Server 2012 restrict active directory dynamic ports

Hello,
Has anyone encountered issues with restricting the Active Directory dynamic ports for Netlogon and NTDS in Server 2012? I have followed the added the typical registry entries as described below but I still see my RDS gateway in the DMZ trying to communicate
to my internal DC over other ephemeral ports (49158). I have rebooted the DC after the registry changes and still no effect. Are the reg entries the same in 2012? Any help would be appreciated. Thank you
Registry key 1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters
Registry value: TCP/IP Port
Value type: REG_DWORD
Value data: 49152 (This value needs to be specified in decimal format)
Registry key 2
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
Registry value: DCTcpipPort
Value type: REG_DWORD
Value data: 49153 (This value needs to be specified in decimal format)
Eddie Espino | Secure Data Solutions | Miami, Florida | Microsoft Partner

Hi,
There are at least two options that can be used to allow replication when there are network traffic filters (aka firewall) in the network, across two DCs:
1. Use registry keys on the DCs to force communication over specific ports
2. Use IPsec to restrict the traffic to two ports only (IP 50 and IP 51)
I tried to find some relevant documents, but could not find support for restricting the Active Directory dynamic ports for Netlogon and NTDS in Server 2012. You could refer to the following article, it may help you to solve your issues:
Restricting AD Replication Traffic between DCs to only a few ports
http://blogs.technet.com/b/luistog/archive/2012/05/08/restricting-ad-replication-traffic-between-dcs-to-only-a-few-ports.aspx
Regards,
Mandy Ye

Similar Messages

Active Directory Dynamic Ports clarification

Hi All,
Please enlighten me about my question:
Scenario:
We have a Windows server 2008R2 Standard edition running Active directory services in a windows server 2003 forest functional level
(we use 2003 FFL because some of our client computers were on XP and we're running MS dynamics)
Question:
Does the dynamic port setup will depend on the version of windows server solely or will it affect by the windows servers' forest functional level?
Sorry for this question, but I strongly knew that dynamic ports setup will depend on windows server version itself, but I just want to make it sure. :D
My reference:
http://blogs.technet.com/b/askds/archive/2007/08/24/dynamic-client-ports-in-windows-server-2008-and-windows-vista-or-how-i-learned-to-stop-worrying-and-love-the-iana.aspx

Hiya,
it's based on the O/S and not related to domain architecture.
Basically it is the server that "decides" which RPC port range it will be using. As the article states, it has been changed for 2008 and up.

New Server 2012 install - Active Directory not working properly

We recently converted from 2003 to 2012. Our 2012 R2 server seems to be running fine. We did a DCPROMO on the OLD 2003 DC just fine but now there are all sorts of odd errors (Sharepoint can't authenticate users, Can't run Exchange 2013 on another 2012 server
because it can't find AD, etc.)
on the DC we have a Group Policy error 1096. "Group Policy Object LDAP://CN=User,cn={2B476B3E-2749-4B1B-8EC1-F5672A66F94F},cn=policies,cn=system,DC=mydom,DC=local\\mydom.local\SysVol\mydom.local\Policies\{2B476B3E-2749-4B1B-8EC1-F5672A66F94F}\User\registry.pol"
So far I haven't found anything on how to fix this (and the AD itself.) There are some errors in the DCDIAG log, too:
      Starting test: NetLogons
         Unable to connect to the NETLOGON share! (\\ISD-DC1\netlogon)
         [ISD-DC1] An net use or LsaPolicy operation failed with error 67,
         The network name cannot be found..
Starting test: FrsEvent
         There are warning or error events within the last 24 hours after the
         SYSVOL has been shared. Failing SYSVOL replication problems may cause
         Group Policy problems.
Any suggestions how we can fix these errors are greatly appreciated!

Hi,
Did you migrate the Active Directory from Windows server 2003 to Windows server 2012?
Please refer to this article:
https://blogs.technet.com/b/canitpro/archive/2013/05/27/step-by-step-active-directory-migration-from-windows-server-2003-to-windows-server-2012.aspx
Regards.
Vivian Wang

Upgrade from Windows Server 2012 Active Directory to Windows Server 2012 R2 Active Directory

We are currently running Windows Server 2012 Active Directory and would like to upgrade to Windows Server 2012 R2 AD. Is it OK to just do an in-place upgrade, or is it advisable to build new domain controllers on R2? Are there any guides or articles anyone
can recommend?

Hi Ginandtonic,
To upgrade DC(Domain Controller) from windows server 2012 to windows server 2012 r2, please refer to these articles:
Upgrade from windows Server 2012 to 2012 R2
Upgrade Active Directory from 2012 to 2012 R2
I hope this helps.
Best Regards,
Anna

SBS 2008 to Server 2012 R2 Active Directory Migration

Is there a tool that i can use to migrate Active Directory from SBS 2008 to Server 2012 R2?

There is no special tool for your situation. While there is a tool called ADMT that you may see mentioned if you search enough, it isn't really well suited for what you want.
With that said, there is also no *need* for a tool as I've already said. Nor do you need to recreate the users and have mismatched SIDs. You will add the 2012 machine to your existing domain and make it a domain controller. Yes, that means you will have
two DCs (for a time.) This is how larger organizations handle multiple DCs all the time, and they obviously don't go and create the same user on each DC. That is where the domain replication comes in. Your new server will be a DC and will replicate
all of the users *and* SIDs from the existing SBS server.
Then, when you are ready, you decommission the SBS 2008 server gracefully and the new 2012 server becomes your sole DC, but has AD completely intact. It is a tried and true practice, both within and outside of the SBS world, and has been done many many times.

Server 2012 Essentials Active Directory users

I am in the process of setting up a small business with 40 users and 12 workstations, most of the users will be working in a client site on they workstation and some will have access to anywhere access. I'm aware of essentials limited to 25 users, my question
is can I only create 25 AD accounts or can I create 40, as all 40 users will not require concurrent access at sny given time?

Hi,
à
when you say Essentials role experience is included, does this include Remote Anywhere feature in Essentials?
The Windows Server Essentials Experience role is available in Windows Server 2012 R2 Standard and Windows Server
2012 R2 Datacenter. When you install the Windows Server Essentials Experience role, you can take advantage of all the features that are available to you in Windows Server 2012 R2 Essentials without the locks and limits enforced in it. Windows Server Essentials
Experience role enables you to
use the Anywhere Access functionalities on the server (such as Remote Web Access and virtual private networks) to access your server, network computers, and data from remote locations in a highly secure manner. For more details, please refer to following article.
Windows Server Essentials Experience Overview
For configuring Anywhere Access functionalities in Windows Server Essentials, please refer to following article
and check if can help you.
Manage Anywhere Access in Windows Server
Essentials
By the way, if only have Windows Server 2012 Essentials, there are two scenarios in which Windows Server 2012
Essentials can be used in environments with more than 25 users. For more details, please refer to following article.
Using
Windows Server 2012 Essentials with more than 25 users
However, as Cliff and diramoh suggested,
Windows Server 2012 R2 Standard with the Windows Server Essentials Experience role installed will be a better option.
If anything I misunderstand or any update, please don’t hesitate to let us know.
Hope this helps.
Best regards,
Justin Gu

Server 2012 R2 Active Directory delegation and access

May be a simple question...
In my company I have installed a backup domain controller on hyper-v for IT administration. All I want the IT admin guy to do is create users, modify their password and join clients to domain. He should not be allowed to change group memberships, or tweak
group policies.
I understand the delegation process - using the wizard I assigned the tasks create/delete/change password and join domain. Als created a policy that allows IT admins to login to this backup domain controller.
However since the IT admins are just domain users, they are unable to open dsa.msc without providing a admin password. If i make the users Member of "Account Manager" then they are able to open the dsa after providing credential but can also change
the group permissions.
How can I implement this lock down in my environment?

Thank you so much guys. So I demoted the computer, and installed RSAT. Now the IT Managers can log onto the machine. Although had to maually set the delegation permissions (The wizard kept giving full rights on a particular condition, will discuss more on
this when i find out whats happening)
I have another problem though ..
So we have an OU: Employees, Inside the OU: I have created many template user accounts, such as Sales.Test, Service.Test, etc.
The idea is to allow IT admins to create new users by copying these templates, so that proper group association are set. However, since, I have not allowed the IT admins to change group associations, the copying fails in the end with error: cannot add user
xxx to group yyy.
Any suggestions?
-- The groups are in a seperate OU, it will be also be okay if the IT admins can change associations for selected. groups..
Why don't you simply use the Powershell method I already shared in the Wiki? That way, you should not be facing these problems.
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile

Windows Server 2008 R2 - Active Directory Replication over DynDNS

Hello,
I have one server that Windows Server 2008 R2 - Active Directory / DNS
Now some users shifted to new office with the server
Some users still in the original place that now don't have ADDS/DNS
i want to install one replication server in the original place to retrieve AD/DNS form new office via DynDNS
is that possible of not?
Best regards,

Badr, I don't think you want AD replication occurring over the internet - even if that was possible the server would need access to all the SRV records, a records, And all the ports required for communication - See here for an exhaustive list
http://social.technet.microsoft.com/wiki/contents/articles/584.active-directory-replication-over-firewalls.aspx - I don't think I have to tell you how bad opening all these ports to the internet would be.
You may want to look at Setting up a vpn or DirectAccess from the original site to the new site. This will give you more security and generally won't cost to much.
http://technet.microsoft.com/en-us/network/dd420463.aspx
Another thing that may work for you would be if you setup remote desktop services in the new location and had the original location remote into via a gateway server -
http://blogs.technet.com/b/windowsserver/archive/2012/05/09/windows-server-2012-remote-desktop-services-rds.aspx as a starting point. With RDS your users would be able to access the new location from anywhere, although there would be upfront costs associated,
licensing and server being part of them - I don't recommend turning your domain controller into an RDS server.These are just some ideas to help you with your issue

Can't connect to Small Business Server 2003 via Active Directory

I have done lots of searching, both in these forums and the wider internet, and cannot find a solution to my specific problem.
I am trying to connect my G5 (10.3.9) to a Windows network. We have a Microsoft Small Business Server 2003 with Active Directory. The PCs have no problem using this, and I can connect to shares setup on the server via AFP.
But I am having problems when I try to configure the AD plug-in in Directory Access on the Mac. When I click 'Bind', I enter the Server's Administrator username & password and when I click 'OK', it gets to Step 3 of 5 "Verifying Credentials". It ticks away at this step for about 30 seconds, then comes up with error message saying "Invalid user name and password combination."
I have tried other users with admin privileges, but they don't work either. I know the usernames and passwords aren't invalid, because I created them. I have tried fiddling around with other settings in the AD setup, but nothing gets any further.
Without any other 3rd party software (that's my final option), is there something I need to check/change, either on the Mac or the server, to make this Mac to authenticate via AD? Please help!

Hi Andbrowny, thanks for your response.
Your advice didn't really help my Active Directory problem (AD doesn't require SMB does it?), but it gave me some progress on my SMB problem. I can connect via AFP, but previously when I tried to connect via SMB, it kept coming up with the error "Could not connect to the server because the name or password is not correct".
Now, after changing the policies on the server, I get an error -43 message saying "The operation could not be completed because one or more required items cannot be found."
So now I have two problems! SMB is not finding something it needs, and Active Directory is not "verifying credentials".
Actually, I have three problems: When I am connected via AFP, filenames over 31 characters long are truncated on the server, and I can't copy long filenames onto the server without renaming them. I have read that SMB would fix this to a degree (256 characters for the complete file path), but is there anything (a protocol or software) that allows long filenames to be read/written with ease?
Side note: The server is not 100% configured, the bloke installing it still has some work to do, but Active Directory works for all the XP machines, and I can connect to each XP workstation with SMB.

Error when joining a leopard server to an active directory

Hi all,
I'd like to add my mac os x server to an active directory. If I fill the "Active Directory Domain" with ip address, "Unable to add the domain, there was no response from the ip,please check that the address you entered is correct", if I fill with domain name, "Unable to add domain, An unexpected error of type -14987 (eUndefinedError) occurred.
What's going on there???

Hi all,
I'd like to add my mac os x server to an active directory. If I fill the "Active Directory Domain" with ip address, "Unable to add the domain, there was no response from the ip,please check that the address you entered is correct", if I fill with domain name, "Unable to add domain, An unexpected error of type -14987 (eUndefinedError) occurred.
What's going on there???

Directory Security Strange Permissions Issues (Windows Server 2003 running Active Directory)

I have a user that all of a sudden was not able to open 70% of her files located on a file server, Windows Server 2003 running Active Directory, from her laptop. The same user can access all the same files from a different machine, logging on with the same
credentials. Just looking for a point in the right direction and a possible theory as what could cause this problem, an why all of a sudden. I did go back through the logs but nothing sticks out. For the most part the logs on the server and the laptop are
pretty clean.
Both machines are Latitude E5420s running Windows 7 Enterprise Service Pack 1. Both machines are 64bit and connect to the network via hard-wire, not wireless.
Thanks in advanced.
Grajek

I would recommend proceeding that way:
Check that your DCs are in a healthy state and AD replication is fine: It might be that the user is member of security groups and the membership is not getting replicated properly which can cause this random behavior. You can use
dcdiag and repadmin for checks and you can refer to my recommendations here: http://social.technet.microsoft.com/wiki/contents/articles/18513.active-directory-replication-issues-basic-troubleshooting-steps-single-ad-domain-in-a-single-ad-forest.aspx
Make sure that the file server is reachable from the user client computer. Start with
ping and nslookup. Also, you need to make sure that the traffic between the client and the server is not blocked or filtered. You might want to temporary disable security software for testing
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile

Active Directory RPC Ports - Server 2012 R2

Hi,
My networking team are looking to restrict the ports from clients to Domain Controllers.
They have opened the following ports:
TCP and UDP 389
TCP 636
TCP 3268
TCP 3269
TCP and UDP 88
TCP and UDP 53
TCP and UDP 445
UDP 123
TCP and UDP 464
UDP 138
TCP 9389
UDP 137
TCP 139
TCP/UDP 49152 - 65535
The question is do we need all of the TCP/UDP RPC Ports (49152 - 65535)? We are running Exchange and Lync. I have found articles (http://support.microsoft.com/kb/224196) which suggest I can use a static port but am concerned what impact this will have on
services.
Any help greatly appreciated.

No you do not need all the high ports open and you can restrict them and be perfectly fine.
We restrict our high ports to a range of 50,000-51,000
This is the article we use below:
http://support.microsoft.com/kb/300083
Obviously you can't click on Start in 2012 so if you move the mouse to the lower right and then click search you can search and find Component Services. You can also find it in the Administrative Tools.
Hope this helps!
If it answered your question, remember to “Mark as Answer”.
If you found this post helpful, please “Vote as Helpful”.
Postings are provided “AS IS” with no warranties, and confers no rights.
Active Directory: Ultimate Reading Collection

Windows 2012 R2 Active Directory Domain Services and Remote Desktop services Role on the same server.

Findings:
Currently, Windows 2012 R2 AD DS role and RDS With Broker services can only seem to coexist properly in a new domain not an existing domain. Any attempt to add to an existing domain causes internal database user access denied issues and any attempt to
adjust rights and circumvent is dubious at best.
The escalation technician said it best. Out of 50 clients that want to do this, they end up not being able to help 5 right off the bat for whatever reason. As for the other 40 they might be able to help by running reports, adjusting rights and trying to add
the roles until it works. This can end up being a 20 day process. Basically they are playing whack-a-mole with user rights and permissions until something sticks.
We tried creating an OU where any other domain policies would not be inherited to see if that was the issue, a fresh install with different sequence of adding the Roles, no effect.
Given the errors I witnessed when running procmon and then trying to add the roles, the NT System and the Windows Internal database user had access denied issues on 100+ registry keys when trying to add the roles. After that the system is not behaving normally.
The errors displayed almost mirror the errors that would occur on Windows 2012 when those two roles would be added which of course is officially NOT supported on that system.
This blog needs serious revision:
http://blogs.msdn.com/b/rds/archive/2013/07/09/what-s-new-in-remote-desktop-services-for-windows-server-2012-r2.aspx
This is the excerpt from that blog: Single server RDS deployment including Active Directory. We now support running our RD Connection Broker role service on the same physical instance as an Active Directory Domain Controller. In addition, we published
guidelines for how RD Session Host could be used without the RD Connection Broker.
Microsoft Support was curteous and helpful and they were the ones who advised cutting our losses, which mirrored my hunch after seeing what was transpiring in the system. They refunded my money for the support call.
For me, it was an opportunity to find out if there was any way to configure Windows 2012 R2 in the Same manner that it was setup as Windows 2008 R2 and lay that to rest. The coexistence is poorly implemented. It is as if there was a reaction from all the deprecation
of bread and butter features such as shadowing in TS and the coexistence of AD DS and RDS to where those features were re-added haphazardly. (I have no complaints on shadowing on Windows 2012 R2 it works, just do not like having to go to server manager to
use it).
I opted for virtualizing the Domain controller to eliminate the incompatibility issues and that is what I will be doing from now on. I found free solutions for backing up and reporting for virtual machines as well as the suggested procedures for configruing
a Domain controller as a virtual machine on a Hyper-V environment and I will be sticking to those. Thus far the setup has been operational.
I am not allergic to virtualization, but for really small setups it adds additional time and considerations but if that is how it has to be done, so be it. Windows 2008 R2 days are numbered and since we can usually squeeze 5-7 years on quality server equipment,
buying a Windows 2008 R2 setup now is a borderline disservice in my opinion.
Hopefully someone finds this useful and saves some time.

Hi,
Thank you for posting in Windows Server Forum.
Do you need any other assistance?
Based on your description, you are describing your story of successfully implementing RDS server with AD role and more regarding all RDS related scenario. For shadowing feature, you can use with command also. Below is the syntax to shadow a session.
mstsc /v:<ServerName> /shadow:<SessionID>
Hope it helps!
Thanks.
Dharmesh Solanki
TechNet Community Support

Windows 2012 R2 Active Directory Server Blank Screen

I have a Windows 2003 Domain, I added a Server 2012 R2 to the domain. The 2012 R2 server is a hyper-v virtual machine. When promoting the server to a domain controller it hung on the process and I had to reboot the server. When
I log into the server now with the same account I was using when I promoted the server I get a black screen. When I hit the (ctrl-alt-del) button on the hyper-v console screen I see several option such as task manager but clicking on it doesn't bring
up anything. I can also sign out. If I log in using another admin account I have no issues. If I view the application log I see a 4006 Event Id:
The Windows logon process has failed to span a user application. .... C:\Windows\system32\userinit.exe.
If I boot in safemode I am able to logon with with problem account and see the normal safe mode screen. Also, BTW the DC promotion process completed without issues.
Thanks,

So here's the situation. The domain was windows 2000, I raised the functional level to 2003 in preparation for adding windows 2012 R2 Domain controllers. I created a hyper-v VM and promoted it to a domain controller. As I mentioned when I logged
on with the account I used to promote the the Windows 2012 R2 server to a domain controller I got a black screen. It is not a core server shell. The only thing I can do is hit the ctrl-alt-del button in the console window and sign out, switch user if I click
on task manger nothing happens.
I added a second w2k12 R2 server as domain controller and had the same issue. I tried logging in with my own account as I am an enterprise admin but I got a blank screen also. The only account I can get the GUI on is the original Administrator account
"Administrator". After comparing properties on that account to two other domain admin accounts I realized the Administrator account has a Delegation tab the other accounts don't. I've been using them without issues to administer the domain
and log onto the W2k3 domain controllers. But I can only assume it is related to the account properties on these accounts.
I tried creating two other domain admin account from one of the 2012 AD servers but same issue. One account was a copy of the Administrator account and the other I created from scratch and added it to the relevant groups.
I have seen something about registering the spn for these accounts which I haven't tired yet. It seems I am missing steps when creating domain administrators.
Some had suggested I had done a minimal install but I have IE so I don't think this is the case.

VDI 3.4 Inegrate with Windows Server 2008 R2 Active Directory

OK,I follow the official documents step by step,I installed the vdi 3.4 in Oracle Linux 5.7(oraclevdi.jiayutester.com),then installed a window server 2008 r2 64bit(jiayudc.jiayutester.com) that made it to be the Domain Controller(jiayutester.com) and DNS,at the end,I edit the /etc/krb5.conf.I execute the following commands:
1.getent hosts jiayudc.jiayutester.com
--------------------My Note:Normal-----------
2.kinit -V [email protected]
Authenticated to Kerberos v5
This is my krb5.conf------------------------------------
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = JIAYUTESTER.COM
default_checksum = rsa-md5
dns_lookup_realm = true
dns_lookup_kdc = true
ticket_lifetime = 24h
forwardable = yes
[realms]
JIAYUTESTER.COM = {
kdc = space-21pel8ghu.jiayutester.com
admin_server = space-21pel8ghu.jiayu.com:749
default_domain = jiayutester.com
[domain_realm]
.jiayutester.com = JIAYUTESTER.COM
jiayutester.com = JIAYUTESTER.COM
[appdefaults]
pam = {
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
Then,I login to the web console to set company, I select Active Directory to use as User Directory,then I fill up all the needed information(I am sure that all the information I fill in the form is correct),when I click the next,error occured....it's the context:
Unable to Connect to User Directory
Failed to connect, no servers available
Now,I searched everywhere for information,but I can't resolve the problem...Please help me,smart guys

Would probably need to see your VDI instance cacao log file to see why this is failing, but you might need to add the following to [libdefaults] section of your krb5.conf file, for 2008R2 AD server:
default_tkt_enctypes = rc4-hmac
default_tgs_enctypes = rc4-hmac
And then restart VDI services (/opt/SUNWvda/sbin/vda-service restart)
Note that VDI will actually try to query individual AD servers as defines as part of your AD Global Catalog when it tries to lookup AD domain data. This means you need to verify that your global calalog referenced servers are valid and having matching forward and reverse DNS information:
For example:
$ *nslookup -querytype=any gc.tcp.vdi.com.*
Server:          win2008.vdi.com
Address:     192.168.1.100#53
gc.tcp.vdi.com     service = 0 100 3268 win2008.vdi.com*.
$ nslookup win2008.vdi.com.
Server:          win2008.vdi.com
Address:     192.168.1.100#53
Name:     win2008.vdi.com
Address: _192.168.1.100_
r$ nslookup 192.168.1.100
Server:          win2008.vdi.com
Address:     192.168.1.100#53
100.1.168.192.in-addr.arpa     name = win2008.vdi.com.*
You'd want to verify that every record returned by the *nslookup -querytype=any gc.tcp.yourdoamin.com* command refers to a server that can be reached and has matching forward and reverse DNS. Otherwise, this may trigger VDI to have failures or delays in performing directory queries.
Beyond that, you need to look in the cacao.log file for errors that you can find and post.
Edited by: DoesNotCompute on Oct 13, 2012 11:48 AM

Server 2012 restrict active directory dynamic ports

Similar Messages

Maybe you are looking for