One Domain Controller, multiple Transport Landscapes - possible?

I would like to have ONE domain controller - configured in Solution Manager - to manage TMS configuration for ECC, BI, etc. I am looking at this domain controller to be the central point for CTS+ and ChaRM.   This means multiple Development systems and associated Quality Assurance systems.
DECC --> QECC --> PECC
DBI --> QBI --> PBI
Is this even possible?
The issue seems to be the standard '/SAP/' transport group for the 'SAP target for Default Layer'.   Is there a way to set up the standard SAP transport group to be uniquely identified in the domain controller if there are multiple SAP components supported by one domain controller?
Thanks in advance for the assistance ...

Hi Peter,
Thanks for the response. My concern was the SAP default transport layer. Another team member and I worked on this in more detail and I was able to successfully a specific SAP default transport layer for each of the Development systems and give each one a unique name. I created the transport layers and transport groups and STMS accepted them, but we haven't actually used any of this yet so whether or not this is actually successful remains to be seen! If
Regards,
Laura

Similar Messages

Only One domain controller, Remote Registry service keeps DISABLING itself. Where in the registry could this be set?

This is killing my remote management. I have 4 server 2012R2 domain controllers. Only one of them is being affected with this problem. Almost everytime I check, the remote registry service is disabled again. It seems like there is a corrupt
group policy preference that keeps on attacking during a policy refresh, but I can't imagine setting a group policy to disable this service. It is needed for our remote management. Also the IP Tunnel service is also disabling. Another strange
artifact is that when I set a Windows Firewall policy to add an exception for remote administration in a group policy to my Admin workstation, it seemed to set a firewall rule in other computers to block remote administration. I can not figure out where
else this strange Windows Firewall rule Blocking remote administration could have come from. These may be related or they may not, but they are occuring on the same domain controller. I am able to set the RemoteRegistry service to enabled and to
start it (which I have done too many times now), but it constantly is being changed back to disabled. I am searching the registry to find any invalid entries or artifacts that may be affecting these two annoying effects, but I cannot find anything yet.
Any ideas? I need to know what policies will disable the remoteregistry service OR the IPTunelling service, or where in the registry this could be set to enact this during a policy refresh. Of course, any other ideas are welcome, I have spent
several days troubleshooting this, and need to conquer this by tomorrow if possible, thank you. James

Hi,
Please type
services.msc in RUN to open Services panel, navigate to the Remote Registry service. Then open its Properties and set
Startup type: Automatic. Then please check if this issue still exist.
In addition, please refer to mlippold’s suggestion (the last reply) in following thread and configure relevant
value in RemoteRegistry registry key, then check if can help you to solve this issue.
For registry items, please back up all registry items before all operations. That will help us to avoid some unexpected issue.
Remote
Registry Service stops automatically if we do not use it above 10 minutes
By the way, did you open Event Viewer and check if find any relevant errors?
If any update, please feel free to let me know.
Hope this helps.
Best regards,
Justin Gu
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Two Essentials, one Domain Controller, one Member Server....

Hi
is possible to install 2 Essentials Server : one as a Domain controller and one as a member server of the same domain?
If it's not possible, the second Essentials could be at least in Workgroup environment?
thank you

Oh, I have no clue on demoting. I am fairly certain that would be bad karma. I got lost when they stopped calling them Backup Domain Controllers. I cant see the forest for the trees.
I don't understand backup DC on a small local lan anyway. I mean most of the time if the server is down, it needs to be fixed. In a branch/quicker logins perhaps. Or maybe a LOB app on a 3rd box, but would they not login with cached creds ?
If he really wants a second DC I think Server Standard and Cals is the way to go. I do not see the advantage to adding the essentials role to a second server on the local lan for 13 users.
I don't suppose he can take it back, but he could take it home to backup his PC's there. Me thinks he would be better off spending the money he spent on the second box for backups or even Storage Craft quick boot. Server dies, you can be backup
in 10 minutes. Or just save the second box for the hardware and do practice bare metal recoveries to it periodically
Grey

Event ID 13568 With Only One Domain Controller

I had two domain controllers in an SBS 2003 domain. The very first installed domain controller died. So I seized the FSMO roles and eventually removed it from the domain by cleaning up the metadata. I told my bosses that we
really needed a new server so that there would be a replication of the AD but no go.
Now, I am getting the 13568 Event ID error on the remaining Windows Server 2003 domain controller that has the SBS Active Directory. This error requires a restore of Active Directory from system state (of which I do have a backup). I eventually
fixed the dead server and was wondering if I could install SBS 2003 to this server and then restore AD to it from the system state backup.
If that is possible, then how do I do it and how do I get this server back into the domain so that the existing DC takes its AD and replicates it to itself.
Please let me know if I have not been clear. Susan E. Russel

Hi,
Event ID 13568 indicates the replica set is in Journal wrap error state, to resolve this, no need to restore AD from backup. This error occurs if a sufficient number of changes that occur while FRS is turned off in such a way that the last USN change that
FRS recorded during shutdown no longer exists in the USN journal during startup. The risk is that changes to files and folders for FRS replicated trees may have occurred while the service was turned off, and no record of the change exists in the USN journal.
To guard against data inconsistency, FRS asserts into a journal wrap state.
What happens in a Journal Wrap? : http://blogs.technet.com/b/instan/archive/2009/07/14/what-happens-in-a-journal-wrap.aspx
Journal Wrap error resolution: http://adfordummiez.com/?p=61
Regards,
Abhijit Waikar - MCSA 2003|MCSA 2003:Messaging|MCTS|MCITP:SA

Group Policy Management Console Failes to open when one Domain Controller is powered down

Hi All,
This was an accidental discovery, but here's my dilemma. I have a site with 2 domain controllers(Windows 2008 R2), and if I shut down my second domain controller, when I try to open the Group Policy Management Console on the 1st domain controller,
it fails to open and I get the following error, "The specified domain either does not exist or could not be contacted" with 3 options to "retry", "choose another domain controller", or remove. If I go to chose another domain
controller and select the 1st domain controller it still fails. Unless the 2nd DC is turned on, I have no issues opening the GP management console. Not sure, why this is happening, I've done it in the pass without issue.
Any help would be appreciated.
Thanks

Well it seems that some how the PDC emulator is set to be the 2nd DC instead of the 1st DC on the 1st DC which explains why the failure after the 2nd DC went down. Why or should I say how could the PDC get switched from the primary DC without human intervention.
Does the PDC automatically switch for any reason?

How can I set up SSL login authentication on one domain for multiple domains

Our site currently runs in 22 countries with 22 different
country domains:
www.mysite.com
www.mysite.co.uk
www.mysite.fr
etc
We want to use SSL on our login pages but realise that the
cost of certification for every domain is expensive. One solution
would be to channel all login activity to a single domain, eg:
www.mysite.com/login.cfm?site=fr which would then redirect to
www.mysite.fr – this is how Google do it
But, currently we are using encrypted cookies for login
authentication so we would have the problem of having to transfer
the cookie info across domains securely. Is there any way of going
about this?
Any other suggestions would be great, too. We do plan to move
to session management for logins but this is a longer term project
so we are hoping to sort out the SSL prior to that.

Can you not pass the values you need as URL parameters?
Encrypt them befor you send them and then decrypt them on the new
domain. Then add them to whatever place you need (cookie, session,
etc.)?

DNS issues from one domain controller to another (but not the other way) nslookup DNS request timed out

Hi All
I've been trying to trudge my way through an issue our client is having but I'm getting nowhere fast. This issue was discovered when searching for why users at our second site were experiencing slow logons every morning (5-10minutes to login).
Within our domain there are two domain controllers for the child domain we manage.
DC1 has connection back to the parent DC's (managed by our clients parent company), and also replicates both ways with DC2. DC2 is at another site, on another subnet and replicates to and from DC1 only.
DC2 appears to have no issues, it can resolve any address, nslookup either using itself or DC1 is fine and name servers resolve fine.
DC1 has massive issues with DC2 - using it for nslookup gives me the following:
I get this timeout error for internal and external names, but both DC's are able to ping and access internet with no issues.
When trying to resolve name servers from DC1, DC2 sits at 'validating' for a while and then comes back with 'a timeout occurred during validation'.
Restarting DNS Server, NETLOGON and registering in DNS from DC2 had DC1 talking to it fine for a few minutes, but then it went back how it is (and I haven't been able to replicate this fix since).
Reverse DNS zones are setup for all the subnets used, there are A records and PTR's for both DC's.
Performing 'ping -a dc2.ip.address' from DC1 comes back fine - it knows what it is in both directions (name and IP) but nslookup and nameserver resolution is still failing.
I just don't know where to go from here - from everything I've read they should be happy... Any ideas?

Hi,
When NSLOOKUP starts, before anything else, it checks the computer's network configuration to determine the IP address of the DNS server that the computer uses.
Then it does a reverse DNS lookup on that IP address to determine the name of the DNS server.
If reverse DNS for that IP address is not setup correctly, then NSLOOKUP cannot determine the name associated with the IP address.
http://support.simpledns.com/kb/a90/nslookup-cant-find-server-name___-default-server-unknown.aspx
Also refer to:
How to fix NSLOOKUP Default Server: UnKnown?
http://www.randika.info/2013/01/how-to-fix-nslookup-default-server.html
Regards.
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Upgrading domain controller from Server 2003 to Server 2012 R2, how will this affect Exchange 2010?

Hi All,
Below is an AD and Server related post that I had submitted last week. While I did receive valid responses for the post, I was advised to check with the Exchange forums for the Exchange related question in
bold. All responses are welcomed, thank you!
===========================================================
Hi All,
I am hoping that someone could perhaps provide some insight on this topic as I apparently can't seem to google the best answer.
I have recently acquired an AD domain that is running on a 2003 domain controller. I have been tasked with upgrading our existing domain structure with 2012 R2 domain controllers for our main office and remote offices.
The domain name is company.mynetwork.com, and it is the default first site name. We have multiple offices throughout the US with their own domain controllers (i.e. FL.mynetwork.com, NY.mynetwork.com, DC.mynetwork.com, etc.).
Our main office, and default first site has one domain controller (mynetdc1) running Server 2003 R2. It is also our only DNS server for the main office. It also has an additional domain controller called mynetmaster3 which is running Server 2003.
Both mynetdc1 & mynetmaster3 NTDS settings show them as global catalogs under AD Sites & Services. Both servers are also in the AD Domain Controllers OU, along with all of the other satellite office domain controllers.
Additionally, our main office is running Exchange 2010 with the latest service pack. My questions are:
Can we demote and retire mynetmaster3, then replace mynetdc1 with a newly promoted 2012 R2 global catalog domain controller without harming anything in the domain tree and interrupting connectivity to the other offices (this of course goes without saying
after a 4 hour maintenance window to get the task completed has passed)?
Should we upgrade the satellite offices first after raising the functional level for mynetdc1, or should we do the opposite (upgrade main office, then satellite offices)?
MS Exchange 2010 is heavily dependent on AD, what effect will this entire project have on our email server? What steps should we take beforehand to ensure email continuity?
Finally, is there any shame for a Net Admin to suggest that we hire an implementation specialist for this task? :)
Any advice would be greatly appreciated!

As long as the operating system on your Exchange servers isn't upgraded, and as long as you do the Active Directory domain and forest updates in the supported manner (the following link is a good example -
http://blogs.msmvps.com/mweber/2012/07/30/upgrading-an-active-directory-domain-from-windows-server-2003-or-windows-server-2003-r2-to-windows-server-2012/), Exchange will happily operate behind the scenes. Exchange 2010 is supported in the Windows
forests (domain controllers, domain functional level and forest functional level) mentioned in the following TechNet article, which includes both Windows 2003 and Windows 2012.
http://technet.microsoft.com/en-us/library/ff728623(v=exchg.150).aspx
Due to this, you should be good as long as you do the domain controller, domain, and forest upgrades carefully. Oh, and before you start each step, get a nice backup.

Change in Active Directory Domain where a SAP landscape is installed

Dear fellow forum members,
the IT team of one of our customers is planning a change in their Microsoft Active Domain forest in their LAN: as their SAP ERP systems are all domain installations, they have asked me, as their BASIS consultant, if this activity could harm in any way their SAP landscape.
The SAP ERP Systems are domain installations on two Windows Server 2008 R2 64 bit hosts.
This is the activity they plan to do is to replace an old Windows Server 2003 domain controller with a Windows Server 2012 domain controller. These are the steps they will do:
1) Add the new Windows Server 2012 domain controller to the forest;
2) Move the main roles from the old Windows Server 2003 domain controller to the new 2012 one, following the procedure recommended by Microsoft;
3) Remove the old Windows 2003 R2 domain controller from the forest.
During all the procedure, their current Windows Server 2008 domain controller will remain active and functional. At the end of the procedure, the domain will then be updated to a Windows Server 2008 structure, from the actual 2003.
I can't see any problem in this procedure: at least one domain controller will always remain active so the SAP users <sid>adm and SAPService<SID> will be able to authenticate on the domain with no interruptions. Also the SAP hosts won't change name, FQDN, IP address or configuration.
But I'm not a Microsoft AD expert and this procedure can't be tested beforehand, because all the SAP systems belong to the same domain obviously.
I've searched through the SAP knowledge base and I can't find any note or document that is relevant to this activity.
I've also opened a ticket to SAP, but they basically replied that the Active Directory is a matter for the Microsoft consultants, not SAP. They also recommended I post my question on the forum so here I am.
So I'd like to ask you if you foresee any problems with this procedure, and if you can recommend preparation activities or any other kind of precautions.
Thanks, kind regards.
M

Hi Marcello,
I can tell you that the Network Operations group at my organization have upgraded the domain controllers a few times (Windows 2000 -> Windows 2003, then Windows 2003 -> Windows 2012), and other than some warning about potential disruptions during the maintenance window, they didn't otherwise even include the SAP Basis group in the discussion! So, it happened, we did nothing special for SAP to prepare (nor afterwards), and basically we didn't even notice. It made no difference to SAP. Other aspects of network/domain functionality, especially our Exchange email server, experienced more disruption than SAP did.
So, in conclusion, I think that your IT team can proceed, and other than keeping an eye on things and testing basic things, like network communication, afterwards, there isn't much you need to do. Your main concern is that there always be a functioning domain controller (and DNS server). Do they have a rollback plan if things go south for them?
Regards,
Matt

Samba4 Domain Controller winbind problem

Hey,
I set up a samba4 active directory domain controller including dns, kerberos, network scripts, etc. Everything is working fine so far.
Now I read that it`s possible to authenticate all users against the active directory with winbind. I did a lot of reading but couldn`t find the answer if winbind is possible with the primary domain controller on the same linux machine without another server in the network.
So clearer: We only have one server, an archlinux machine with samba4 as primary domain controller. Is it possible to use the domain users for other services like ssh or do I need to give the users a local linux account?
If it is possible what will the smb.conf have to look like?
Thanks in advance

Hey,
I set up a samba4 active directory domain controller including dns, kerberos, network scripts, etc. Everything is working fine so far.
Now I read that it`s possible to authenticate all users against the active directory with winbind. I did a lot of reading but couldn`t find the answer if winbind is possible with the primary domain controller on the same linux machine without another server in the network.
So clearer: We only have one server, an archlinux machine with samba4 as primary domain controller. Is it possible to use the domain users for other services like ssh or do I need to give the users a local linux account?
If it is possible what will the smb.conf have to look like?
Thanks in advance

Provision Search in SharePoint Foundation 2013 without Domain Controller / Active Directory - Domain accounts

Hi,
I have successfully setup SharePoint Foundation 2013 as single server farm with SQL Server Standard database in a DMZ environment using local accounts since DMZ doesn't have an Active Directory and hence Domain accounts using powershell as described
in https://theblobfarm.wordpress.com/2012/12/03/installing-sharepoint-2013-without-a-domain-controller
When I run Farm configuration wizard to provision search service application, I get an error:
ERROR: "The service application(s) for the service "Search Service Application" could not be provisioned because of the following error: I/O error occurred."
The log file logged the details of this error as:
ERROR: "Failed to create file share Analytics_e441aa1c-1a8d-4f0a-a079-58b499eb4c50 at D:\SharePoint Search\Office Server\Analytics_e441aa1c-1a8d-4f0a-a079-58b499eb4c50 (System.ArgumentException: The SDDL string contains an invalid sid or a sid
that cannot be translated."
After investigation, I found that potentially the error could be because the timer service is trying to setup a network share for analytics component (as part of provisioning search). It is trying to setup that share with a domain account that happens to
be a local user instead in this case and fails with error “System.ArgumentException: The SDDL string contains an invalid sid or a sid that cannot be translated”.
I got some pointer from the below thread
https://social.technet.microsoft.com/Forums/en-US/c8e93984-f4e5-46da-8e8a-c5c79ea1ff62/error-creating-search-service-application-on-sharepoint-foundation-with-local-account?forum=sharepointadmin
However, the above thread doesn't state that the solution worked.
I have tried creating share manually for Analytics_<Guid> folder but it doesn't work since every time farm configuration wizards is run it creates a new Analytics_<Guid> folder.
Since, I have setup SharePoint Foundation 2013 on a production environment I cannot test and trial various solutions.
Can some please guide me on how to successfully provision search for SharePoint Foundation 2013 setup as a single server farm with SQL Server Standard database in a DMZ environment using local accounts (without Active Directory - domain accounts).
Thanks in advance.
Himanshu

Microsoft documentation doesn't always specifically call out all products (Project Server isn't there, either). But it does apply. You'll need to stand up at least one Domain Controller, or allow port access back to a DC.
Preferably, set up SharePoint on the internal network and use a reverse proxy (which will terminate client connections at the reverse proxy) present in the DMZ.
Trevor Seward
Follow or contact me at...
&nbsp&nbsp
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

Hyper-V Guest Cannot Find Host Domain Controller 2012 R2

Poweredge T320 server as a Domain Controller, file server and an EXCHANGE 2010 server. There are no other servers at the site.
DHCP is from the firewall.   The DC and the file server will be on the host.
The 2010 EXCHANGE server will be on the guest. The Hyper-V
2012 R2 server cannot see the Domain Controller on the host 2012 R2 server.
The Active Directory is requesting to be promoted to a Domain Controller.
I have a logical or physical error in the installation.
It is asking to promote the Hyper-V guest 2012 R2 to a Domain Controller.
I believe I should have only one Domain Controller in this application.
After the Hyper-V guest can see the host domain controller I will install EXCHANGE 2010.
This is a test environment, offsite.
NIC1 – Host IP:192.168.1.130, 255.255.255.0, Gateway:192.168.1.1, DNS:127.0.0.1
NIC2- Only Hyper-V switch checked
Virtual Switch: 192.168.1.140, 255.255.255.0, Gateway: Blank, DNS: Was 127.0.0.1 didn’t work so I pointed it to the host, 192.168.1.130, but that didn’t work either.
Host adapter: IP:192.168.1.150, 255.255.255.0, 192.168.1.1, DNS Pointing to HOST:162.168.1.130
Active Directory and DNS installed on the guest.
Removed IPv6 from both NICs without any change.
IPAM is not installed on the host or the guest.
Several articles in Internet search didn’t help.
Thanks for your help.

Hi Steve,
I suggest referring to the following links:
REMOTEFX, WINDOWS SERVER & HYPER-V SERVER
http://blogs.technet.com/b/puneetvig/archive/2011/04/21/remotefx-windows-server-amp-hyper-v-server.aspx
RemoteFX (with Hyper-V) is a serious business tool. For games.
http://blogs.technet.com/b/tristank/archive/2012/02/17/remotefx-with-hyper-v-is-a-serious-business-tool-for-games.aspx
Best Regards,
Vincent Wu
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Installing Domain Controller certificates remotely - private key remains on local server!

Using a 3rd party CA (Entrust), I have successfully requested and installed Domain Controller certificates via the Certificates MMC snap-in.
I did this from one Domain Controller, and then just used the (right click) "Connect to another computer" option to do the rest. Everything looks absolutely fine, the certificates look ok.... certificate chain is complete, and valid (all
CA certs are installed) and the certificates say "You have the private key that corresponds to this certificate".
If I do a LDAPS bind using LDP.exe, it works fine on the first DC.
Do this on the next and I get the error:
Cannot open connection
Error 81 = ldap_connect(hLdap, NULL);
Server error: <empty>
Error <0x51>: Fail to connect to DCHostname.
After some checking I looked in the folder C:\ProgramData\Microsoft\Crypto\Keys
This contains a lot of files on the DC I was logged onto when installing the certs, and no files on any of the other DCs. I am guessing this is the private key file and it has stored all of them on the local machine I was running MMC from rather than
on the machines I connected to from MMC.
Is there any way to get these keys onto the correct DCs now - or will I have to re-request all of the others. The private key was not exportable.
I figured copying and pasting them was probably not going to work with a private key, but I tried it anyway just to be sure!
It is pretty annoying as no clue was given during the process of requesting and installing the certificates, and there is no error when you look at the certificate - they all think they have the private key associated to them, even though it rather looks
like they don't!
It's a bit painful requesting certificates here, so any help in avoiding this would be appreciated! Thank you

Thank you Elke,
So I copied the key files across from the server where they were all generated to the server I remotely connected to (which had no key files at all). Copied all just to be sure, though I’m
pretty sure which one actually relates to that server as I did them all in order - reflected by the time stamps.
Ensured all the permissions were the same, and that they were marked as ‘system’ files.
Ran the command
certutil -repairstore my [SerialNumber of cert]as
you suggested, but no luck unfortunately.
So firstly, I get the same error message:
Cannot find the certificate and private key for decryption.
CertUtil: -repairstore command FAILED: 0x80090010 (-2146893808)
And then I get:
CertUtil: Access denied.
Not sure why the access denied, I am running elevated with full local and domain administration rights.
Toby

Include a system in two different Transport Domain Controller

Hi folks,
I s it possible to configure a system in two different transport Domain Controller?
The two domain controllers will be in the same /usr/sap/trans file system.
thanks,
Má

Hello Má
Firstly to include system in the transport domain you need to have systems sharing common transport directory. Which you confirmed is the case.
Now when you try to change the Transport Domain of the system to make it part of another system it will overwrite current configuration.
Hence you wont be able to make one system part of two Domains.
There is no workaround available best of my infomation.
Regards
DG

Same transport domain. different transport directory, possible?

Hi SAP folks,
A quick query, I work on multiple systems within a single SAP transport domain. Recently we have requirements to move 2 non-ABAP systems to a different transport directory while keeping the rest intact.
The reason for this is we are doing CTS+ for the 2 non-ABAP system and do not want to share the transport directories for the rest of the ABAP system.
Please advise if this can be done and how?
The following link for SAP suggested that it's possible but stop short of how to do it.
http://help.sap.com/saphelp_nw04/helpdata/en/c4/6045377b52253de10000009b38f889/content.htm
Anyone done similar setup? care to share?
Thank you.
Regards,
Jansen

Hi,
You can do this very well. First you should remove the two systems that you wanted to configure for CTS+ from your existing transport domain. To do this, login to your existing transport domain controller and delete the systems you wanted to remove from transport domain.
To perform this:
STMS --> Overview -> Systems -> < choose the system u want to delete> -> SAP Systems -> Delete. Confirm the deletion and save and activate the changes made to ur configuration.
And then add your Non-ABAP systems you wanted to configure for CTS+ using the domain controller you decided for CTS+.
I hope this help you to perform your action.
Best Regards,
Vasanth Govindaraj

One Domain Controller, multiple Transport Landscapes - possible?

Similar Messages

Maybe you are looking for