Setting up second Active Directory controller at remote office

I need to setup active directory controller at remote office over VPN.  Right now there is one primary DC at the main site and I need to setup the new secondary DC at a new site?  Are there any instructions or steps on setting up an additional
site to add second domain controller?    The new server is 2012R2.  The original server  is 2007 data center.

you can create the prerequisites Ad website and attached it the right subnet.
http://technet.microsoft.com/en-us/library/cc740187(v=ws.10).aspx
thereafter, it is necessary to carry out the promotion server. The config ip of the new server should be that the:
IP address: IP address new
Mask: Mask
Gateway: Gateway
DNS server: DNS server already in production of dc
After the promotion you can change the address of the DNS server to put him
http://technet.microsoft.com/en-us/library/cc526434.aspx

Similar Messages

  • Monitoring Microsoft Windows 2008 Active Directory by a remoted Agent

    Oracle documentation (E14542-01) said that for remote Agent monitoring with default settings, Grid Control can monitor only the Active Directory associated with the primary domain controller.
    But for Microsoft Windows 2008 Active Directory primary domain doesn't exist anymore, can we use a remote Agent to monitor Microsoft Windows 2008 Active Directory ?
    Thanks
    Dominik

    Dominik wrote:
    Oracle documentation (E14542-01) said that for remote Agent monitoring with default settings, Grid Control can monitor only the Active Directory associated with the primary domain controller.
    But for Microsoft Windows 2008 Active Directory primary domain doesn't exist anymore, can we use a remote Agent to monitor Microsoft Windows 2008 Active Directory ?I think , you can monitor it . Please check :
    Oracle Enterprise Manager Grid Control Certification Checker [ID 412431.1]
    How to Install the Microsoft Active Directory Plugin for Grid Control R2 [ID 359621.1]
    Regards
    Rajesh

  • EFS Encrypted Files over home workgroup network via WebDAV avoiding Active Directory fixing Access Denied errors

    This is for information to help others
    KEYWORDS:
      - Sharing EFS encrypted files over a personal lan wlan wifi ap network
      - Access denied on create new file / new fold on encrypted EFS network file share remote mapped folder
      - transfer encryption keys / certificates
      - set trusted delegation for user + computer for EFS encrypted files via
    Kerberos
      - Windows Active Directory vs network file share
      - Setting up WinDAV server on Windows 7 Pro / Ultimate
    It has been a long painful road to discover this information.
    I hope sharing it helps you.
    Using EFS on Windows 7 pro / ultimate is easy and works great. See
    here and
    here
    So too is opening + editing encrypted files over a peer-to-peer Windows 7 network.
    HOWEVER, creating a new file / new folder over a peer-to-peer Windows 7 network
    won't work (unless you follow below steps).
    Typically, it is only discovered as an issue when a home user wants to use synchronisation software between their home computers which happens to have a few folders encrypted using windows EFS. I had this issue trying to use GoodSync.
    Typically an "Access Denied" error messages is thrown when a \\clientpc tries to create new folder / new file in an encrypted folder on a remote file share \\fileserver.
    Why such a EFS drama when a network is involved?
    Assume a home peer-to-peer network with 2pc:  \\fileserver  and  \\clientpc
    When a \\clientpc tries to create a new file or new folder on a \\fileserver (remote computer) it fails. In a terribly simplified explanation it is because the process on \\fileserver that is answering the network requests is a process working for a user on
    another machine (\\clientpc) and that \\fileserver process doesn't have access to an encryption certificate (as it isn't a user). Active Directory gets around this by using kerberos so the process can impersonate a \\fileserver user and then use their certificate
    (on behalf of the clienpc's data request).
    This behaviour is confusing, as a \\clientpc can open or edit an existing efs encrypted file or folder, just can't create a new file or folder. The reason editing + opening an encrypted file over a network file share is possible is because the encrypted
    file / folder already has an encryption certificate, so it is clear which certificate is required to open/edit the file. Creating a new file/folder requires a certificate to be assigned and a process doesn't have a profile or certificates assigned.
    Solutions
    There are two main approaches to solve this:
         1) SOLVE by setting up an Active Directory (efs files accessed through file shares)
              EFS operations occur on the computer storing the files.
              EFS files are decrypted then transmitted in plaintext to the client's computer
              This makes use of kerberos to impersonate a local user (and use their certificate for encrypt + decrypt)
         2) SOLVE by setting up WebDAV (efs files accessed through web folders)
               EFS operations occur on the client's local computer
               EFS files remain encrypted during transmission to the client's local computer where it is decrypted
               This avoids active directory domains, roaming or remote user profiles and having to be trusted for delegation.
               BUT it is a pain to set up, and most online WebDAV server setup sources are not for home peer-to-peer networks or contain details on how to setup WebDAV for EFS file provision
             READ BELOW as this does
    Create new encrypted file / folder on a network file share - via Active Directory
    It is easily possible to sort this out on a domain based (corporate) active directory network. It is well documented. See
    here. However, the problem is on a normal Windows 7 install (ie home peer-to-peer) to set up the server as part of an active directory domain is complicated, it is time consuming it is bulky, adds burden to operation of \\fileserver computer
    and adds network complexity, and is generally a pain for a home user. Don't. Use a WebDAV.
    Although this info is NOT for setting up EFS on an active directory domain [server],
    for those interested here is the gist:
    Use the Active Directory Users and Computers snap-in to configure delegation options for both users and computers. To trust a computer for delegation, open the computer’s Properties sheet and select Trusted for delegation. To allow a user
    account to be delegated, open the user’s Properties sheet. On the Account tab, under Account Options, clear the The account is sensitive and cannot be delegated check box. Do not select The account is trusted for delegation. This property is not used with
    EFS.
    NB: decrypted data is transmitted over the network in plaintext so reduce risk by enabling IP Security to use Encapsulating Security Payload (ESP)—which will encrypt transmitted data,
    Create new encrypted file / folder on a network file share - via WebDAV
    For home users it is possible to make it all work.
    Even better, the functionality is built into windows (pro + ultimate) so you don't need any external software and it doesn't cost anything. However, there are a few hotfixes you have to apply to make it work (see below).
    Setting up a wifi AP (for those less technical):
       a) START ... CMD
       b) type (no quotes): "netsh  wlan set hostednetwork mode=allow ssid=MyPersonalWifi key=12345 keyUsage=persistent"
       c) type (no quotes): "netsh  wlan start hostednetwork"
    Set up a WebDAV server on Windows 7 Pro / Ultimate
    -----ON THE FILESERVER------
       1  click START and type "Turn Windows Features On or Off" and open the link
           a) scroll down to "Internet Information Services" and expand it.
           b) put a tick in: "Web Management Tools" \ "IIS Management Console"
           c) put a tick in: "World Wide Web Services" \ "Common HTTP Features" \ "WebDAV Publishing"
           d) put a tick in: "World Wide Web Services" \ "Security" \ "Basic Authentication"
           e) put a tick in: "World Wide Web Services" \ "Security" \ "Windows Authentication"
           f) click ok
           g) run HOTFIX - ONLY if NOT running Windows 7 / windows 8
    KB892211 here ONLY for XP + Server 2003 (made in 2005)
    KB907306 here ONLY for Vista, XP, Server 2008, Server 2003 (made in 2007)
      2 Click START and type "Internet Information Services (IIS) Manager"
      3 in IIS, on the left under "connections" click your computer, then click "WebDAV Authoring Rules", then click "Open Feature"
           a) on the right side, under Actions, click "Enable WebDAV"
      4 in IIS, on the left under "connections" click your computer, then click "Authentication", then click "Open Feature"
           a) on the "Anonymous Authentication" and click "Disable"
           b) on the "Windows Authentication" and click "Enable"
          NB: Some Win 7 will not connect to a webDAV user using Basic Authentication.
            It can be by changing registry key:
               [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WebClient\Parameters]
               BasicAuthLevel=2
           c) on the "Windows Authentication" click "Advanced Settings"
               set Extended Protection to "Required"
           NB: Extended protection enhances the windows authentication with 2 security mechanisms to reduce "man in the middle" attacks
      5 in IIS, on the left under "connections" click your computer, then click "Authorization Rules", then click "Open Feature"
           a) on the right side, under Actions, click "Add Allow Rule"
           b) set this to "all users". This will control who can view the "Default Site" through a web browser
           NB: It is possible to specify a group (eg Administrators is popular) or a user account. However, if not set to "all users" this will require the specified group/user account to be used for logged in with on the
    clientpc.
           NB: Any user account specified here has to exist on the server. It has a bug in that it usernames specified here are not validated on input.
      6 in IIS, on the left under "connections" click your computer, then click "Directory Browsing", then click "Open Feature"
           a) on the right side, under Actions, click "Enable"
    HOTFIX - double escaping
      7 in IIS, on the left under "connections" click your computer, then click "Request Filtering", then click "Open Feature"
           a) on the right side, under Actions, click "Edit Feature Settings"
           b) tick the box "Allow double escaping"
         *THIS IS VERY IMPORTANT* if your filenames or foldernames contain characters like "+" or "&"
         These folders will appears blank with no subdirectories, or these files will not be readable unless this is ticked
         This is safe btw. Unchecked (default) it filters out requests that might possibly be misinterpreted by buggy code (eg double decode or build url's via string-concat without proper encoding). But any bug would need to be in IIS basic
    file serving and this has been rigorously tested by microsoft, so very unlikely. Its safe to "Allow double escaping".
      8 in IIS, on the left under "connections" right click "Default Web Site", then click "Add Virtual Directory"
           a) set the Alias to something sensible eg "D_Drive", set the physical path
           b) it is essential you click "connect as" and set
    this to a local user (on fileserver),
           if left as "pass through authentication" a client won't be able to create a new file or folder in an encrypted efs folder (on fileserver)
                 NB: the user account selected here must have the required EFS certificates installed.
                            See
    here and
    here
            NB: Sharing the root of a drive as an active directory (eg D:\ as "D_Drive") often can't be opened on clientpcs.
          This is due to windows setting all drive roots as hidden "administrative shares". Grrr.
           The work around is on the \\fileserver create an NTFS symbollic link
              e.g. to share the entire contents of "D:\",
                    on fileserver browse to site path (iis default this to c:\inetpub\wwwroot)
                    in cmd in this folder create an NTFS symbolic link to "D:\"
                    so in cmd type "cd c:\inetpub\wwwroot"
                    then in cmd type "mklink /D D_Drive D:\"
            NB: WebDAV will open this using a \\fileserver local user account, so double check local NTFS permissions for the local account (clients will login using)
             NB: If clientpc can see files but gets error on opening them, on clientpc click START, type "Manage Network Passwords", delete any "windows credentials" for the fileserver being used, restart
    clientpc
      9 in IIS, on the left under "connections" click on "WebDAV Authoring Rules", then click "Open Feature"
           a) click "Add authoring rules". Control access to this folder by selecting "all users" or "specified groups" or "specified users", then control whether they can read/write/source
           b) if some exist review existing allow or deny.
               Take care to not only review the "allow access to" settings
               but also review "permissions" (read/write/source)
           NB: this can be set here for all added virtual directories, or can be set under each virtual directory
      10 Open your firewall software and/or your router. Make an exception for port 80 and 443
           a) In Windows Firewall with Advanced Security click Inbound Rules, click New Rule
                 choose Port, enter "80, 443" (no speech marks), follow through to completion. Repeat for outbound.
              NB: take care over your choice to untick "Public", this can cause issues if no gateway is specified on the network (ie computer-to-computer with no router). See "Other problems+fixes"
    below, specifically "Cant find server due to network location"
           b) Repeat firewall exceptions on each client computer you expect to access the webDAV web folders on
    HOTFIX - MAJOR ISSUE - fix KB959439
      11 To fully understand this read "WebDAV HOTFIX: RAW DATA TRANSFERS" below
          a) On Windows 7 you need only change one tiny registry value:
               - click START, type "regedit", open link
               -browse to [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MRxDAV\Parameters]
               -on the EDIT menu click NEW, then click DWORD Value
               -Type "DisableEFSOnWebDav" to name it (no speech marks)
               -on the EDIT menu, click MODIFY, type 1, then click OK 
               -You MUST now restart this computer for the registry change to take effect.
          b) On Windows Server 2008 / Vista / XP you'll FIRST need to
    download Windows6.0-KB959439 here. Then do the above step.
             NB microsoft will ask for your email. They don't care about licence key legality, it is more to keep you updated if they modify that hotfix
      12 To test on local machine (eg \\fileserver) and deliberately bypass the firewall.
            a) make sure WebClient Service is running
                (click START, type "services" and open, scroll down to WebClient and check its status)
            b) Open your internet software. Go to address "http://localhost:80" or "http://localhost:80"
                It should show the default "IIS7" image.
                If not, as firewall and port blocking are bypassed (using localhost) it must be a webDAV server setting. Check "Authorization Rules" are set to "Allow All Users"           
            c) for one of the "virtual directories" you added (8), add its "alias" onto "http://localhost/"
                    e.g. http://localhost/D_drive
                If nothing is listed, check "Directory Browsing" is enabled
      13 To test on local machine or a networked client and deliberately try and access through the firewall or port opening of your router.
            a) make sure WebClient Service is running
                (click START, type "services" and open, scroll down to WebClient and check its status)
            b) open your internet software. Go to address "http://<computer>:80" or "http://<computer>:80".
                  eg if your server's computer name is "fileserver" go to "http://fileserver:80"
                  It should show the default "IIS7" image. If not, check firewall and port blocking. 
                  Any issue ie if (12) works but (13) doesn't,  will indicate a possible firewall issue or router port blocking issue.
           c) for one of the "virtual directories" you added (8), add its "alias" onto "http://<computername>:80/"
                   eg if alias is "C_driver" and your server's computer name is "fileserver" go to "http://fileserver:80/C_drive"
                   A directory listing of files should appear.
    --- ON EACH CLIENT ----
    HOTFIX - improve upload + download speeds
      14 Click START and type "Internet Options" and open the link
            a) click the "Connections" tab at the top
            b) click the "LAN Settings" button at the bottom right
            c) untick "Automatically detect settings"
    HOTFIX - remove 50mb file limit
      15 On Windows 7 you need only change one tiny registry value:
          a) click START, type "regedit", open link
          b) browse to [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WebClient\Parameters]
           c) click on "FileSizeLimitInBytes"
           d) on the EDIT menu, click MODIFY, type "ffffffff", then click OK (no quotes)
    HOTFIX - remove prompt for user+pass on opening an office or pdf document via WebDAV
     16 On each clientpc click START, type "Internet Options" and open it
             a) click on "Security" (top) and then "Custom level" (bottom)
             b) scroll right to the bottom and under "User Authentication" select "Automatic logon with current username and password"
             SUCH an easy fix. SUCH an annoying problem on a clientpc
       NB: this is only an issue if the file is opened through windows explorer. If opened through the "open" dialogue of the software itself, it doesn't happen. This is as a WebDAV mapped drive is consdered a "web folder" by windows
    explorer.
    TEST SETUP
      17 On the client use the normal "map network drive"
                e.g. server= "http://fileserver:80/C_drive", tick reconnect at logon
                e.g. CMD: net use * "http://fileserver:80/C_drive"
             If it doens't work check "WebDAV Authoring Rules" and check NTFS permissions for these folders. Check that on the filserver the elected impersonation user that the client is logging in with (clientpc
    "manage network passwords") has NTFS permissions.
      18 Test that EFS is now working over the network
           a) On a clientpc, map network drive to http://fileserver/
           b) navigate to a folder you know on the \\flieserver is encrypted with EFS
           c) create a new folder, create a new file.
               IF it throws an error, check carefully you mapped to the WebDAV and not file share
                  i.e. mapped to "http://fileserver" not "\\fileserver"
               Check that on clientpc the required efs certificate is installed. Then check carefully on clientpc what user account you specified during the map drive process. Then check on the \\fileserver this
    account exists and has the required EFS certificate installed for use. If necessary, on clientpc click START, type "Manage Network Passwords" and delete the windows credentials currently in the vault.
           d) on clientpc (through a webDAV mapped folder) open an encrypted file, edit it, save it, close it. On the \\fileserver now check that file is readable and not gobble-de-goup
           e) on clientpc copy an encrypted efs file into a folder (a webDAV mapped folder) you know is not encrypted on \\fileserver. Now check on the \\fileserver computer that the file is readable and not gobble-de-goup (ie the
    clientpc decrypted it then copied it).
            If this fails, it is likely one in IIS setting on fileserver one of the shared virtual directories is set to: "pass through authentication" when it should be set to "connect as"
            If this is not readable check step (11) and that you restarted the \\fileserver computer.
      19 Test that clients don't get the VERY annoying prompt when opening an Office or PDF doc
          a) on clientpc in windows explorer browse to a mapped folder you know is encrypted and open an office file and then PDF.
                If a prompt for user+pass then check hotfix (16)
      20 Consider setting up a recycling bin for this mapped drive, so files are sent to recycling bin not permanently deleted
          a) see the last comment at the very bottom of
    this page: 
    Points to consider:
       - NB: WebDAV runs on \\fileserver under a local user account, so double check local NTFS permissions for that local account and adjust file permissions accordingly. If the local account doesn't have permission, the webDAV / web folder share won't
    either.
      - CONSIDER: IP Security (IPSec) or Secure Sockets Layer (SSL) to protect files during transport.
    MORE INFO: HOTFIX: RAW DATA TRANSFERS
    More info on step (11) above.
    Because files remain encrypted during the file transfer and are decrypted by EFS locally, both uploads to and downloads from Web folders are raw data transfers. This is an advantage as if data is intercepted it is useless. This is a massive disadvantage as
    it can cause unexpected results. IT MUST BE FIXED or you could be in deep deep water!
    Consider using \\clientpc to access a webfolder on \\fileserver and copying an encrypted EFS file (over the network) to a web folder on \\fileserver that is not encrypted.
    Doing this locally would automatically decrypt the file first then copy the decrypted file to the non-encrypted folder.
    Doing this over the network to a web folder will copy the raw data, ie skip the decryption stage and result in the encrypted EFS file being raw copied to the non-encrypted folder. When viewed locally this file will not be recognised as encrypted (no encryption
    file flag, not green in windows explorer) but it will be un-readable as its contents are still encrypted. It is now not possible to locally read this file. It can only be viewed on the \\clientpc
    There is a fix:
          It is implimented above, see (11) above
          Microsoft's support page on this is excellent and short. Read "problem description" of "this microsoft webpage"
    Other problems + fixes
      PROBLEM: Can't find server due to network location.
         This one took me a long time to track down to "network location".
         Win 7 uses network locations "Home" / "Work" / "Public".
         If no gateway is specified in the IP address, the network is set to '"unidentified" and so receives "Public" settings.
         This is a disaster for remote file share access as typically "network discovery" and "file sharing" are disabled under "Public"
         FIX = either set IP address manually and specify a gateway
         FIX = or  force "unidentified" network locations to assume "home" or "work" settings -
    read here or
    here
         FIX = or  change the "Public" "advanced network settings" to turn on "network discovery" and "file sharing" and "Password Protected Sharing". This is safe as it will require a windows
    login to gain file access.
      PROBLEM: Deleting files on network drive permanently deletes them, there is no recycling bin
           By changing the location of "My Contacts" or similar to the root directory of your mapped drive, it will be added to recycling bin locations
          Read
    here (i've posted a batch script to automatically make the required reg files)
    I really hope this helps people. I hope the keywords + long title give it the best chance of being picked up in web searches.

    What probably happens is that processes are using those mounts. And that those processes are not killed before the mounts are unmounted. Is there anything that uses those mounts?

  • Route mail and Active Directory Sites and Services configuration

    Folks,
    I have a problem in the internal email routing. My network is spread across various regions and the branch offices are connected together in a mpls network (full mesh). Every region has its own Exchange Server with all roles installed and the smtp connection
    to the outside world is linked to two Exchange servers in the headquarter server farm.
    The problem is that internally I often see emails going across the Exchange Servers in the branch offices where there is low bandwidth (from 3 to 5 Mbps), thus email are sent first to these servers instead of going immediately to the Exchange hosting
    the mailboxes of the intended recipients. This happens also with inbound emails.
    This causes slowness in the email system and sometimes also the network with these branch offices suffers from packet loss or very high latency.
    I know that Exchange is a site-aware application and uses the Active Directory topology for message routing and to communicate with the services that are running on other Exchange 2013 computers. For this reason I have checked the Active Directory Sites
    and Services and surprisingly I have found that there are no sites, no subnets, nothing has been defined but the default settings, included the Inter-Sites transport which contains the default DEFAULTIPSITELINK.
    Apart from the fact that clients use logon servers which are not supposed to use in the far remote offices, I am concerned of changing the Exchange Infrastructure whilst the email system is running and I would like to ask your opinion about my next steps:
    1) Create subnets for every office
    2) Create sites and then link them to the subnets done in point 1
    3) Delete the DEFAULTIPSITELINK and create new site links based on the costs (network speed) in order to determine the best routing server. I have 5 remote offices with 5 different network bandwidth, so I'll have to create 5 IP site links: high cost for
    link with slow network, low cost for fast network.
    4) (Optional) Configure the Exchange-specific cost using the Set-AdSiteLink cmdlet to the AD IP site links created previously
    Apart from the valid questions on why the previous Exchange Administrator have forgotten to set up the Active Directory (Topology) Sites and Services...
    ...And why have chosen to install all Exchange Roles to each server when there was no reason to do that (there are two servers connected to the external smtp gateways in the headquarter, so in my opinion the Exchange Servers in the remote branch offices
    should have had only the mailbox and the cas role)...
    As a matter of fact, my idea is to go further and create the sites,subnets and the ip site link. If I still notice a wrong email flow, I can configure an ad-hoc Exchange-specific cost using the Set-AdSiteLink cmdlet. Does this sound reasonable to you guys
    or I am taking the wrong decisions?
    Thanks

    Thank you very much for your link. This is exactly the page I have read just before posting my question here. It is not easy for me to understand why this has been setup this way by a Microsoft certified engineer.
    There are specific rules to follow when Active Directory and Exchange are located in multiple sites and I am not a skilled Exchange Administrator... he keeps saying that it is correct and also tells that if I go forward with my ideas there is the
    risk to increase the level of complexity. I prefer more complexity than default setting, and as a consequence of that, connectivity problems!
    Hopefully everything goes well. I will post my results here once I have done the changes
    Regards

  • Distribute active directory allow administration by

    Hi!
    We're in the process of setting up profile distribution through Mac OS Server (we're all Mavericks), and would like to distribute the settings to allow administration by Active Directory domain admins (normally set in the Active Directory settings using the Directory Utility), rather than having to do this manually on each enrolled machine.
    Is this possible - and if so, how?
    Cheers,
    Erwin Wessels

    Once profile manager is set up and ready to go on your server go to
    https://server.name.com/profilemanager
    Login and set up a Device Group with the settings that you want for the AD.
    Once complete then each machine needs to be enrolled.
    You have to add a 2 profiles
    1. Trust Profile
    2. Remote Management
    This is done through the My Devices web interface
    https://server.name.com/mydevices
    Once you have these profiles installed and the machines connected to the network you will not have to be at the machine to change settings again as it can all be controlled from the Profile Manager web interface.

  • How to authenticate user in Active Directory for an Oracle report

    Hey there,
    We have users of 1 report all over the country.
    Currently, when using the report, the user chooses a location as a parameter, then runs the report.
    The problem is we don't want the user to be able to see data from other locations, only their own.
    So how can I do this as all users are set up in Active Directory, but the only thing that distinguishes them apart is under the Properties of the user, under the General tab, the Office field says where they are located.
    Thanks in advance!

    Hey there,
    We have users of 1 report all over the country.
    Currently, when using the report, the user chooses a location as a parameter, then runs the report.
    The problem is we don't want the user to be able to see data from other locations, only their own.
    So how can I do this as all users are set up in Active Directory, but the only thing that distinguishes them apart is under the Properties of the user, under the General tab, the Office field says where they are located.
    Thanks in advance!

  • Open directory and Active directory

    Hello everyone.
    I am from a school in london. We currently have 8 servers (7 running Server 2003 and a recently installed Mac server running os x server 10.5)
    We have recently installed new macs into our media room and need them to be set up to work with the current domain setup.
    what we wish to do is to run the media centers computers through the Mac server but get the existing domain information from the Active directory server running windows. As i have not set up a mac server before I am having certain difficulties doing this. The first time we set up the active directory on the mac server we could log into the mac computers but could not change any of the policies to different groups to allow or deny certain applications from running. Everytime i go to save a policy for a certain group we get the error message
    "Error while saving record "Finchley\Level 1@ Error -14140
    Im guessing this is because we are trying to save that to the active directory and not onto the mac server so how can we Map the active directory to the Macs open directory so that we can customize the mac group policies?
    Sorry if that didnt make alot of sense im typing abit fast
    Thanks

    Have you been here?
    http://docs.info.apple.com/article.html?path=DirectoryAccess/1.8/en/c7od45.html
    It should be straight forward, depending on how your AD accounts are setup.
    Unfortunately, I currently see a bug in the system which is often causing the home directory share to fail to mount when I use the AD plug-in in its default configuration. I'm pleading with Apple to fix this soon.
    If you use the plug-in in "true network home" fashion, by unchecking the 'force local home' option, then you should avoid this annoying bug. This method however requires plenty of network bandwidth and space for your entire Mac home folder.

  • Active Directory in 11.1.2

    HI,
    I set up an Active Directory in shared services (we used hostname not DNS lookup as adviced by our admin). Now when i log in as Windows user i can only see under AD folder only the user that have logged in and in Native Directory there is NO USER. But logging to planning as any user (now they dissapperad from ss) is possible.
    Please help us how can we proceed with this
    thank you very much
    lubos

    Hi,
    1. I installed Active Directory
    2. In SS i run configure user directory and choose MSAD
    3. I set up info for my first screen - BUT SS does not let me into manage users and manage groups screen!!!
    4. Restart everything
    5. Now i am able to login to SS as admin/password or user/password(from AD with full administration rights)
    6. In SS every option is greyed-out except for security reports i guess.
    7. I do not see any users in my native directory or AD folder. I can not create users or make whatever changes .....
    8. I can not log on to my planning application APP1 as no user (that were my native directory users - now dissappeard from SS).
    Thank you very much

  • If Active Directory will be effected when upgrade to Windows Server2008

    Client will upgrading its existing AD to Windows Server 2008 version. Will like to know what will be the impact to our ALUI portal.
    We have used AquaLogic Interaction Identity Service - Active Directory to create remote authentication and profile sources. And the users are currently being synchronized between the client's existing AD and ALUI database on the daily basis.
    If the client upgrades the AD version, what will happend to the existing "AD users" in ALUI database. The upgrading may involves installation a new AD 2008
    The existing client AD is installed in a separate machine from ALUI portal.
    Thanks,

    Hi there! Your laptop is certainly 'Windows 10 ready' as mentioned in the website: http://us.acer.com/ac/en/US/content/series/aspire-e You may also want to look into the following forum too: http://community.acer.com/t5/Windows-10/Welcome-to-the-Windows-10-forum-Start-here-first/m-p/366899#U366899 Regards

  • Active directory intersite replication minimum polling interval is 15 min or 7.5 min ?

    in  MCITP 70-640 R2 Self-paced training kit , at page 593, we read :
    "The minimum polling interval is 15 minutes. With this setting, and using Active Directory’s
    default replication configuration, a change made to the directory in one site takes on average
    seven and a half minutes to replicate to domain controllers in another site."
    i don't underestand which one is true at last ? 15 min or  7.5 min ?
    i wonder at my exercises i noticed that replication occured between sites at about that 7.5 min  and didn't take  15 min.
    if that is 7.5 min , so what is the reason that they wrote 15 min ?

    at a maximum 15 min.
    the so called average is 7,5 min <----- forget this!
    remember the following as your rule of thumb: the minimum interval that can be configured is 15 min and the default is 180 min (3 hours). The interval is the max amount of time that needs to pass before the DCs (between sites) initiates inbound replication.
    So it will take the period of the interval or less before replications starts
    <o:p></o:p>
    Cheers,<o:p></o:p>
    (HOPEFULLY THIS INFORMATION HELPS YOU!)
    Jorge de Almeida Pinto | MVP Identity & Access - Directory Services
    * This posting is provided "AS IS" with no warranties and confers no rights!
    * Always evaluate/test yourself before using/implementing this!
    * DISCLAIMER: http://jorgequestforknowledge.wordpress.com/disclaimer/
    ################# Jorge's Quest For Knowledge ###############
    ###### BLOG URL: http://JorgeQuestForKnowledge.wordpress.com/ #####
    #### RSS Feed URL: http://jorgequestforknowledge.wordpress.com/feed/ ####
    -------------------------------------------------------------------------------------------------------<o:p></o:p>
    "john.s2011" wrote in message news:[email protected]...
    in  MCITP 70-640 R2 Self-paced training kit , at page 593, we read :
    "The minimum polling interval is 15 minutes. With this setting, and using Active Directory�??s
    default replication configuration, a change made to the directory in one site takes on average
    seven and a half minutes to replicate to domain controllers in another site."
    i don't underestand which one is true at last ? 15 min or  7.5 min ?
    i wonder at my exercises i noticed that replication occured between sites at about that 7.5 min  and didn't take  15 min.
    if that is 7.5 min , so what is the reason that they wrote 15 min ?
    Jorge de Almeida Pinto [MVP-DS] (http://jorgequestforknowledge.wordpress.com/)

  • New Version of the Azure Active Directory Module and PowerShell 2.0

    Since the last upgrade of the Azure Active Directory Module for Windows PowerShell (64-bit version), we are no longer able to load it in an application targeting .NET Framework 3.5 SP1. The error message that we receive is:
    Could not load file or assembly 'file:///C:\Windows\system32\WindowsPowerShell\v1.0\Modules\MSOnline\Microsoft.Online.Administration.Automation.PSModule.dll' or one of its dependencies. This assembly is built by a runtime newer
    than the currently loaded runtime and cannot be loaded.
    Our application loads and uses the Azure AD PowerShell Module for Azure AD management. The previous version of the module available until September worked well, however, we cannot use the new version because it is built using the .NET Framework 4.0 runtime,
    and our application targets .NET Framework 3.5 SP1.
    The link for the old version of the module was removed, and since the EULA for the module restricts us from making the old version available on our web site, we need a solution that would enable us
    to load the module in our application because we cannot retarget the application to a newer Framework version. In particular,
    we need a link that our customers can use to download the old version of the module.
    Is there a URL to the old version of the Azure Active Directory Module that we can download the old version from? Can someone help?

    Hi Vladimir,
    Since I'm not familiar with AZure AD, to get the old version of Azure AD Module, I also recommend you can post in Azure AD forum for more effective support:
    http://social.msdn.microsoft.com/forums/azure/en-US/home?forum=WindowsAzureAD
    However, for the error you posted, as you said, this is related to .NET version.
    I found a similar error, which was solved by upgrading the Powershell version 3.0 on Server 2008 R2 sp1, which also need to update the .NET version on server.
    Active Directory Single sign-on Office 365 Powershell Error
    If there is anything else regarding the powershell, please feel free to post back.
    Best Regards,
    Anna Wang
    Anna, yep upgrading to version 3.0 simple solve the issue. But WMF 3.0 is not compatible with few things like
    SharePoint 2010, Exchange 2007 , SCCM etc.
    WMF 3.0 has the same .NET version so how about making a configuration file in version 2.0
    I am not really sure if Azure support this but its worth to make your configuration file to support .NET 4.0
    $PShome\PowerShell_ISE.CONFIG and $PSHOME\PowerShell.exe.config will be not existing.
    So you can make an entry in configuration to support .NET framework 4.0
    like shown below
    $config_text = @"
    <?xml version="1.0"?>
    <configuration>
    <startup useLegacyV2RuntimeActivationPolicy="true">
    <supportedRuntime version="v4.0.30319"/>
    <supportedRuntime version="v2.0.50727"/>
    </startup>
    </configuration>
    $config_text| Out-File $pshome\powershell.exe.config
    $config_text| Out-File $pshome\powershell_ise.exe.config
    Close PowerShell Console and open as administrator.
    Try loading the modules back and let me know.
    Regards Chen V [MCTS SharePoint 2010]

  • Help with setting up active directory domain controller/DNS - need this for Clustering

    Disclaimer: I am new to Active Directory, so please dont rule out the obvious things I may have overlooked.
    I need to set up Active Directory Domain controller on at least one server so I can run clustering. I set up the domain controller and ran Cluster validation and that failed - unable to reach writable domain controller.
    When I look at my server manager AD DS complain about DNS:
    NASE-2012-234    4015    Error    Microsoft-Windows-DNS-Server-Service    DNS Server    1/14/2014 12:54:06 AM
    The DNS server has encountered a critical error from the Active Directory. Check that the Active Directory is functioning properly. The extended error debug information (which may be empty) is "". The event data contains the error.
    When I click on DNS this is the error:
    The DNS server has encountered a critical error from the Active Directory. Check that the Active Directory is functioning properly. The extended error debug information (which may be empty) is "". The event data contains the error.
    Output of DCDiag -v is below.
    PS C:\Users\Administrator> dcdiag -v
    Directory Server Diagnosis
    Performing initial setup:
       Trying to find home server...
       * Verifying that the local machine NASE-2012-234, is a Directory Server.
       Home Server = NASE-2012-234
       * Connecting to directory service on server NASE-2012-234.
       * Identified AD Forest.
       Collecting AD specific global data
       * Collecting site info.
       Calling ldap_search_init_page(hld,CN=Sites,CN=Configuration,DC=lab,DC=nase,DC=com,LDAP_SCOPE_SUBTREE,(objectCategory=
    ntDSSiteSettings),.......
       The previous call succeeded
       Iterating through the sites
       Looking at base site object: CN=NTDS Site Settings,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=lab,DC=nas
    e,DC=com
       Getting ISTG and options for the site
       * Identifying all servers.
       Calling ldap_search_init_page(hld,CN=Sites,CN=Configuration,DC=lab,DC=nase,DC=com,LDAP_SCOPE_SUBTREE,(objectClass=ntD
    SDsa),.......
       The previous call succeeded....
       The previous call succeeded
       Iterating through the list of servers
       Getting information for the server CN=NTDS Settings,CN=NASE-2012-234,CN=Servers,CN=Default-First-Site-Name,CN=Sites,C
    N=Configuration,DC=lab,DC=nase,DC=com
       objectGuid obtained
       InvocationID obtained
       dnsHostname obtained
       site info obtained
       All the info for the server collected
       * Identifying all NC cross-refs.
       * Found 1 DC(s). Testing 1 of them.
       Done gathering initial info.
    Doing initial required tests
       Testing server: Default-First-Site-Name\NASE-2012-234
          Starting test: Connectivity
             * Active Directory LDAP Services Check
             The host c0c507c4-fb9b-49a6-9a01-ef79d7960c94._msdcs.lab.nasecom could not be resolved to an IP address.
             Check the DNS server, DHCP, server name, etc.
             Got error while checking LDAP and RPC connectivity. Please check your firewall settings.
             ......................... NASE-2012-234 failed test Connectivity
    Doing primary tests
       Testing server: Default-First-Site-Name\NASE-2012-234
          Skipping all tests, because server NASE-2012-234 is not responding to directory service requests.
          Test omitted by user request: Advertising
          Test omitted by user request: CheckSecurityError
          Test omitted by user request: CutoffServers
          Test omitted by user request: FrsEvent
          Test omitted by user request: DFSREvent
          Test omitted by user request: SysVolCheck
          Test omitted by user request: KccEvent
          Test omitted by user request: KnowsOfRoleHolders
          Test omitted by user request: MachineAccount
          Test omitted by user request: NCSecDesc
          Test omitted by user request: NetLogons
          Test omitted by user request: ObjectsReplicated
          Test omitted by user request: OutboundSecureChannels
          Test omitted by user request: Replications
          Test omitted by user request: RidManager
          Test omitted by user request: Services
          Test omitted by user request: SystemLog
          Test omitted by user request: Topology
          Test omitted by user request: VerifyEnterpriseReferences
          Test omitted by user request: VerifyReferences
          Test omitted by user request: VerifyReplicas
          Test omitted by user request: DNS
          Test omitted by user request: DNS
       Running partition tests on : ForestDnsZones
          Starting test: CheckSDRefDom
             ......................... ForestDnsZones passed test CheckSDRefDom
          Starting test: CrossRefValidation
             ......................... ForestDnsZones passed test CrossRefValidation
       Running partition tests on : DomainDnsZones
          Starting test: CheckSDRefDom
             ......................... DomainDnsZones passed test CheckSDRefDom
          Starting test: CrossRefValidation
             ......................... DomainDnsZones passed test CrossRefValidation
       Running partition tests on : Schema
          Starting test: CheckSDRefDom
             ......................... Schema passed test CheckSDRefDom
          Starting test: CrossRefValidation
             ......................... Schema passed test CrossRefValidation
       Running partition tests on : Configuration
          Starting test: CheckSDRefDom
             ......................... Configuration passed test CheckSDRefDom
          Starting test: CrossRefValidation
             ......................... Configuration passed test CrossRefValidation
       Running partition tests on : lab
          Starting test: CheckSDRefDom
             ......................... lab passed test CheckSDRefDom
          Starting test: CrossRefValidation
             ......................... lab passed test CrossRefValidation
       Running enterprise tests on : lab.nasecom
          Test omitted by user request: DNS
          Test omitted by user request: DNS
          Starting test: LocatorCheck
             GC Name: \\NASE-2012-234.lab.nasecom
             Locator Flags: 0xe000f3fd
             PDC Name: \\NASE-2012-234.lab.nasecom
             Locator Flags: 0xe000f3fd
             Time Server Name: \\NASE-2012-234.lab.nasecom
             Locator Flags: 0xe000f3fd
             Preferred Time Server Name: \\NASE-2012-234.lab.nasecom
             Locator Flags: 0xe000f3fd
             KDC Name: \\NASE-2012-234.lab.nasecom
             Locator Flags: 0xe000f3fd
             ......................... lab.nase.com passed test LocatorCheck
          Starting test: Intersite
             Skipping site Default-First-Site-Name, this site is outside the scope provided by the command line arguments
             provided.
             ......................... lab.nasecom passed test Intersite
    PS C:\Users\Administrator>

    http://social.technet.microsoft.com/Forums/en-US/home?forum=winserverDS is the forum for Directory Services questions.  You might want to post your question there.
    .:|:.:|:. tim

  • Microsoft Exchange Server 2013 Cumulative Update 7 Setup - Active Directory Topology service on server 'TopologyClientTcpEndpoint (localhost)' returned an error - Set-SharedConfigDC

    What am I trying to do?
    I have tried installing Microsoft Exchange Server 2013 Cumulative Update 7 Setup on a fresh install of Windows Server 2012 R2 but it gets stuck when running the setup exe on Step 8 of 14 “Mailbox Transport Service” I have included full
    error logs at the bottom of the page but the basics are in order it will throw which loop around are:
    [01/20/2015 17:13:20.0084] [2] Beginning processing Set-SharedConfigDC
    [01/20/2015 17:13:20.0178] [2] The call to Microsoft Exchange Active Directory Topology service on server 'TopologyClientTcpEndpoint (localhost)' returned an error. Error details No Minimal Required Number of Suitable Directory Servers
    Found in Forest mydomain.com Site Default-First-Site and connected Sites..
    [01/20/2015 17:13:20.0178] [2] No Minimal Required Number of Suitable Directory Servers Found in Forest mydomain.com Site Default-First-Site and connected Sites.
    Exchange is currently running in the envirmonet on 2010 Sp3 I am installing 2013 CU7 fresh so I can migrate the databases over.
    What am I running?
    2 X DC on domain and forest functional level 2008R2 both writable
    1 X fresh install of Windows 2012 R2 which is domain joined
    What have I tried?
    Checked Ipv6 is enabled on all DC NICS and Existing Exchange Servers
    Rebooted every server
    Run setup as Administrator
    My account is part of the domain Enterprise Admin group
    Tried adding "Exchange Server" or "Exchange Enterprise Servers" to the group policy and doing the relevant gpupdate /force and reboot :
    Computer Configuration Windows Settings
    Security Settings + Local Policies
    User Rights Assignment Mange auditing and security log
    Turned off firewall on DC and Exchange Server even stopped the service
    Turned off all AV on the DC and Exchange Server
    Checked I could telnet to global catalog servers on port 3268 which I can
    Checked the global catalog records existed in DNS which they all do
    Done the obvious ping tests all round which confirms connectivity
    Schema has been prepared using appropriate commands before running the setup exe
    setup.exe /PrepareSchema /IacceptExchangeServerLicenseTerms
    Making sure the following path has full permissions:
    EXCHANGE14:\Current\Release\Shared\Datacenter\Setup
    Restarted Microsoft Exchange Active Directory Topology service
    DcDiag all looks good
    What have I noticed that is suspicious?
    Microsoft Exchange Transport service will not start even though both of its dependences services have started:
    Microsoft Filtering Management Service
    Microsoft Exchange Active Directory Topology Service
    It will eventually error with
    “Windows could not start the Microsoft Exchange Transport Service on local computer
    Error 1053: This Service did not respond to the start of control request in a timely fashion”
    This error is from the GUI wizard itself:
    Error:
    The following error was generated when "$error.Clear();
    $maxWait = New-TimeSpan -Minutes 8
    $timeout = Get-Date;
    $timeout = $timeout.Add($maxWait);
    $currTime = Get-Date;
    $successfullySetConfigDC = $false;
    while($currTime -le $timeout)
    $setSharedCDCErrors = @();
    try
    Set-SharedConfigDC -DomainController $RoleDomainController -ErrorVariable setSharedCDCErrors -ErrorAction SilentlyContinue;
    $successfullySetConfigDC = ($setSharedCDCErrors.Count -eq 0);
    if($successfullySetConfigDC)
    break;
    Write-ExchangeSetupLog -Info ("An error ocurred while setting shared config DC. Error: " + $setSharedCDCErrors[0]);
    catch
    Write-ExchangeSetupLog -Info ("An exception ocurred while setting shared config DC. Exception: " + $_.Exception.Message);
    Write-ExchangeSetupLog -Info ("Waiting 30 seconds before attempting again.");
    Start-Sleep -Seconds 30;
    $currTime = Get-Date;
    if( -not $successfullySetConfigDC)
    Write-ExchangeSetupLog -Error "Unable to set shared config DC.";
    " was run: "System.Exception: Unable to set shared config DC.
    at Microsoft.Exchange.Configuration.Tasks.Task.WriteError(Exception exception, ErrorCategory category, Object target, Boolean reThrow, String helpUrl)
    at Microsoft.Exchange.Configuration.Tasks.Task.WriteError(Exception exception, ErrorCategory category, Object target)
    at Microsoft.Exchange.Management.Deployment.WriteExchangeSetupLog.InternalProcessRecord()
    at Microsoft.Exchange.Configuration.Tasks.Task.<ProcessRecord>b__b()
    at Microsoft.Exchange.Configuration.Tasks.Task.InvokeRetryableFunc(String funcName, Action func, Boolean terminatePipelineIfFailed)".
    Exchange logs which have been written:
    **The error will loop around for 8 minutes on trying to set-sharedconfig DC whatever this is trying to do ??
    [01/20/2015 17:13:20.0084] [2] Active Directory session settings for 'Set-SharedConfigDC' are: View Entire Forest: 'True', Configuration Domain Controller:mydomain.com', Preferred Global Catalog: 'mydomain.com', Preferred Domain Controllers:
    '{ mydomain.com}'
    [01/20/2015 17:13:20.0084] [2] User specified parameters: 
    -DomainController:mydomain.com' -ErrorVariable:'setSharedCDCErrors' -ErrorAction:'SilentlyContinue'
    [01/20/2015 17:13:20.0084] [2] Beginning processing Set-SharedConfigDC
    [01/20/2015 17:13:20.0178] [2] The call to Microsoft Exchange Active Directory Topology service on server 'TopologyClientTcpEndpoint (localhost)' returned an error. Error details No Minimal Required Number of Suitable Directory Servers
    Found in Forest mydomain.com Site Default-First-Site and connected Sites..
    [01/20/2015 17:13:20.0178] [2] No Minimal Required Number of Suitable Directory Servers Found in Forest mydomain.com Site Default-First-Site and connected Sites.
    [01/20/2015 17:13:20.0178] [2] The call to Microsoft Exchange Active Directory Topology service on server 'TopologyClientTcpEndpoint (localhost)' returned an error. Error details No Minimal Required Number of Suitable Directory Servers
    Found in Forest mydomain.com Site Default-First-Site and connected Sites..
    [01/20/2015 17:13:20.0178] [2] No Minimal Required Number of Suitable Directory Servers Found in Forest mydomain.com Site Default-First-Site and connected Sites.
    [01/20/2015 17:13:20.0178] [2] Ending processing Set-SharedConfigDC
    [01/20/2015 17:13:20.0193] [2] Beginning processing Write-ExchangeSetupLog
    [01/20/2015 17:13:20.0193] [2] An error ocurred while setting shared config DC. Error: The call to Microsoft Exchange Active Directory Topology service on server 'TopologyClientTcpEndpoint (localhost)' returned an error. Error details
    No Minimal Required Number of Suitable Directory Servers Found in Forest mydomain.com Site Default-First-Site and connected Sites..
    [01/20/2015 17:13:20.0193] [2] Ending processing Write-ExchangeSetupLog
    [01/20/2015 17:13:20.0193] [2] Beginning processing Write-ExchangeSetupLog
    [01/20/2015 17:13:20.0193] [2] Waiting 30 seconds before attempting again.
    [01/20/2015 17:13:20.0193] [2] Ending processing Write-ExchangeSetupLog
    [01/20/2015 17:13:50.0195] [2] Beginning processing Write-ExchangeSetupLog
    [01/20/2015 17:13:50.0273] [2] [ERROR] Unable to set shared config DC.
    [01/20/2015 17:13:50.0273] [2] [ERROR] Unable to set shared config DC.
    [01/20/2015 17:13:50.0288] [2] Ending processing Write-ExchangeSetupLog
    [01/20/2015 17:13:50.0288] [1] The following 1 error(s) occurred during task execution:
    [01/20/2015 17:13:50.0288] [1] 0.  ErrorRecord: Unable to set shared config DC.
    [01/20/2015 17:13:50.0288] [1] 0.  ErrorRecord: System.Exception: Unable to set shared config DC.
       at Microsoft.Exchange.Configuration.Tasks.Task.WriteError(Exception exception, ErrorCategory category, Object target, Boolean reThrow, String helpUrl)
       at Microsoft.Exchange.Configuration.Tasks.Task.WriteError(Exception exception, ErrorCategory category, Object target)
       at Microsoft.Exchange.Management.Deployment.WriteExchangeSetupLog.InternalProcessRecord()
       at Microsoft.Exchange.Configuration.Tasks.Task.<ProcessRecord>b__b()
       at Microsoft.Exchange.Configuration.Tasks.Task.InvokeRetryableFunc(String funcName, Action func, Boolean terminatePipelineIfFailed)
    [01/20/2015 17:13:50.0288] [1] [ERROR] The following error was generated when "$error.Clear();
    $maxWait = New-TimeSpan -Minutes 8
    $timeout = Get-Date;
    $timeout = $timeout.Add($maxWait);
    $currTime = Get-Date;
    $successfullySetConfigDC = $false;
    while($currTime -le $timeout)
    $setSharedCDCErrors = @();
    try
    Set-SharedConfigDC -DomainController $RoleDomainController -ErrorVariable setSharedCDCErrors -ErrorAction SilentlyContinue;
    $successfullySetConfigDC = ($setSharedCDCErrors.Count -eq 0);
    if($successfullySetConfigDC)
    break;
    Write-ExchangeSetupLog -Info ("An error ocurred while setting shared config DC. Error: " + $setSharedCDCErrors[0]);
    catch
    Write-ExchangeSetupLog -Info ("An exception ocurred while setting shared config DC. Exception: " + $_.Exception.Message);
    Write-ExchangeSetupLog -Info ("Waiting 30 seconds before attempting again.");
    Start-Sleep -Seconds 30;
    $currTime = Get-Date;
    if( -not $successfullySetConfigDC)
    Write-ExchangeSetupLog -Error "Unable to set shared config DC.";
            " was run: "System.Exception: Unable to set shared config DC.
       at Microsoft.Exchange.Configuration.Tasks.Task.WriteError(Exception exception, ErrorCategory category, Object target, Boolean reThrow, String helpUrl)
       at Microsoft.Exchange.Configuration.Tasks.Task.WriteError(Exception exception, ErrorCategory category, Object target)
       at Microsoft.Exchange.Management.Deployment.WriteExchangeSetupLog.InternalProcessRecord()
       at Microsoft.Exchange.Configuration.Tasks.Task.<ProcessRecord>b__b()
       at Microsoft.Exchange.Configuration.Tasks.Task.InvokeRetryableFunc(String funcName, Action func, Boolean terminatePipelineIfFailed)".
    [01/20/2015 17:13:50.0288] [1] [ERROR] Unable to set shared config DC.
    [01/20/2015 17:13:50.0288] [1] [ERROR-REFERENCE] Id=AllADRolesCommonServiceControl___ee47ab1c06fb47919398e2e95ed99c6c Component=EXCHANGE14:\Current\Release\Shared\Datacenter\Setup
    [01/20/2015 17:13:50.0288] [1] Setup is stopping now because of one or more critical errors.
    [01/20/2015 17:13:50.0288] [1] Finished executing component tasks.
    [01/20/2015 17:13:50.0304] [1] Ending processing Install-BridgeheadRole
    Windows Event Viewer:
    Process Microsoft.Exchange.Directory.TopologyService.exe (PID=5276) Forest mydomain.com. Exchange Active Directory Provider couldn't find minimal required number of suitable Global Catalog servers
    in either the local site 'Default-First-Site' or the following sites:

    Hi apl228,
    1. Please make sure the IPv6 is enabled.
    2. Please make sure the account that install Exchange server has Administrator permission.
    3. Please make sure DNS has been configured correctly.
    Thanks
    Mavis Huang
    TechNet Community Support

  • Forest trust unable to find Active Directory Domain Controller

    I have two domains with a two-way forest trust. We'll call them ForestA and ForestB. They're on seperate subnets. ForestA's DCs are in one physical location. ForestB's DCs are in two locations, one of which is shared with A.
    I'm unable to route traffic directly from the remote DC in ForestB to the subnet ForestA is on, so I created a new DC in ForestA that sits on the subnet ForestB uses (basically, I can't route between subnets via the wireless bridge between locations, but
    can within the same location).
    I found this: http://www.neomagick.net/zen/2008/11/30/using-dns-to-force-a-domain-trust-through-a-specific-domain-controller-dc/
    I followed the instructions to set the new DC in forest A to be the only one the remote DC in forest B was aware of.
    Nslookup ForestA.com resolves correctly to this DC, but I'm unable to validate the trust relationship, getting the error:
    "Windows cannot find an Active Directory Domain Controller for the ForestA.com domain. Verify that an AD DC is available and then try again."
    I'd appreciate any help.

    In the event viewer, have you found any event id's that corrospond with this error? Have you ensured all ports required are open? Windows firewall is correctly setup? NIC is properly configured?
    Statement below taken from: http://technet.microsoft.com/en-us/library/cc961803.aspx
    If you receive the following error, ERROR_NO_LOGON_SERVERS while using the Nltest tool to query the secure channel, this is usually indicative of the inability to find a domain controller for that domain. Run nltest /dsgetdc: < DomainName > : to verify
    whether you can locate a domain controller. If you are unable to find a domain controller examine DNS registrations and network connectivity.
    ADDS Ports:
    http://msdn.microsoft.com/en-us/library/dd772723(v=ws.10).aspx

  • Install Domain Controller, Active Directory, RemoteApps on Single Server?

    Have a server that I want to experiment with RemoteApps.   Documentation I have read state you need to have a Domain Controller setup with AD on one server, and have a second server to install all the RemoteApps requirements. Is this true or can
    this all be done on one server.
    If I need a separate server for the Domain Controller and Active Directory, can I assume that a low end server would be sufficient?  Or would using Hyper-V with a single hardware server and create two virtual machines: one as the DC/AD, and the other
    to run Remote Apps be a possible solution.  Any advice?

    it really depends to be honest. I'd probably go something like this though:
    One Small physical server to act as a domain controller - you could put DHCP on this too
    One or Two physical, quite powerful servers to act as Hyper-V hosts - these can be domain joined. 
    Then for your VM's create the following:
    1 x additional domain controller
    For remote desktop services:
    1 x Remote Desktop Session Host
    1 x Connection Broker
    1 x Gateway and web server
    For additional services
    1 or 2 x Exchange
    1 x sharepoint
    1 x IIS
    but it really depends what you want to achieve. 
    The benefit from Virtual machines is that you can keep separate virtual servers for separate applications. 
    If you have two hosts you could then replicate the virtual machines between them if you wanted some layer of fault tolerance. 
    Hope this helps you a bit more. And thanks for positive blog feedback - its appreciated. 
    Regards,
    Denis Cooper
    MCITP EA - MCT
    Help keep the forums tidy, if this has helped please mark it as an answer
    My Blog
    LinkedIn:

Maybe you are looking for