Forum Widgets
Latest Discussions
Error trying to demote via dcpromo legacy 2012 R2 DCs
Hi, I am in the process of trying to assist a customer upgrade their 2 x DCs from 2012 R2 to 2022. I have built the 2 x new 2022 servers and they are domain joined so I am at the point where I am about to demote the first 2012 R2 DC. At this point, I have Made sure that AD is healthy and there are no issues with replication Moved all FSMO roles to the other DC in this environment meaning that the DC I am working on is hosting nothing DNS is synching fine At a high level, everything looks like it should so proceeding to demote the first DC and got the following error during demote process through dcpromo.exe Error - The Active Directory Domain Services Installation Wizard (Dcpromo.exe) could not configure the computer account DC2$ on the remote Active Directory Domain Controller DC1.REC.LAN. Verify that the user running Dcpromo.exe is granted the "Enable computer and user accounts to be trusted for delegation" user right in the Default Domain Controllers Policy. For more information, see the resolution section of http://go.microsoft.com/fwlink/?LinkId=178406." Now I have looked at the MS KB and I can see from this in this environment, it could be exactly what is stated and / or the fact that the DC computer objects are protected from accidental deletion. The second option is easy to fix but given the error specifically calls out the "Enable computer and user accounts to be trusted for delegation" I wanted to look at this. The user account that was running dcpromo.exe at this time has Domain Admin membership and when I checked this right through whoami /all, it stated this right was disabled. Looking at the Default Domain Controller Policy (which is applying to the Domain Controller OU) BUILTIN\Administrators (which Domain Admin are a part of) should be getting this right assigned to them. Does anyone know what is going on here or can provide assistance? I can't raise a partner support case for the customer as it is affecting 2012 R2. From DCPROMO.LOG " 2/17/2024 13:12:36 [INFO] Removing Active Directory Domain Services objects that refer to the local Active Directory Domain Controller from the remote Active Directory Domain Controller DC1.REC.LAN... 12/17/2024 13:12:36 [INFO] Error - The Active Directory Domain Services Installation Wizard (Dcpromo.exe) could not configure the computer account DC2$ on the remote Active Directory Domain Controller DC1.REC.LAN. Verify that the user running Dcpromo.exe is granted the "Enable computer and user accounts to be trusted for delegation" user right in the Default Domain Controllers Policy. For more information, see the resolution section of http://go.microsoft.com/fwlink/?LinkId=178406. The error was: (5) 12/17/2024 13:12:36 [INFO] NtdsDemote returned 5 12/17/2024 13:12:36 [INFO] DsRolepDemoteDs returned 5 12/17/2024 13:12:36 [ERROR] Failed to demote the directory service (5)" Any help would be much appreciated.
Windows Server 2019 and .NET 4.8?
Hello, On a fully updated Windows Server 2019, roles and features allow me to install only .NET 4.7. One of the solution we are using require .NET 4.8 (Adaxes). When I install .NET 4.8 using the installer available herehttps://support.microsoft.com/en-us/topic/microsoft-net-framework-4-8-offline-installer-for-windows-9d23f658-3b97-68ab-d013-aa3c3e7495e0 It works, I can install Adaxes, but it break ServerManager as well as Azure AD Connect. What's the correct procedure to install .NET 4.8 on Server 2019 without breaking anything else? Thanks a lot
Windows DNS server crash?
Our DNS servers crashed and took our network down. I rebooted them and its back but I foud the below error I have never seen before. Can't find anything in any log but this and its never happened before. Is thewre any way to tell what caused this? Event ID 906 lsass (796,G,0) A significant portion of the database buffer cache has been written out to the system paging file. This may result in severe performance degradation. See help link for complete details of possible causes. Previous cache residency state: 64% (23809 out of 37063 buffers) (72 seconds ago) Current cache residency state: 15% (4338 out of 28472 buffers) Current cache size vs. target: 99% (214.508 / 214.711 MBs) Physical Memory / RAM size: 8191.023 MBs
Certificate based Authentication and KB5014754
Hello community, we have an AD CS that issues certificates to users and computers. How do we achieve automatic certificate mapping? According to KB504754, strong certificate mapping is to be done. Currently, AD computer/user certificates are being used, and no mapping has been configured. Will this continue to work?
Servers not rebooting following update (WSUS)
Has anyone else encountered an issue with servers sometimes not rebooting straight away following an update installed via WSUS? It sits at restart pending for 24 hours, until the next update check is due, then reboots. This is particularly an issue with terminal servers because (for reasons best known to Microsoft), these offer ordinary users the option to update and restart (under normal circumstances, only an admin has the restart option visible). so there is a whole day where one person could inadverteltly reboot a terminal server, thereby potentially causing others logged in to lose what they are working on. I've trawled through the event log on an affected server, and I can't see any clear reason why it doesn't reboot immediately on all occasions (with some updates it does reboot - this behaviour is not consistent). The affected updates seem to be .NET monthly cumulative ones, but I can't say for sure whether it's only them affected, nor is it clear whether only terminal servers do this (I hope to clarify this with testing over the next few weeks). However, either way it's the terminal servers which are the problem - the other servers are only accessible by admins, who know not to reboot them during working hours unless really necessary). ThanksUnusual Behavior using GPO PowerShell Scripts During Restart/Shutdown in Hyper-V – Need Help
I have noticed strange behavior in Hyper-V. Group Policy is configured to execute PowerShell scripts for logon, logout, startup, and shutdown. The typical sequence of script execution is: startup → logon → logout → shutdown. However, an issue arises when a restart is initiated while logged in (i.e., after startup and logon scripts have already been executed). Upon clicking the restart button from the GUI, the following occurs: after the logout and shutdown scripts run as expected, the startup script is executed and the logon script (!)is triggered. This happens despite the fact that the lock screen is displayed after the restart, and no user has logged in yet. This phenomenon consistently occurs when restarting or shutting down from the GUI while logged in. It does not occur when restarting via the command line using shutdown /r /t 0 or shutting down with shutdown /s /t 0. Why does Hyper-V behave in this inexplicable manner, executing the logon script in such cases? Is it possible to configure something within the virtual machine to address this issue? Or are there specific Group Policies for script execution that could control this behavior? Could there be certain Registry entries that influence the shutdown or restart process to prevent this issue in Hyper-V? Alternatively, could the problem be resolved by modifying the startup or logon scripts, for instance, by adding conditions to verify if an actual login has occurred? Any ideas or suggestions to explain or resolve this behavior would be greatly appreciated.Activate Server 2025 with 2022 retail key
I have a retail key for Windows Server 2022 standard edition. I'm rebuilding from scratch on new hardware and have installed Windows Server 2025 standard edition evaluation on the new hardware. If I try to activate Server 2025 with my 2022 license key, I get the error 'The product key you entered didn't work. (0x80041014)' Shouldn't this work? ThanksHow to clear AD Users Mobile and Home phone number under the Telephone tab using PowerShell
Hello, We have multiple users in AD who has a mobile number assigned under the Telephone tab; now, we want to clear the Mobile number for all user. Is there a PowerShell script that I can use? Get all users list from AD. Remove listed users Mobile number Your help would be much appreciated.
