windows 2003 AD problems.

Tutorials Win: Microsoft Windows Forum

- Previous
  - 1
    - Re-addressing sites/servers Hi, We have to re-address some of our sites and I was hoping someone could point out what needs to be done when not just re-addressing servers but entire AD sites. Thanks in advance for any help. Riley Tag: windows 2003 AD problems. Tag: 125931
  - 2
    - NetDiag and DCDiag discrepencies on new 2008 domain.... I have a new 2008 domain as a pilot for the domain that I'll be building soon for production. Single forest, single domain. Two 2008 DCs thus far, both running integrated DNS zone. -Netdiag report shows a failure for the DNS test when run from one of the DCs... DNS test . . . . . . . . . . . . . : Failed [WARNING] Cannot find a primary authoritative DNS server for the name 'dc1.domain.internal.co.xxxxxx.tx.us.'. OTAVAIL ] The name 'FruitLoops.mcse.internal.co.travis.tx.us.' may not be registered in DNS. [FATAL] Could not open file C:\Windows\system32\config\netlogon.dns for reading. [FATAL] No DNS servers have the DNS records for this DC registered. My concern with this is that a good bit of the info provided by google points to single label DNS names, such as this: http://support.microsoft.com/default.aspx?scid=kb;en-us;300684&FR=1. We are local government, so we do have a legnthy FQDN, but if I need to resort to something shorter such as mycounty.local I need to know ahead of time. Another concern is that when I run netdiag from my vista laptop on the domain, the dns test passes. There are also replication issues reported by replmon. -Next failure shown when run from 'dc1': DC list test . . . . . . . . . . . : Failed Failed to enumerate DCs by using the browser. [ERROR_NO_BROWSER_SERVERS_FOUND] Same failure shown when run from my laptop: DC list test . . . . . . . . . . . : Failed Failed to enumerate DCs by using the browser. [ERROR_NOT_ENOUGH_SERVER_MEMORY] Each DC is an ESX VM with 1.5 gb of ram, and I'm the only one using the domain, so memory isn't an issue. -On to dcdiag run from dc1: Starting test: NetLogons [dc1] User credentials does not have permission to perform this operation. The account used for this test must have network logon privileges for this machine's domain. ......................... dc1 failed test NetLogons I'm running as an Enterprise and Domain Admin. -Next: Starting test: Replications [Replications Check,dc1] DsReplicaGetInfo(PENDING_OPS, NULL) failed, error 0x2105 "Replication access was denied." ......................... dc1 failed test Replications -Next: Starting test: Services Could not open NTDS Service on dc1, error 0x5 "Access is denied." ......................... dc1 failed test Services Again, run as Ent/Domain admin. -DCDiag from my laptop: Starting test: VerifyReferences Some objects relating to the DC dc1 have problems: [1] Problem: Missing Expected Value Base Object: CN=dc1,OU=Domain Controllers,DC=domain,DC=internal,DC=co,DC=xxxxx,DC=tx,DC=us Base Object Description: "DC Account Object" Value Object Attribute Name: frsComputerReferenceBL Value Object Description: "SYSVOL FRS Member Object" Recommended Action: See Knowledge Base Article: Q312862 I went straight to 2008 native mode, so it should be using DFS-R if I understand it correctly.... I apologize for the verbosity, I just need to get this thing to a perfect state before I attempt to go to production. Tag: windows 2003 AD problems. Tag: 125928
  - 3
    - NetDiag and DCDiag discrepencies on new 2008 domain.... I have a new 2008 domain as a pilot for the domain that I'll be building soon for production. Single forest, single domain. Two 2008 DCs thus far, both running integrated DNS zone. -Netdiag report shows a failure for the DNS test when run from one of the DCs... DNS test . . . . . . . . . . . . . : Failed [WARNING] Cannot find a primary authoritative DNS server for the name 'dc1.domain.internal.co.xxxxxx.tx.us.'. OTAVAIL ] The name 'FruitLoops.mcse.internal.co.travis.tx.us.' may not be registered in DNS. [FATAL] Could not open file C:\Windows\system32\config\netlogon.dns for reading. [FATAL] No DNS servers have the DNS records for this DC registered. My concern with this is that a good bit of the info provided by google points to single label DNS names, such as this: http://support.microsoft.com/default.aspx?scid=kb;en-us;300684&FR=1. We are local government, so we do have a legnthy FQDN, but if I need to resort to something shorter such as mycounty.local I need to know ahead of time. Another concern is that when I run netdiag from my vista laptop on the domain, the dns test passes. There are also replication issues reported by replmon. -Next failure shown when run from 'dc1': DC list test . . . . . . . . . . . : Failed Failed to enumerate DCs by using the browser. [ERROR_NO_BROWSER_SERVERS_FOUND] Same failure shown when run from my laptop: DC list test . . . . . . . . . . . : Failed Failed to enumerate DCs by using the browser. [ERROR_NOT_ENOUGH_SERVER_MEMORY] Each DC is an ESX VM with 1.5 gb of ram, and I'm the only one using the domain, so memory isn't an issue. -On to dcdiag run from dc1: Starting test: NetLogons [dc1] User credentials does not have permission to perform this operation. The account used for this test must have network logon privileges for this machine's domain. ......................... dc1 failed test NetLogons I'm running as an Enterprise and Domain Admin. -Next: Starting test: Replications [Replications Check,dc1] DsReplicaGetInfo(PENDING_OPS, NULL) failed, error 0x2105 "Replication access was denied." ......................... dc1 failed test Replications -Next: Starting test: Services Could not open NTDS Service on dc1, error 0x5 "Access is denied." ......................... dc1 failed test Services Again, run as Ent/Domain admin. -DCDiag from my laptop: Starting test: VerifyReferences Some objects relating to the DC dc1 have problems: [1] Problem: Missing Expected Value Base Object: CN=dc1,OU=Domain Controllers,DC=domain,DC=internal,DC=co,DC=xxxxx,DC=tx,DC=us Base Object Description: "DC Account Object" Value Object Attribute Name: frsComputerReferenceBL Value Object Description: "SYSVOL FRS Member Object" Recommended Action: See Knowledge Base Article: Q312862 I went straight to 2008 native mode, so it should be using DFS-R if I understand it correctly.... I apologize for the verbosity, I just need to get this thing to a perfect state before I attempt to go to production. Tag: windows 2003 AD problems. Tag: 125927
  - 4
    - Demoted 2K DC in Sites and Services Two days ago I demoted a 2K DC after having transferred all FSMO roles 5 days prior to a 2003 DC. The 2K DC still shows up in Site and Services as a server, however the NTDS settings for it are gone. Will this entry eventually be purged, or should I manually delete it? Any futher AD cleanup needed if I do delete it? Also, after demoting the 2K DC, clients could not connect via Outlook to the Exchange 2003 server. After I powered off the 2K box they could. Any thoughts on why that happened? Lastly, now that the remaining 2 DCs are 2003, I am considering raising the FFL and DFL to 2003. Will doing so pose any problems for the Exchange2003 server? We are a small (60 workstations) environment and I really don't think we stand to gain much by raising the forest and domain levels, do we? We also have four Adaptec (was Quantum) Snap servers (2- 2200s and a 4100) which after the demotion of the 2K box had to have their OS upgraded to ver 4.x in order to authenticate with the 2003 DCs. Will raising the forest and/or domain level cause problems with these? Thanks for any and all assistance. Kevin Tag: windows 2003 AD problems. Tag: 125912
  - 5
    - DHCP on two different subnets with a Virtual additional IP Hi to all, here's my situation: 1 Domain Controller with DHCP (192.168.9.0) and DNS Service installed 2 LAN Network Device with two IP address (192.168.9.2 and 192.168.9.3 subnet c) The question is: Is it possible to create a new scope (192.168.10.0), disable the old 192.168.9.0 scope and release ip address to clients only in the x.x.10.0 Subnet? Is it possible to do it without adding another Network Device, but only using an additional IP Address(on the x.x.10.0 subnet) in the TCP IP protocol properties of my connection? TKs in advance to all Tag: windows 2003 AD problems. Tag: 125909
  - 6
    - AD User Objects not retaining security Salutations, I've run across a strange issue in a Windows 2000 Native AD environment. There are two Domain Controllers, one is Windows 2000, the other is Server 2003. Server 2003 hosts Exchange 2003. The issue began when the 2000 DC was hosting all of the FSMO roles. When new security was added to the security tab of an AD user object, it would disappear after a period of time, leaving only the SID behind. We don't have an exact time frame, but it seems to be within an hour. We went through several layers of troubleshooting, and we've eventually moved all of the FSMO roles to the 2003 server. Now, the same error seems to be occuring, but the Security descriptors are completely removed, no SID is left behind. I've checked replication with replmon, and ran several dcdiag tests, and nothing seems out of the ordinary. The only thing I've not explored deeply is the AdminSDholder object, as described in http://support.microsoft.com/?id=232199. I suppose I'm looking for any thoughts as to what else could be causing this strange issue. Tag: windows 2003 AD problems. Tag: 125903
  - 7
    - Problem Setting up Trust I am going to migrating from domain A to domain B so I need to create a trust between them because I will be migrating 1 office at a time and their files but my other offices will need access to those files on Domain B. I have Domain B setup as a secondary zone in Domain A and vice versa. I can ping any computer in the other domain and the domain itself on both. My issue is that when I go to Domain A Domains and Trusts and right click on domain A go to properties and then the trust tab. I click New Trust, put in the FQN of domain B and select either External or Forest trust, then two-way trust, then Both this domain and the specified domain, give it a domain admin account info for the other domain. I get the following. Cannot Continue The trust relationship cannot be created because the following error occurred: The operation failed. The error is: Access is denied. Just a note that if I go to domain B and check the security log it shows my admin getting successfully authenticated from the domain A server. Thanks much Brett Bishop MCSE Tag: windows 2003 AD problems. Tag: 125902
  - 8
    - replication failed access denied Hi all, 2003 AD Domain functional level running windows server 2003 and the Forest Level is running at 2000. I am trying to setup my second domain controller, went through the wizard and I am able to logon to the domain on the second controller. I am also always logging in as the domain admin. I am able to open and make changes to the AD User and Computers Console. When I run replmon from the secondary DC and try to sync with the PDC I keep getting the following error: There was an error during queuing the synchronization. The error code was: ERROR_REPLICA_SYNC_FAILED_ACCESS IS DENIED. I am logged in as the DC admin even set as the Enterprise Admin also. I ran the same procedure on the PDC and get the same error. I will post netdiag in another post. Thanks in advance. Tag: windows 2003 AD problems. Tag: 125893
  - 9
    - offsite DC don't find new PDC hello, 2 weeks ago,I had a crash of AD so I rebuild a new PDC. The new PDC replicate good informations on offsite DCs, only one offsite DC stay on the old unreachable PDC. so on this offsite DC, DCDIAG indicate the OLD PDC. How can I force the new PDC ? Thank's Tag: windows 2003 AD problems. Tag: 125892
  - 10
    - Desktop Internet Shortcut Domain-Wide Lost https Property Bizarre occurrence ...suddenly this AM users click on an https:// shortcut on their desktops to a critical web-based application and the link doesn't work because the shortcut has lost the 's' in https. So they are trying unsuccessfully to connect using http:// Nothing has changed on the network. Temporarily we are forcing out via Group Policy an Internet Explorer Favorite with the correct https:// Checked all domain controllers using dcdiag...no issues. We don't manage desktops via GP nor do we have 3rd party desktop mgmt utilities. Anyone have any ideas as to what could have caused this? Tag: windows 2003 AD problems. Tag: 125887
  - 11
    - Clients and new E2k3 server that exist in the root forest make GC I have a root domain with one child domain. Lately I've been noticing on my router syslogs that some of my XP clients on the root domain have been hitting the child ADC over tcp 389 and 88. Also, a new E2k3 server I built on the root domain last week is hitting/receiving traffic over tcp 3268 & 389 to/from the child ADC. Shouldn't this traffic be directed to the parent.com ADC/GC or is this normal behaviour? I've also noticed that the E2k3 server is sending Echo requests to the child ADC about every 10 mins. I've checked my 2 root ADC's and they are both GC's. Is this normal traffic, or is there a setting off somewhere? NONE of the Accounts on the child domain have mail accounts. Any help would be greatly appreciated. Rob Tag: windows 2003 AD problems. Tag: 125885
  - 12
    - Elevated Priviledges for an MSI deployment Not Working I have assigned an msi package with Active Directory and only a domain administrator can install it. I have tested and tested and cannot understand what is preventing this. I thought that elevated priviledges allowed the package to be installed as non administrator but does it have to be done as a silent install by the SYSTEM to work and not be assigned. Does the deployment of the msi to the administrative share have to include a switch to allow all users to be able to install the package once assigned? Does the transform have to include something in a property row to allow this? This package has to be installed as the user. Thank you in advance, Tina Cecil Tag: windows 2003 AD problems. Tag: 125879
  - 13
    - Set homedir and roaming profile based on couple (machine+login) Hello, On an AD 2k3 R2 + one file server I've got a UNC homedirectory and profilepath set for each user. I'd like to (with logon script?) disable for certain users who connect to certain domain member machines (XP pro), roaming profile loading and homedirectory network map mounting. It is to avoid file server access through VPN. Is there a way to do that? thank you! Tag: windows 2003 AD problems. Tag: 125878
  - 14
    - DNS settings on DNS servers? Hi there, I've got 2 domain controllers in my domain (both 2003). One was DNS and now i've made the second one DNS. Everything seems to be working. On the first DNS server in the DNS settings within TCP/IP i've got primary as itself and secondary as the second one. On the second DNS server in the DNS settings within TCP/IP i've got primary as itself and secondary as the first one. Is that correct? Thanks. Tag: windows 2003 AD problems. Tag: 125854
  - 15
    - Best way to replace 2 DC's with 2 new ones? Hi, we have 2 Windows 2003 DC's and a third one offsite for DR purposes. We have budget to replace these 2 old servers and I was wondering what is the easiest method to replace them is, as we need to make sure they have the same IP, plus they have DNS and DHCP installed on them? The mothods I can think of are: 1.) Build these 2 new servers and run DC promo on them and install DNS (As we use Integrated DNS). Then move the FSMO roles over to one of them and then change the IP 's. 2.) Simply image the old DC's and image on the new ones? Thanks in advance for your info. Tag: windows 2003 AD problems. Tag: 125850
  - 16
    - DSADD COMPUTER - Doesn't work right! I set up a group and gave it the following access to an OU. When I manually add a computer account to the OU, users in the group can go to that computer and add it to the domain. However, if I use DSADD COMPUTER to add it (and include the "-samid" to make sure it matches the CN) - they get an access denied! Everything looks exactly the same between when it is created manually vs. when it is created with DSADD, but for some reason they cannot add it if I make the account with DSADD. If I delete and recreate it in ADUC, it works no problem. What's going on here?!?!?! Thanks. - JayDee Tag: windows 2003 AD problems. Tag: 125846
  - 17
    - Netdiag, active directory problems Windows 2003 Domain, single DC. 10 XP clients. On 2 of them, I can log into the domain, but my group policy is not being applied. DCdiag on DC passes fine. After much research, discovered that netdiag reports errors on those machines. the first time I ran netdiag, it failed DC discovery test, DC list test, trust relationship test, kerberos test and LDAP test. Basic message for all was that it couldn't find the DC in my domain (the same DC I'm logged into !?!). Ran dcdiag /fix and then dcdiag again. Now just DC list and kerberos fail. Ran netdiag /test:dclist and that all passed. Netdiag still fails for DC list and Kerberos. I tried resetting the computer account and leaving/rejoining the domain. When I tried to join, i couldn't get the login prompt up unless I specified domainname.local for the domain to join as opposed to the usual domainname. The pressing issue is with the Group Policy not being applied, but I'm sure it's because of the DCdiag issues. Can someone give me some guidance on where to go from here? Thanks, Al Tag: windows 2003 AD problems. Tag: 125843
  - 18
    - Mass changing security groups to distribution groups Hi, We have a large number of email distribution lists that were incorrectly created as 'Security Group - Global' with attached email addresses instead of 'Distribution Group - Global'. Is there any easy way to change all of the Security Groups in an OU to Distribution Groups with scripting ? Regards Michael Tag: windows 2003 AD problems. Tag: 125838
  - 19
    - Introduce windows 2008 DC to Windows 2003 Domain Hello We are looking at introduce a new 2008 DC server to our network. we have 3 domain controller 1 of the DC is running windows 2003 in mixed mode holding FSMO role, the rest of the 2 are running windows 2000 Server. we will retire windows 2000 Server later on the year, we also have 1 Exchange 2003 Server in place. Currently we have 70 Desktop computers mixed with NT, 2000 and XP Once the 2008 Server in place, we will transfer the FSMO role from 2003 to windows 2008 Server. Has any one done this migration? Any problem to Exchange 2003 Server after role out 2008 DC? I am trying to look for some helpful article for this migration Any help will be appreciated Tag: windows 2003 AD problems. Tag: 125836
  - 20
    - Match IP Address List to Computer Objects Is there a way to get the IP address of a computer object in AD? I guess it would be based on the last known IP address. The only reason I am thinking there may be hope is because there is a attribute called "iphostnumber". What I would need to do is run a list of about 3000 IP addresses against the domain to see which computer objects they match up with. A reverse DNS lookup would not work because we aren't using Windows DNS and it's not truly dynamic. I guess one other possibility would be to run the IP list against reverse netbios lookups, since the names would then mostly match the names of the computer objects. If someone knows a way of doing that, it may be an alternate solution. I am not a scripter, but I am guessing something like "for each do nbtstat -A". Thanks. Tag: windows 2003 AD problems. Tag: 125835
  - 21
    - installing new dc (different domain name) in production LAN I've been asked to set up a development dc with different domain name on our production LAN, so that our application developers can test their AD intregrated apps. I'd be interested to know what (if any) consequences there are of doing this e.g. will the new dc affect the production dc's in anyway? Any help on this appreciated, Tom Tag: windows 2003 AD problems. Tag: 125834
  - 22
    - Computer Does Not Allow ANY Use To Search Using AD Group Alias Nam Would anyone happen to know why a computer would not allow ANY user (even Domain Admins) to search for an AD Universal Security group by its Alias name when this works fine on other computers? For example, if you want to add an AD Universal Security group to the local Administrators group, you would bring up a search box and type in part of the name and it should find it either by display name or alias, but it is not doing it on this one computer. Tag: windows 2003 AD problems. Tag: 125827
  - 23
    - AD Security Group Membership Viewing Hello, Is there a tool/method that a regular Domain User can use to view AD security group membership without giving them AD Users & Computers? Thanks Tag: windows 2003 AD problems. Tag: 125822
  - 24
    - Groups That Must Remain In AD Users OU? Does anyone have a link to a document that lists which groups must remain in the AD Users OU, especially when you have other Microsoft products in your domain like Exchange? I've seen this document before, but haven't been able to find it. Tag: windows 2003 AD problems. Tag: 125821
  - 25
    - C# AD Scripting Hi All, I'm getting some error messages, while trying to pull back a list of users from our AD - I'm guessing it's a security issue (because it works correctly when running as domain admin, so hoping someone can point me in the right direction. The code : DirectoryEntry objDirEntry = new DirectoryEntry("LDAP://domain/OU=Users,OU=MyOU,DC=domain,DC=local"); DirectorySearcher objSearch = new DirectorySearcher(objDirEntry); objSearch.Filter = "(&(mailnickname=*)(objectClass=user))"; try { SearchResultCollection results = objSearch.FindAll(); } catch (Exception e) { textBoxErr.Text = e.Message.ToString(); } For some users, will produce the error : The specified directory service attribute or value does not exist. and for some users, the even stranger : Logon failure: unknown user name or bad password. Even though the users' account is enabled and working fine for everything else. The users are members of the same groups, so I can't see why the error would be different. What are minimum security requirements I need to set on the OU to allow users to list all the users? What are minimum security requirements I need to set on the OU to allow some users to update the user details? Tag: windows 2003 AD problems. Tag: 125817
- Next
  - 1
    - Getting accountExpires as a date/time using Java I'm connecting to an AD instance and able to get the raw accountExpires value from the entry, but I can't figure out how to convert this value into a usable date/time. I've dug around and found references to INTEGER8 and bit-shifting and all kinds of other stuff, but it's all VB/.NET/C# related code and I can't quite translate that into Java. Any and all help is greatly appreciated. Tag: windows 2003 AD problems. Tag: 125813
  - 2
    - Limited service account to query AD Hi, I'd like to query AD using a fixed account. Since I'll be coding in the username and password for the user into a .config file, I'd like to set the user up pretty much only so that it can read Active Directory. The user will be used under an Asp.Net IIS process to talk to the DC, which is on a separate server. Thanks! Andy Tag: windows 2003 AD problems. Tag: 125797
  - 3
    - Problems changing account information I am seeing a problem where I have access to change some network accounts but not others, the ones I see that are problems are users that were created a while ago, and new users that are created, I don't have any problems accessing the accounts to change their information or unlock their accounts. Anyone see this problem? Tag: windows 2003 AD problems. Tag: 125795
  - 4
    - profile problems hi all A user was deleted. profile still exists user was recreated. all settings set to pick up path and profile etc. log on and it says windows cannot find the roaming profile. then cannot find local profile. logging on with temp profile. what am i missing any help will be great Tag: windows 2003 AD problems. Tag: 125791
  - 5
    - Create a shortcut that prompts for AD login Here is the situation, I have a large number of users with a random pile of laptops that they can check out for going to remote sites. We have a local account that they all can log in to get to a desktop, and turn on wireless, and configure it for the remote site they are at. What I need now, is a way for them to log in and authenticate to AD without having to re-logon to the machine. Is this possible? Tag: windows 2003 AD problems. Tag: 125790
  - 6
    - Adding multiple machines with CSVDE Is it possible to add multiple new computers to a domain using csvde? I have a list of 30 pc's to do now, and who knows what will come down the road. I can't find anything saying what the class would be for the value. Tag: windows 2003 AD problems. Tag: 125789
  - 7
    - Multiple IPs on a DC The situation is fairly complex, but in short: I need to DCPromo down a server with IP x.x.2.3 and change it's IP address in preparation for a coming upgrade process. In the end I will have a new DC with x.x.2.3. The problem being that I have some devices that are hard coded for LDAP lookups, DNS lookups etc to x.x.2.3. Until I get the new server up, can I simply assign a secondary IP to a DC of x.x.2.3. No DNS record is necessary. Thanks, Bob Tag: windows 2003 AD problems. Tag: 125788
  - 8
    - Hourly event locking account? Ever since we changed all passwords in our 2003 AD we've tracked down all the dependant services except one. According to the event logs a specific Domain Admin account is locked, every hour at the exact same minute and the source "Caller Machine Name" is always the same Windows Server 2003 SP2 Domain Controller at a remote location. The minute value on which this locked-account event repeats will only change when we reboot the server. i.e., at the moment it's happening every hour at 43 minutes past the hour, but before we did a series of reboots trying to troubleshoot this the account would get locked at every 18 minutes after the hour. This DC sits behind a Cisco PIX firewall/VPN device with the latest OS and I've confirmed the only Internet connection allowed is outgoing UDP port 53. This DC is an HP DL380 G3 will all the latest HP firmware and software management updates as of last week and we are current on all Microsoft "High Priority" updates. On this specific DC in Computer Management I looked at the Services by sorting by Log On As and found all services are set to logon as Local System or Network Service. None are configured for a specific AD account. So I believe the problem is not here. I did a search of the registry for the AD account name and found numerous entries but they were exclusively related to that account performing Windows updates a few weeks ago. However the account password did change since those updates were done, so that has me wondering if that has anything to do with it. I even went so far as to delete the profiles and all folders I could find that were created by that account. And I uninstalled many applications which were unnecessary to the functions of this server, and even uninstalled and reinstalled some of the apps we did need. Later I logged on again as the account and let it create a new profile hoping the DC would somehow recognize the new password. And of course rebooted numerous times. I also used Task Manager to watch all the processes "by all users" while the event happened as the account was locked at 43 minutes past the hour, hoping to hit the PrintScreen button the moment it appears. It never appeared. I changed the Audit Polices to give more detailed information for security event logging: Default Domain Policy | Computer Configuration | Windows Settings | Security Settings | Local Policies | Audit Policies | set to check for Success and Failures on all nine of the items in this subset. But this did not prove any additional information that was useful. I am considering changing the password back to what it had been to see if the problem goes away, however since then we've implemented password complexity so now that password is not allowed. So I would have to turn off the password complexity again. And of course change that password everywhere else it is used. Phew. Please let me know if you know where else to look because at the moment I am out of ideas. Thanks! -Bob Tag: windows 2003 AD problems. Tag: 125783
  - 9
    - unable to completly delete roaming profile on local computer wh lo Bonjour, On a Windows 2000 domain (server and workstation), when a user logon on a computer, the profile of the user is copy localy in the c:\Documents and Settings\user folder. When the user loggout, we configure the gpo to delete the user folder. So until the middle of 2007 this process work perfectly. But now, when the user logout they are some index.dat files the system cannot delete and some files are not copy back to the server. When the user logon on another computer, the last configuration of the user are lost. When the user logon on a previsouly logon comptuer a seconde user folder is create like (user.vision2000) and the previous configuration is also lost. The only way to delete theses files is to reboot the computer and the last user's configuration is lost. We have three index.dat files locked. C:\Documents and Settings\user\Cookies\index.dat C:\Documents and Settings\scomtois\Local Settings\History\History.IE5\index.dat C:\Documents and Settings\scomtois\Local Settings\Temporary Internet Files\Content.IE5\index.dat It'is possible to configure something so the index.dat files must be erases. Note: The last version of uphclean is install on our computers and the problem is not present on all workstation for the same user account. Thanks, Sylvain Comtois Tag: windows 2003 AD problems. Tag: 125782
  - 10
    - Joined a server to domain using the same name as the Primary serve I accidentally joined an older server being set up as a file server to our domain using the same name as the current(and only) server in our domain. Now active directory and DNS is acting up. Just wondering if anyone has gone through this issue before, and if so what steps need to be taken to remedy the situation. Thanks Tag: windows 2003 AD problems. Tag: 125780
  - 11
    - Userenv 1030 and 1058 errors every 5 minutes Hi Everyone, I am getting the following two errors every 5 minutes on my two Windows 2003 R2 domain controllers: Event Type: Error Event Source: Userenv Event Category: None Event ID: 1030 Date: 3/27/2008 Time: 10:32:42 AM User: NT AUTHORITY\SYSTEM Computer: COMPUTER Description: Windows cannot query for the list of Group Policy objects. Check the event log for possible messages previously logged by the policy engine that describes the reason for this. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. --------------------------------------------------------------------------------------------------------------------------------------------- Event Type: Error Event Source: Userenv Event Category: None Event ID: 1058 Date: 3/27/2008 Time: 10:32:42 AM User: NT AUTHORITY\SYSTEM Computer: COMPUTER Description: Windows cannot access the file gpt.ini for GPO CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=DOMAIN,DC=COM. The file must be present at the location <\\DOMAIN.COM\sysvol \DOMAIN.COM\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini>. (Access is denied. ). Group Policy processing aborted. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. --------------------------------------------------------------------------------------------------------------------------------------------- The DCs are in a Windows 2003 R2 domain with 3 other Windows 2000 DCs. The errors seemed to start around the time that I demoted another Windows 2000 DC. I have searched for hours on this and tried all of the suggestions such as clearing the MUP cache, resetting the permissions on the gpt.ini file and it's parent folders, etc. However, the problem persists. There doesn't seem to be any ill effects from it, but it's quite annoying. Any help would be greatly appreciated. Regards, Damian Profancik Tag: windows 2003 AD problems. Tag: 125779
  - 12
    - Deny Simultaneous Logins to All Users EXCEPT Admin? Windows 2000 Small Business Server With Windows XP Pro Workstations I am using roaming profiles and folder redirections. I want to restrict individual users to only one (1) login on one PC at any given time (no simultaneous logins by any given user). However, I want the Admin users to have multiple simultaneous logins possible. Do I simply put a script (see below) in each user's login profile and omit it from the Admin users? Any caveats? Any better suggestions? e.g.: http://windowsitpro.com/articles/print.cfm?articleid=82454 Thanks. Fred Tag: windows 2003 AD problems. Tag: 125761
  - 13
    - Authentication doesn't fail over to additional DC's Hi, I have 8 domain controllers in our enterprise. 6 are located at other geographical sites and 2 are located in our central datacenter. All domain controllers are handling logon requests through the enterprise. I assumed I should be able to shut down one of the DC's in the datacenter without causing logon issues, but that doesn't seem to be the case -- even if I transfer the PDC emulator role to another DC. Users start calling the HelpDesk saying they can't log on but more importantly, our BizTalk server won't authenticate and all users are denied access to our intranet site which relies on BizTalk. Once the DC controller is back on line, everything goes back to normal. I've talked with the team controlling the BizTalk server and they assure me that don't have any dependencies written into the server configuration requiring that one DC to be online. I can shut down other DC's with no interruption to authentication. Any ideas? Tag: windows 2003 AD problems. Tag: 125758
  - 14
    - Raising domain/forest functional level by command line Hello everybody, is it possible to change the dfl/ffl with some kind of command line tool? Thanks in advance! Greetings, Malte Tag: windows 2003 AD problems. Tag: 125757
  - 15
    - trusting a non-Windows Kerberos Realm I am looking to setup a trust between a Windows 2003 domain and a non-Windows Kerberos realm. 1) I'm looking for a straight-forward how-to 2) I'm looking for an official doc on what protocols MS uses to encrypt the shared secret Thanks Blake Tag: windows 2003 AD problems. Tag: 125755
  - 16
    - Signing into wrong DC when launching "AD Users and Computers" Our network has many different geographical locations around the world. 1 Forest, 1 Domain, several DC's (All 2003 except 1, and it is a 2000 DC). When I launch Active Directory Users and Computers (or GPMC, etc...), It has been taking a few minutes to open up. I was looking at it yesterday and noticed that the DC I was logging into was at a site (Germany) other than mine (US). I was able to right click and change what DC I wanted to be connected to, but it does not keep that setting. I have been on the Google and Microsoft site, but the keywords I am using do not seem to help. If anyone has any ideas to help assist, I would appreciate it greatly. Thanks, Brent Tag: windows 2003 AD problems. Tag: 125730
  - 17
    - Not apply a policy against the administrator Against our Citrix/Terminal Server OU is a GPO that sets the path for terminal services profile under the computer settings section. The problem is our administrator account picks up this setting and uses a TS profile. I dont want the admin to use this profile. Is it possible to write a WMI filter to not apply the GPO if it is the administrator who is loggging on? Or if anybody has any better suggestions????? Tag: windows 2003 AD problems. Tag: 125710
  - 18
    - Exporting member of a particular group using csvde Hi, I am trying to export a list of users in a particular group so that it just gives me the names of the users in the group. I have done an export using the ldifde command but that gives the list with all the CN/OU/DC and the users logon information etc. I know it can be done using CSVE but am having trouble getting the right format. For example I want to export all users in a group named 'test users', the group is in an OU structure as follows: cn=test users,ou=users,ou=tier2,ou=tier3,dc=mycompany,dc=int Would appreciate any help. Thanks Tag: windows 2003 AD problems. Tag: 125698
  - 19
    - Server failure I have a couple of servers at a site. One original server running 2000 and the other recently added 2003. Both were domain controllers. Running in mixed mode. The 2000 box collapsed and died early today. Slammed in a DHCP scope on the 2003 box and we're golden. Print services were on the 2000 machine but I'm well on my way to getting that together. I should be raising the domain functional level to 2003 mode now I assume. The new DHCP scope points the dns to the 2003 servers ip instead of the 2000 machine but I'm getting some small delays in net view and basic network browsing. What else should I be doing? We have domain logins and access as before but I'm sure there's something else to do. Thanks for your help. Tag: windows 2003 AD problems. Tag: 125692
  - 20
    - Security Tab How can I hide the security tab in AD Users and Computers from my Help Desk? -- Steve Tag: windows 2003 AD problems. Tag: 125690
  - 21
    - reverse lookup dns zone Hi All: I'm having a hard time getting a clear answer on the following. I have a Windows 2003 Active Directory with about 300 machines, all belonging to a single domain. If its relevant, I do run a RAS server and exchange server and otherwise, pretty standard stuff. In this type of environment, in my DNS, do I need a reverse lookup zone? I believe I understand if I don't have one that I won't, as an admin, be able to do nslookup <ip address> and get a computer name back. Would this also mean that tracert wouldn't be able to resolve an address to a name? I know that the reverse lookup to the mail server must be valid as this is used as a spam prevention technique. But outside of this, in this basically flat network topology, do I need a lookup zone? Any info or advice or what having the reverse lookup gets me in this environment is much appreciated! Thanks! Drew Tag: windows 2003 AD problems. Tag: 125689
  - 22
    - Fixing domain name A few years ago when I installed a Win2K Server, I mistakenly created the domain as "ab.abc.com" when I really wanted it to be "abc.com". I am now replacing the server with Windows Server 2003 on a new machine. The two servers must overlap in time on the network so that I have time for application migration, etc. How do I promote the new server to the PDC _and_ fix up the domain name? Or, should I just start from scratch creating the domain with the correct name? Before this new server there was - and after the migration there will be - only one server in existance in the domain. BTW, This is the second time that I've done something like this wrong. On another occasion, I ended up with a domain named abc.abc.com when, of course, I really wanted abc.com. Any ideas what my misunderstanding was when I created these domain names in the first place? Clearly, I answered some question incorrectly and I must avoid doing this again. Any help and advice is grgeatly appreciated. Thanks and regards, David Tag: windows 2003 AD problems. Tag: 125684
  - 23
    - How to transfer domain controller roles Hi, I have a client who has two windows 2003 domain controllers - DC1 & DC2. I was told that DC1 has all the forest info and DC2 may not have all the info. DC1 is also the DHCP server. Both are DNS servers. DC1 one has a strange issue - Its MMC is acting up. Sometimes it opens up and sometimes it won't. Microsoft connected to the machine and after two days they gave up. We are thinking about re-installing the OS on DC1. What would be the proper way to achieve this objective....that is to have two domain controllers again in the end with all the AD info intact and not have to change anything on the client's side. If needed, we are willing to use a 3rd server on a temporary basis as well. Or, can we do this by swapping roles etc. Please provide the steps. -- Network Admin Tag: windows 2003 AD problems. Tag: 125671
  - 24
    - Forest Trust Hello All, We have 2 forests A and B; both have a child domain under it. We now have a two-way trust from child.A to child.B. I have created a Local Domain Group in child.A that contains a global security group from child.B. We have a website that requires integrated windows authentication. With just the group the users get access denied, but if I do add single users child.B to the local domain group in child.A then the users in child.B are able to access the website with no prompt for password [ie. windows authentication works properly]. Any ideas? Tag: windows 2003 AD problems. Tag: 125666
  - 25
    - dcpromo /forceremoval Good afternoon! I think that I know this, but I want to check.... If I use dcpromo /forceremoval to remove a dying DC and then clean things up (via the metadata cleanup and ntdsutil) and things have run nicely and cleanly for two months or more can I introduce - temporarily - a workstation or server that has the same computer name (actually, same FQDN) of the machine on which I performed a dcpromo /forceremoval? Here is why I ask: Had an older DC that continued to fail (hardware). Finally, client purchased replacement. Could not run dcpromo on failing server so used dcpromo /forceremoval. After that, cleaned up everything with our friend, ntdsutil. Environment is running nicely and cleaning since then. Let's say that the servername was DAFFY. In addition to being a DC/GC it was also the main file server (where the users "My Documents" were redirected, among other things). One of the lingering affects (no...not that...oh, lingering affects...not lingering objects) was that the usesrs of MS Access now have a multitude of choices when they synchronize - they click on the little drop down and choose the replica (do not worry what I mean here...not really the point). Client wants this cleaned up as half the entries point to \\DAFFY\blah\blah\blah\file.mdb and the like. Essentially we need to remove all replicas that reference DAFFY. According to some MS Access MVPs the only way to do that is to recreate the old directory structure and to then remove the replicas via normal methods (whatever that means...not an MS Access person). Thanks, Cary Tag: windows 2003 AD problems. Tag: 125657

I just recently updated both our offices from 2000 sp4 AD to 2003 r2
AD. I added the new servers then used dcpromo to remove the windows
2000 servers which are no longer on the network. One seems to be
working without a problem. However the other systems seems to be
having problems. specifially I keep getteing even id 4015 on my DNS.
When I try to create a new partion for teh DNS I get an error saying
the AD server is unreachable. I'm at a loss. All my users are able to
log on without problems, with the exception of some time zone
issues.

I'm really not even sure how to start trouble shooting this any ideas ?

Top

Re: windows 2003 AD problems. by Meinolf

Meinolf
Fri Mar 28 12:22:09 PDT 2008

Hello Rowan,

You can start here:
http://www.eventid.net/display.asp?eventid=4015&eventno=333&source=DNS&phase=1

Also please post an unedited ipconfig /all from both servers. Are they on
the same subnet, because you are talking about 2 offices?

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

> I just recently updated both our offices from 2000 sp4 AD to 2003 r2
> AD. I added the new servers then used dcpromo to remove the windows
> 2000 servers which are no longer on the network. One seems to be
> working without a problem. However the other systems seems to be
> having problems. specifially I keep getteing even id 4015 on my DNS.
> When I try to create a new partion for teh DNS I get an error saying
> the AD server is unreachable. I'm at a loss. All my users are able to
> log on without problems, with the exception of some time zone
> issues.
> I'm really not even sure how to start trouble shooting this any ideas
> ?
>

Top