resolve records in
DNS and open https web servers and ... .
But I face the problem when i want to join computers to domain, after entering the credentials it returned error message as "the network path was not found" . For solving this problem I found that the TCP ports 139 and 445 (that refers to user
and computer authentication) could not establish connection to DC while all services are open in origin and destination, even DNS service is passed and when I issue the netstat command in branhce's computer, I noticed connection to DC is established in SYN_sent
step and it couldn't step forward to SYN_ack and SYN_RCVD . it is worth to mention that all these logs information were seen in the branch and there is no join query in the firewall 1240B
I know this problem should answered in firewall forums but I asked this question here because i hope anyone can help me :-/
thank you in advance for replying

Hi,
You can use a wireshark or network monitor capture to see if any traffic is being blocked/stopped somewhere along the path, when trying to join domain. You do not need WINS. Have you enabled DNS debugging logs on the DC/DNS serversin the hub site and
watched if the client from branch site reaches the server?
Regards,
Calin

How to join a lot of computers to a domain?

I join a computer doing this
i go to system, change settings, network id, and the wizard ask me for:
username and password and the domain then ask me the same but for the administrator of the server and that's what i do to join a computer to a domain, now the problem is that if i do this with i don't know maybe 50 machines this going to take me a lot of
time and i have to do it with one computer at a time.
How can i do this more easy, maybe exist a tool to join a bulk of computers in the domain or some script?
if you know some easy way to do this please help me XD

Hi Bastian,
Calin provide you correct link. Please refer to that link and check if help you to solve this issue.
Just addition, please also refer to following article.
Use
PowerShell to Replace netdom Commands to Join the Domain
If more issues for batch file or PowerShell script, you can also post those issues which were related to scripts
in the
Official Scripting Guys forum or
PowerShell forum. I believe we will get a better assistance there.
If any update, please feel free to let us know.
Hope this helps.
Best regards,
Justin Gu

How Do I Join a Workstation to a Domain

I'm trying to join a workstation to my domain (Server 2012 R2 Foundation). I've set the workstation up with a static internal IP address (192.168.1.2), and can both ping the server from the workstation and the workstation from the server. When
I go into system properties and change the workstation from a workgroup to the domain (Averihire.local), I get an error message saying that "An Active Directory Domain Congroller (AD DC) for the domain "Averihire.local" could not be contacted".
I'm very new to servers, so I suspect there's something else that needs to be done on the workstation and/or the server, but I haven't a clue to what it would be.
I'd very much appreciate it if someone explaining what steps must be taken in order to join the workstation to the domain.
Capt. Dinosaur

What DNS address did you assign to the workstation? It should be the IP address of your domain controller. If that's not the problem, please post the output from ipconfig /all from both the workstation and the domain controller. That
error is almost always a network configuration issue.. : | : . : | : . tim
I'm afraid I'm terribly confused here. When I posted my question above, I had set up the workstation's static IP Address to the same as the automatic one (i.e. 192.168.1.2). That gave me the error I cited above. After reading your
post, I changed it to the IP Address of the server (i.e. 192.168.1.8), and when I saved it I got an error saying that there are two computers on the network with the same IP Address, and, of course, when I then tried to add it to the domain, I got
the same error as above. Also, each time I try to set the workstation's IP Address to the 192.168.1.2, within a minute or two, the workstation loses it's internet connection. Here's the ipconfig /all for the server
Windows IP Configuration
Host Name . . . . . . . . . . . . : AVDC1
Primary Dns Suffix . . . . . . . : Averihire.local
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : Averihire.local
Ethernet adapter Ethernet:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Broadcom NetXtreme Gigabit Ethernet
Physical Address. . . . . . . . . : D4-AE-52-D5-3C-03
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::51ca:6bd:aa5c:b3e7%12(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.1.8(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.1
DHCPv6 IAID . . . . . . . . . . . : 315928146
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1B-C1-57-A0-D4-AE-52-D5-3C-03
DNS Servers . . . . . . . . . . . : ::1
127.0.0.1
NetBIOS over Tcpip. . . . . . . . : Enabled
Tunnel adapter isatap.{CC3EB832-8869-48E5-B39C-0CDB5BB27590}:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Here's the DNS from the Workstation, but with dynamic DNS. Every time I try to set up a static IP there it loses its internet connection:
Windows IP Configuration
Host Name . . . . . . . . . . . . : Averi02
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Broadcom 440x 10/100 Integrated Controller
Physical Address. . . . . . . . . : 00-1A-A0-2D-F4-0D
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::297d:9587:544d:de1d%10(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.1.2(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Monday, December 01, 2014 6:10:57 PM
Lease Expires . . . . . . . . . . : Tuesday, December 02, 2014 6:10:57 PM
Default Gateway . . . . . . . . . : 192.168.1.1
DHCP Server . . . . . . . . . . . : 192.168.1.1
DHCPv6 IAID . . . . . . . . . . . : 234887840
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1B-5C-59-07-00-1A-A0-2D-F4-0D
DNS Servers . . . . . . . . . . . : 66.119.96.9
70.158.128.9
192.168.1.1
NetBIOS over Tcpip. . . . . . . . : Enabled
Tunnel adapter isatap.{CC18CC2F-EC81-44AB-B600-E8916A02420C}:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Tunnel adapter Local Area Connection* 11:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : 2001:0:5ef5:79fb:30f1:403:3f57:fefd(Preferred)
Link-local IPv6 Address . . . . . : fe80::30f1:403:3f57:fefd%12(Preferred)
Default Gateway . . . . . . . . . : ::
NetBIOS over Tcpip. . . . . . . . : Disabled
I hope this helps. I guess I need to know exactly what settings I need to put in the workstation's DNS.
Capt. Dinosaur

Joining a computer to the domain using the netbios name VS the FQDN

Where I work we must join computers to the domain using the netbios name (ex: mycomp) vs the FQDN mycompany.tx.com or else problems occur and the computer must be rejoined to the domain again with the netbios name- it can be joined to the domain initially, but after about 15 - 30 mins we'll get an error message when trying to logon.
The error message I believe is:
"The system cannot log you on to this domain because the system's computer account in its primary domain is missing or the password on the account is incorrect."
I haven't seen it happen in a while, but if I remember correctly this is the error message we get -I could be wrong though.
It may also have just been a "domain is not available" message.
Some additional info:
The netbios domain name is diffent then the DNS name ie: "mycompany.tx.com" was not made "mycompany" for netbios, but "mycomp" instead.
Our DFL is mixed mode with some 2000 and some 2003 servers
We used to use WINS, but now we do not.
And lastly we usually add a WINS address along with the dns address in each workstation via "advanced TCP/IP settings" (why I do not know) and occationally I will not be able to join a computer to the domain until I add this WINS address. I know what your thinking, and I will say that I am not 100% all of our WINS server were deactivated.
Any info on how to figure this out or troubleshoot this would be greatly apprieciated. Thanks a lot.

Well this happened again.
As a test before I deployed a PC to one of our branches I joined it to the domain via the FQDN: mycompany.tx.com instead of the netbios name: mycomp prior to shipping. It spent a few days in transit and when it arrived a user plugged it in and tried to logon, but recieved this message:
"The system cannot log you on to this domain because the system's computer account in its primary domain is missing or the password on that account is incorrect"
I realize this error message maybe unrelated, but if I recall correctly this is what happened last time.
I pretty sure I was thorough in removing the computer account from the nessesary DCs (it failed and needed to be replaced) before I joined the replacement to the domain with the same name.
Rejoining to the domain via "mycomp" corrected the issue.
Netlogsetup.log:
01/06 15:24:01 -----------------------------------------------------------------
01/06 15:24:01 NetpValidateName: checking to see if 'BR021WS025' is valid as type 1 name
01/06 15:24:01 NetpCheckNetBiosNameNotInUse for 'BR021WS025' [MACHINE] returned 0x0
01/06 15:24:01 NetpValidateName: name 'BR021WS025' is valid for type 1
01/06 15:24:01 -----------------------------------------------------------------
01/06 15:24:01 NetpValidateName: checking to see if 'BR021WS025.mycompany.tx.com' is valid as type 5 name
01/06 15:24:01 NetpValidateName: name 'BR021WS025.mycompany.tx.com' is valid for type 5
01/06 15:24:01 -----------------------------------------------------------------
01/06 15:24:01 NetpValidateName: checking to see if 'FGYJ' is valid as type 2 name
01/06 15:24:01 NetpCheckNetBiosNameNotInUse for 'FGYJ' [ Workgroup as MACHINE] returned 0x0
01/06 15:24:01 NetpValidateName: name 'FGYJ' is valid for type 2
01/06 15:24:01 -----------------------------------------------------------------
01/06 15:24:01 NetpUnJoinDomain: unjoin from 'mycomp' using '(null)' creds, options: 0x4
01/06 15:24:01 OS Version: 5.0
01/06 15:24:01 Build number: 2195
01/06 15:24:01 ServicePack: Service Pack 4
01/06 15:24:01 NetpUnJoinDomain: status of getting computer name: 0x0
01/06 15:24:01 NetpApplyJoinState: actions: 0xb803a
01/06 15:24:01 NetpDsGetDcName: trying to find DC in domain 'mycomp', flags: 0x1020
01/06 15:24:01 NetpDsGetDcName: failed to find a DC in the specified domain: 0x54b
01/06 15:24:01 NetpApplyJoinState: initiating a rollback due to earlier errors
01/06 15:24:01 NetpApplyJoinState: actions: 0x40000
01/06 15:24:01 NetpGetLsaPrimaryDomain: status: 0x0
01/06 15:24:01 NetpUnJoinDomain: status: 0x54b
01/06 15:24:01 -----------------------------------------------------------------
01/06 15:24:01 NetpUnJoinDomain: unjoin from 'mycomp' using '(null)' creds, options: 0x0
01/06 15:24:01 OS Version: 5.0
01/06 15:24:01 Build number: 2195
01/06 15:24:01 ServicePack: Service Pack 4
01/06 15:24:01 NetpUnJoinDomain: status of getting computer name: 0x0
01/06 15:24:01 NetpApplyJoinState: actions: 0xb003a
01/06 15:24:02 NetpApplyJoinState: status of stopping and setting start type of Netlogon to 16: 0x0
01/06 15:24:06 NetpApplyJoinState: status of stopping and setting start type of TimeSvc to 16: 0x0
01/06 15:24:06 NetpGetLsaPrimaryDomain: status: 0x0
01/06 15:24:06 NetpLsaOpenSecret: status: 0x0
01/06 15:24:06 NetpLsaOpenSecret: status: 0x0
01/06 15:24:06 NetpSetLsaPrimaryDomain: for 'mycomp' status: 0x0
01/06 15:24:06 NetpApplyJoinState: status of setting LSA pri. domain: 0x0
01/06 15:24:07 NetpApplyJoinState: status of removing from local groups: 0x0
01/06 15:24:07 NetpApplyJoinState: NON FATAL: status of removing DNS registrations: 0x0
01/06 15:24:07 NetpUnJoinDomain: status: 0x0
01/06 15:24:12 -----------------------------------------------------------------
01/06 15:24:12 NetpDoDomainJoin
01/06 15:24:12 NetpMachineValidToJoin: 'BR063WS014'
01/06 15:24:12 NetpGetLsaPrimaryDomain: status: 0x0
01/06 15:24:12 NetpMachineValidToJoin: status: 0x0
01/06 15:24:12 NetpJoinWorkgroup: joining computer 'BR063WS014' to workgroup 'FGYJ'
01/06 15:24:12 NetpValidateName: checking to see if 'FGYJ' is valid as type 2 name
01/06 15:24:12 NetpCheckNetBiosNameNotInUse for 'FGYJ' [ Workgroup as MACHINE] returned 0x0
01/06 15:24:12 NetpValidateName: name 'FGYJ' is valid for type 2
01/06 15:24:13 NetpSetLsaPrimaryDomain: for 'FGYJ' status: 0x0
01/06 15:24:13 NetpJoinWorkgroup: status: 0x0
01/06 15:24:13 NetpDoDomainJoin: status: 0x0
01/07 10:49:50 -----------------------------------------------------------------
01/07 10:49:50 NetpValidateName: checking to see if 'mycompany.tx.com' is valid as type 3 name
01/07 10:49:50 NetpValidateName: 'mycompany.tx.com' is not a valid NetBIOS domain name: 0x7b
01/07 10:49:50 NetpCheckDomainNameIsValid [ Exists ] for 'mycompany.tx.com' returned 0x0
01/07 10:49:50 NetpValidateName: name 'mycompany.tx.com' is valid for type 3
01/07 10:49:59 -----------------------------------------------------------------
01/07 10:49:59 NetpDoDomainJoin
01/07 10:49:59 NetpMachineValidToJoin: 'BR021WS025'
01/07 10:49:59 NetpGetLsaPrimaryDomain: status: 0x0
01/07 10:49:59 NetpMachineValidToJoin: status: 0x0
01/07 10:49:59 NetpJoinDomain
01/07 10:49:59 Machine: BR021WS025
01/07 10:49:59 Domain: mycompany.tx.com
01/07 10:49:59 MachineAccountOU: (NULL)
01/07 10:49:59 Account: mycompany.tx.com\myUserName
01/07 10:49:59 Options: 0x27
01/07 10:49:59 OS Version: 5.0
01/07 10:49:59 Build number: 2195
01/07 10:49:59 ServicePack: Service Pack 4
01/07 10:49:59 NetpValidateName: checking to see if 'mycompany.tx.com' is valid as type 3 name
01/07 10:49:59 NetpValidateName: 'mycompany.tx.com' is not a valid NetBIOS domain name: 0x7b
01/07 10:49:59 NetpCheckDomainNameIsValid [ Exists ] for 'mycompany.tx.com' returned 0x0
01/07 10:49:59 NetpValidateName: name 'mycompany.tx.com' is valid for type 3
01/07 10:49:59 NetpDsGetDcName: trying to find DC in domain 'mycompany.tx.com', flags: 0x1020
01/07 10:50:00 NetpDsGetDcName: found DC '\\br041svr.mycompany.tx.com' in the specified domain
01/07 10:50:00 NetpJoinDomain: status of connecting to dc '\\br041svr.mycompany.tx.com': 0x0
01/07 10:50:00 NetpGetLsaPrimaryDomain: status: 0x0
01/07 10:50:00 NetpLsaOpenSecret: status: 0xc0000034
01/07 10:50:00 NetpGetLsaPrimaryDomain: status: 0x0
01/07 10:50:00 NetpLsaOpenSecret: status: 0xc0000034
01/07 10:50:01 NetpManageMachineAccountWithSid: NetUserAdd on '\\br041svr.mycompany.tx.com' for 'BR021WS025$' failed: 0x8b0
01/07 10:50:01 NetpManageMachineAccountWithSid: status of attempting to set password on '\\br041svr.mycompany.tx.com' for 'BR021WS025$': 0x0
01/07 10:50:01 NetpJoinDomain: status of creating account: 0x0
01/07 10:50:01 NetpJoinDomain: status of setting netlogon cache: 0x0
01/07 10:50:01 NetpGetLsaPrimaryDomain: status: 0x0
01/07 10:50:02 NetpSetLsaPrimaryDomain: for 'mycomp' status: 0x0
01/07 10:50:02 NetpJoinDomain: status of setting LSA pri. domain: 0x0
01/07 10:50:02 NetpJoinDomain: status of managing local groups: 0x0
01/07 10:50:03 NetpJoinDomain: status of setting ComputerNamePhysicalDnsDomain to 'mycompany.tx.com': 0x0
01/07 10:50:04 NetpJoinDomain: status of starting Netlogon: 0x0
01/07 10:50:04 NetpWaitForNetlogonSc: waiting for netlogon secure channel setup...
01/07 10:50:06 NetpWaitForNetlogonSc: status: 0x0, sub-status: 0x0
01/07 10:50:06 NetpJoinDomain: status of disconnecting from '\\br041svr.mycompany.tx.com': 0x0
01/07 10:50:06 NetpDoDomainJoin: status: 0x0
01/11 11:21:08 -----------------------------------------------------------------
01/11 11:21:08 NetpValidateName: checking to see if 'WK' is valid as type 2 name
01/11 11:21:20 NetpCheckNetBiosNameNotInUse for 'WK' [ Workgroup as MACHINE] returned 0x0
01/11 11:21:20 NetpValidateName: name 'WK' is valid for type 2
01/11 11:21:20 -----------------------------------------------------------------
01/11 11:21:20 NetpUnJoinDomain: unjoin from 'mycomp' using '(null)' creds, options: 0x4
01/11 11:21:20 OS Version: 5.0
01/11 11:21:20 Build number: 2195
01/11 11:21:20 ServicePack: Service Pack 4
01/11 11:21:20 NetpUnJoinDomain: status of getting computer name: 0x0
01/11 11:21:20 NetpApplyJoinState: actions: 0xb803a
01/11 11:21:20 NetpDsGetDcName: trying to find DC in domain 'mycomp', flags: 0x1020
01/11 11:21:56 NetpDsGetDcName: failed to find a DC having account 'BR021WS025$': 0x525
01/11 11:21:56 NetpDsGetDcName: found DC '\\BR021SVR' in the specified domain
01/11 11:21:56 NetUseAdd to \\BR021SVR\IPC$ returned 1326
01/11 11:21:56 Trying add to \\BR021SVR\IPC$ using NULL Session
01/11 11:21:56 NetpApplyJoinState: status of connecting to dc '\\BR021SVR': 0x0
01/11 11:21:57 NetpApplyJoinState: status of stopping and setting start type of Netlogon to 16: 0x0
01/11 11:22:01 NetpApplyJoinState: status of stopping and setting start type of TimeSvc to 16: 0x0
01/11 11:22:01 NetpGetLsaPrimaryDomain: status: 0x0
01/11 11:22:01 NetpLsaOpenSecret: status: 0x0
01/11 11:22:01 NetpLsaOpenSecret: status: 0x0
01/11 11:22:01 SamLookupNamesInDomain on BR021WS025$ failed with 0xc0000073
01/11 11:22:01 NetpManageMachineAccountWithSid: status of disabling account 'BR021WS025$' on '\\BR021SVR': 0x534
01/11 11:22:01 NetpApplyJoinState: status of disabling account: 0x534
01/11 11:22:01 NetpApplyJoinState: initiating a rollback due to earlier errors
01/11 11:22:01 NetpApplyJoinState: actions: 0x40130
01/11 11:22:01 NetpDsGetDcName: trying to find DC in domain '(null)', flags: 0x1020
01/11 11:22:26 NetpDsGetDcName: failed to find a DC having account 'BR021WS025$': 0x525
01/11 11:22:26 NetpDsGetDcName: found DC '\\br021svr.mycompany.tx.com' in the specified domain
01/11 11:22:26 NetUseAdd to \\br021svr.mycompany.tx.com\IPC$ returned 1326
01/11 11:22:26 Trying add to \\br021svr.mycompany.tx.com\IPC$ using NULL Session
01/11 11:22:26 NetpApplyJoinState: status of connecting to dc '\\br021svr.mycompany.tx.com': 0x0
01/11 11:22:26 NetpGetLsaPrimaryDomain: status: 0x0
01/11 11:22:26 NetpLsaOpenSecret: status: 0xc0000034
01/11 11:22:27 NetpSetMachineAccountPassword: NetUserGetInfo on '\\br021svr.mycompany.tx.com' 'BR021WS025$' failed: 0x8ad
01/11 11:22:27 NetpApplyJoinState: status of setting machine password: 0x8ad
01/11 11:22:27 NetpApplyJoinState: status of starting and setting start type of Netlogon to 4: 0x0
01/11 11:22:28 NetpApplyJoinState: status of starting and setting start type of TimeSvc to 4: 0x0
01/11 11:22:28 NetpApplyJoinState: status of disconnecting from '\\br021svr.mycompany.tx.com': 0x0
01/11 11:22:28 NetpApplyJoinState: status of disconnecting from '\\BR021SVR': 0x0
01/11 11:22:28 NetpUnJoinDomain: status: 0x534
01/11 11:22:28 -----------------------------------------------------------------
01/11 11:22:28 NetpUnJoinDomain: unjoin from 'mycomp' using '(null)' creds, options: 0x0
01/11 11:22:28 OS Version: 5.0
01/11 11:22:28 Build number: 2195
01/11 11:22:28 ServicePack: Service Pack 4
01/11 11:22:28 NetpUnJoinDomain: status of getting computer name: 0x0
01/11 11:22:28 NetpApplyJoinState: actions: 0xb003a
01/11 11:22:58 NetpApplyJoinState: status of stopping and setting start type of Netlogon to 16: 0x0
01/11 11:23:01 NetpApplyJoinState: status of stopping and setting start type of TimeSvc to 16: 0x0
01/11 11:23:02 NetpGetLsaPrimaryDomain: status: 0x0
01/11 11:23:02 NetpLsaOpenSecret: status: 0x0
01/11 11:23:02 NetpLsaOpenSecret: status: 0x0
01/11 11:23:02 NetpSetLsaPrimaryDomain: for 'mycomp' status: 0x0
01/11 11:23:02 NetpApplyJoinState: status of setting LSA pri. domain: 0x0
01/11 11:23:03 NetpApplyJoinState: status of removing from local groups: 0x0
01/11 11:23:03 NetpApplyJoinState: NON FATAL: status of removing DNS registrations: 0x0
01/11 11:23:03 NetpUnJoinDomain: status: 0x0
01/11 11:23:45 -----------------------------------------------------------------
01/11 11:23:45 NetpDoDomainJoin
01/11 11:23:45 NetpMachineValidToJoin: 'BR021WS025'
01/11 11:23:45 NetpGetLsaPrimaryDomain: status: 0x0
01/11 11:23:45 NetpMachineValidToJoin: status: 0x0
01/11 11:23:45 NetpJoinWorkgroup: joining computer 'BR021WS025' to workgroup 'WK'
01/11 11:23:45 NetpValidateName: checking to see if 'WK' is valid as type 2 name
01/11 11:23:57 NetpCheckNetBiosNameNotInUse for 'WK' [ Workgroup as MACHINE] returned 0x0
01/11 11:23:57 NetpValidateName: name 'WK' is valid for type 2
01/11 11:23:58 NetpSetLsaPrimaryDomain: for 'WK' status: 0x0
01/11 11:23:58 NetpJoinWorkgroup: status: 0x0
01/11 11:23:58 NetpDoDomainJoin: status: 0x0
01/11 11:33:08 -----------------------------------------------------------------
01/11 11:33:08 NetpValidateName: checking to see if 'mycomp' is valid as type 3 name
01/11 11:33:17 NetpCheckDomainNameIsValid [ Exists ] for 'mycomp' returned 0x0
01/11 11:33:17 NetpValidateName: name 'mycomp' is valid for type 3
01/11 11:34:23 -----------------------------------------------------------------
01/11 11:34:23 NetpDoDomainJoin
01/11 11:34:23 NetpMachineValidToJoin: 'BR021WS025'
01/11 11:34:23 NetpGetLsaPrimaryDomain: status: 0x0
01/11 11:34:23 NetpMachineValidToJoin: status: 0x0
01/11 11:34:23 NetpJoinDomain
01/11 11:34:23 Machine: BR021WS025
01/11 11:34:23 Domain: mycomp
01/11 11:34:23 MachineAccountOU: (NULL)
01/11 11:34:23 Account: mycomp\USER1
01/11 11:34:23 Options: 0x27
01/11 11:34:23 OS Version: 5.0
01/11 11:34:23 Build number: 2195
01/11 11:34:23 ServicePack: Service Pack 4
01/11 11:34:23 NetpValidateName: checking to see if 'mycomp' is valid as type 3 name
01/11 11:34:23 NetpCheckDomainNameIsValid [ Exists ] for 'mycomp' returned 0x0
01/11 11:34:23 NetpValidateName: name 'mycomp' is valid for type 3
01/11 11:34:23 NetpDsGetDcName: trying to find DC in domain 'mycomp', flags: 0x1020
01/11 11:34:35 NetpDsGetDcName: failed to find a DC having account 'BR021WS025$': 0x525
01/11 11:34:35 NetpDsGetDcName: found DC '\\BR021SVR' in the specified domain
01/11 11:34:35 NetpJoinDomain: status of connecting to dc '\\BR021SVR': 0x0
01/11 11:34:35 NetpGetLsaPrimaryDomain: status: 0x0
01/11 11:34:35 NetpLsaOpenSecret: status: 0xc0000034
01/11 11:34:35 NetpGetLsaPrimaryDomain: status: 0x0
01/11 11:34:35 NetpLsaOpenSecret: status: 0xc0000034
01/11 11:34:36 NetpJoinDomain: status of creating account: 0x0
01/11 11:34:36 NetpJoinDomain: status of setting netlogon cache: 0x0
01/11 11:34:36 NetpGetLsaPrimaryDomain: status: 0x0
01/11 11:34:37 NetpSetLsaPrimaryDomain: for 'mycomp' status: 0x0
01/11 11:34:37 NetpJoinDomain: status of setting LSA pri. domain: 0x0
01/11 11:34:37 NetpJoinDomain: status of managing local groups: 0x0
01/11 11:34:37 NetpJoinDomain: status of setting ComputerNamePhysicalDnsDomain to 'mycompany.tx.com': 0x0
01/11 11:34:38 NetpJoinDomain: status of starting Netlogon: 0x0
01/11 11:34:38 NetpWaitForNetlogonSc: waiting for netlogon secure channel setup...
01/11 11:34:45 NetpWaitForNetlogonSc: status: 0x0, sub-status: 0x0
01/11 11:34:45 NetpJoinDomain: status of disconnecting from '\\BR021SVR': 0x0
01/11 11:34:45 NetpDoDomainJoin: status: 0x0
- I forgot to add when the user experienced this problem I checked for the computer account and found it was not present in the domain on any DCs.

Is there a way to monitor System Performance for all the computers in my domain?

Like Resource Monitor for a local computer, Is there a way or tool to monitor the Resources usage of all the computers in my Domain. Can I do it using 2008 R2 server?

You can monitor all performance counters with perfmon.msc, also for remote computers.
If you want to monitor systems continuously and log the perforamnce data, you will need a real monitoring solution. Microsoft offers System Center Operations
Manager for this purpose, but many other third party solution also exist for this purpose.
MCP/MCSA/MCTS/MCITP

How can get value of registry DWORD value of remote computers with powershell

HI
I am using below script to get registry of remote computers with powershell but not desired result.
$computers = Import-Csv 'C:\New folder\dclist.csv'
$key = "SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}"
foreach ($computer in $computers)
Get-RegDword -ComputerName $computer -Key $key -Value IsInstalled
As I have installed remoteregistry pssnapin a well..
Also How can i get this from Invoke-Command ............
Please help or guide me

This script may help (I haven't used it personally, but I know that many people have used it and thanked Jason for coming up with it):
http://gallery.technet.microsoft.com/scriptcenter/Enable-PSRemoting-Remotely-6cedfcb0
You can also configure remoting across your entire domain via GP:
http://www.briantist.com/how-to/powershell-remoting-group-policy/
http://blog.powershell.no/2010/03/04/enable-and-configure-windows-powershell-remoting-using-group-policy/
Don't retire TechNet! -
(Don't give up yet - 12,830+ strong and growing)

Hi I am looking for a way to have trace32 open multiple files on remote computers

Simply put I am looking for someone who could afford to give me a basic script (vbs) that I could run from an elevated command prompt. It would need to be available for me to type in the name of a remote computer or (mulitple if possible) and also
allow me to choose log files to open or multiple files and then open them using trace 32. Hopefully it would detect the available log files and show me what is available to choose to open... anyone know of such a thing or know how to go about setting up something
like this for people to use?
EDIT
I was able to create a basic script to do what I wanted but I want to be able to add wildcards for the rollover logs... Can someone suggest the easiest way to do that as I am not sure how to add the wildcards directly before the .log
here is the script.
' ******Created by Luis Delgado*********
'This script will get a remote computers .log files depending on which documents you enter in the "files to open on remote computer using trace32" section
'Get and open log files on remote Computer
on error resume next
Set WshShell = Wscript.CreateObject("Wscript.Shell")
strcomputer = inputbox("Enter remote computer name or leave as localhost for this computer","Get log files from a remote computer with Trace32","Localhost")
If strComputer = "" Then
WScript.Quit
End If
'Opens trace32
wshShell.run "C:\Program Files\ConfigMgr 2007 Toolkit\CCM Tools\Trace32.exe"
'Files to open on remote computer using trace32
wshShell.Run "\\" & strcomputer & "\c$\Windows\System32\CCM\Logs\datatransferservice.log"
wshShell.Run "\\" & strcomputer & "\c$\Windows\System32\CCM\Logs\ccmexec.log"
wshShell.Run "\\" & strcomputer & "\c$\Windows\System32\CCM\Logs\locationservices.log"
!!!!NOTE!!!
What I need is for any file that starts with datatransferservices, ccmexec, or locationservices to open in trace32
my thought would be place a wild card in its respective spots but it does not work see below
wshShell.Run "\\" & strcomputer & "\c$\Windows\System32\CCM\Logs\datatransferservice*.log"
wshShell.Run "\\" & strcomputer & "\c$\Windows\System32\CCM\Logs\ccmexec*.log"
wshShell.Run "\\" & strcomputer & "\c$\Windows\System32\CCM\Logs\locationservices*.log"

The roll over logs all have the same name exact the extension is .lo_ , So.. I'm not sure what you are looking for.
Garth Jones | My blogs: Enhansoft and
Old Blog site | Twitter:
@GarthMJ

Cannot join Server 2012 machine to domain

I am trying to join a clean Server 2012 machine configured with Active Directory Domain Services and DNS features enabled to a domain (alekatest.com) which I have purchased. The Active Directory Domain Services option in Server Manager advises me that
the server requires promotion to a Domain Controller, but if I select "Add a domain controller to an existing domain" and enter "alekatest.com", and supply Domain Admin credentials I get a message "Encountered an error contacting
domain alekatest.com. The server is not operational". The DNS server has address 10.0.0.2.
When I try and change from workgroup to new domain alekatest.com, it fails with the message "No records found for given DNS query. The query was for the SRV record for _ldap._tcp.dc._msdcs.alekatest.com". The server is connected by Ethernet to
a wireless router in a home network.
The ipconfig/all data from the server is:
Windows IP Configuration
   Host Name . . . . . . . . . . . . : SERVER2012
   Primary Dns Suffix . . . . . . . :
   Node Type . . . . . . . . . . . . : Broadcast
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
Ethernet adapter Ethernet:
   Connection-specific DNS Suffix . :
   Description . . . . . . . . . . . : Intel(R) 82567LM-3 Gigabit Network Connecti
   Physical Address. . . . . . . . . : 00-26-B9-82-D5-76
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 10.0.0.2(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 10.0.0.138
   DNS Servers . . . . . . . . . . . : 10.0.0.2
   NetBIOS over Tcpip. . . . . . . . : Enabled
Tunnel adapter Teredo Tunneling Pseudo-Interface:
   Connection-specific DNS Suffix . :
   Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv6 Address. . . . . . . . . . . : 2001:0:9d38:6ab8:386b:2023:f5ff:fffd(Prefer
   Link-local IPv6 Address . . . . . : fe80::386b:2023:f5ff:fffd%14(Preferred)
   Default Gateway . . . . . . . . . : ::
   DHCPv6 IAID . . . . . . . . . . . : 335544320
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1A-FC-79-E8-00-26-B9-82-D5-76
   NetBIOS over Tcpip. . . . . . . . : Disabled
Tunnel adapter isatap.{6945E26E-B530-4271-8CF1-AD4BC13AF147}:
   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix . :
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
Tunnel adapter Reusable ISATAP Interface {74B5ED96-D12C-413B-9ED4-5B6270328AE0}:
   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix . :
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #3
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
Tunnel adapter Reusable ISATAP Interface {A9E91CEE-5350-4ACA-934D-D2AA5188B694}:
   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix . :
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #4
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
I can ping alekatest.com from the server:
Pinging alekatest.com [203.170.87.12] with 32 bytes of data:
Reply from 203.170.87.12: bytes=32 time=86ms TTL=50
Reply from 203.170.87.12: bytes=32 time=109ms TTL=50
Reply from 203.170.87.12: bytes=32 time=106ms TTL=50
Reply from 203.170.87.12: bytes=32 time=81ms TTL=50
and nslookup alekatest.com returns
Server: UnKnown
Address: 10.0.0.2
Non-authoritative answer:
Name:    alekatest.com
Address: 203.170.87.12
if I try to return srv records from alekatest.com as follows, no records are returned
PS C:\Users\Administrator> nslookup
Default Server: UnKnown
Address: 10.0.0.2
> set q=srv
> _ldap._tcp.dc._msdcs.alekatest.com
Server: UnKnown
Address: 10.0.0.2
_ldap._tcp.dc._msdcs.alekatest.com
        primary name server = ns1.crazydomains.com
        responsible mail addr = dns.crazydomains.com
        serial = 2010010101
        refresh = 7200 (2 hours)
        retry   = 120 (2 mins)
        expire = 1209600 (14 days)
        default TTL = 3600 (1 hour)
In order to add an srv record I would appear to need to access the server ns1.crazydomains.com, which I doubt is possible.
Any help would be much appreciated

You're confusing DNS Domains and Active Directory Domains. While there are similarities the two are and do completely different things.
A DNS domain, in your case alekatest.com hosted by crazydomains.com is used to direct people to resources, for instance on the internet, to get to things like your website, email etc. It's not specific to Windows, and generally speaking after purchasing
it from a 3rd party you control what the DNS records are through that 3rd party.
An Active Directory domain is what you're referring to when you talk about joining a machine to a domain, setting up users on a domain, controlling access to resources on your network etc. This doesn't require you to purchase a domain from a 3rd party, and
could potentially be called anything you like.
So, in terms of your AD server, assuming you don't already have an AD domain configured on another AD controller on the network, when you do the setup you'll need to select the option to create a new domain. You could then set it to use alekatest.com, but
that isn't recommended as you can get into all kinds of issues with your local and public DNS records conflicting, so unless you know what you're doing and why you're doing it I'd suggest avoiding that. A better idea would be to set the AD domain to something
like alekatest.local. That would then become the local domain, so for instance your users would login as akekatest\<username> on the domain, and your local machines can then be joined to that domain.
Once all that is done, if you did need to have local records for alekatest.com pointing to local resources, there's nothing stopping you from adding that zone into DNS Manager on the AD server and configuring the records accordingly, however be aware that
once you did that your server would assume that it has all the records for the domain. So if you had a website configured on
www.alekatest.com and had the DNS records for that pointing to your website hosted somewhere else via your domain provider, if you didn't re-create that same record on your local copy of the domain then you'll be unable
to reach that website from your local network (since your users will be trying to find it locally rather than on the internet).
Hope that makes sense.

ARD report to find admin users on remote computers

It there a way to tell which users have administrator rights on the remote computers? I cannot find anything in the built in reports. I have found a way to do it via terminal by finding who is in the admin group, but was wondering if there is a report built into ARD that will do this.
Thanks!

Here is Sherry's post:
http://mnscug.org/blogs/sherry-kissinger/244-all-members-of-all-local-groups-inventory-for-configmgr-2012
I hope that helps,
Nash
Nash Pherson, Senior Systems Consultant
Now Micro -
My Blog Posts
If you've found a bug or want the product worked differently,
share your feedback.
<-- If this post was helpful, please click "Vote as Helpful".

Powershell script to get firewall status on all computers on the domain

Trying to create a script that will get the status of the firewall's on all computers in the domain. I have a decent start but the formatting looks like crap and I am sure there is a better way to do this. Any help would be appreciated.
$strFilter = "computer"
$objDomain = New-Object System.DirectoryServices.DirectoryEntry
$objSearcher = New-Object System.DirectoryServices.DirectorySearcher
$objSearcher.SearchRoot = $objDomain
$objSearcher.SearchScope = "Subtree"
$objSearcher.PageSize = 1000
$objSearcher.Filter = "(objectCategory=$strFilter)"
$colResults = $objSearcher.FindAll()
foreach ($i in $colResults)
$objComputer = $i.GetDirectoryEntry()
$objComputer.Name
netsh -r $objComputer.Name advfirewall show allprofiles state | Export-Csv -append -Path C:\Firewall.csv
My export is not working as expected - it is just giving me gibberish numbers

Using the above script I was able to get the netsh output to txt. However the formatting is not very good. Not sure if there is anything that can be done about that. Unfortunately though the output does not even display the computer
name so that the output is just a bunch of the following...
Domain Profile Settings:
State                                 OFF
Private Profile Settings:
State                                 OFF
Public Profile Settings:
State                                 OFF
Ok.
Domain Profile Settings:
State                                 OFF
Private Profile Settings:
State                                 OFF
Public Profile Settings:
State                                 OFF
Ok.
How do I at least get the computer name in the text file?
I added $objComputer.Name to the loop this and it didn't work... it did not put this in the text file.
Thanks for your help
$strFilter = "computer"
$objDomain = New-Object System.DirectoryServices.DirectoryEntry
$objSearcher = New-Object System.DirectoryServices.DirectorySearcher
$objSearcher.SearchRoot = $objDomain
$objSearcher.SearchScope = "Subtree"
$objSearcher.PageSize = 1000
$searcher=[adsisearcher]'(objectCategory=computer)'
$searcher.FindAll() |
ForEach-Object{
$objComputer.Name
netsh -r $_.Properties['name'][0] advfirewall show allprofiles state
} |
Out-File -append -FilePath C:\Firewall.txt

How to collect info in AD about operational system, installed on all computers in AD domain?

The problem is to collect info in AD about operational system, installed on all computers in AD domain?

The problem is to collect info in AD about operational system, installed on all computers in AD domain?
In addition this is a nice article which covers your needs with good explanation:
Count the number of Windows XXX computers with PowerShell and Active Directory
Mahdi Tehrani |
|
www.mahditehrani.ir
Please click on Propose As Answer or to mark this post as
and helpful for other people.
This posting is provided AS-IS with no warranties, and confers no rights.
How to query members of 'Local Administrators' group in all computers?

Cannot add Computers to DSfW domain

We have been running DSfW for a couple of years.
Recently we found we couldn't add computers to the domain any longer. Also using the MMC all the existing computers are of type mSDSComputer which the team suggest what is normally there.
Both DSfW servers are running SLES10 sp3 and eDir 8.8sp3
The logs show the following error:
Aug 11 19:00:33 dsfw1 xadsd: [NETLOGON] PC02335$ opened secure channel
Aug 11 19:00:33 dsfw1 xadsd: [NETLOGON] Setting account password for object <cn=PC1234,cn=Computers,dc=company,dc=com>
Aug 11 19:00:33 dsfw1 xadsd: [NETLOGON] Setting account password failed: Access Denied.
Googling didn't reveal much useful info.
Thanks
Simon

Hi,
Thanks for responding.
Originally Posted by psahukar
Hi,
Can you please try creating a computer in MMC as the same user (used for adding the computer into the domain). If the computer creation works then I think the admin rights of that user is fine.
So I would next doubt on the password policy settings. Have the NMAS password policy settings changed that you know of ?
Also try creating a user and see how it goes.
Thanks,
Praveen Kumar
Tried adding via MMC - we get an error "Windows cannot create the object because: The requested operation did not satisfy one or more constraints associated with the class of the object"
I have followed TID 7010319 as we had an issue with ldap groups thinking this may also be the problem. But it doesn't appear to be. Also as mentioned in my OP the item type in MMC is mSDSComputer which appears as an unknown object for all the currently registered computer objects.
TIA

Issue Binding remote computers

OK, have Advanced Leopard Server running, DNS and Open Directory setup. Can Bind local computers. Tried binding remote computers and does not see/find server in Directory Utility... yet I can sign in and mount NFS shares. Does a specific port need to be open in firewall to do the binding? - Lewis

Binding is largely for login. Yes some management settings, like printers, can be passed through this way.
To print from home you should be using a VPN. The Internet is not a safe place these days. VPN creates a virtual tunnel between home and the office and you can imagine a virtual Ethernet cable passing through that tunnel.
I think a combination of Mobile accounts and VPN may be the deal for you. You might not even need mobile accounts if your users have their own Mac and are already using a local account.
VPNs are meant to be the only entry point on to your network. So once you have a VPN setup then your Internet connection should only allow VPN traffic in and nothing else, e.g. LDAP.
Ok, two basic choices for VPNs... either your router is fancy enough to have its own VPN feature or you can setup your Leopard Server to be your VPN server. The router would then need to be configured to route incoming VPN requests to your Mac server. All other types of traffic pass through the VPN.
This isn't the place for detailing exact steps for this. It would get long and complicated and there are specific info needed about your actual setup. I have to refer you to the manuals in the first instance:
http://images.apple.com/server/macosx/docs/NetworkServices_Admin_v10.5_2ndEd.pdf
http://images.apple.com/server/macosx/docs/UserManagementv10.5.mnl.pdf
Other recommended reading:
Mac OS X Support Essentials v10.5 ISBN-13: 978-0321489814
Mac OS X Server Essentials v10.5 ISBN-13: 978-0321496607
Leader-led training:
http://training.apple.com/itpro/leopard101
http://training.apple.com/itpro/leopard201
Trust me... you will feel so enlightened.

Passing Credentials When Reading Performance Counters on Remote Computers; Systems.Diagnostics namespace

Hello,
I am working on a website where I need to read a few performance counters on remote computers.
I'm using the System.Diagnostics namespace and the following is a snipet of my code:
**************** CODE *********************************************************
Try
With perf_process
.MachineName = Hostname
.CategoryName = "Process"
.CounterName = "Private Bytes"
'Write entry to log here
tmp_working_set = perf_process.NextValue()
txtWorkingSet.Text = tmp_working_set
Select Case tmp_working_set
Case Is > 80000000
working_set_status = "Red"
Case 40000000 To 80000000
working_set_status = "Green"
Case 1000000 To 40000000
working_set_status = "Yellow"
Case Else
working_set_status = "Error"
End Select
If working_set_status = "Error" Then
txtWorkingSet.BackColor = Drawing.Color.Red
txtWorkingSet.Text = String.Format(CultureInfo.InvariantCulture, "{0:0,0.0}", working_set_status)
Else
txtWorkingSet.Text = String.Format(CultureInfo.InvariantCulture, "{0:0,0.0}", tmp_working_set)
txtWorkingSet.Text = tmp_working_set
End If
End With
Catch
ErrMsg = ("Error reading the Working Set (memory) counter on " & Hostname & "." & vbCrLf & "Error number is " & Err.Number & vbCrLf & "Error description:
" & Err.Description)
MsgBox(ErrMsg)
Write_Log_Entry(Now(), ErrMsg)
ErrMsg = ""
End Try
**************** CODE *********************************************************
I usually end up with an "Access Denied" error because the account I'm running under does not have the proper permissions on the remote computer to read the counters.
How can I pass and connect to the remote computer with a different set of credentials that have access to the counters?
Exactly what permissions do I need to access the remote counters? I can read them on some of my test computers and on others, I get the "Access Denied" error.
Thanks in Advance,
DetRich
DetRich

http://forums.asp.net/
The ASP.NET forum is probably where you need to post.

Join Remote Computers to AD Domain

Similar Messages

Maybe you are looking for