Replication with Domain and Sub domain in Active directory sites and services

I seen many AD enviroments and know that when you have mutiple DCs you use Active Directory Sites and services to replicate using the NTDS Settings. If you have a Domain and sub domain do you need to do this as well or does it sync up automatically because
it's a sub domain? A see a couple of domains where the NTDS settings isn't being used to snyc with the child domain. Just wondering if that is normal or will it cause authentication errors?

I seen many AD enviroments and know that when you have mutiple DCs you use Active Directory Sites and services to replicate using the NTDS Settings. If you have a Domain and sub domain do you need to do this as well or does it sync up automatically
because it's a sub domain? A see a couple of domains where the NTDS settings isn't being used to snyc with the child domain. Just wondering if that is normal or will it cause authentication errors?
Two way transitive trusts are configured automatically when you create a child domain or tree root domain. You don't have to worry about site/subnet or replication part at least from trust perspective. But make sure site's names are unique in each domain.
How Domain and Forest Trusts Work
http://technet.microsoft.com/en-us/library/cc773178%28v=ws.10%29.aspx
http://technet.microsoft.com/en-us/library/cc730868.aspx
http://blogs.technet.com/b/askds/archive/2008/09/24/domain-locator-across-a-forest-trust.aspx
Awinish Vishwakarma - MVP
My Blog: awinish.wordpress.com
Disclaimer This posting is provided AS-IS with no warranties/guarantees and confers no rights.

Similar Messages

  • Route mail and Active Directory Sites and Services configuration

    Folks,
    I have a problem in the internal email routing. My network is spread across various regions and the branch offices are connected together in a mpls network (full mesh). Every region has its own Exchange Server with all roles installed and the smtp connection
    to the outside world is linked to two Exchange servers in the headquarter server farm.
    The problem is that internally I often see emails going across the Exchange Servers in the branch offices where there is low bandwidth (from 3 to 5 Mbps), thus email are sent first to these servers instead of going immediately to the Exchange hosting
    the mailboxes of the intended recipients. This happens also with inbound emails.
    This causes slowness in the email system and sometimes also the network with these branch offices suffers from packet loss or very high latency.
    I know that Exchange is a site-aware application and uses the Active Directory topology for message routing and to communicate with the services that are running on other Exchange 2013 computers. For this reason I have checked the Active Directory Sites
    and Services and surprisingly I have found that there are no sites, no subnets, nothing has been defined but the default settings, included the Inter-Sites transport which contains the default DEFAULTIPSITELINK.
    Apart from the fact that clients use logon servers which are not supposed to use in the far remote offices, I am concerned of changing the Exchange Infrastructure whilst the email system is running and I would like to ask your opinion about my next steps:
    1) Create subnets for every office
    2) Create sites and then link them to the subnets done in point 1
    3) Delete the DEFAULTIPSITELINK and create new site links based on the costs (network speed) in order to determine the best routing server. I have 5 remote offices with 5 different network bandwidth, so I'll have to create 5 IP site links: high cost for
    link with slow network, low cost for fast network.
    4) (Optional) Configure the Exchange-specific cost using the Set-AdSiteLink cmdlet to the AD IP site links created previously
    Apart from the valid questions on why the previous Exchange Administrator have forgotten to set up the Active Directory (Topology) Sites and Services...
    ...And why have chosen to install all Exchange Roles to each server when there was no reason to do that (there are two servers connected to the external smtp gateways in the headquarter, so in my opinion the Exchange Servers in the remote branch offices
    should have had only the mailbox and the cas role)...
    As a matter of fact, my idea is to go further and create the sites,subnets and the ip site link. If I still notice a wrong email flow, I can configure an ad-hoc Exchange-specific cost using the Set-AdSiteLink cmdlet. Does this sound reasonable to you guys
    or I am taking the wrong decisions?
    Thanks

    Thank you very much for your link. This is exactly the page I have read just before posting my question here. It is not easy for me to understand why this has been setup this way by a Microsoft certified engineer.
    There are specific rules to follow when Active Directory and Exchange are located in multiple sites and I am not a skilled Exchange Administrator... he keeps saying that it is correct and also tells that if I go forward with my ideas there is the
    risk to increase the level of complexity. I prefer more complexity than default setting, and as a consequence of that, connectivity problems!
    Hopefully everything goes well. I will post my results here once I have done the changes
    Regards

  • Active Directory Sites and Exchange 2013 Deployment

    I've recently took over responsibility of an Exchange 2013 Organization that is deployed as follows:
    Active Directory consists of 4 Sites. AD Site A, B, C, D  Exchange 2013 Enterprise resides in 2 of the 4 AD Sites as follows:
    AD Site A - ExchangeServer 1 and ExchangeServer 2
    AD Site B - Exchange Server 3
    AD Site C - No Exchange Servers
    AD Site D - No Exchange Servers
    All 4 AD Sites are 4 different Physical locations/datacenters. All 3 Exchange 2013 servers are multi-role servers.
    The Forest in which Exchange resides in consists of an empty Root domain, a Production (child) domain and a Test (child) domain. Exchange resides in the Production (child) domain.
    Issue: AD Site A contains DC's from all 3 domains: Root Domain, Production child Domain (this is where Exchange lives) and Test child Domain. I notice that Exchange in AD Site A is using DC's from the Root Domain for it's "DefaultGlobalCatalog",
    "DefaultConfigurationDomainController" and "DefaultPreferredDomainControllers" This to me does not seem to be very efficient as any Address Book queries will have to be referred to by the Root Domain DC's to the Production child domain
    where Exchange lives. All of the AD User accounts and mailboxes are in the Production child domain.
    In a situation such as this, would it be advisable to build 2 additional AD sites specifically for Exchange? Rather than re-IP Exchange or risk the impact of moving several other (non exchange) servers to another AD site, I would add the IP address
    of the Exchange servers /32 to the new Exchange dedicated AD Sites and erect a DC in these new sites adding its IP address /32. Any thoughts on this idea? If the subnet that exchange resides on is (for example) 10.60.3.0 /16 in AD Site A, and
    I build a new AD site for Exchange and add the IP address of the Exchange server such as 10.60.3.141/32 for this new Exchange AD Site boundary, I can still leave the 10.60.3.0 /16 unaffected in AD Site A, correct?
    I'm looking for Microsoft's best practices in terms of laying out AD and domain controllers pertaining to Exchange server 2013.

    Hi Anthouyray,
    Thank you for your question.
    We could use the following command to exclude domain controller which is root domain controller:
    Set-ExchangeServer –Identity  <exchange servername> -StaticExcludeDomainControllers <root domain controller>
    Then we could restart the service of “Microsoft Exchange Active Directory Topology” to check if the issue persist.
    If there are any questions regarding this issue, please be free to let me know.
    Best Regard,
    Jim
    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
    Jim Xu
    TechNet Community Support

  • Laptop (Running Windows 8.1) no longer able to print and now see message Active Directory Domain Services is not available

    Have a very recent Lenovo Ideapad Laptop running Windows 8.1. Connected via USB port to HP LaserJet Pro CM1415 frw Color MFP Printer. Was able to print fine nearly 2 weeks ago, but something recently happened - either a new windows or office 2013 update
    or perhaps I blew away a certain file by mistake. I can see the printer installed but cannot print to it from anything (Word, Notepad, IE, Firefox etc.). The one thing to note is that usually when I plug or unplug a USB related device, Windows 8.1 recognizes
    this and makes a certain chime noise, but with the printer USB cable it never makes that noise - making me think that it never fully recognizes the printer. Also when I select the printer (from within the control panel) and right click for properties (via
    admin rights) It never lets me fully connect to it.
    I have tried all the usual remedies - remove, install all drivers, reinstall printer, Windows update, start/stop print spooler and all other printer related services,  etc. Its really annoying because this printer was working fine nearly 2
    weeks ago. Looking for any advice now. Thanks.
    -Chris

    Hi Chris,
    à
    I have tried all the usual remedies - remove, install all drivers, reinstall printer, Windows update, start/stop print spooler and all other printer related services, etc.
    I noticed that you had reinstalled the printer. Just a confirmation, when un-install this printer, please check
    if this printer still exist in registry. For more details, please refer to following KB.
    Registry entries for printing
    If printer entry still exist in registry, please delete that printer entry and re-install this printer again,
    then check if this issue still exists. (Please backup registry entries before operating registry. It will help us to avoid unexpected issue.)
    àand now see
    message Active Directory Domain Services is not available
    By the way, would you please let me know where/when get this
    Active Directory Domain Services is not available error message? Or provide a screenshot of it?
    (Please hide all protected or private information) Please check if all services are running correctly on the computer. Meanwhile, please refer to following article and check if can help you.
    Printer
    Problem: Active Directory Domain Services is currently unavailable – Why does windows say no printers are installed?
    Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft
    does not guarantee the accuracy of this information.
    If any update, please feel free to let me know.
    Hope this helps.
    Best regards,
    Justin Gu

  • Active Directory Domain Services crash after Administrator renames object in Active Directory Users and Computers

    Hello.
    We have two domain controllers - node1 (Windows 2008 R2) and node2 (Windows 2012 R2). When administrator connects to node2 and tries to rename some object in AD (for example, user) AD Domain Services crashes and reboot server after 60 seconds.
    In Events I can see these messages:
    Log Name:      Directory Service
    Source:        Microsoft-Windows-ActiveDirectory_DomainService
    Date:          04.03.2014 12:37:58
    Event ID:      1173
    Task Category: Internal Processing
    Level:         Warning
    Keywords:      Classic
    User:          domain\admin
    Computer:      NODE2.domain.example
    Description:
    Internal event: Active Directory Domain Services has encountered the following exception and associated parameters.
    Exception:
    c0000005
    Parameter:
    0
    Additional Data
    Error value:
    7ffc7c38e45d
    Internal ID:
    0
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-ActiveDirectory_DomainService" Guid="{0e8478c5-3605-4e8c-8497-1e730c959516}" EventSourceName="NTDS General" />
        <EventID Qualifiers="32768">1173</EventID>
        <Version>0</Version>
        <Level>3</Level>
        <Task>9</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8080000000000000</Keywords>
        <TimeCreated SystemTime="2014-03-04T06:37:58.116264800Z" />
        <EventRecordID>881</EventRecordID>
        <Correlation />
        <Execution ProcessID="572" ThreadID="2580" />
        <Channel>Directory Service</Channel>
        <Computer>NODE2.domain.example</Computer>
        <Security UserID="S-1-5-21-3794920928-4165619442-305938157-2047" />
      </System>
      <EventData>
        <Data>c0000005</Data>
        <Data>7ffc7c38e45d</Data>
        <Data>0</Data>
        <Data>0</Data>
      </EventData>
    </Event>
    Log Name:      Application
    Source:        Microsoft-Windows-Wininit
    Date:          04.03.2014 12:37:58
    Event ID:      1015
    Task Category: None
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      NODE2.domain.example
    Description:
    A critical system process, C:\Windows\system32\lsass.exe, failed with status code c0000005.  The machine must now be restarted.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-Wininit" Guid="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" EventSourceName="Wininit" />
        <EventID Qualifiers="49152">1015</EventID>
        <Version>0</Version>
        <Level>2</Level>
        <Task>0</Task>
        <Opcode>0</Opcode>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2014-03-04T06:37:58.000000000Z" />
        <EventRecordID>189578</EventRecordID>
        <Correlation />
        <Execution ProcessID="0" ThreadID="0" />
        <Channel>Application</Channel>
        <Computer>NODE2.domain.example</Computer>
        <Security />
      </System>
      <EventData>
        <Data>C:\Windows\system32\lsass.exe</Data>
        <Data>c0000005</Data>
      </EventData>
    </Event>
    Log Name:      Application
    Source:        Application Error
    Date:          04.03.2014 12:37:58
    Event ID:      1000
    Task Category: (100)
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      NODE2.domain.example
    Description:
    Faulting application name: lsass.exe, version: 6.3.9600.16384, time stamp: 0x5215e25f
    Faulting module name: ntdsai.dll, version: 6.3.9600.16421, time stamp: 0x524fcaed
    Exception code: 0xc0000005
    Fault offset: 0x000000000019e45d
    Faulting process id: 0x23c
    Faulting application start time: 0x01cf3773fe973e1b
    Faulting application path: C:\Windows\system32\lsass.exe
    Faulting module path: C:\Windows\system32\ntdsai.dll
    Report Id: 85cfbe32-a367-11e3-80cc-00155d006724
    Faulting package full name:
    Faulting package-relative application ID:
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Application Error" />
        <EventID Qualifiers="0">1000</EventID>
        <Level>2</Level>
        <Task>100</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2014-03-04T06:37:58.000000000Z" />
        <EventRecordID>189576</EventRecordID>
        <Channel>Application</Channel>
        <Computer>NODE2.domain.example</Computer>
        <Security />
      </System>
      <EventData>
        <Data>lsass.exe</Data>
        <Data>6.3.9600.16384</Data>
        <Data>5215e25f</Data>
        <Data>ntdsai.dll</Data>
        <Data>6.3.9600.16421</Data>
        <Data>524fcaed</Data>
        <Data>c0000005</Data>
        <Data>000000000019e45d</Data>
        <Data>23c</Data>
        <Data>01cf3773fe973e1b</Data>
        <Data>C:\Windows\system32\lsass.exe</Data>
        <Data>C:\Windows\system32\ntdsai.dll</Data>
        <Data>85cfbe32-a367-11e3-80cc-00155d006724</Data>
        <Data>
        </Data>
        <Data>
        </Data>
      </EventData>
    </Event>
    In node2 we installed all available updates and hotfixes.

     Hi Azamat Hackimov,
    Regarding to error messages, it seems that the
    ntdsai.dll file caused the issue. Based on current situation, please use
    sfc /scannow command to scan protected system files and check if find error and repair. Meanwhile, you can also navigate to the location of this DLL file and confirm details.
    In addition, Windows Server 2012 R2 has reboot unexpectedly. Please check if you get some dump file and then analysis it. It may help us to find the root reason. Please refer
    to the following KB.
    How to read the small dump memory dump file that is created by Windows if a crash occurs.
    http://support.microsoft.com/kb/315263/en-us
    By the way, it is not effective for us to debug the crash dump file here in the forum. If this issues is a state of emergency for you. Please contact Microsoft Customer Service
    and Support (CSS) via telephone so that a dedicated Support Professional can assist with your request.
    To obtain the phone numbers for specific technology request, please refer to the web site listed below:
    http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone#faq607
    Hope this helps.
    Best regards,
    Justin Gu

  • Test-OutlookConnectivity fails with '[Microsoft.Exchange.Data.Storage.WrongServerException]: The user and the mailbox are in different Active Directory sites'.

    I have a two site DAG, and the command is running from the alternate site where the databases are not currently being hosted. The following command...
    Test-OutlookConnectivity -Protocol:TCP -TrustAnySSLCert:$true -MonitoringContext:$true
    ...errors with the following output:
    An error occurred while trying to access mailbox CurrentlyHostingMBServerName.InternalDomainName, on behalf of user InternalDomainName\extest_bb13200232474
     Additional information:
     [Microsoft.Exchange.Data.Storage.WrongServerException]: The user and the mailbox are in different Active Directory sit
    es..
        + CategoryInfo          : OperationStopped: (Microsoft.Excha...onnectivityTask:TestOutlookConnectivityTask) [Test-
       OutlookConnectivity], CasHealthStorageErrorException
        + FullyQualifiedErrorId : F2F8AC0D,Microsoft.Exchange.Monitoring.TestOutlookConnectivityTask
    I thought this command would work based on the 'AllowCrossSiteRpcClientAccess: True' option on the DAG.  The command works well if run a CAS server in the active DB site.

    Hi,
    Exchange 2013 users use Outlook Anywhere to connect to CAS server. You may run the RCA to test the connectivity:
    https://www.testexchangeconnectivity.com/
    Thanks,
    Simon Wu
    TechNet Community Support

  • Active Directory Access and Synchronization with R/3

    Dear All,
    What I have understood till now about users being maintained in Active Directory is: there are no Roles in Active Directory, users are to be assigned to Groups in the Active Directory.
    My requirement is: I have to maintain the users in Active Directory, and ensure they are in sync with my BW system CUA.
    First question is: Can we maintain users and roles in CUA?
    If I want to synchronize between Active Directory and CUA, do I always need the EP to play a part? If not, what are my alternatives?
    My second requirement is: I have to get the users and roles ( partly from Active Directory  via LDAP Connector, and partly from BW CUA ), the challenge being, I am getting users from the Active Directory, how will I determine the role it is assigned to in CUA?
    I will have the group of the user from Active Directory, where and how do I determine what is the role assigned to this user?
    Please suggest.
    Regards,
    Prosenjit.

    Prosenjit,
    My apologies, I didnt really understand your scenario.
    For your query -- I have to fetch the users from AD, check their roles, and display some relevant data.
    You create the role in portal as assign it to the group (group can be anything either AD Groups, CUA Roles which would be groups on the portal or simple portal groups). Now the role will display the reports as links in the TLN and Detail level navigation however it would only be the authorizations which control what data will be visible to the end user.
    Syncronization between AD - ABAP (CUA) would allow you to sync the user details between both the data sources roles dont come into the pitcure as far as I know and have seen (might be wrong also)
    How will I conclude to which role the user is entitles in the BW side, just by getting the group?
    I suppose you must have developed and then published reports on the portal. You will have to create a user - report matrix and then assign users to approproate groups.
    Do clarify the requirement in further detail if this doesnt solve your issue.

  • Active directory users and computers wont start on a dc, "the server is not operational"

    In our environment, we have 3 dc's 
    two which run server 2008 (they work perfectly)
    and one never off branch dc that runs server 2008 r2.
    We have been having some problems where we feel the replication isnt up too speed(stuff could take up to 24 hours to replicate) and now when i tried opening active directory users and computers i am met with this error window:
    We have a third party DNS solution.
    How do i troubleshoot this issue?

    dc01 (which replicates perfectly with dc02, and vise versa)
    dcdiag /test:dns
    C:\Users\adminuser>dcdiag /test:dns
    Domain Controller Diagnosis
    Performing initial setup:
    Done gathering initial info.
    Doing initial required tests
    Testing server: Hostingpartner\ourdc01
    Starting test: Connectivity
    ......................... ourDC01 passed test Connectivity
    Doing primary tests
    Testing server: Hostingpartner\ourdc01
    DNS Tests are running and not hung. Please wait a few minutes...
    Running partition tests on : ForestDnsZones
    Running partition tests on : DomainDnsZones
    Running partition tests on : Schema
    Running partition tests on : Configuration
    Running partition tests on : int
    Running enterprise tests on : int.domain.com
    Starting test: DNS
    Test results for domain controllers:
    DC: ourdc01.int.domain.com
    Domain: int.domain.com
    TEST: Delegations (Del)
    Error: DNS server: ourdc02.int.domain.com. IP:xx.xx.xx.32 [Broken delegated domain domaindnszones.int.domain.com.]
    Error: DNS server: ourdc02.int.domain.com. IP:xx.xx.xx.32 [Broken delegated domain forestdnszones.int.domain.com.]
    Summary of test results for DNS servers used by the above domain controllers:
    DNS server: xx.xx.xx.32 (ourdc02.int.domain.com.)
    2 test failures on this DNS server
    Delegation is broken for the domain domaindnszones.int.domain.com. on the DNS server xx.xx.xx.32
    Delegation is broken for the domain forestdnszones.int.domain.com. on the DNS server xx.xx.xx.32
    Summary of DNS test results:
    Auth Basc Forw Del Dyn RReg Ext
    Domain: int.domain.com
    ourdc01 PASS PASS PASS FAIL n/a PASS n/a
    ......................... int.domain.com failed test DNS
    dcdiag on dc01(which can replicate with dc02)
    C:\Users\adminuser>dcdiag
    Domain Controller Diagnosis
    Performing initial setup:
    Done gathering initial info.
    Doing initial required tests
    Testing server: hostingpartner\ourdc01
    Starting test: Connectivity
    ......................... OURDC01 passed test Connectivity
    Doing primary tests
    Testing server: hostingpartner\ourdc01
    Starting test: Replications
    [Replications Check,OURDC01] DsReplicaGetInfoW(PENDING_OPS) failed with error 8453,
    Win32 Error 8453.
    ......................... OURDC01 failed test Replications
    Starting test: NCSecDesc
    ......................... OURDC01 passed test NCSecDesc
    Starting test: NetLogons
    [OURDC01] User credentials does not have permission to perform this operation.
    The account used for this test must have network logon privileges
    for this machine's domain.
    ......................... OURDC01 failed test NetLogons
    Starting test: Advertising
    ......................... OURDC01 passed test Advertising
    Starting test: KnowsOfRoleHolders
    ......................... OURDC01 passed test KnowsOfRoleHolders
    Starting test: RidManager
    ......................... OURDC01 passed test RidManager
    Starting test: MachineAccount
    ......................... OURDC01 passed test MachineAccount
    Starting test: Services
    ......................... OURDC01 passed test Services
    Starting test: ObjectsReplicated
    ......................... OURDC01 passed test ObjectsReplicated
    Starting test: frssysvol
    ......................... OURDC01 passed test frssysvol
    Starting test: frsevent
    ......................... OURDC01 passed test frsevent
    Starting test: kccevent
    ......................... OURDC01 passed test kccevent
    Starting test: systemlog
    An Error Event occured. EventID: 0xC0002719
    Time Generated: 04/04/2013 15:04:29
    (Event String could not be retrieved)
    An Error Event occured. EventID: 0xC0002719
    Time Generated: 04/04/2013 15:04:50
    (Event String could not be retrieved)
    An Error Event occured. EventID: 0xC0002719
    Time Generated: 04/04/2013 15:10:56
    (Event String could not be retrieved)
    An Error Event occured. EventID: 0xC0002719
    Time Generated: 04/04/2013 15:11:17
    (Event String could not be retrieved)
    ......................... OURDC01 failed test systemlog
    Starting test: VerifyReferences
    ......................... OURDC01 passed test VerifyReferences
    Running partition tests on : ForestDnsZones
    Starting test: CrossRefValidation
    ......................... ForestDnsZones passed test CrossRefValidation
    Starting test: CheckSDRefDom
    ......................... ForestDnsZones passed test CheckSDRefDom
    Running partition tests on : DomainDnsZones
    Starting test: CrossRefValidation
    ......................... DomainDnsZones passed test CrossRefValidation
    Starting test: CheckSDRefDom
    ......................... DomainDnsZones passed test CheckSDRefDom
    Running partition tests on : Schema
    Starting test: CrossRefValidation
    ......................... Schema passed test CrossRefValidation
    Starting test: CheckSDRefDom
    ......................... Schema passed test CheckSDRefDom
    Running partition tests on : Configuration
    Starting test: CrossRefValidation
    ......................... Configuration passed test CrossRefValidation
    Starting test: CheckSDRefDom
    ......................... Configuration passed test CheckSDRefDom
    Running partition tests on : int
    Starting test: CrossRefValidation
    ......................... int passed test CrossRefValidation
    Starting test: CheckSDRefDom
    ......................... int passed test CheckSDRefDom
    Running enterprise tests on : int.domain.com
    Starting test: Intersite
    ......................... int.domain.com passed test Intersite
    Starting test: FsmoCheck
    ......................... int.domain.com passed test FsmoCheck
    The problematic dc03:
    Dcdiag gives the same output as dcdiag /test:dns
    C:\Users\adminuser>dcdiag
    Directory Server Diagnosis
    Performing initial setup:
    Trying to find home server...
    Home Server = OURDC03
    Ldap search capabality attribute search failed on server NTSDC03, return
    value = 81
    We have an infoblox dns server on ip address xxx.y.y.251.
    first error in event logs on dc03:
    error 1863
    This is the replication status for the following directory partition on this directory server.
    Directory partition:
    CN=Configuration,DC=int,DC=domain,DC=com
    This directory server has not received replication information from a number of directory servers within the configured latency interval.
    Latency Interval (Hours):
    24
    Number of directory servers in all sites:
    2
    Number of directory servers in this site:
    2
    The latency interval can be modified with the following registry key.
    Registry Key:
    HKLM\System\CurrentControlSet\Services\NTDS\Parameters\Replicator latency error interval (hours)
    To identify the directory servers by name, use the dcdiag.exe tool.
    You can also use the support tool repadmin.exe to display the replication latencies of the directory servers. The command is "repadmin /showvector /latency <partition-dn>".
    i have also go several warning 2088, 2093, 2087.
    And errors 1863 pointing to different directory partitions like schema/configuration/domaindnszones/forestdnszones

  • How to create "folders" in Active Directory Users and Computers?

    Hello Community
        In Windows Server 2008R2 when you go to Active Directory Users and Computer
    you will see icons of folders such as:
        -  Builtin has a folder icon
        - Computers has a folder icon
        - ForeignSecurityPrinicpals has a folder icon
        - Domain Controller as a folder icon
        - Managed Service Accounts has a folder icon
        - Users has a folder icon
        All of the above folders are visually identical.
        If you right click and select “File” –  “New”
     on any of the selections the icon
    will not look like the folder icon they have their own icons which look different
    from the "Folder" icon.
        I would like to create a “Folder” that looks just visually exactly like the ones
    mentioned above, how can I create those types of Folders in Active Directory User
    and Computers?
        Note: I would like to put users in the folders.
        Thank you
        Shabeaut

    Hi,
    you should use OUs (an OU is they type of object (folder) that is available for you to easily create.
    The object type you are asking about is a "container", and there are various reasons why an OU is more flexible (applying GPO, etc).
    Refer: Delegating Administration by Using OU Objects
    http://technet.microsoft.com/en-us/library/cc780779(v=ws.10).aspx   
    and the sub-articles:
    Administration of Default Containers and OUs
    http://technet.microsoft.com/en-us/library/cc728418(v=ws.10).aspx
    Delegating Administration of Account and Resource OUs
    http://technet.microsoft.com/en-us/library/cc784406(v=ws.10).aspx
    Also: http://technet.microsoft.com/en-us/library/cc961764.aspx
    Don
    (Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
    This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

  • Not able to open active directory user and computer in windows server 2008r2

    Hi All techies,
    i would like to know one issue which i am facing mostly, i have created 5 virtual machine all with window server2008r2 and one windows 7 on vm-ware now when ever i start my virtual machines everything going rite but when i try to open active directory user/
    computer or domain and trust i get a following error "data from active directory user and computers is not available from dc(null) bcoz unspecified error" even when i chk in events log its give me no help, and after 15-30 min everything works good
    Please let me know the cause of it and really appreciate it .
    Thanks
    Atul

    You need to ensure that
    1. group policy that says "wait for network before logon" is applied to all computers including servers and workstations is applied
    2. DNS record exists for all DCs in DNS
    3. If there are multiple Domain Controllers in Forests, then they point them as secondary DNS server. This way they will be able to resolve IPs if local DNS server service takes time to start.
    As Chris mentioned, you need to start all DCs first, give a time of 5 minutes and then start member servers and workstations for successful logon.
    - Sarvesh Goel - Enterprise Messaging Administrator

  • Active Directory Users and Computer not displaying column data?

    I am running Windows 8.1 Enterprise with RSAT installed.  My Domain controllers are Server 2008 R2.
    I am having and issue with Active Directory Users and Computers.  Typically I will turn on Advanced Features and then add Columns for Email address and Display Name.  This for example allows me to easily export lists of users and there email
    addresses among other things.
    The issue is that on my Windows 8.1 client, the columns for Email and Display Name are empty.  It simply will not display this information.  It only displays Name, TYpe and Description.
    If I use a Windows 7 client, the information displays correctly.
    Has anyone run into this issue or heard of this problem when using ADUC on Windows 8.1?

    ADUC is an AD tool that is no longer being improved, with Microsoft now focusing on ADAC (Administrative Center). In 8.1, it has improved quite a bit since 7. You can also just try using the
    ActiveDirectory PowerShell Module, which is easy to use and fairly powerful. It can be simple to export lists, and the module for AD is included with RSAT tools.
    Example:
    Import-Module ActiveDirectory
    Get-ADUser -Filter {Manager -eq "John.Smith"} -Properties DisplayName,Mail | Export-Csv dump.csv -NoTypeInformation
    So, recommendation: either use ADAC, or PowerShell -- ADUC is part of the wave of deprecation.

  • Active Directory Integration and home folder mounting

    Hello,
    I've set up a G4 tower with Tiger 10.4.4 and bound it to our AD domain. Authentication works perfectly, however the home directories of the users (on smb shares on windows servers) do not mount consistently. At first I thought that it was working for administrative users but not for regular users, but one of our test accounts which has no admin priv's works perfectly. It does seem to work consistently for admins, though.
    Most regular users are given a local home directory. Has anyone seen this? Any thoughts? Is there any particular log file that I might check for clues?
    I'll try get in a little later to post the output of dsconfigad -show , which might help...
    Anyhow any help will be appreciated..... thanks!
    -Jonathan

    I have been working on doing this as well. If I set the 'mount home directoy' property in the user in Active Directory Users and Computers it has worked for all users and I did not have to specify anything in the AD connector on the Macs.
    Robert

  • Hide all except one object in Active Directory Users and Computers.

    Hello,
    I have a question.. I need to allow to one group of "administrators" creating users in one OU and adding computers to the domain, nothing else. I allowed them to log on DC using the GPO "Allow log on locally", because I don't want to give
    them administrator rights, I allowed them to do these operations on one OU through delegation wizard and now I need to make all OUs, groups etc. invisible to them except this OU. What is the best way how to achieve this? Thank you...
    d.

    I would disable the ability to allow them to login. I suggest to create a Computers OU that you can delegate to the "admins" to add computers, and don't use the default Computers container.
    I assume the admins are using Windows 7 or newer. You can customize an RSAT installation to just provide the ADAC.
    Description of Remote Server Administration Tools for Windows 7:
    http://support.microsoft.com/default.aspx/kb/958830
    Remote Server Administration Tools for Windows 7:
    http://technet.microsoft.com/en-us/library/ee449475(WS.10).aspx
    Remote Server Administration Tools for Windows 7
    http://www.microsoft.com/downloads/details.aspx?FamilyID=7D2F6AD7-656B-4313-A005-4E344E43997D&displaylang=en
    Customizing - Installing Remote Server Administration Tools (RSAT) for Windows 7
    http://www.petri.co.il/remote-server-administration-tools-for-windows-7.htm
    Or if you want to chop it down and control it further, create a custom ADUC with just that OU you've delegated. I've done this in the past and worked fine for my customer:
    Delegate an Organizational Unit (OU) in Active Directory Users and Computers (ADUC), then create a custom MMC or customized RSAT
    http://blogs.msmvps.com/acefekay/2014/09/04/delegate-an-organizational-unit-ou-in-active-directory-users-and-computers-aduc-then-create-a-custom-mmc-or-customized-rsat/
    Ace Fekay
    MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
    Microsoft Certified Trainer
    Microsoft MVP - Directory Services
    Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php
    This posting is provided AS-IS with no warranties or guarantees and confers no rights.

  • Can not open Active Directory Users and Computers

    Problem Reported:
    Out of the blue this has started happening:
    When I go to "Active Directory Users and Computers" I get this message.
    "MMC cannot open the file C:\WINDOWS\system32\dsa.msc.
    This may be because the file does not exist, is not an MMC console, or was created by a later version of MMC. This may also be because you do not have sufficient access rights to the file.
    Additional information:
    This is a server that has been in use for 2+ years with active directory users that can and do login everyday.
    As far as I know the system has no backup.
    dsa.msc IS located in the system32 folder
    I am using the administrator account.
    OS:
    Microsoft Windows Server 2003 R2
    Standard x64 Edition
    Service Pack 2
    Please help with detail. Thank you.

    Have you tried to uninstall ADUC administrative tool and re-install it again? If no, please give a try. 
    This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
    Get Active Directory User Last Logon
    Create an Active Directory test domain similar to the production one
    Management of test accounts in an Active Directory production domain - Part I
    Management of test accounts in an Active Directory production domain - Part II
    Management of test accounts in an Active Directory production domain - Part III
    Reset Active Directory user password

  • Windows 2008 Server - Cannot run Active Directory Users and Computers

    Hi,
    I am running Windows 2008 Server with latest windows updates installed. Directory Services Role also.
    I attempt to open Active Directory Users and Computers tool and I get a;
    Microsoft Visual C++ Runtime Library error;
    "The Application has requested the runtime to terminate it in a unusual way. Please contact the application's support team for more information"
    I click ok, then get the following debug info;
    Problem signature:
    Problem Event Name: APPCRASH
    Application Name: mmc.exe
    Application Version: 6.0.6001.18000
    Application Timestamp: 47919524
    Fault Module Name: msvcrt.dll
    Fault Module Version: 7.0.6001.18000
    Fault Module Timestamp: 4791ad6b
    Exception Code: 40000015
    Exception Offset: 0000000000029b06
    OS Version: 6.0.6001.2.1.0.272.7
    Locale ID: 3081
    Additional Information 1: 43aa
    Additional Information 2: cf3a46656318492c1997480001b6b0e0
    Additional Information 3: 3837
    Additional Information 4: 92f72e0d0589ff77cef51e0a413aeff6
    Read our privacy statement:
    http://go.microsoft.com/fwlink/?linkid=50163&clcid=0x0409
    If someone could please assist, it would be very much appreciated.
    Regards
    B

     
    Hi,
    To solidly troubleshoot this kind of issue, we need to debug dump file. A suggestion would be to contact Microsoft Customer Service and Support (CSS) via telephone so that a dedicated Support Professional can assist with your request.
    To obtain the phone numbers for specific technology request please take a look at the web site listed below:
    http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone#faq607
    However, I am also glad to share my research.
    Some third party applications may lead to this error. Please check if you install other third party applications on Windows server 2008?
    Also, please follow the article below to perform necessary steps to see how it's going?
    FIX: You receive an "invalid page fault in module MSVCRT.DLL" error message after you install the run-time libraries from Visual C++ 6.0
    http://support.microsoft.com/kb/190536/en-us
    Hope this helps.
    Best wishes
    Morgan Che

Maybe you are looking for

  • Table Centering

    How to I center the table? I put in this line into the table area <table style="margin: auto;" However the table leans towards the right. If I can get the table to fall evenly below the navigation bar that would help.  The lines in the table header c

  • Is there a usb port to download files from another person

    I want to know if I can download a file from storage device inot an ipad?

  • Can I use 24 fps in DVDSP?

    I compressed my video in BitVice at 23.976 (the master is DVCPro 60/23.98), but when I try to import into DVD Studio Pro 4 I get an "Incompatable Format" warning and can't import. The file opens in QT and shows it is in fact an MPEG-2 file. Next I'll

  • Chalet font in Font Book not opening up in my Photoshop CS6

    Hi there, I recently had Apple do a migration from my old power pc G5 to my new iMac Mavericks. I am having trouble with a font 'Chalet' not showing up in my photoshop cs6. I added the font to my Font Book and it is visible there & is validated, but

  • Deactivate "Detailed Navigation" in an iView?

    Hi there, just a little question. I created a new URL iView and put it in to the toplevel Navigation. Thats works fine. But when i open the iview over my menu always the detailed navigation is displayed on the left side... where can i deactivate the