Domain Controller Failover

Tutorials Win: Microsoft Windows Forum

- Previous
  - 1
    - ADAM Service Account I am trying to install ADAM in our domain on two seperate servers. One will be the Master and the other will be a replica. I will be using a domain account for the service. What permissions are necessary for the ADAM service account in a domain? Do I just need to make it an admin on the local box? Please advise.... Tag: Domain Controller Failover Tag: 128105
  - 2
    - What is ADLDS Hello I'm wondering what ADLDS (previous named ADAM) can be used for? I can't seem to find a good document that explains it pro's and con's. Could anyone please assist? Regards Per-Torben Sørensen Tag: Domain Controller Failover Tag: 128104
  - 3
    - How to know when an AD object has been deleted ? Hi, I would like to know which day and approximatively at what time an object has been deleted. I think that it is possible with the repadmin command but I dont find how. Please could you help me ? Thank you -- Pascal Tag: Domain Controller Failover Tag: 128103
  - 4
    - Removing failed DC from AD Integrated Zones Hi there, One of our Windows 2000 domain controllers died last week so we had to remove it from AD as per the following article -> http://support.microsoft.com/kb/216498. The problem is we have approximately 100 Active Directly integrated DNS zones & the 'old' DC is still listed as a Name Server (NS) in all of them. Is there a quick & easy to remove this entry or do we need to remove it manually from all of the zones? Any suggestions/comments are greatly appreciated. Regards, Veets Tag: Domain Controller Failover Tag: 128096
  - 5
    - HOWTO merge multiple GPO's to one new GPO Does anyone know a way howto merge multiple GPO's to one new GPO. I want to merge multiple GPO's with some security, system and administrative policies to one new GPO. I also want to merge the multiple "regedit.pol" files that are now part of individual GPO's into one new GPO. The GPMC does not provide this function with import. The import overwrites the whole GPO. VB scripts are also welcome. Thanx in advance Tag: Domain Controller Failover Tag: 128095
  - 6
    - prevent some users to download mp3 and specified files Hi how can prevent some users to download mp3 and specified files to desktop and their home folder. Thanks Tag: Domain Controller Failover Tag: 128092
  - 7
    - Hot Shop Tissot Watches Ballade - Tissot Minimum Price Hot Shop Tissot Watches Ballade - Tissot Minimum Price Hot Watch Shop : http://www.hotwatchshop.com Tissot Watches : http://www.hotwatchshop.com/Tissot-Watches.html Tissot Watches Ballade : http://www.hotwatchshop.com/Tissot-Watches-Ballade-Watch.html Tissot Watches Ballade All Products : Tissot Men's Ballade III watch #T97148152 : http://www.hotwatchshop.com/Tissot-wristwatch-9033.html Tissot Men's Ballade III watch #T97.5.483.31 : http://www.hotwatchshop.com/Tissot-wristwatch-9034.html Tissot Men's Ballade III watch #T97148331 : http://www.hotwatchshop.com/Tissot-wristwatch-9035.html Tissot Men's Ballade III watch #T97148142 : http://www.hotwatchshop.com/Tissot-wristwatch-9036.html Tissot Men's Ballade III watch #T97148132 : http://www.hotwatchshop.com/Tissot-wristwatch-9037.html Tissot Men's Watches Ballade III T97.1.483.31 - AA : http://www.hotwatchshop.com/Tissot-wristwatch-9038.html Tissot Men's Watches Ballade III T97.5.483.31 - AA : http://www.hotwatchshop.com/Tissot-wristwatch-9039.html Tissot Men's Ballade III watch #T97248132 : http://www.hotwatchshop.com/Tissot-wristwatch-9040.html Tissot Men's Ballade III watch #T97148351 : http://www.hotwatchshop.com/Tissot-wristwatch-9041.html The Same Tissot Watches Series : Tissot Happy Chic Baguette : http://www.hotwatchshop.com/Tissot-Happy-Chic-Baguette-Watch.html Tissot Happy Chic Rectangular : http://www.hotwatchshop.com/Tissot-Happy-Chic-Rectangular-Watch.html Tissot Porto Chronograph : http://www.hotwatchshop.com/Tissot-Porto-Chronograph-Watch.html Tissot Watches Ballade : http://www.hotwatchshop.com/Tissot-Watches-Ballade-Watch.html Tissot Watches Ballade III : http://www.hotwatchshop.com/Tissot-Watches-Ballade-III-Watch.html Tissot Watches Bascule : http://www.hotwatchshop.com/Tissot-Watches-Bascule-Watch.html Tissot Watches Belle Tonneau : http://www.hotwatchshop.com/Tissot-Watches-Belle-Tonneau-Watch.html Tissot Watches Flower Power : http://www.hotwatchshop.com/Tissot-Watches-Flower-Power-Watch.html Tissot Watches Generosi-T : http://www.hotwatchshop.com/Tissot-Watches-Generosi-T-Watch.html Tissot Watches Grain De Folie : http://www.hotwatchshop.com/Tissot-Watches-Grain-De-Folie-Watch.html Tissot Watches Le Locle : http://www.hotwatchshop.com/Tissot-Watches-Le-Locle-Watch.html Tissot Watches Navigator : http://www.hotwatchshop.com/Tissot-Watches-Navigator-Watch.html Tissot Watches Oval T : http://www.hotwatchshop.com/Tissot-Watches-Oval-T-Watch.html Tissot Watches PR100X : http://www.hotwatchshop.com/Tissot-Watches-PR100X-Watch.html Tissot Watches PR50 : http://www.hotwatchshop.com/Tissot-Watches-PR50-Watch.html Tissot Watches PRC100 : http://www.hotwatchshop.com/Tissot-Watches-PRC100-Watch.html Tissot Watches PRC200 : http://www.hotwatchshop.com/Tissot-Watches-PRC200-Watch.html Tissot Watches Precious Flower : http://www.hotwatchshop.com/Tissot-Watches-Precious-Flower-Watch.html Tissot Watches PRS200 : http://www.hotwatchshop.com/Tissot-Watches-PRS200-Watch.html Tissot Watches PRS516 : http://www.hotwatchshop.com/Tissot-Watches-PRS516-Watch.html Tissot Watches Quadrato : http://www.hotwatchshop.com/Tissot-Watches-Quadrato-Watch.html Tissot Watches Seastar : http://www.hotwatchshop.com/Tissot-Watches-Seastar-Watch.html Tissot Watches Six-T : http://www.hotwatchshop.com/Tissot-Watches-Six-T-Watch.html Tissot Watches T-Moments : http://www.hotwatchshop.com/Tissot-Watches-T-Moments-Watch.html Tissot Watches T-Race : http://www.hotwatchshop.com/Tissot-Watches-T-Race-Watch.html Tissot Watches T-Round : http://www.hotwatchshop.com/Tissot-Watches-T-Round-Watch.html Tissot Watches T-Tonneau : http://www.hotwatchshop.com/Tissot-Watches-T-Tonneau-Watch.html Tissot Watches T-Touch : http://www.hotwatchshop.com/Tissot-Watches-T-Touch-Watch.html Tissot Watches T-Touch Nascar : http://www.hotwatchshop.com/Tissot-Watches-T-Touch-Nascar-Watch.html Tissot Watches T-Tracx : http://www.hotwatchshop.com/Tissot-Watches-T-Tracx-Watch.html Tissot Watches T-Wave : http://www.hotwatchshop.com/Tissot-Watches-T-Wave-Watch.html Tissot Watches TXL : http://www.hotwatchshop.com/Tissot-Watches-TXL-Watch.html Tissot Watches V8 : http://www.hotwatchshop.com/Tissot-Watches-V8-Watch.html Tag: Domain Controller Failover Tag: 128089
  - 8
    - Hot Shop Invicta Lupah Watches - Invicta Minimum Price Hot Shop Invicta Lupah Watches - Invicta Minimum Price Hot Watch Shop : http://www.hotwatchshop.com Invicta Watches : http://www.hotwatchshop.com/Invicta-Watches.html Invicta Lupah Watches : http://www.hotwatchshop.com/Invicta-Lupah-Watches-Watch.html Invicta Lupah Watches All Products : Invicta Lupah Classic Diamond Mens Watch ZW9896 : http://www.hotwatchshop.com/Invicta-wristwatch-9671.html Invicta 9820 Lupah Unisex Watch : http://www.hotwatchshop.com/Invicta-wristwatch-9672.html Invicta Lupah Diamond Chronograph Mens Watch ZW9895 : http://www.hotwatchshop.com/Invicta-wristwatch-9673.html Invicta Lupah Chronograph Mens Watch 9816 : http://www.hotwatchshop.com/Invicta-wristwatch-9674.html Invicta Baby Lupah Watch 2007 : http://www.hotwatchshop.com/Invicta-wristwatch-9675.html Invicta 8008 Lupah Mens Watch : http://www.hotwatchshop.com/Invicta-wristwatch-9676.html Invicta 2663 Lupah Horizon Chrono Mens Watch : http://www.hotwatchshop.com/Invicta-wristwatch-9677.html Invicta Lupah Watch 2183 : http://www.hotwatchshop.com/Invicta-wristwatch-9678.html Invicta Lupah Chronograph Mens Watch 9814 : http://www.hotwatchshop.com/Invicta-wristwatch-9679.html Invicta Lupah Watch 9818 : http://www.hotwatchshop.com/Invicta-wristwatch-9680.html Invicta Lupah Watch 9817 : http://www.hotwatchshop.com/Invicta-wristwatch-9681.html Invicta Lupah Watch 9815 : http://www.hotwatchshop.com/Invicta-wristwatch-9682.html Invicta Men's Lupah Metal Goldplated Chronograph Watch 3386 : http://www.hotwatchshop.com/Invicta-wristwatch-9683.html Invicta Women's Lupah Pink Ribbon Diamond Watch 2261/IS529 : http://www.hotwatchshop.com/Invicta-wristwatch-9684.html The Same Invicta Watches Series : Invicta Lupah Diver Watches : http://www.hotwatchshop.com/Invicta-Lupah-Diver-Watches-Watch.html Invicta Lady Lupah Watches : http://www.hotwatchshop.com/Invicta-Lady-Lupah-Watches-Watch.html Invicta Baby Lupah Watches : http://www.hotwatchshop.com/Invicta-Baby-Lupah-Watches-Watch.html Invicta Infinity Watches : http://www.hotwatchshop.com/Invicta-Infinity-Watches-Watch.html Invicta Diver Watches : http://www.hotwatchshop.com/Invicta-Diver-Watches-Watch.html Invicta Pro Diver Watches : http://www.hotwatchshop.com/Invicta-Pro-Diver-Watches-Watch.html Invicta Time Square Watches : http://www.hotwatchshop.com/Invicta-Time-Square-Watches-Watch.html Invicta Camelot Watches : http://www.hotwatchshop.com/Invicta-Camelot-Watches-Watch.html Invicta Charmed Watches : http://www.hotwatchshop.com/Invicta-Charmed-Watches-Watch.html Invicta Elite Watches : http://www.hotwatchshop.com/Invicta-Elite-Watches-Watch.html Invicta Speedway Watches : http://www.hotwatchshop.com/Invicta-Speedway-Watches-Watch.html Invicta Ocean Ghost Watches : http://www.hotwatchshop.com/Invicta-Ocean-Ghost-Watches-Watch.html Invicta Transatlantic Watches : http://www.hotwatchshop.com/Invicta-Transatlantic-Watches-Watch.html Invicta Ocean Pro Watches : http://www.hotwatchshop.com/Invicta-Ocean-Pro-Watches-Watch.html Invicta Lupah Watches : http://www.hotwatchshop.com/Invicta-Lupah-Watches-Watch.html Invicta Lupah Grand Watches : http://www.hotwatchshop.com/Invicta-Lupah-Grand-Watches-Watch.html Invicta Lupah Dragon Watches : http://www.hotwatchshop.com/Invicta-Lupah-Dragon-Watches-Watch.html Invicta Chronograph Watches : http://www.hotwatchshop.com/Invicta-Chronograph-Watches-Watch.html Invicta Abyss Watches : http://www.hotwatchshop.com/Invicta-Abyss-Watches-Watch.html Invicta 10 Collection Watches : http://www.hotwatchshop.com/Invicta-10-Collection-Watches-Watch.html Invicta Lefty Chronograph Watches : http://www.hotwatchshop.com/Invicta-Lefty-Chronograph-Watches-Watch.html Invicta Corduva Watches : http://www.hotwatchshop.com/Invicta-Corduva-Watches-Watch.html Invicta Vintage Watches : http://www.hotwatchshop.com/Invicta-Vintage-Watches-Watch.html Invicta Russian Diver Watches : http://www.hotwatchshop.com/Invicta-Russian-Diver-Watches-Watch.html Invicta Multi-Function Watches : http://www.hotwatchshop.com/Invicta-Multi-Function-Watches-Watch.html Invicta Extreme Watches : http://www.hotwatchshop.com/Invicta-Extreme-Watches-Watch.html Invicta Signature Watches : http://www.hotwatchshop.com/Invicta-Signature-Watches-Watch.html Invicta Caprice Watches : http://www.hotwatchshop.com/Invicta-Caprice-Watches-Watch.html Invicta Curlo Melody Watches : http://www.hotwatchshop.com/Invicta-Curlo-Melody-Watches-Watch.html Invicta Corduba Watches : http://www.hotwatchshop.com/Invicta-Corduba-Watches-Watch.html Invicta II Watches : http://www.hotwatchshop.com/Invicta-II-Watches-Watch.html Invicta Just Added Watches : http://www.hotwatchshop.com/Invicta-Just-Added-Watches-Watch.html Tag: Domain Controller Failover Tag: 128088
  - 9
    - question about GPO in domain 2003 Hi I have an OU with "Block Inheritance" is tagged. I have a server 2003 R2 SP2 in this OU, I configured the local GPO of this server(security optins), when I'm running the RSOP on this server I get "NOT definded", I run the GPUPDATE command, did'nt solv the problem. why is that? Lior Tag: Domain Controller Failover Tag: 128087
  - 10
    - win 2003 ADS Password change I setup a win 2008 ADS Domain with 2 DC's/DNS & 2 Member machines. The 1st DC plays all FSMO roles. Then I disconnected the 1 DC from the network & logged on from my Member machines to the domain as enterprise admin. I was authenticated by the 2nd DC that was availiable. I then attempted a password change of my enterprise admin AC from my member machine & i was allowed to change the password. Later I brought the 1st DC in the network . Now I could logon as enterprise admin from any of my member machine with the old enterprise admin pwd as well as the new pwd [Strange]. With the old pwd the 1st Dc authenticates me & with the new pwd the 2nd Dc authenticates me. This shouldnt be the case. Could someone explain the strange behaviour? Tag: Domain Controller Failover Tag: 128085
  - 11
    - One DC has died. How to remove it from the DC quorum? One of our 3 DC's has died. How can we demote/remote this DC from Active Directory? Thanks. Tag: Domain Controller Failover Tag: 128074
  - 12
    - Migration inter-forests I have to move users , workstations and security groups from a win2k3 domain to another corporate w2k3 domain (already trusted 2 ways).Servers will not be migrated. Users are really few (35-40) so I would like to know if I can find white papers or simple tools (Quest migration is too complicate) to perform the migration even manually. New users should go on accessing shared resources on a file server of the old domain. Exchange will also remain on the old domain for the moment. TIA Tag: Domain Controller Failover Tag: 128073
  - 13
    - Changing from Novell to Active Directory We have recently done a major system overhaul and changed from using Novell to usin Server 2003 with AD. It has all gone smoothly except for one constant problem on a small number of machines. We are an educational facility and becuse of this the computers the students useare protected using protection cards that return the computers to their previous state at reboot. Even though changes have been saved to the cards and the computers have been accepted as part of the AD network every couple of weeks a few of the computers give a message of not being recognized by the network and the only way to bypass this is by entering as a local administrator and in properties of my computer reassigning the computer to the network(that is to say if the network is called MS it shows in the network tab of the properties as MS.LOCAL so by deleting it you are requested to enter name and password of the network administrator) The computers that are having the problem are all running Win 2000 with one exception that is a computer running XP. ALL the other computers have no problems. We are talking about between 5 - 10 computers here where there are other machines exactly the same make and OS with the same protection cards that have no problems( Approx 15 machines with Win 2000 and about 80 - 100 with XP) Any ideas? Tag: Domain Controller Failover Tag: 128070
  - 14
    - test domain completely offline.. help I just made the biggest mistake ever... here's the situation. I have a test domain(4 DC's across two sites..) I had everything working properly(replication and whatnot) and the vmware esx server that hosted the DC's in my boston site crashed. I had to rebuild and the time ended up being off... I didn't notice this, or notice the replication errors... until after I raised the functional level last night from mixed 2000 to native 2000.. I figured maybe it was something else and let the dc's run overnight.. nothing changed. I just realized that it was a time issue so I fixed the time on the DC's in boston(the dublin DC's were perfectly fine in terms of time..) My dc's from boston jumped from 11/17/2007 to todays date and time(EDT..).. the stupid thing that I did was rebooted all 4 DC's... Now I'm screwed.. I can't RDC into any of them.. and on a console I can log in but I can't do anything AD related. If I open ADI.msc I was getting "the specified domain does not exist or could not be found" and I couldn't manage the domain. DNS was also offline(adi integrated..) I just checked again on the DC that holds the FSMO roles and I can see the domain from the snapin.. as well as the other dc's.. but DNS is still offline. My guess is that the time jump royally screwed everything up. I can RDC into my remote DC's now so that's a better sign.. I just have to figure out why DNS isn't working. I suppose this more turned into a cry/rant than a question, but if anyone has ever experienced similar.. and would like to share.. by all means.. Tag: Domain Controller Failover Tag: 128062
  - 15
    - 2k DC tombstoned what is the best way to recover a recently tombstoned W2k DC? This DC is a does not contain any FSMO roles. The domain functional level is 2k Native. It is a distributed environment conatines 2k and 2k3 DC's. thanks. Tag: Domain Controller Failover Tag: 128033
  - 16
    - One DC cannot boot up due to Directory Services failures We have 3 DC's in our domain. For one of them, we get the following error upon startup: Directory Services could not start because of the following error: The system cannot find the file specified. Error status: 0xc000000f. Please click Ok to shutdown this system and reboot into Directory Services Restore Mode, check the event log for more detail information. We've booted into DS Restore mode, and tried to recover the AD db manually, but also get errors with that: esentutl /r C:\Windows\NTDS\ntds.dit --> Operation terminated with error -1003 (JET_errInvalidParameter, Invalid API parameter) after 0.15 seconds. What can we do to resolve this problem on that DC? If not, can we demote that DC from one of the other DC's? Is it as simple as deleting the server from "Domain Controllers" in ADUC? Thanks in advance, Derek. Tag: Domain Controller Failover Tag: 128029
  - 17
    - ADAM Replica ISSUE I had installed ADAM on a master replica topology. I chose a domain account for the service to use to logon and made that user an admin of the server that ADAM was running on. I noticed on one of our DC's that I was getting a KCC error message for one of the ADAM servers. The event ID was Event Type: Error Event Source: KDC Event Category: None Event ID: 11 Date: 5/2/2008 Time: 10:56:59 AM User: N/A Computer: DC2 Description: There are multiple accounts with name E3514235-4B06-11D1-AB04-00C04FC2DCD2-ADAM/SSERVICE-VM.pennmutual.com:30000 of type DS_SERVICE_PRINCIPAL_NAME. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. I disjoined the machine from the domain, deleted the computer account and then rejoined it to the domain and started the ADAM service with the same doman user account. The service started and was working but replication failed to the replica. I woul dlike to correct this without having to remove ADAM and start over again. Can I just delete the replication objects and force the KCC to rebuild the topology? If I have to uninstall ADAM and start over how do I force it to remove the replica? Please advise... Tag: Domain Controller Failover Tag: 128023
  - 18
    - Secondary DC not registering in DNS I have an active directory domain runnin all Win2003 servers with service pack 2. In this domain I have two DCs. The first domain controller which was also the first DC created in the domain is working fine and has all the proper DNS records. The second DC seems to be working find and I am able to ping it, however, if I take down the first DC I get errors from exchange and other servers saying that a global catalog server is not available. I checked and the second DC is acting as a global catalog but for some reason is not seen when the first DC is taken offline. I ran DCDiag (results are below) and it failed the connectivity test. I thought this was due to DNS entries in the _msdcs section of the forward lookup zone. I am not sure how to fix this. I did note that within the dc section of the msdcs zone only the main DC is listed. This is also apparent in other sections like the gc folder. Has my second DC failed to add it records or is something else going wrong? Any help in this matter would be greatly appreciated Domain Controller Diagnosis Performing initial setup: * Verifying that the local machine arrowdc02, is a DC. * Connecting to directory service on server arrowdc02. * Collecting site info. * Identifying all servers. * Identifying all NC cross-refs. * Found 2 DC(s). Testing 1 of them. Done gathering initial info. Doing initial required tests Testing server: Default-First-Site-Name\ARROWDC02 Starting test: Connectivity * Active Directory LDAP Services Check The host 4ac30e94-0571-42d1-8ee5-e518d1e08079._msdcs.arrowheaddental.com could not be resolved to an IP address. Check the DNS server, DHCP, server name, etc Although the Guid DNS name (4ac30e94-0571-42d1-8ee5-e518d1e08079._msdcs.arrowheaddental.com) couldn't be resolved, the server name (arrowdc02.arrowheaddental.com) resolved to the IP address (192.168.9.12) and was pingable. Check that the IP address is registered correctly with the DNS server. ......................... ARROWDC02 failed test Connectivity Doing primary tests Testing server: Default-First-Site-Name\ARROWDC02 Skipping all tests, because server ARROWDC02 is not responding to directory service requests Test omitted by user request: Topology Test omitted by user request: CutoffServers Test omitted by user request: OutboundSecureChannels Test omitted by user request: VerifyReplicas Test omitted by user request: VerifyEnterpriseReferences Test omitted by user request: CheckSecurityError Running partition tests on : DomainDnsZones Starting test: CrossRefValidation ......................... DomainDnsZones passed test CrossRefValidation Starting test: CheckSDRefDom ......................... DomainDnsZones passed test CheckSDRefDom Running partition tests on : ForestDnsZones Starting test: CrossRefValidation ......................... ForestDnsZones passed test CrossRefValidation Starting test: CheckSDRefDom ......................... ForestDnsZones passed test CheckSDRefDom Running partition tests on : Schema Starting test: CrossRefValidation ......................... Schema passed test CrossRefValidation Starting test: CheckSDRefDom ......................... Schema passed test CheckSDRefDom Running partition tests on : Configuration Starting test: CrossRefValidation ......................... Configuration passed test CrossRefValidation Starting test: CheckSDRefDom ......................... Configuration passed test CheckSDRefDom Running partition tests on : arrowheaddental Starting test: CrossRefValidation ......................... arrowheaddental passed test CrossRefValidation Starting test: CheckSDRefDom ......................... arrowheaddental passed test CheckSDRefDom Running enterprise tests on : arrowheaddental.com Starting test: Intersite Skipping site Default-First-Site-Name, this site is outside the scope provided by the command line arguments provided. ......................... arrowheaddental.com passed test Intersite Starting test: FsmoCheck GC Name: \\arrowdc02.arrowheaddental.com Locator Flags: 0xe00001fc PDC Name: \\arrowdc01.arrowheaddental.com Locator Flags: 0xe00003fd Time Server Name: \\arrowdc02.arrowheaddental.com Locator Flags: 0xe00001fc Preferred Time Server Name: \\arrowdc01.arrowheaddental.com Locator Flags: 0xe00003fd KDC Name: \\arrowdc02.arrowheaddental.com Locator Flags: 0xe00001fc ......................... arrowheaddental.com passed test FsmoCheck Test omitted by user request: DNS Test omitted by user request: DNS -- Darius Sanders -- Darius Sanders Tag: Domain Controller Failover Tag: 128018
  - 19
    - ADAM question Hi, I am new to using ADAM, actually it just got dumped in my lap from a layoff. OK, so the scoop is we have an ADAM server setup, it is NOT connected to our domain but rather a test domain. After further investigation there is no DC in this so called "test domain". Now heres the question. Do we need to have a DC setup in a test domain to have ADAM work? From everything i have been reading today ADAM uses domain accounts, right? So in order to get this software to work it needs to be joined to a domain correct? My apologies for what seems to be an ignorant question. -- fritzkracker ------------------------------------------------------------------------ fritzkracker's Profile: http://forums.techarena.in/member.php?userid=48018 View this thread: http://forums.techarena.in/showthread.php?t=960841 http://forums.techarena.in Tag: Domain Controller Failover Tag: 128016
  - 20
    - Server 2008 and AD problems I've recently installed a Server running 2008 Std Ed. I made it a DC/GC with DNS & WINS. I was checking replication from this server and receive the following: C:\Windows\system32>repadmin /kcc Repadmin: running command /kcc against full DC localhost Default-First-Site-Name Current Site Options: IS_GROUP_CACHING_ENABLED DsReplicaConsistencyCheck() failed with status 8453 (0x2105): Replication access was denied. C:\Windows\system32>repadmin /syncall CALLBACK MESSAGE: The following replication is in progress: From: d11a3242-06a5-468c-9d10-ca94e5398015._msdcs.domain.com To : 14e4cac2-4c16-4833-bf09-2420b554546e._msdcs.domain.com CALLBACK MESSAGE: The following replication completed successfully: From: d11a3242-06a5-468c-9d10-ca94e5398015._msdcs.domain.com To : 14e4cac2-4c16-4833-bf09-2420b554546e._msdcs.domain.com CALLBACK MESSAGE: The following replication is in progress: From: 14e4cac2-4c16-4833-bf09-2420b554546e._msdcs.domain.com To : 7883f05f-3bae-49f1-a0ed-a2f23927e132._msdcs.domain.com CALLBACK MESSAGE: Error issuing replication: 8453 (0x2105): Replication access was denied. From: 14e4cac2-4c16-4833-bf09-2420b554546e._msdcs.domain.com To : 7883f05f-3bae-49f1-a0ed-a2f23927e132._msdcs.domain.com CALLBACK MESSAGE: The following replication is in progress: From: 2a678948-4537-4719-aab0-093b92baa145._msdcs.domain.com To : 7883f05f-3bae-49f1-a0ed-a2f23927e132._msdcs.domain.com CALLBACK MESSAGE: Error issuing replication: 8453 (0x2105): Replication access was denied. From: 2a678948-4537-4719-aab0-093b92baa145._msdcs.domain.com To : 7883f05f-3bae-49f1-a0ed-a2f23927e132._msdcs.domain.com CALLBACK MESSAGE: SyncAll Finished. SyncAll reported the following errors: Error issuing replication: 8453 (0x2105): Replication access was denied. From: 14e4cac2-4c16-4833-bf09-2420b554546e._msdcs.domain.com To : 7883f05f-3bae-49f1-a0ed-a2f23927e132._msdcs.domain.com Error issuing replication: 8453 (0x2105): Replication access was denied. From: 2a678948-4537-4719-aab0-093b92baa145._msdcs.domain.com To : 7883f05f-3bae-49f1-a0ed-a2f23927e132._msdcs.domain.com Any idea as to why I would get an 'Access Denied' when running these checks? Mike Tag: Domain Controller Failover Tag: 128014
  - 21
    - gpinventory how can i use gpinventory.exe which i downloaded from microsoft website? when i run, it says you should put this file with wmiqueries.xml. but i can not find this file. and how can i run gui version? when i try to connect with rsop from mmc it says wmi service is not running on client altough i have run this? Thanks Tag: Domain Controller Failover Tag: 128011
  - 22
    - Deleted a Domain Controller, now what? Hello Everyone, I inadvertantly deleted the WRONG domain controller out of Active Directory the other day. Does anyone have advice on the proper way to get promote this server to a Domain Controller again? Can I demote/promote or will it bomb out when attempt either action? Thanks in advance for any advice... stupid move here that might end up being a LOT of work... Thanks, Sean Tag: Domain Controller Failover Tag: 128009
  - 23
    - RPC_S_CALL_FAILED_DNE WE have 3 DCs with domain based DFS. for some reasons DFS replication is not successful. I run FRSDIAG and got 3 RPC_S_CALL_FAILED_DNE error. I check RPC mapper error for port 135 (with portqry.exe) and it display 110 results. I am not sure that to do to make replication successful? PLease help Tag: Domain Controller Failover Tag: 128008
  - 24
    - ADAM Replication We have built an ADA repositiory and a replica of it on another machine They are the only two instances with in the same site. I have increased the scheduled replication to four times per day. I have been adding objects to the master ADAM instance and see a lag of about a minute before I see the object in the replica residing on another server. Is there a way to make adam replicate faster than that? Please advise... Tag: Domain Controller Failover Tag: 128005
  - 25
    - Resyncing AD Hi, I have a situation. I just got customer who had deployed 2 2K3 AD and had it sync with each other in the local office. however, they split the network between 2 sites and have been making changes on both sites. thus now both site have different database. this has been going on for a while and they did not connect the 2 sites together, thus the AD is not sync. Question: If they connect the network together now and tried to sync the 2 AD, will the different changes made on both AD be sync to each other thus have a single database again? Thanks. Gilbert Tag: Domain Controller Failover Tag: 128002
- Next
  - 1
    - AFDS, Domain trust or other? Hello all, I'm falling in a strange question. I've an exchange systems in my domain. Using this exchange system I give a service to my customers outsourcing the exchange. Now, I've to sell this service to another customer. This customers do not want for privacy/security/other reasons to trust its own domain with my one but want to use for every user in its domain the local credential to logon to my exchange service thought outlook and thought owa. If I can use trust googling around I've found AD Federation services, but seems to be that this systems works only for web applications. This can be good for OWA but is unusable for Outlook client. There's another trick to solve this? Thanks Stefano Tag: Domain Controller Failover Tag: 128001
  - 2
    - Ports & Services & Security I'm looking for documentation that links services to ports for security reasons. This is coming for a *nix guy whose only been able to piecemeal/guess-n-check listening & open ports with several netstat tests. One test crippled AD because I had disabled one too many services! (luckily it was a test server). Something like /etc/services for Windows would be grande ... :) Tag: Domain Controller Failover Tag: 127999
  - 3
    - homepage from gpo i have changed homepage of all users from gpo -> user conf -> administrative -> windows comp. ->internet explorer to specific web site which is located locally. some users have updated this new policy but some others polcies can not be changed. Only change is changing homepage is disabled. How can i force all domain users have affected this new policies? Thanks Tag: Domain Controller Failover Tag: 127997
  - 4
    - Problem deleting an unknown object in a group Hi, We have a problem with our A.D. We have 9 DC in 8 different sites. All DC are W2K3 Std R2 SP2 with all hotfixes. Domain functionnal level is Windows Server 2003. We have a GPO that use Restricted Groups to set members of the Built-In Administrators group. We have an event in Application Event Log on all DC. SceCLI event #1202 : "Security policies were propagated with warning. 0x4b8 : An extended error has occurred." I've enabled debug logging for the Security Configuration client-side extension and I have found this error in Winlogon.log : remove SID: S-1-5-21-1047738115-132384186-1539857752-500. Error 1377: The specified account name is not a member of the local group. error removing SID: S-1-5-21-1047738115-132384186-1539857752-500. This SID is an object from a trusted domain. The trust has been deleted and we forgot to remove it from the GPO before deleting the trust. When I go directly to the Administrators group and I try to delete the member manually, I receive this warning after clicking on Apply : The object is no longer a member of this group. It may still appear due to standard delays in replication between domain controllers. I've done this yesterday and I have this message again this morning, so I know it is not a replication delay. In the ForeignSecurityPrincipals container, I can see the object. Ca I delete the object directly in this place ? Will this result in removing the object from the Administrators group ? Can this cause other issue ? If yes, what should I do to remove the object from the Administrators group ? Thank you very much, Dominic Tag: Domain Controller Failover Tag: 127987
  - 5
    - Licensing Computer for each site? Hi all, I run a Win2K3 domain. I noticed that you can choose a Licensing Computer for each site. I have never configured one for any of my sites including the default one. What is it for? Do I need to set one up? We are using per-device licensing. But the only thing I have ever done is choose the per-device radio-button when installing a server and thats it. Any help is appreciated, thanks. Robert Tag: Domain Controller Failover Tag: 127982
  - 6
    - AD Sites And Services I have set up three sites for our three DCs. I have moved each of the DCs to the correct site, Default-First-Site-Name to Site A, Site B, Site C for DC A, DC B, and DC C. Now can I delete the Default-First-Site-Name without any issues? TIA John Tag: Domain Controller Failover Tag: 127975
  - 7
    - ADAM Space Usage I recently received a notification from our Server Administrators that the available space on an ADAM server is running low. I have been monitoring the server and noticed that the size of the .dit file has not changed for several days, eventhough we add hundreds of records a day. How is storage allocated to ADAM? Does ADAM allocate blocks of storage, uses it as it seams fit and grabs additional blocks when it determines it is running low? If so, how much does it allocate at a time, xx kb, yy%? Tag: Domain Controller Failover Tag: 127970
  - 8
    - Primary restore on differente hardware Recently I've attempted to perform a Windows Server 2003 DC Primary Restore, originally installed on an HP Proliant ML310 server - PIV 2,4 GHz - N.2 SCSI Disk - N. 2 Nic - 512 MB RAM, on a new HP Proliant ML110 G5 server - Pentium 1,8 GHz Dual Processor - N. 2 SATA Disk - N.2 NIC card - 512 MB RAM. But when the restore was completed (using NTBackup) and the new server was restarted was impossible to use mouse or keyboard that where completly inactive. Then I've restarted the server in safe mode but mouse and keyboard was inactive too. I've tried to use USB mouse and keyboard (not PS2) but the result was the same. At this point I've finded on microsoft KB that this is a problem related to different hardware on the two server and was suggested to perform an "upgrade on place" of the Operating System by the original CD. By this way it was possible to restore the server. But the question is: for the next years, having on my networks (I'm a Network consultant for many Companies and SMB) many servers 4-5 years old (as the Proliant ML310) when they well be too old or irremediably damaged well be possible to restore their system on new (very different) servers? Thanks in advance. Ing. Cosimo MERCURO Tag: Domain Controller Failover Tag: 127969
  - 9
    - Locate the computer by using login ID information Hi, I want to know how to search for the computer name in an AD when I have only user login ID information on hand. No WINS, only DHCP and DNS. Any idea? Thanks in advance. Pakeon Tag: Domain Controller Failover Tag: 127964
  - 10
    - Is there a restriction on number of characters for user name Can someone please confirm if there is restriction of number characters for user name. User has 23 characters in username (firstname.lastname) and can't login, however user is able to login with using first 20 characters. Many thanks Tag: Domain Controller Failover Tag: 127963
  - 11
    - windows 2000 mixed to windows 2000 native question I'm about to promote my domain to windows 2000 native and had a few questions. We have 6 domain controllers.. 4 windows 2000 SP4 and 2 windows 2003 (one is r2 sp2..) the other I believe is just win2k3 sp2. I just finished cleaning up the AD metadata with ntdsutil for all our old DC's that don't exist. We have no NT4 machines in our domain(all are 2000+).. I've read that I initiate the change from the DC that holds the FSMO and pdc emulator roles... so im clear on that.. what im not clear on is.. I read someplace that "all DC's need to be rebooted after they display "native mode" after the domain level is raised on the PDC emulator." I've been working on this sporadically... so it is entirely possible that I dreamt this one night during an AD nightmare... I just spent an hour trying to find this blurb on the net.. and I can't which is why I think I dreamt it.. any thoughts there would be appreciated.. When I raise the domain functional level to windows 2000 native.. will the forest functional level automatically be raised? or do I need to raise that separately? Will it really be as simple as raising the level on my one win2k3 DC(which is the fsmo/pdc emu dc..) and just watching replication occur? I think I'm over exciting myself for this and looking for crazy things to happen when it should be a non-event. Tag: Domain Controller Failover Tag: 127959
  - 12
    - Exchange Settings Folder (Sorry that I have to post here as I posted it to exchange admin already. I do not know how to link the post.) Hi all, Today, I open Active Directory Sites and Services and found Exchange Settings folder under the first windows2K DC of servers of sites. Exchange settings shows 0 objects. Is Exchange Settings folder supposed to be in the AD sites and settings? Can I delete it since it shows 0 objects? Just wonder: I switched all roles to Windows 2003 DCs and why it shows under the first windows 2000 DC? (windows 2003 and windows 2000 mixed DC envir.) Thank you. Tag: Domain Controller Failover Tag: 127947
  - 13
    - Users denied access to their folders I'm running Windows 2003 Server with Active directory and using folder redirection to a network share for their My Documents folders. The security is set to them having full access priveleges to their own folder. About 4 months ago, users have started to be denied access to their folders...this seems to be random. We have multiple users that use common computers. When I look at their home folders, the permissions that have disappeared vary. I've tried everything I can think of..even lag times but nothing seems to be working. Does anyone have any ideas? -- Leisha Tag: Domain Controller Failover Tag: 127946
  - 14
    - Migrate Active Directory from Win2k to Win2003 I have an older server (Win2k) that has all 5 FSMO roles at the moment. I would like to move these roles to a new Win2003 server that is already joined to the domain. I have already run the adprep / forestprep and adprep /domainprep on teh older server using the 2003 disk. I tried soon after to add the new server as a secondary DC but it still gives me an error. Did I just not wait long enough for the changes to populate? I did not receive any errors through either domainprep or forestprep. And to continue, if enough time passes and it allows me to add the Win2003 server as a secondary DC, I then just need to promote it once I verify all the AD data has moved properly? Tag: Domain Controller Failover Tag: 127943
  - 15
    - Scripting add users from file Hi, I want to put in place a facility where a member of staff can add users which are listed in a spreadsheet into AD into specific OUs and Groups. Some users will need to be mail enabled but not all. What process would be quickest and most efficient to learn so I can achieve this? Should I use PowerShell, or vbscript or is there something else I should be using, perhaps a combination of apps are required. Please only suggest free tools, and if possible an informatin resource for this task. I have limited programming experience, but also understand I am going to have to learn more about scripting to manage our AD infrastructure. Thanks in advance for your ideas. Pete. Tag: Domain Controller Failover Tag: 127938
  - 16
    - Time Server Question - Please Help Dear All, I have a Windows 2003 Native domain with three domain controllers. In this example I will simply refer to them as DC1, DC2 and DC3. DC1 was originally the PDC Emulator for the domain after some rejuggling of the FSMO roles the PDC Emulator role was transferred to DC2. After running a DCDIAG I noticed that DC1 was still the preferred time server. I have since changed time server related registry changes on DC2 to match DC1 and stopped and started the time service on DC2 to reflect the changes. I have since run w32tm on DC1 to change the configuration on this original PDC Emulator. Now when I run DCDIAG on any of the three DC's I find DC2 is the preferred Time Server which is what I required. My question is though DC1 and DC3 still advertise as Time Servers is this desirable??? They do list DC2 as the preferred Time Server but it would appear they advertise as Time Servers themselves still. Can this cause issues? Or is it beneficial? If it isn't desirable can you explain how I remove this feature from them so DC2 is the only Time Server. Regards, Darren Tag: Domain Controller Failover Tag: 127937
  - 17
    - Set Logon Server I have a 2003 domain with 2 DC's and they are both in the Default First Site. 1 in the main office holds all the roles and the other one is in a branch office is basically for logon purposes to cut WAN traffic. I did a SET command on a computer in the branch office and noticed that the logon server reported the one in the main office. I also have a remote office with 3 computers in it with no server and they come all the way back to the main server when they are closer to the branch office. IS there a group policy I can set to make them login to the closet server or do I have to create sites? If so - how do I get the remote office with 3 computers to log into the branch site? -- Thanks in Advance - Marcus Tag: Domain Controller Failover Tag: 127934
  - 18
    - Win 2008 RODC in Win 2003 Domain We have win 2003 domain. since we have branch offices, so we want to take benefit of win 2008 RODC feature. we want to install win 2008 RODC for our branch offices. The question is, for RODC, do we need to also have a writable win 2008 domain controller in our domain or win 2003 DC would work in such case ?????? Second question is, what all steps do we need to take for introducing win 2008 RODC in our win 2003 domain. For your info. our forest n domain functional level is "Win 2003" Looking forward to your support. Tag: Domain Controller Failover Tag: 127933
  - 19
    - Moving a certificate Authority Certificates are not my thing :-) I'm on a network that was a one DC forest a few years ago (Windows 2003 server, fully patched...). Certificate services were installed for internal use for EFS and then WSUS. NOw the network is expanded and there's a desire to use a VM DC and put certificate services on there instead. howver the standard migration process rquires the original server to be decommissioned or renamed. That cannot happen as it still host F&P and other stuff, that would a PITA to relocate now (and is not really needed!) So, I'm familiar with KB 298138 now, but this does not give me a "keep the old server". I guess it's impossible now, but just in case does anyone have knowledge out there that isn't on google or support? Thanks, Peter Tag: Domain Controller Failover Tag: 127932
  - 20
    - Mapped drives and DFS shares Hi, due to the limitation of mapped drives what else can I use to map drives for users, as we have over 2o drives mapped, overall? Tag: Domain Controller Failover Tag: 127928
  - 21
    - AD Sites and Services Design Question Hello, Here is my scnario. We have 2 Sever 2003 Native mode forests connected by a forest to forest trust. We'll call them USA and Asia. Users in Asia need to connect to resources in the USA forest. We have tested this and the Asia users are complaining of slow logons and authentication when they access the resources. To help alleviate this pain we have decided to put an Asia DC here in the USA. We already have the subnet that this domain controller will go in to defined here in the USA sites and services. Will it be a problem to define it again in the Asia Forest? My thoughts were no as this seems to be a per forest configuration and should not affect anything we already have configured. I just wanted to get some verifciation from some other professionals. Thanks in advance! Tag: Domain Controller Failover Tag: 127926
  - 22
    - Security groups and Folder permissions Hello all, I have to clean up a mess made by a former administrator. I have many security groups defined in AD that I have been asked to go through review/cleanup. I was wondering if there is a utility that I can run against security groups that will list which folders they are providing permissions to. The goal is to eliminate any duplication or unnecessary security groups. I would hate to think the only way to get the information is to look at Sharing & Security permissions of every folder. Thanks Tag: Domain Controller Failover Tag: 127925
  - 23
    - AD advanced search I am looking to get a list of all users that have a quote that is not the default store? Is there a way to search that in active directory or any free tools? Tag: Domain Controller Failover Tag: 127917
  - 24
    - replication issue - event id 1988 Hi - I have 2 Windows 2003 Servers Standard on SP2 together on a local network. They are both DCs. ACCPAC is the problem DC it appears. ACCPAC's Active directory is not updating with SHPMSSERVER. I'm past the 60 day Tombstone Limit so I edited the registry to Allow Replication With Divergent and Corrupt Partner on ACCPAC. Now I'm getting lingering object errors (event id 1988) So I ran this command: repadmin /removelingeringobjects accpac. stanleyhotel.com 4c83796c-4928-4340-b0cd-3a4c3570b765 DC=stanleyhotel,DC=com RemoveLingeringObjects sucessfull on accpac.stanleyhotel.com. It says its successful but keeps reporting the 1988 error a few minutes later. Can any one shed some light on this issue? Thanks in advance. Here is the repadmin/showrepl command. repadmin running command /showrepl against server localhost Default-First-Site-Name\ACCPAC DC Options: (none) Site Options: (none) DC object GUID: 7ed498a2-8bfe-4cee-8c73-a9abe0fbacbb DC invocationID: dfe0a089-0e53-440f-9035-270d0dde8ac6 ==== INBOUND NEIGHBORS ====================================== DC=stanleyhotel,DC=com Default-First-Site-Name\SHPMSSERVER via RPC DC object GUID: 4c83796c-4928-4340-b0cd-3a4c3570b765 Last attempt @ 2008-04-30 19:40:25 failed, result 8606 (0x219e): Insufficient attributes were given to create an object. This object may not exist because it may have been deleted and already garbage collected. 58606 consecutive failure(s). Last success @ 2008-02-04 14:32:51. CN=Configuration,DC=stanleyhotel,DC=com Default-First-Site-Name\SHPMSSERVER via RPC DC object GUID: 4c83796c-4928-4340-b0cd-3a4c3570b765 Last attempt @ 2008-04-30 18:59:13 was successful. CN=Schema,CN=Configuration,DC=stanleyhotel,DC=com Default-First-Site-Name\SHPMSSERVER via RPC DC object GUID: 4c83796c-4928-4340-b0cd-3a4c3570b765 Last attempt @ 2008-04-30 18:55:09 was successful. Source: Default-First-Site-Name\SHPMSSERVER ******* 58597 CONSECUTIVE FAILURES since 2008-02-04 14:32:51 Last error: 8606 (0x219e): Insufficient attributes were given to create an object. This object may not exist because it may have been deleted and already garbage collected. Tag: Domain Controller Failover Tag: 127914
  - 25
    - Group Policy and Office 2007 Are there any updates planned to be able to install Office 2007 with Group Policy? Tag: Domain Controller Failover Tag: 127909

Hello.

We have 2 DC in our forest.
Today after shutting down the 1st for maintenance, all users were unable to
login.
Are there any whitepapers you can suggest?

Top

Re: Domain Controller Failover by Meinolf

Meinolf
Mon May 05 07:21:24 PDT 2008

Hello Dimitris,

In a single forest, single domain, make all DC's Global catalog server and
also you need at least one available DNS server for the clients to find a
DC for authentication.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

> Hello.
>
> We have 2 DC in our forest.
> Today after shutting down the 1st for maintenance, all users were
> unable to
> login.
> Are there any whitepapers you can suggest?

Top

Re: Domain Controller Failover by Jorge

Jorge
Tue May 20 11:23:02 PDT 2008

are both DC a GC and DNS servers and are all clients/servers pointing to
both DNS servers?

--

Cheers,
(HOPEFULLY THIS INFORMATION HELPS YOU!)

# Jorge de Almeida Pinto # MVP Identity & Access - Directory Services #

BLOG (WEB-BASED)--> http://blogs.dirteam.com/blogs/jorge/default.aspx
BLOG (RSS-FEEDS)--> http://blogs.dirteam.com/blogs/jorge/rss.aspx
------------------------------------------------------------------------------------------
* How to ask a question --> http://support.microsoft.com/?id=555375
------------------------------------------------------------------------------------------
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always test ANY suggestion in a test environment before implementing!
------------------------------------------------------------------------------------------
#################################################
#################################################
------------------------------------------------------------------------------------------
"Dimitris Dellios" <edp@naftomar.gr> wrote in message
news:578EA013-8093-47EB-8517-8FD995D38B14@microsoft.com...
> Hello.
>
> We have 2 DC in our forest.
> Today after shutting down the 1st for maintenance, all users were unable
> to
> login.
> Are there any whitepapers you can suggest?

Top