Users, domain and services logon problem

Hi all. I'm having several issues related to users in my farm (mostly service accounts, as it isn't in production yet). The farm is based on W2003 servers (except SQL which uses Windows 2008)
Domain is named sp.test.com , but when I create a web application that doesn't share the same domain name, the users are prompted to type for username and password, first try is a error because it search the user on the other domain, and
in the second one I'm able to type the correct domain.
I'll try to summarize
Domain name: sp.test.com
Web Application name: shop.mall.net (I leave the host header in blank so I can access directly with that address)
First try it only prompts for user/pass and returns an error no matter which combination of domain user and password I type. Second try by default I see the username by default is shop.mall.net\sharepointadmin , and not
sp.test.com\sharepointadmin which is where the user is stored in AD. I think this is also related with the SSP as it says it cannot find the username for provisioning account despite it exists in AD, but SSP is on a Web Application that
doesn't share domain name with the domain.
Thank you all in advance.
PS.- First time I posted on technet, sorry for not being clear or any mistake I could have made.

The trouble is the browser thinks the URL is an internet site and as a security measure doesn't attempt to automatically log in.
Add the URL to your user's local intranet or trusted sites zones in IE.
Jason Warren
@jaspnwarren
jasonwarren.ca
habaneroconsulting.com/Insights

Similar Messages

Windows 8 - user login and Kerberos Realm problems.

Hi,
Just installed Windows 8 Enterprise x64 from our MDT into our production enviroment for some final testing. I have done this with both Consumer and the Release Preview just to make sure our infrastructure can support user that want to run Windows 8 (Win
7 Enterprise will still be the default OS for our client desktops).
The problem I reported here with the Consumer Preview
http://social.technet.microsoft.com/Forums/en-US/W8ITProPreRel/thread/069f59be-b89c-4005-8cd2-ff5fd756825a is still alive and kicking.
Logon after fresh reboot. (Windows 8)
Username: XWYZ
Password: *********
Sign in to: "OURKERBEROSREALM.SE"
We authenticate all our users with our Kerberos Realm and in our AD's all user passwords are random dummy placeholders, and are linked to the Kerberos realm.
When a user lock their computer, or put it in sleep mode, they should see this at their login.
XWYZ (their full name)
"OURKERBEROSREALM.SE\XWYZ(their username)
Locked
Password: ********
But it does not show this… it shows:
XWYZ (their full name)
WINDOWS DOMAIN NAME\XWYZ(their username)
Locked
Password: ********
This meens that when they want to unlock their desktop, or login after sleep, it will try and authenticate their login on the domain AD and not the Kerberos realm. Howver if you choose to go back and select "other user" it defaults back to using "OURKERBEROSREALM.se"
as "Sign in to:" domain.
This worked flawlessly in XP, Vista and Windows 7, but not in Windows 8. Not having our Kerberos realm as default login in every scenario is kind of a bummer.

I had some brief time looking into this, and my awesome workbuddy found that you can poke about the keys found in
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\SessionData\1
With the LastLoggedONSAMUser and LastLoggedOnUser values I changed from from "domain"\username to "kerberosrealm"\user, and when locking my computer or restating, I now have no need to choose "other user" every time I want to login again.
Atleast somewhere to start.

Create a new OSB domain and data source problems

Hello,
I noticed a problem while create a new OSB domain with Oracle Service Bus 10gR3 on Solaris 10 (intel-based).
This domain is composed of two managed servers deployed on a cluster.
I have configured the JMS reporting data sources to use an Oracle 10g (XE) database (driver Oracle Thin (non XA)) installed on a remote server.
While trying to start my managed servers, the startup process of these managed servers failed due to a data source problem on "wlsbjmsrpDataSource" or "cgDataSource-nonXA".
The workaround I found is to delete and recreate (through the WLS console) the data sources "wlsbjmsrpDataSource", "cgDataSource-nonXA" and "cgDataSource".
In this situation, my managed servers can be started properly.
Is it a known problem located on the configuration wizard?
Thanks for your help.

Hi
For the answer.
I fully understand that those datasources are default ones and are mainly related to JMS reporting.
But my question was probably not well expressed.
The problem I had is when the domain is created, the managed servers won't start due to problems related to theses datasources.
The workaround I found is to delete and to create those datasources from the WLS console.
In this situation, the managed servers are able to be started.
I want to know if this is a known problem/limitation of OSB 10gR3 with Solaris 10 and Oracle 10g?
Thanks for your help.

Service entry sheet and Service PO problem

HI GURU's
I am facing problem with Service procurment ,
   i have created service PO , of 100 quantity , then Service entry sheet of Same 100 quantities
up to here is ok ,
        ,BUT when i am creating 2nd service entry sheet of 50 quantity against same previous PO system allow me to create & accept , this should not happen as i received all 100 quantity already   , end user doing missuse of it
          Define Attributes of System Messages->
here message SE 363 (version 00) as Error message (E) ,
These settings are ok , as if i am taking 120 quantity i.e. more than quantity in PO , it is showing an error message ,   " Quantity entered $ exceeds quantity $ in purchase order "
please tell me how to salved it , so that system should not create SES   more than PO quantity please help
Regards
    AKSHAY

The simple solution for the same is as follows:
Delivery indicator should be ticked in PO under delivery tab then system will not allow you to make Further SES in system.
Or
Please set error message for Message number SE319 and SE363.
SPRP > MM > External Service Management > Define attribute of system messages.
Or
Activate validity start and Validity End date in PO throgh Screen Layout. Mentione the end date in PO > Additional Data TAb.System will not allow you to then make SES beyound the mentioned Period. Standard Error messages allowed.
If user tries to Make SES beyond this date system issuing below message.
Runtime of entry must fall within runtime of purchase order (01.12.2011 - 31.12.2011)
Message no. SE242
Tested my server.Working Fine.
Or
Please check SAP Note-1579976 - SES allows more quantity than specified in Purchase order.
Regards,
Sandesh Sawant

Error Message, user exits, and editing disabled problem.

HEllo I recently had an assignment where I have to create a user exit with an error message. I had no problems with the error message but after an error occurs, with this line:
 MESSAGE ID 'ZSD' TYPE 'W' NUMBER '002'.
the fields have become disabled and there seems to be no way to enable the fields for changing. Is there a way to fix this. Thanks people and take care!

Oh, TYPE E, when issuing an error message, all fields are disabled unless you tie it to a field or group of fields. This is commonly done by using the CHAIN...ENDCHAIN statements in the PAI of the screen. Do you have access to this? I assume that you are issueing the message from within a MODULE, right? You are probably calling this module in the PAI flow logic of the screen. You will need to do something like this.
Here P_BUKRS is the screen field and CHECK_BUKRS is the module where you are checking the value and issuing the error message. Using the CHAIN, you can tie other fields to the check so that they are also enabled when the error message is issued.
CHAIN.
field p_bukrs module check_bukrs.
ENDCHAIN.
Regards,
Rich Heilman

Domain Object and Service oriented pattern

We have J2EE based application with following components, we are facing some issues with existing system.
Current System : We have J2EE based application. The following is the flow.
Client Layer [including JSP, Struts ] action classes  Delegates  Session fa�ade [Session bean]  DAO EJBDAO  EJB. We use CMP, xDoclets , JBOSS.
1.     Our Domain objects are heavy. I know they are suppose to be coarse objects but they take more time in loading. Also, we noticed one thing that lot of methods are called during Domain Object creation process and it takes lot of time in loading. Actually, we dont really know what is happening as we are using CMPs.
Question :
-     Any input on what can be done to avoid Domain object excessive loading time.
-     Anyone can share there experiences with Domain objects. Are you facing issues related with performance.
-     We dont use DTO, we pass domain objects between. Do you see any problem in doing that.
2.     Currently, our system was used by one single front end or lets say we have only one client but soon we will have more clients using it.
Question :
-     What should be our design approach. How can we make our system more like service oriented. If the two clients demand different business logic then how it will be handled. Business logic common to all the clients will be handled by which layer and business logic specific to client will be handles by which layer.
-     Please suggest based on our existing infrastructure. We don�t want to use SOAP or cannot make drastic changes to our flow.
We have domain and services in the same package and we are doing the refactoring of code, your inputs will be valuable.
Thanks
Sandipan

What type of logger do you use and what is the loger-level during production?
If it is log4j set the logger to level INFO or WARN.
This might sound trivia but can make a difference between 20seconds and 500 ms.

Query users, access level and last logon date

Hello, Does anybody know how to query Essbase to look up users accesslevel and last logon date? Rey Fiesta

It can be done using the API. Access level is a little complicated because it can be by individual or group they belong to and it of course is different by application/database

Error when trying to access the RBAC User editor and Message tracking

Hi,
I am getting an error when trying to access the RBAC User editor and Message tracking on the Web Mgmt interface. I verified that the admin account trying to access is in the Organization Management group and has the correct Role Assignment Policy applied.
I searched through this thread below and saw that matching the msExchRoleLink and msExchUserLink attributes fixed the issue.
https://social.technet.microsoft.com/Forums/exchange/en-US/fc568cc6-8691-4127-b70b-bcc82f9b1f7f/first-2010-cas-server-no-administrator-rights-emc-permissions-gone?forum=exchange2010
However I have another environment where this is not the case and works just fine; the msExchUserLink attribute has a value of CN=Organization Management,OU=Microsoft Exchange Security Groups,DC=Domain,DC=Local which is different as per the issue outlined in
the above thread so I am not convinced that this will work and also don’t want to blindly edit something in adsiedit without being sure.
I then checked the event logs on the server and saw the below error logged;
Current user: 'Domain/Server Services Accounts/administrator'
Request for URL 'https://server.domain.com/ecp/default.aspx?p=AdminDeliveryReports&exsvurl=1' failed with the following error:
System.Web.HttpUnhandledException: Exception of type 'System.Web.HttpUnhandledException' was thrown. ---> Microsoft.Exchange.Management.ControlPanel.UrlNotFoundOrNoAccessException: The page may not be available or you might not have permission to open the
page. Please contact your administrator for the required credentials. For new credentials to take effect, you have to close this window and log on again.
at Microsoft.Exchange.Management.ControlPanel._Default.CreateNavTree()
at Microsoft.Exchange.Management.ControlPanel._Default.OnLoad(EventArgs e)
at System.Web.UI.Control.LoadRecursive()
at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
--- End of inner exception stack trace ---
at System.Web.UI.Page.HandleError(Exception e)
at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
at System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
at System.Web.UI.Page.ProcessRequest()
at System.Web.UI.Page.ProcessRequest(HttpContext context)
at ASP.default_aspx.ProcessRequest(HttpContext context)
at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)
Microsoft.Exchange.Management.ControlPanel.UrlNotFoundOrNoAccessException: The page may not be available or you might not have permission to open the page. Please contact your administrator for the required credentials. For new credentials to take effect, you
have to close this window and log on again.
at Microsoft.Exchange.Management.ControlPanel._Default.CreateNavTree()
at Microsoft.Exchange.Management.ControlPanel._Default.OnLoad(EventArgs e)
at System.Web.UI.Control.LoadRecursive()
at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
I then had a look at the IIS permissions for ecp and owa. The account did not have permissions so I added them there but still got the same error. I’ve also tried all of the above with a newly-created account but still got the same issue.
Any ideas as to what the above event log is specifically referring to?

Hi,
From your description, I would like to clarify the following thing:
If you want to search message tracking logs, the account you use should be a member of the role groups below:
Organization Management role group, Records Management role group, Recipient Management role group.
Hope this can be helpful to you.
Best regards,
Amy Wang
TechNet Community Support

Win 98SE Startup Logon Problem

All our Win 98SE had the startup logon problem when we migrated to Cisco 1240AP. Previously, we don't had this problem when we are still using the SMC AP.
When we want to login to windows 2000 Domain during startup, the system will complain that it can't find a DC and we had to click ok to proceed. Once login, we can see that it can detect the AP with good signal strength. Then we need to logoff and then only we can login to the Domain without any problem.
But when we restart the system to login to the Domain again, the same problem occurs. Only when you click ok to login without network and then logoff again to login without restart the system, then the PC can find the Domain and login without problem. All our PCs are using the static IP assignment with DNS and WINS configure.
We are currently using the DLink client wireless adapter and we had try to change to Belkin client wireless adapter with more recent Win98 driver but with the same problem.
Our Window XP don't had this issue. As i had said, previously when we are using a SMC AP, we don't had this problem.
Anyone here had the same problem that had a solution ?
Thanks.
CMYip

Yes. The solution was to upgrade to upgrade the customer's laptops to WinXP.
(Drive mappings were also a related issue).

Sudden failed authentications for user@domain

Hello,
We are running 6 ACS 4.1 servers on Windows 2003 Servers. These servers are not the same as the Domain Controllers.
Since many years, we have devices sending their username in the format domain\user and some other use user@domain. Everything was working well in our 6 ACS servers.
Suddenly, this morning, as 06:00:25, on one single server, all the request using user@domain were reported as failed with the follwowing message in the ACS logs: "External DB user invalid or bad password".
We first thought that the DC near the ACS server was the cause of the issue, but we observe that all the other ACS servers could process these user@domain AAA queries without problem. We then rebooted the ACS server and when it went back up, everything was running again like a charm.
We could not find what happened at 06:00:25. There is no Windows Scheduled Tasks at that time, and there is no ACS DB Replication or Backup running at that time neither.
Can someone help us troubleshooting that issue that affected only one single server in an unexpected way ?
Thanks a lot,
David Mayor

Hello Anisha,
I understand that with new installation, such post tasks are required. However, our installation is running in such a state for more than 2 or 3 years. And it is only over the past week that such problem happens twice.
We have also observed one more thing: You know that the main problem started few seconds after 6 AM, in both days when it happened. We observed that between 00:02 (midnight + about 2 minutes) and 01:05 AM, the same problems happens also ! But, at 01:05 AM, the problem automatically goes away without any intervention. However, when it happens again at 6 AM, we have to restart the server, because otherwise it would not automatically recover.
Didn't you find anything else than "error Windows authentication FAILED (error 1326L)" on the full log ?
Thanks a lot,
With my very best regards,
David Mayor

New user called user.domain after updating from win 8.1 to win 10

I can't find any information on it at the moment but my guess would be that the profile versions have increased between 8.1 and 10 as they did between 7 and 8.1
I think I remember seeing somewhere that the profiles in Windows 10 are now v5 instead of the v4 of 8.1
Found a similar article explaining the changes from the release of 8.1/server 2012R2
https://support.microsoft.com/en-us/kb/2890783

Hi,
i will try to shortly explain the scenario:
I have removed my PC from my company's domain, in order to update my windows 8.1 pro to windows 10 pro. (i read a microsoft article telling that we are supposed not to be joined to a domain so we can do the upgrade).
so after the upgrade was done, i rejoined my pc to the domain. i logged in with my AD user, but a new profile was loaded called: user.domain
and my old profile is still in c:/users/ called user
how can i load my old profile back?
This topic first appeared in the Spiceworks Community

The report server has encountered a configuration error. Logon failed for the unattended execution account. (rsServerConfigurationError) Log on failed. Ensure the user name and password are correct. (rsLogonFailed) The user name or password is incorrect

I am able to run the report fine in BIDS in the preview window, and it deployes fine. When it goes to view the report in the browser, I get the following error. There is no domain, I am using a standalone computer with SQL Server and SSRS on
this one machine.
Can anyone point to where I might configure the permission it is looking for? thanks! Steven
The report server has encountered a configuration error. Logon failed for the unattended execution account. (rsServerConfigurationError)
Log on failed. Ensure the user name and password are correct. (rsLogonFailed)
The user name or password is incorrect
Steven DeSalvo

Hi StevenDE2012,
Based on the error message "The report server has encountered a configuration error. Logon failed for the unattended execution account. (rsServerConfigurationError)", it seems that the Unattended Execution Account settings in Reporting Services
Configuration is not correct.
Reporting Services provides a special account that is used for unattended report processing and for sending connection requests across the network. Unattended report processing refers to any report execution process that is triggered by an event rather than
a user request. The report server uses the unattended report processing account to log on to the computer that hosts the external data source. This account is necessary because the credentials of the Report Server service account are never used to connect
to other computers. To configure the account, please refer to the following steps:
Start the Reporting Services Configuration tool and connect to the report server instance you want to configure.
On the Execution Account page, select Specify an execution account.
Type the account and password, retype the password, and then click Apply.
In addition, please verify you have access to the Report Server database by following steps:
Go to SQL Server Reporting Services Configuration Manager, make sure the configuration is correct.
Go to Database, Verify that you can connect to the database.
Make sure you are granted public and RSExecRole roles.
Reference:
Configure the Unattended Execution Account
Configure a Report Server Database Connection
If the problem is unresolved, i would appreciate it if you could give us detailed error log, it will help us move more quickly toward a solution.
Thanks,
Wendy Fu

The report server has encountered a configuration error. Logon failed for the unattended execution account. (rsServerConfigurationError) Log on failed. Ensure the user name and password are correct. (rsLogonFailed) Logon failure: unknown user name or bad

The report server has encountered a configuration error. Logon failed for the unattended execution account. (rsServerConfigurationError)
Log on failed. Ensure the user name and password are correct. (rsLogonFailed)
Logon failure: unknown user name or bad password
am using Windows integrated security,version of my sql server 2008R2
I have go throgh the different articuls, they have given different answers,
So any one give me the exact soluction for this problem,
Using service account then i will get the soluction or what?
pls help me out it is urgent based.
Regards
Thanks!

Hi Ychinnari,
I have tested on my local environment and can reproduce the issue, as
Vaishu00547 mentioned that the issue can be caused by the Execution Account you have configured in the Reporting Services Configuration Manager is not correct, Please update the Username and Password and restart the reporting services.
Please also find more details information about when to use the execution account, if possible,please also not specify this account:
This account is used under special circumstances when other sources of credentials are not available:
When the report server connects to a data source that does not require credentials. Examples of data sources that might not require credentials include XML documents and some client-side database applications.
When the report server connects to another server to retrieve external image files or other resources that are referenced in a report.
Execution Account (SSRS Native Mode)
If you still have any problem, please feel free to ask.
Regards
Vicky Liu
Vicky Liu
TechNet Community Support

Exchange certificates and services setup for internal and external clients access on separate domains.

I have the following on my local network.
Server DomainA -> Small Business server 2003/Exchange 2003
Server DomainB -> Windows 2008 R2/Exchange 2013
Clients Domain A -> Windows XP/Outlook 2003
Clients Domain B -> Windows 7/Outlook 2007/2010
Problem: I want clients from DomainA to log into Exchange on DomainB on the same local network.
I need to know how to setup the DNS on both domains and the certificates on the DomainB Exchange server
to accept the connection from the PC on domainA. All connections from clients on domainB to server on domainB
work correctly but when adding accounts to Outlook 2003/2007 on domainA clients I am getting certificate errors.
I have purchased certificates for mail.domainb.com and autodiscover.domainb.com but I dont know how to get
the clients on domainA to recognize those external URL's of the exchange server (with the certificates bound to them) from the internal network. Hence I get domain errors.
I am getting issues when a client on DomainA tries to add an Outlook mail profile to connect to the Exchange on DomainB
Any suggestions on how to set this up?
thanks

Domain A & Domain B are two separate AD Forests?
Users in Domain A either need mailbox-enabled user accounts that are in DomainB or a linked mailbox in Domain B to utilise the Exchange Server in DomainB. In either case with the help of the autodiscover service user can use the services in ExchangeB.
If the client machines are member of domainA and you are trying to access ExchangeB you will then need to leverage a custom XML file for autodiscover and force the Outlook client to use this file.
<?xml version="1.0" encoding="utf-8"?>
<Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/responseschema/2006">
<Response xmlns="http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a">
<Account>
<AccountType>email</AccountType>
<Action>redirectUrl</Action>
<RedirectUrl>https://autodiscover.domain.com/autodiscover/autodiscover.xml</RedirectUrl>
</Account>
</Response>
</Autodiscover>
Then you need to configure the client machine to query that XML file by adding the following registry key:
Refer to XML file
for Outlook 2007:
HKCU\Software\Microsoft\Office\12.0\Outlook\Autodiscover
for Outlook 2010:
HKCU\Software\Microsoft\Office\14.0\Outlook\Autodiscover
STRING_value <your_namespace> = path to XML file
you can find more information in the following link.
Controlling Outlook Autodiscover behavior
http://blogs.technet.com/b/kristinw/archive/2013/04/19/controlling-outlook-autodiscover-behavior.aspx
CK

New Domain Controller does not show in our different site's Domain controller's Sites and Services

Hi,
we have two sites in our AD environment. OMA site and NY site. we have three domain controllers in our OMA site and two domain controllers in our NY site. All our DCs are windows server 2008R2 except one in our OMA site that is 2003R2 the domain
functional level is also 2003R2.
We decided to raise our functional level to 2008R2. I added a new domain controller in our OMA site and transferred all FESMOS from the DC that was running 2003R2 to this new domain controller.
the issue now is that our NY site does not make any connection with the new domain controller in OMA site. it does not even show it under sites and services. I have checked the DNS settings and everything. if you try to replicate the connections
from NY site it gives the following error: "The naming context is in the process of being removed or is not replicated from the specific server."
can anyone plz tell me why this is happening mt brain is just frozen at this moment and cant figure out why is this happening

Just noticed this replication issue has been going on for a while now but we never noticed until I added new DC. here is the error log for the NY site DC.
Log Name: Directory Service
Source: Microsoft-Windows-ActiveDirectory_DomainService
Date: 1/4/2014 8:11:40 AM
Event ID: 2042
Task Category: Replication
Level: Error
Keywords: Classic
User: ANONYMOUS LOGON
Computer: NORDC1.vertrue.com
Description:
It has been too long since this machine last replicated with the named source machine. The time between replications with this source has exceeded the tombstone lifetime. Replication has been stopped with this source.
The reason that replication is not allowed to continue is that the two DCs may contain lingering objects. Objects that have been deleted and garbage collected from an Active Directory Domain Services partition but still exist in the writable partitions
of other DCs in the same domain, or read-only partitions of global catalog servers in other domains in the forest are known as "lingering objects". If the local destination DC was allowed to replicate with the source DC, these potential lingering object
would be recreated in the local Active Directory Domain Services database.
Time of last successful replication:
2013-05-16 15:26:38
Invocation ID of source directory server:
9236ac56-d046-4632-b072-acbe823c5f6c
Name of source directory server:
accde843-11b2-476c-9783-9b29252d0ba5._msdcs.vertrue.com
Tombstone lifetime (days):
90
The replication operation has failed.
User Action:
The action plan to recover from this error can be found at
http://support.microsoft.com/?id=314282.
If both the source and destination DCs are Windows Server 2003 DCs, then install the support tools included on the installation CD. To see which objects would be deleted without actually performing the deletion run "repadmin /removelingeringobjects
<Source DC> <Destination DC DSA GUID> <NC> /ADVISORY_MODE". The eventlogs on the source DC will enumerate all lingering objects. To remove lingering objects from a source domain controller run "repadmin /removelingeringobjects <Source
DC> <Destination DC DSA GUID> <NC>".
If either source or destination DC is a Windows 2000 Server DC, then more information on how to remove lingering objects on the source DC can be found at
http://support.microsoft.com/?id=314282 or from your Microsoft support personnel.
If you need Active Directory Domain Services replication to function immediately at all costs and don't have time to remove lingering objects, enable replication by setting the following registry key to a non-zero value:
Registry Key:
HKLM\System\CurrentControlSet\Services\NTDS\Parameters\Allow Replication With Divergent and Corrupt Partner
Replication errors between DCs sharing a common partition can prevent user and compter acounts, trust relationships, their passwords, security groups, security group memberships and other Active Directory Domain Services configuration data to vary between
DCs, affecting the ability to log on, find objects of interest and perform other critical operations. These inconsistencies are resolved once replication errors are resolved. DCs that fail to inbound replicate deleted objects within tombstone lifetime
number of days will remain inconsistent until lingering objects are manually removed by an administrator from each local DC. Additionally, replication may continue to be blocked after this registry key is set, depending on whether lingering objects are
located immediately.
Alternate User Action:
Force demote or reinstall the DC(s) that were disconnected.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
 <Provider Name="Microsoft-Windows-ActiveDirectory_DomainService" Guid="{0e8478c5-3605-4e8c-8497-1e730c959516}" EventSourceName="NTDS Replication" />
 <EventID Qualifiers="49152">2042</EventID>
 <Version>0</Version>
 <Level>2</Level>
 <Task>5</Task>
 <Opcode>0</Opcode>
 <Keywords>0x8080000000000000</Keywords>
 <TimeCreated SystemTime="2014-01-04T13:11:40.963263500Z" />
 <EventRecordID>38018</EventRecordID>
 <Correlation />
 <Execution ProcessID="660" ThreadID="1596" />
 <Channel>Directory Service</Channel>
 <Computer>NORDC1.vertrue.com</Computer>
 <Security UserID="S-1-5-7" />
</System>
<EventData>
 <Data>2013-05-16 15:26:38</Data>
 <Data>9236ac56-d046-4632-b072-acbe823c5f6c</Data>
 <Data>accde843-11b2-476c-9783-9b29252d0ba5._msdcs.vertrue.com</Data>
 <Data>90</Data>
 <Data>Allow Replication With Divergent and Corrupt Partner</Data>
 <Data>System\CurrentControlSet\Services\NTDS\Parameters</Data>
</EventData>
</Event>

Users, domain and services logon problem

Similar Messages

Maybe you are looking for