Adding DC to remote site

Tutorials Win: Microsoft Windows Forum

- Previous
  - 1
    - ntdsutil not working for me. I'm trying to remove two DCs from a 2K3 domain that's no longer in use. I've already migrated the primary DC to our new domain (and all the users), but now I'm attempting to promote these other two DCs into the new domain. I tried running dcpromo on both of the servers but both are "not willing to" be demoted. So I moved on to this Technote: http://support.microsoft.com/kb/216498 and I'm still coming up empty. I get as far as selecting the old domain and old site and when I list servers, I get Found (1) Servers, 0 - (null).I try to select the (null) server and it fails. At this point, I think the only thing I can do is start from scratch and rebuild both of the old DCs, but one of them is my WSUS server and I'd prefer to not have to rebuild that. Anyone have any other ideas. When I look at Sites and Services, both DCs (DC02 & DC03) are linked to each other in the NTDS settings, but DC03 still has a link to DC01, which has since been migrated to the new domain. Tag: Adding DC to remote site Tag: 134124
  - 2
    - Connect to a domain occasionally; don't want the policies sent to me I work at a remote location from our home office. I have my own two computers here in my office, both running Windows XP Pro. I sometimes log in to the company's network using a VPN, which I *think* logs me in to their domain. (Although when I log on to my computer, I ask to log in to my local computer, not to any domain. I connect to the VPN later.) I don't want or need the corporate security policies applied to my computer here. They have some things like a big logon "scare" dialog box (which is so full of words that it overflows the dialog box, and of course there are no scroll bars on this box, so the message is partly useless anyway). Today, I tried to encrypt one of my local folders, and I can't, because somewhere in the vastness of the corporate behemoth, there is an expired certificate that was (or could be) used as a recovery agent. So I get the error message that the "recovery policy configured for this system [which system?] contains invalid recovery certificate". I tried to tell my own local Encrypting File System policy that I don't want to use a recovery agent, but I still can't encrypt anything. Question: Even though I connect occasionally to this corporate domain using a VPN, can I avoid their AD policies? I am my own administrator, and I want to log in to my own two-computer peer-to-peer network, or to no domain at all. Even when I am using the VPN Thanks. David Walker Tag: Adding DC to remote site Tag: 134123
  - 3
    - user data to syncv between two forests Hello, we are currently re-design our demolab and want to get a flexible setup, where a schema update for one product is not affecting any other. Therefor we setup a main forest containing two DCs in one Domain. This domain contains all user accounts. For each product we now want to setup a dedicated Forest with one domain, which is linked to the primimary forest by a two-way-trust (right now). so far we are able to use the user credentials from the primary forest to log on at the product forest... The key issue we now faced is that in case we have to run a schema update to provide additional features to the users, we of course stuck in the middle of nowhere as the user data is not in the product forest. also ldap queries do not get any proper user information as long as we keep all seperated. Do you know any smart way how we can get the user data being synct in the product forest? so that we are able to configure additional features as well as being able to locate them in a ldap query we only point to the directory of the product forest? Thanks a lot for any help on this. Tag: Adding DC to remote site Tag: 134115
  - 4
    - vista folder redirection error My Setup: Windows Server 2003R2 File Server Active Directory Domain I have a policy set up to redirect the user's my documents to their 'home folder' On the user's account properties their home folder is set to 'connect u to' \\usd\homedirs\staff\hs\%username%' for example. So I have my user s home folder pointing to the home folders share via dfs. The folder was created by AD This works perfect with windows xp my users documents are redirected no problem. In windows vista this is not the case. The documents are not being redirected, in sync center there is an error staff (\\usd\homedirs) - Access is denied. Why would this be happening? What is different about the way vista does folder redirection that could cause it to work in xp but not vista and appear to be a permission issue? Tag: Adding DC to remote site Tag: 134114
  - 5
    - how to exclude domain administrator from default domain policy? thanks for your help Tag: Adding DC to remote site Tag: 134112
  - 6
    - Event Written Dear, i want to write event. how it is possible to define or write own events in Microsoft windows 2003. Rgds, Nasir Karim -- Message posted via WinServerKB.com http://www.winserverkb.com/Uwe/Forums.aspx/windows-server-ad/200808/1 Tag: Adding DC to remote site Tag: 134110
  - 7
    - domain upgrade: w2k to w2k8 I've already run both "adprep /forestprep" and "adprep /domainprep /gpprep" successfully and everything has replicated ok. I have two w2k sp4 domain controlers and I am planning on adding a third machine as w2k8 DC, and given I am not doing an in-place upgrade - how disruptive will the promoting of this third machine be? do I need to take our infrastructure offline - my next maintenance window is weeks away so I was wondering whether I can squeeze this earlier? Thanks G Tag: Adding DC to remote site Tag: 134103
  - 8
    - DNS Suffix question Hi, I have a Windwos 2003 domain and a trust to another. DNS is working between the 2 domains via a secondary DNS zone creation. Anyway I think I need to use the DNS suffix option for users to be able to contact servers by their name (serverA) and not FQDN (serverA.example.com). I went to my domain GPO - Computer Configuration->Administrative Templates->Network->DNS Client->DNS Suffix Search List entry... and I wondered do I need to add my domain first then this second domain? so mydomain.com,theirdomain.com Thanks Tag: Adding DC to remote site Tag: 134102
  - 9
    - Bridgehead questions Hi there, My root forest ad domain is called domain A. In that i've got 3 sites set up within sites andd services. I've also got a hardly used child domain as well. In each site there is a DC (which is a GC) for each domain in each site. I've got Exchange (1 server only). A few days ago i removed some older hardware DCs by demoting them. I noticed one was set as the bridgehead server for IP and SMTP i think. I thought these might populate themselves back or something but nothing has appeared? Do i need to set these manually? What do i need to set? Domain_1: Site A: 1 server Site B: 1 server Site C: 2 servers and exchange server here Domain_2 (Child not that important) Site C: 2 servers Do i need to make one server from each site for domain a a bridgehead server? Thanks. Tag: Adding DC to remote site Tag: 134101
  - 10
    - Delegate permission let one user to join pc to a domain Hi all, I used the delegation wizard to grand permission to one of our pc support staff to join PC to a domain, but we only can join a new installed OS PC into domain, if he needs to re-join it, the windows prompts out the Access is denied, does anyone know how to fix the problem? Thanks Tag: Adding DC to remote site Tag: 134082
  - 11
    - Join domain question Hello, I have one notebook is windows XP pro and join the domain. My server OS is Srever 2003 SBS. After I input the administrator login and password, the winodws display a error message: The following error occurred attempting to join the domain "xxx": Logon failure: the user has not been granted the requested logon type at this computer. I test my notenook is work, because I can join other domain server. Tag: Adding DC to remote site Tag: 134079
  - 12
    - Domain Controller Slow to boot (Applying Computer Settings) Hi, I have 2 Domain Controllers (Windows Server 2008 Enterprise) both ar also running DNS (AD integrated). When I boot both servers up at the same time (or boot a single server) they stay at "Applying Computer Settings" for about 5 mins. I have rea various things mentioning DNS client settings. If I boot 1 AD server, i will hang at this point as well, then I boot the second AD server i boots normally. My DNS client settings on each server are: AD01 Preferred DNS: 127.0.0.1 Alternate DNS: 192.168.99.32 (AD02) AD02 Preferred DNS: 127.0.0.1 Alternate DNS: 192.168.99.31 (AD01) Is there anything I am missing? Is this normal behavior for 2 domai controllers? This is causing a problem with my 2008 cluster, which th cluster name will not come online, I think this problem is related t the slow booting of DNS/AD -- bg_2 ----------------------------------------------------------------------- bg_27's Profile: http://forums.techarena.in/members/bg_27.ht View this thread: http://forums.techarena.in/active-directory/1019600.ht http://forums.techarena.i Tag: Adding DC to remote site Tag: 134076
  - 13
    - Active Directory upgrade from W2000 to W2003 I am currently running all my DC with W2000. I want to replace them by new servers running W2003 and therefore need to upgrade my AD to W2003. According to a book and articles I read until now, it seems I have 2 solutions to upgrade my AD: 1) In place upgrade : upgrade my current DC which holds FSMO roles and is currently running W2000 to W2003, but this is not the best for me as I want to replace my old servers 2) Clean and Pristine migration : create a new domain on a new W2003 server and migrate my resources : a lot of work I was wondering is the following procedure wouldn't upgrade my AD to W2003 too: Introduce a new W2003 member server in the domain, run W2003 forest prep and domain prep, promote the new W2003 server as DC, move the FSMO roles to this new server. Will the result be different from in place upgrade? Thank you for your help Tag: Adding DC to remote site Tag: 134075
  - 14
    - How to restore a GC from backup using VERITAS? We would like to restore an existing Global Catalog backed up using VERITAS NetBackup. The situation: We have a single domain Windows 2000 forest with multiple DCs and GCs, all running Windows Server 2003 Enterprise. Service pack levels vary between SP1 and SP2. Our PDC Emulator experienced a failed upgrade to Windows Server 2003 SP2 from SP1 and the rollback of SP2 was not completely successful either. The server is still running, but it has some problems. We want to restore it using a backup taken before the attempted upgrade. The backup is about 30 days old at this point. The backup software is VERITAS NetBackup 5.1MP4 and the backup is a full backup including System State. The server in question is also a DNS server that points to itself for name resolution. Although I'd like to simply promote a new DC and remove the old one from the domain, this is not the preferred option because the old GC has several Secure LDAP clients that require the use of a specific certificate that is installed on it. As a last resort, we will build a replacement GC, issue a new cert and reconfigure the various dependent applications to use the new cert. We have an identical server available to perform the restore on. I have already transferred the FSMO roles the GC held to other DCs and enabled the GC function on another DC in the same site. Would the restore process be as follows? Load Windows Server 2003 SP1 on replacement server. Do not join domain, give it a temporary name. Load VERITAS NetBackup client on replacement. Perform a full system and System State restore of original GC using VERITAS Client on replacement. Remove replacement from network. Restart replacement. Replacement comes up with identity of original GC. Shut replacement down again. Shut down original GC. Bring replacement GC back up on production network. Other DCs and GCs replicate AD updates to replacement GC? When we tried this earlier, the System Event log showed Event ID 5706 SYSVOL errors, a 16651 FSMO error from SAM, 40960 errors from LSASRV, and a string of dynamic DNS registration errors. It looks like DNS isn't starting because it's AD-integrated and AD isn't available. Then DNS registration and lookups fail. AD has problems updating because DNS isn't working and DNS won't start working because AD isn't getting updated. The next time we try swapping the replacement GC, we'll have it pointed to a different DNS server and see if this sorts itself out, but I'd like to know if I'm missing anything else. Thank you. Tag: Adding DC to remote site Tag: 134070
  - 15
    - LDAP settings What is the best way to get the following LDAP settings for a VOIP phone? LDAP name filter: LDAP number filter: Server Address: Port: Base: Username: Password: Max. Hits: LDAP name attributes: LDAP number attributes: LDAP display name: Countrycode: Areacode: LDAP lookup for incoming call: Tag: Adding DC to remote site Tag: 134069
  - 16
    - Cross Domain Authentication I am currently trying to fix an issue with my companies AD structure. I have had this issue but I cannot find my answer on the internet yet so I will post here with hope that the community can help me out. Currently I have AD structure similar to the drawing below. <rootdomain.int> | | <domain.int> rootdomain.int has only a few DC's and 4 real users, just a empty root domain domain.int is where all the servers, groups, users and etc are. When on a member server from the "domain.int" domain I cannot access the rootdomain.int domain. I get access denied no matter what I do. I know the user accounts I am using (from both domains) have access as I can login to the DC's at the rootdomain.int with them. Plus they are Domain Administrators or something comparable. Anyone have any ideas? I seem to remember something about authentication and a GPO but I cannot put my finger on it yet. Peter Tag: Adding DC to remote site Tag: 134068
  - 17
    - Time not defaulting to NT5DS after DCPROMO We are in the process of doing a hardware refresh on all of our remote domain controllers. While replacing some of the old servers with new hardware after promoting them up to Domain Controller status in a Windows Server 2003 only forest they are not moving the default setting of NT5DS to use the domain hierarchy as the default for time services. The W32TIME service is running but the servers are not looking back to the PDCE as they should. The PDCE is set as the authoratize time server for the domain and that server is set to use a hardware device for it's time as per Microsofts best practices. This is only happening on 12 out of 320 remote DC's. Does anybody have any suggeestions on how to properly correct this problem? -- ddecamp5308 Tag: Adding DC to remote site Tag: 134060
  - 18
    - Group policy extension Hi all, We are at windows 2003 DCs environrment. I have one member server with Windows 2008. I installed KB943729 on my Vista computer. But, I still can not see Preference in group policy. Can anyone help? Also, is it possible to disable one service through group policy? Thank you. Tag: Adding DC to remote site Tag: 134056
  - 19
    - Forcing password change with PwdLastSet=0 doesn't work Hi, I have a script (vbs) that changes PwdLastSet for a user to zero, and that is supposed to force them to change password at next logon but they don't get the prompt. I can see that the value is set to zero successfully. Are there other account parameters that would stop it from working? I am trying to do a one off forced password change for sections of my domain with this from MS: Set objUser = GetObject _ ("LDAP://cn=MyerKen,ou=Management,dc=NA,dc=fabrikam,dc=com") objUser.Put "pwdLastSet", 0 objUser.SetInfo. http://tinyurl.com/3dvejj Thanks -- Tag: Adding DC to remote site Tag: 134054
  - 20
    - Kerberos Authentication When mapping a drive from a Windows XP client to another Windows XP client and both are members of the same domain and both are correctly registered in DNS they use NTLM authentication instead of Kerberos. This is happening for all XP to XP mappings in the domain. If any of these same XP clients map to a Windows 2003 Server OS they use Kerberos. Is the Server service required for cifs service principle name registration? Should XP to XP mappings be using Kerberos? Thanks. Tag: Adding DC to remote site Tag: 134048
  - 21
    - Folder Redirection So, I set up the Default Domain Policy under Group Policy Management in Server Manager in Windows Server 2008 for Folder Redirection. The settings I chose were Basic (Redirect everyone's folder to the same location), and under Target Folder Location, "Create a folder for each user under the root path" was chosen. The Root Path is set as \ \SageRealtyDC.SageRealty.local\SageRealtyUsers. I set up SageRealtyUsers as a Share and gave Everyone Full Control. From most of what I read on the subject of Folder Redirection, this should create a folder in the SageRealtyUsers folder when the user logs in using this new policy for the first time, and copy the My Documents folder there. That is not happening. Am I assuming wrong? Do I need to manually create the user folders myself? Tag: Adding DC to remote site Tag: 134044
  - 22
    - Slow Log off scripts when laptop is off the domain network Hi all, We have log off scripts set on one of our GPOs. When laptops are taking off the network, they take ~10-20 minutes to shutdown as they get "stuck" at the "running log off scripts". My guess is that it keeps looking for our DCs but since the laptop is not on the network, it doesn't find them an eventually times out. Is there a way to resolve this either by changing a setting that will bypass the log off scrips when not on the network or by reducing the timeout value? Thanks Tag: Adding DC to remote site Tag: 134042
  - 23
    - Can a win2003 become a BDC for NT4 PDC? Hi, Is there any article that explain how can a windows 2003 box become a BDC for a NT4 PDC? Any help would be appreciated, Max Tag: Adding DC to remote site Tag: 134037
  - 24
    - How Do You Verify The Last Domain Controller in a Window2003 Fores Hi All, How would you verify this? I googled and could not find any links. TIA, Zoey Tag: Adding DC to remote site Tag: 134024
  - 25
    - Infrastructure role - how intensive? Hi there, We've got our domain. It's got 3 sites (as set up in sites and services). We have 4 domain controllers as follows: 1. Site A - DC_A 2. Site B - DC_B 3. Site C - DC_C and DC_D (A virtual server) Now - A, B and C are GCs because they are each in their own site. C holds the majority of the roles. I know the infrastrcuture role should not be held on a GC so i've got it on D. Is this correct? How intensive is this role? I'd rather not stress a virtual machine you see -rather it just be there as the backup. Thanks, Tag: Adding DC to remote site Tag: 134017
- Next
  - 1
    - Event Dear, i want to write self define event for event viewer. How it is possible. rgds. Nasir karim Tag: Adding DC to remote site Tag: 134016
  - 2
    - How to change My Documents folder location for all domain users Hi all, I have configured Samba - PDC on ubuntu 8.04 and winXP clients. Domai logins are working without any problem. How do i map the My Document folder to a network drive for all users. I know you can do this if i wa using a ADS on Windows. But, i don't have an ADS on windows but a PDC o Linux. Is there a tweak on winxp where i can redirect the my documents folde to a network drive no matter which user logs into the machine. Thanks Avinas -- Avinash.Ra ----------------------------------------------------------------------- Avinash.Rao's Profile: http://forums.techarena.in/members/avinash-rao.ht View this thread: http://forums.techarena.in/active-directory/1019091.ht http://forums.techarena.i Tag: Adding DC to remote site Tag: 134008
  - 3
    - After demoting a DC (sites and services) Hi, I did a DCpromo today on an old box that is being removed. In sites and services I can still see the server there (but obviously no replication partners). The dcpromo demotion was sucessful. Does it just take a while before it removes the object from sites and services? Thanks, Tag: Adding DC to remote site Tag: 134002
  - 4
    - Event Log Dear All, how we can generate an event if a active directory user cut or copy data in domain environment. Rgds Nasir karim Tag: Adding DC to remote site Tag: 134001
  - 5
    - How can I change the font size of the log-on message text I have used group policy to set a message text for users attempting to log on in my Windows 2000 domain controllers. How can I change the font size to a bigger one? I cannot find any option in the group policy setting in doing so. Tag: Adding DC to remote site Tag: 133999
  - 6
    - Problem with GROUP report - Domain Users ( more than 15 000 member I have on Windows 2003 AD ( Native Domain and Forest 2003 ) problem with report members ( for example all ba* users ) from group Domain Users. There is more than 15 000 users in AD. Dsget group -member or VBS ( memberof ) return empty results. As temporary solution i'm checking all users account for primaryGroupID atribut ( value 513 ) Is there any chance for direct report from Domain Users group ? Marek Chladek Tag: Adding DC to remote site Tag: 133997
  - 7
    - Domain login problem after AD restore Hope you guys can give me some pointers here. The client is a school and these are the details of the issue: The main server (â??server1â??, for staff) was derived from earlier NT4 box that has been upgraded and moved around over the years. It had exchange 5.5 and was then upgraded first to windows 2000, then exchange 2000. It's hard disk has been cloned and moved into a newer server. It was once the only server, 18 months ago it was upgraded to server 2003R2, with some difficulty from exchange 2000 failing. Its been stable for 18 months. Server2 (for pupils) was added at some point after the first win2k server came, and was a domain controller and global catalog with server in the domain â??schoolâ??. All master and schema roles etc were on server1. At the end of last term I tried to upgrade exchange to 2003. It failed due to the domain controllers not being in sync. Looking at the system logs there has been a problem since April 14th. In looking at the AD connector on exchange 2000 a permissions message was returned. At this point the users disappeared from server1, but were still ok on server2. Backups were taken and a third server (server3) introduced, with some success. The exchange data was moved to server2. Foolishly I then tried to upgrade the exchange here, and guess what, the users disappeared on server2 and server3! I then restored the AD from server2 from July 18th back to server2 (server1 had shadow copy in backup exec but no system state backup). I forcibly did a dcpromo /remove on server1, so itâ??s a standalone as there did not seem much point in keeping it, I regret it now. The users reappeared on server2, and with a little more configuration it looks good, you can create new users (there are around 200) and share folders etc. All the shares are correct. The exchange data is however â??stuckâ?? here as the AD restore also restores the registry, so this is another issue! The main problems are that you cannot login to server2, even though it claims to be a DC with all roles â?? things like netlogon, sysvol share etc are all there. You cannot join server1 (or server3) to the domain. You cannot run a terminal server session on it. You can login on a workstation, but it's so slow its obviously not right (dns screams at me here?) Nslookup fails on any other server looking at server2 as dns. If you ping server2â??s fqdn it fails (but it's ok on server2 itself). Dcdiag and event logs show very little to help. Just wondering if anyone can give me some pointers. I have eliminated any physical possibilities like NIC drivers, switching, cabling etc and am pretty sure it's DNS (things like this always seem to be DNS!) but I am kind of banging my head against a brick wall here. In essence, I need to get Server2 to accept logins and allow server1 (or server3) to be a AD server. Then I can tackle the Exchange issue on server2. Thanks a lot guys. Tag: Adding DC to remote site Tag: 133992
  - 8
    - keytab multiple SPN-s How can I generate keytab file for unix service with multiple SPNs? I don't want to produce lot of service accounts and prefer having similar services with one service account and keytab file with multiple SPN. Tag: Adding DC to remote site Tag: 133991
  - 9
    - Group name not updating when accessing from Outlook Calendar Hey, I have a bunch of Groups in AD with various members in each. When I open Calendar in Outlook (Office 2003) and click Share My Calendar, I'm able to add Users or Groups. However, for some reason when I add a new Group or edit the name of an existing group to something else, the change is not being picked up and I'm not able to find/select this new Group to add. I am able to edit a Group name, search for the old name, add it and it will show the new Users that I have added to the Group, however I really want to be able to add new Groups as well. Any ideas? Thanks! -- Duracelll ------------------------------------------------------------------------ Duracelll's Profile: http://forums.techarena.in/members/duracelll.htm View this thread: http://forums.techarena.in/active-directory/1018953.htm http://forums.techarena.in Tag: Adding DC to remote site Tag: 133986
  - 10
    - Any good books/resources for ADAM and AzMan? Hi, What are the good books/resources to learn ADAM and AzMan? I searched Amazon.com and I couldn't find any! Any help would be appreciated, Max Tag: Adding DC to remote site Tag: 133965
  - 11
    - Script to read Computers in AD Hi, I need some help with this script. I've been trying to read a file with computer names, have it select the computer and write the Name and Description to a file. I can get the Name and write it to a file, but I can not seem to get the Description. Here is my code: ********************************************** On Error Resume Next Const ADS_SCOPE_SUBTREE = 2 Const ForReading = 1 Set objConnection = CreateObject("ADODB.Connection") Set objCommand = CreateObject("ADODB.Command") objConnection.Provider = "ADsDSOObject" objConnection.Open "Active Directory Provider" Set objCommand.ActiveConnection = objConnection objCommand.Properties("Page Size") = 1000 objCommand.Properties("Searchscope") = ADS_SCOPE_SUBTREE Set objFSO = CreateObject("Scripting.FileSystemObject") Set objFile = objFSO.OpenTextFile("C:\admin\Computers.txt") Set objFS = CreateObject("Scripting.FileSystemObject") Set objNewFile = objFS.CreateTextFile("fsoutput.txt") Do Until objFile.AtEndOfStream strComputer = objFile.ReadLine objCommand.CommandText = "SELECT Name, Description FROM 'LDAP://DC=fabrikam,DC=com' " & _ "WHERE objectCategory='computer' AND Name = '" & strComputer & "'" Set objRecordset = objCommand.Execute If objRecordset.RecordCount = 0 Then objNewFile.WriteLine strComputer & " does not exist." Else objNewFile.WriteLine strComputer & " " & objRecordSet.Fields("Description").Value End If Loop objNewFile.Close ***************************************************** Any help is greatly appreciated. Tag: Adding DC to remote site Tag: 133959
  - 12
    - folder redirection error My Setup: Windows Server 2003R2 File Server Active Directory Domain I have a policy set up to redirect the user's my documents to their 'home folder' On the user's account properties their home folder is set to 'connect u to' \\usd\homedirs\staff\hs\%username%' for example. So I have my user s home folder pointing to the home folders share via dfs. The folder was created by AD This works perfect with windows xp my users documents are redirected no problem. In windows vista this is not the case. The documents are not being redirected, in sync center there is an error staff (\\usd\homedirs) - Access is denied. Why would this be happening? What is different about the way vista does folder redirection that could cause it to work in xp but not vista and appear to be a permission issue? Tag: Adding DC to remote site Tag: 133958
  - 13
    - View number of objects in entire OU? Is there a way within AD to show the number of objects within a certain OU including sub containers? I know if I go to each subcontainer it will show the number but I would like to be able to click the upermost OU and then be able to set the type of objects to count and then get that total. Can this be done? This is a 2003 native domain. Thanks! Tag: Adding DC to remote site Tag: 133956
  - 14
    - Filtering on a Security Group to Apply a Group policy Instead of applying a Group Policy to an OU, what is the proper way to apply it to just a security group of users or computers to ensure the policy is no applied to any other computer or user. If you have a good article. I am reading about how to apply but does it really work without affecting other computers or users? This is because moving users or computers in and out of a specific OU that has policy's attached to it causes custom applications to break that are tied into Active Directory. tina Tag: Adding DC to remote site Tag: 133954
  - 15
    - adfind search using adfind what would be the best way to show a single users attributes adfind -default -f "(&(objectcategory=person) (objectclass=user))" ????? Tag: Adding DC to remote site Tag: 133952
  - 16
    - Failed DCPROMO?? This morning to promo'd out what I believed to be a NT BDC promoted to PDC, then upgraded to Win2000. The demotion I guess went ok, users can log in, no calls etc . . But when I look at our AD-DNS, the old DC is still listed as a name server. When I look at ADSites and Services, he's still listed in my site, but there is no NTDS listed. If I look at Computer Mangement\Sessions there are a handful of users connected, but no open files. And what's the deal in Sites and Services when links aren't automatically created? I forget. But I have a handful of links that were manually created... So - should I wait for my four sites to replicate for that old DC to drop out of DNS, and sites and services or do I have a problem?? Tia, RandyH Tag: Adding DC to remote site Tag: 133947
  - 17
    - Default Homepage IE6 We use the Default Domain Policy GPO that changes the default home page and doesn't allow the end users to change it. We now have a need to exclude 1 specific user from this policy. So I stuck them in a new OU and told that OU to block inheritence so that we could change the default home page. No luck. Any suggestions on how to do this? Mike Tag: Adding DC to remote site Tag: 133946
  - 18
    - Converting LastLogonTimestamp to a readable format Hi Everyone I have done a dump of directory attributes using csvde. One of the attributes Im after is the lastlogontimestamp which is obviously in an interger8 format. How do I convert this to a normal readable date format? I don't want to run other scripts against our AD. I would rather have a script that ran against the export file if there is one. I do seem to remember being able to use Excel to convert this to a readable format but I can't seem to get this to work now. Your help is appreciated Tag: Adding DC to remote site Tag: 133926
  - 19
    - Rename a DC Hi, I've got a DC that i wish to change the name of (I have a few other DCs within this domain). How would i go about this? Any issues in doing this? Thanks, Tag: Adding DC to remote site Tag: 133921
  - 20
    - change a global group to a domain local group Hello, It is not possible to change a global group directly to a domain local group however it is possible to change the global group into an universal group and then change the universal group into a domain local group. There are people that say that it is not a recommended way to do this, other say that it is no problem. I can imagin that there will be problems when GC's are nested in other groups. But if the groups are not nested, what kind of issue's can I expect? Can anyone give me some feedback or links where I can find more information about this subject? Kind regards, Peter van der Laarse Tag: Adding DC to remote site Tag: 133919
  - 21
    - server 2000 (single domain name) to server 2008 migration + domain rename So I have a windows 2000 domain controller with a single label domain name. Nobody uses it as a domain controller, just to access shares stored on it. but now we need to migrate it to windows 2008 and make it work like a domain controller without loosing the user passwords and share permissions. (all users have accounts on it, they just type their passwords when accessing shares). I tried to add a secondary domain controller with windows 2008 to it and wanted to rename it later. but even after transfering all the roles to it it didn't work. Tried to follow this article: http://support.microsoft.com/default.aspx?scid=kb;en-us;300684 about working with single domains. But that broke my DNS server, it won't start anymore. and doesn't start after reverting the changes also. dcdiag says that Global Catalog, PDC, and KDC could not be found. The DNS zone was active directory integrated. I do have backups, so I could try to do this again if I can find out where did I go wrong an what precautions should I take next time. THenks. -- zux ------------------------------------------------------------------------ zux's Profile: http://forums.techarena.in/members/zux.htm View this thread: http://forums.techarena.in/active-directory/1018297.htm http://forums.techarena.in Tag: Adding DC to remote site Tag: 133918
  - 22
    - Documentation/Tutorial for anyone new to Active Directory Anyone just getting started with Active Directory may find the two documents available for download near the bottom of the page at http://members.shaw.ca/bsanders/WindowsGeneralWeb/DomainAndActiveDirectory.htm interesting or helpful. Installing Windows Server 2008 and making it a Domain Controller - explains how to configure a simple network, install Windows Server 2008 and make it a Domain Controller for a new domain in a new forest. Getting started with Windows 2008 Domains - explains Domain concepts and objects plus detailed instructions setting up a "starter set" of OUs, user accounts, groups, and GPOs, including delegation of authority within Active Directory. No adds, no gimmicks; just some hopefully useful information derived from some years of experience. Comments and suggestions are welcome! -- Bruce Sanderson http://members.shaw.ca/bsanders It is perfectly useless to know the right answer to the wrong question. Tag: Adding DC to remote site Tag: 133910
  - 23
    - Group Policy Windows 2000 domain Security Page-Site to Zone assign I have a Windows 2000 active directory domain and I would like to set the following group policy settings. Group Policy-User Configurations-Administrative Templates-Internet Explorer-Security Page-Site to Zone assignment List But I am unable to find this settings in the current group policy. How do I go about it? This setting is available in XP local policy. Thanks Tag: Adding DC to remote site Tag: 133909
  - 24
    - Display the user permission on a share folder Hi, Is it possible to scan the share folder and report the user permission on that folder? I ever tried the "ShareEnum" and it only showed the domain login name. Possible to show the User Name (from AD) instead of the login name? thanks huang Tag: Adding DC to remote site Tag: 133906
  - 25
    - 1 user gets no logon server at logon attempt I have an XP pro sp2 in an AD network. when 1 user attempts to logon to the domain she gets no logon server available. Other users can logon that machine. No restrictions for that PC or user. What could cause this? corrupt profile is about all I can think of. Carl -- Tag: Adding DC to remote site Tag: 133905

We have a remote site connected via PtP fiber ethernet 60MBps. I am
promoting 1 server to a DC. Is there any special precaution/consideration
for this new DC or AD changes?

Thanks

Kirl

Top

Re: Adding DC to remote site by Meinolf

Meinolf
Wed Aug 13 13:10:17 PDT 2008

Hello MSNewsgrp,

On the running DC/DNS make sure that you use AD integrated zones on the DNS
server. So it also replicates the DNS zones to the new server. Is there another
DC in the site? Make sure the new DC points to an up and running DNS server
as preferred DNS on the NIC, no other server. Also make this new DC DNS server
and Global catalog server after promotion. When AD database and DNS is fully
replicated change the preferred DNS server to itself and another DNS as secondary
on the new DC. If you have configured FORWARDERS on the main DNS server,
you have also configure them on the new DNS server. Server configs will not
be replicated, only the sites.
Configure AD Sites and services for the site and subnet and move the new
DC to the site after promotion. So all clients at the remote site will use
this DC for authentication first. Also if DNS is replicated( take round about
15 minutes) reconfigure all machines at the remote site to use the site DNS
as preferred DNS and another as secondary.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

> We have a remote site connected via PtP fiber ethernet 60MBps. I am
> promoting 1 server to a DC. Is there any special
> precaution/consideration for this new DC or AD changes?
>
> Thanks
>
> Kirl
>

Top