Recent Discussions
Server 2025 Evaluation Version not activating
Hi all, in my test environment I have a fresh server 2025 build (eval version), but not matter what I do I can't get it to activate to allow the 180 days. Following the information on the Windows Server 2025 Eval website: https://www.microsoft.com/en-us/evalcenter/evaluate-windows-server-2025 I have done everything as instructed apart from: "Evaluation versions of Windows Server must be activated over the internet in the first 10 days to avoid automatic shutdown." Searching for an answer online only brings up how to activate a purchased license which is NOT what I want to do. I want to activate the 180 evaluation days. How can I do this please?
Active Directory Restoration in Isolated Environment
Introduction: Active Directory is centralized Database which stores the objects like users, groups, computers, printers, shares, service accounts in an hierarchical structure. It is one of the most critical and important services in IT Infrastructure as it provides centralized authentication and authorization, allows administrators to manage access to resources, enforce security policies etc., Objective \ Purpose: The purpose of this article is to provide detailed steps to recover the entire Active Directory forest from Good Backup taken using native backup "Windows Server Backup" and Backup taken through "Azure VM Backup" in an isolated environment to check the backup working status. This builds the confidence of restoring the AD and bringing to production in case of a disaster like complete loss of Production domain or malware attack or any other attack etc., Environment Background: ----------------------------- In this article, the Active Directory environment is considered to be having Root domain as test.com and Child Domain as child.test.com in Azure Cloud. Operating system used is Windows server 2019 and Windows server 2025. Recovery Approaches: ------------------------- Active Directory can be recovered using many methods, viz., 1. Active directories recycle bin: To restore only the deleted objects, but this option is not suitable for recovering complete AD 2. System State Backup: This helps in restoring Active Directory Database in DSRM mode by marking authoritative or non-authoritative based on requirement. 3. Complete VM Backup: This is the best option to restore complete Domain Controller Building the Isolated Environment in Azure: ------------------------------------------------ 1. Create a separate VNET 2. Subnet for Azure Bastion and Subnet for deploying virtual machine 3. NSG to allow only communication inside the VNET and block other communications Restore Procedure: -------------------------- Restoring the Root Domain DC: 1. Search the domain Controller VM in Azure console 2. Select recover and create new 3. Fill in the details of the isolated environment so that the VM will be re-created 4. Login with domain admin privileges 5. Verify the DNS assigned using IPCONFIG /ALL 6. Change the DNS IP address on network properties to Server IP Address 7. Perform Ipconfig /registerdns so that the IP of new DC will be updated 8. Run Command : Net Share to check SYSVOL and NETLOGON is showing up 9. Boot the system into DSRM Mode by selecting the option in msconfig 10. Once it is booted in DSRM Mode, login using local administrator credential If it is needed to restore the system state of any other date after restoring the complete VM, then using "Windows Server Backup Wizard" choose recover and follow the steps; else skip this step and continue with step 11. >Select Backup Location >Specify the backup source >Select date and time >Select the recovery type as system restore >Recovery options as Original >Review and Confirm 11. Open Command Prompt as administrator and mark all the naming context as authoritative using ntdsutil >ntdsutil >activate instance ntds >authoritative restore >restore subtree "DC=test,DC=com" Repeat the above steps for the other Naming context like "CN=Configuration,DC=test,DC=com", "CN=Schema,CN=Configuration,DC=test,DC=com", "DC=ForestDNSZones,DC=test,DC=com", "DC=DomainDNSZones,DC=test,DC=com" as well. Reboot the server in normal mode and perform the following steps for making sysvol as authoritative: Mark the sysvol as authoritative by changing the msDFSR-Enabled value to 1 >net stop dfsr >Open Active Directory Users and Computers, go to View and enable Advanced Features >Navigate to Domain Controllers -> Your DC -> DFSR-Localsettings -> Domain System Volume >Right-click SYSVOL Subscription, select Properties, and then Attribute Editor >Find msDFSR-Options, click Edit, change the value to 1, and click OK >Run repadmin /syncall /Aed from an elevated command prompt to force replication of the AD changes >Run net start dfsr in an elevated command prompt on the authoritative DC. >Run dfsrdiag /pollad from an elevated command prompt on the authoritative DC Verify the domain controller is holding the FSMO roles if not seize the roles. Steps are as follows: >ntdsutil >Roles >Connections >Connect to Server <Recovered VM> >quit >seize PDC Emulator Repeat the above steps to seize the other roles (Infrastructure, Schema master, RID Master and Domain Naming master) Check the time synchronization by using w32tm /query /source. Now Domain Controller is completely recovered from backup. Check the health of domain controller using DCDIAG Command. Restoring the Child Domain DC: 1. Search the domain Controller VM in Azure console 2. Select recover and create new 3. Fill in the details of the isolated environment so that the VM will be recreated 4. login with domain admin privileges 5. Verify the DNS assigned using IPCONFIG /ALL 6. Change the DNS IP address on network properties to Server IP Address 7. Perform Ipconfig /registerdns so that the IP of new DC will be updated 8. Run Command : Net Share to check SYSVOL and NETLOGON is showing up 9. Boot the system into DSRM Mode by selecting the option in msconfig 10. Once it is booted in DSRM Mode, login using local administrator credential If it is needed to restore the system state of any other date after restoring the complete VM then using "Windows Server Backup Wizard" choose recover and follow the steps; else skip this step and continue with step 11. >Select Backup Location >Specify the backup source >Select date and time >Select the recovery type as system restore >Recovery options as Original >Review and Confirm 11. Open Command Prompt as administrator and mark all the naming context as authoritative using ntdsutil >ntdsutil >activate instance ntds >authoritative restore >restore subtree "DC=Child,DC=test,DC=com" Repeat the above steps for the other Naming context. Reboot the server in normal mode and Perform the following steps for making sysvol as authoritative: Mark the sysvol as authoritative by changing the msDFSR-Enabled value to 1 >net stop dfsr >Open Active Directory Users and Computers, go to View and enable Advanced Features >Navigate to Domain Controllers -> Your DC -> DFSR-Localsettings -> Domain System Volume >Right-click SYSVOL Subscription, select Properties, and then Attribute Editor >Find msDFSR-Options, click Edit, change the value to 1, and click OK >Run repadmin /syncall /Aed from an elevated command prompt to force replication of the AD changes >Run net start dfsr in an elevated command prompt on the authoritative DC. >Run dfsrdiag /pollad from an elevated command prompt on the authoritative DC Verify the domain controller is holding the FSMO roles if not seize the roles. Steps are as follows: >ntdsutil >Roles >Connections >Connect to Server <Recovered VM> >quit >seize PDC Emulator Repeat the above steps to seize the other Domain specific roles (Infrastructure, RID Master) Check the time synchronization by using w32tm /query /source. Verify the DNS Resolution for Root Domain and Child domain from both Root DC and Child DC. Verify the Parent and child trust using AD Trust console and validate the Trust connection. Now Domain Controller is completely recovered from backup. Check the health of domain controller using DCDIAG Command. In case it is planned to move this to Production environment to make these as first root DC and first child DC, then following steps are to be performed to cleanup the stale entries of non-functional DC. >ntdsutil >metadata cleanup >Connections >Connect to server <server> >quit >Select Operation Target >list domains >Select Domain <number> >List Servers in site >Select Server <number> >quit >remove selected server Confirm for removal as 'Yes' Repeat the above cleanup steps in both Root Domain DC and Child Domain DC for the non-functioning domain controller. Verify the Dcdiag, repadmin /showrepl, repadmin /replsummary to check health of Domain controller and replications. This completes the recovery of both Root Domain and Child Domain.
QOS and MTU settings
A contractor has asserted that latency delays are caused by a "misconfiguration" of the hardware of certain machines that produces flooding of the network with bad packets. They have asserted that they find this when checking out a new site. Is this also associated with a Quality of Service setting on a site's server if it would then release such large number of packets to the network? Does this also require careful adjustment of the MTU (Max. Trans. Unit) settings on each base server? (MS Server setting???) Or does the server simply transmit all the packets it receives from networked machines?
Language Bug
I'd like to report a bug between WS2025 (english version not affected) and WAC. I tried to download Windows Server 2025 evaluation Italian version from https://www.microsoft.com/en-us/evalcenter/download-windows-server-2025?msockid=1c4d54ba113b6b020d1942b710e66a95, I installed all the updates, installed WAC App, present in start (but also by downloading from the website) once the procedure was completed the WAC website opens in Edge but the "Sign in" button does not send any command. there is a problem translating a command because it is accentedS2D FaultDomainAwareness
We're setting up a 2 Node windows 2025 cluster with storage spaces direct After creating the pool we created two virtual disk but see the following output PS C:\WINDOWS\system32> Get-VirtualDisk | Format-List FriendlyName, Size, FaultDomainAwareness FriendlyName : ClusterPerformanceHistory Size : 25769803776 FaultDomainAwareness : StorageScaleUnit FriendlyName : S2DVOL01 Size : 10995116277760 FaultDomainAwareness : FriendlyName : S2DVOL02 Size : 10995116277760 FaultDomainAwareness : The FaultDomainAwareness is empty for the two virtual disk created on the storage pool which is configured like this PS C:\WINDOWS\system32> Get-StoragePool –FriendlyName S2D-CLHV-001-Pool | Format-List FriendlyName, Size, FaultDomainAwarenessDefault FriendlyName : S2D-CLHV-001-Pool Size : 57592038555648 FaultDomainAwarenessDefault : StorageScaleUnit is there something wrong ?Public network on NIC instead of domain network
On a Windows Server 2025 Standard Edition, I have 2 NICs: a 10Gbps NIC and 1Gbps NIC. Both NICs have a static IP address, but only the faster 10Gbps has a default gateway. The faster NIC correctly identifies as the domain network but the slower NIC says it is on a public network. The DNS settings and suffixes are the same for both cards. I have another Windows 2025 server with the same setup but both NICs identify as the domain network. Any ideas on how to fix this? Thanks.Deploying Multiple NPS Servers
I have been working on ditching our password-based WiFi with WPA2-Enterprise. On DC1 I deployed internal CA, NPS, and group policies that auto-request certs and deploy wireless network settings. Cisco AP is pointed to DC1 as the radius server. NPS has been registered in AD and wireless network policy has been created. Test laptops get their cert and connect just fine. It's working. For redundancy, I installed NPS on DC2. This NPS instance has also been registered in AD, and I imported the NPS config from DC1 to DC2 NPS. Cisco AP has DC1 as first radius server and DC2 as second radius server. If I stop NPS on DC1 to force the Cisco AP to authenticate against DC2, test laptops won't authenticate and connect. What am I missing? They're configured exactly the same (except DC1 hosts the CA...I was under the assumption the CA is AD integrated).Advice for replacing a Windows 2012R2 file server
We have a small company network that includes one Windows Server 2012R2 file server necessary to run Sequel for two server hosted business applications, file and print services for the user accounts and is also the Domain Controller for the Active Directory local forest and domain. Six Windows 11 Pro workstations are domain attached to the file server. The workstations all have a local user account and after domain attaching to the file server, a user.Acme user account with Administrator rights to their local computer. Each has its own 192.168.1.x static address and uses their domain user account with mapped drives to access the fileserver. The existing file server name is ACMEWS2012R2, local public static ip 192.168.1.12, DNS Domain Acme.LAN, Netbios name ACME, local accounts are located in \Users\username, and runs SQL Server Express 2012 with default MSSQL database name and mixed security using the SA with password credentials. The new file server will be using Windows Server 2022 (the company apps are not yet certified for 2025) and SQL SVR Express 2022 and I am looking for information about what configuration decisions I can make to hopefully minimize the need to install new user accounts on the workstations, copy all the user folders between users accounts and reinstall applications. My understanding of Domain security is limited, knowing just enough to get workstations attached and properly accessing the file server SQL based applications. My Google results have provided some piecemeal answers, but I would like to better understand the big picture before starting the server upgrade and make some irreversible configuration choices that would cause unnecessary work re-attaching the workstations. I would first ask for recommendations whether and why to keep or change each of the following: The file server machine name The file server 192.168.1.12 IP address The file server Administrator account and password. The Acme.LAN forest and root domain name that was defined after adding the Active Directory Domain Service role that also added File and Print Services and Group Policy Management. The SQL Server Express default MSSQL database name The SQL Server Express SA account name and password I would also ask about the best steps for disconnecting workstations from the old domain then joining the new domain to hopefully retain the existing workstation user account, or if not, to minimize the need to copy users folders between the user accounts and / or uninstall then reinstall the workstation applications to properly authenticate to the new user account. I would greatly appreciate some experienced insights for how to best accomplish these upgrade goals. Thanks, all!
Not able to update the parameter "UserRightsGenerateSecurityAudits" for OSConfigDesiredConfiguration
Hello, I want to add my AD group as part of "UserRightsGenerateSecurityAudits" in order to be able to collect audit logs but when I run the command, the change is not applied (Processed 0 out of 1 settings) : "Set-OSConfigDesiredConfiguration -Scenario SecurityBaseline/WS2025/MemberServer -Setting UserRightsGenerateSecurityAudits -Value @("*S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415","*S-1-5-20","*S-1-5-19","*S-1-5-21-2654652530-1219913000-911364509-1603") Warning : Cannot process the settings 'UserRightsGenerateSecurityAudits': 0x82d0000a. Verify the value and try again. Processed 0 out of 1 settings. Using GPO, I'm able to update the value, but OsConfig is overwriting it after some time after because the group is not part of defaut values allowed by OsConfig. Your assitance will be ready appreciated. ThanksUnable to download Windows 11 Client Arm64 Insider Preview Dev Channel Edition
Error We are unable to complete your request at this time. Some users, entities and locations are banned from using this service. For this reason, leveraging anonymous or location hiding technologies when connecting to this service is not generally allowed. If you believe that you encountered this problem in error, please try again. If the problem persists you may contact page for assistance. Refer to message code 715-123130 and c21934f3-66c0-43e3-9e88-c5869adeae48. I am in the US and simply want to download this. Please provide a usable link without restrictions.For those with Windows Insider Problems to read please before posting in this Server Insiders Forum
For all Windows Insider Build issues Home, Pro, Pro for Workstations, Etc. the Windows Insider Forum is https://learn.microsoft.com/en-us/answers/tags/953/windows-insider Respectfully meaning to be helpful Thank You p.s. Can Microsoft please lock this conversation topic as closed and if possible pin it?Advice for replacing a Windows 2012R2 file server
We have a small company network that includes one Windows Server 2012R2 file server necessary to run Sequel for two server hosted business applications, file and print services for the user accounts and is also the Domain Controller for the Active Directory local forest and domain. Six Windows 11 Pro workstations are domain attached to the file server. The workstations all have a local user account and after domain attaching to the file server, a user.Acme user account with Administrator rights to their local computer. Each has its own 192.168.1.x static address and uses their domain user account with mapped drives to access the fileserver. The existing file server name is ACMEWS2012R2, local public static ip 192.168.1.12, DNS Domain Acme.LAN, Netbios name ACME, local accounts are located in \Users\username, and runs SQL Server Express 2012 with default MSSQL database name and mixed security using the SA with password credentials. The new file server will be using Windows Server 2022 (the company apps are not yet certified for 2025) and SQL SVR Express 2022 and I am looking for information about what configuration decisions I can make to hopefully minimize the need to install new user accounts on the workstations, copy all the user folders between users accounts and reinstall applications. My understanding of Domain security is limited, knowing just enough to get workstations attached and properly accessing the file server SQL based applications. My Google results have provided some piecemeal answers, but I would like to better understand the big picture before starting the server upgrade and make some irreversible configuration choices that would cause unnecessary work re-attaching the workstations. I would first ask for recommendations whether and why to keep or change each of the following: The file server machine name The file server 192.168.1.12 IP address The file server Administrator account and password. The Acme.LAN forest and root domain name that was defined after adding the Active Directory Domain Service role that also added File and Print Services and Group Policy Management. The SQL Server Express default MSSQL database name The SQL Server Express SA account name and password I would also ask about the best steps for disconnecting workstations from the old domain then joining the new domain to hopefully retain the existing workstation user account, or if not, minimize the need to copy users folders between the user accounts and / or uninstall then reinstall the workstation applications to properly authenticate to the new user account. I would greatly appreciate some experienced insights for how to best accomplish these upgrade goals. Thanks all.Demoting DC Windows Server 2019
Windows Server 2019 with Domain controller forest version 2016. When demoting our Domain controller XYDC01 in Site XY, it is the only DC and DNS in the site, but all other 20 sites have a DC with DNS. We get this error when demoting our DC. Active Directory domain controller appears to be the last DNS server for the following Active Directory-integrated zones: enterpriseregistration.jens.be If you demote this domain controller, you may be unable to resolve any DNS names in these zones. If you wish to proceed, specify the 'IgnoreLastDNSServerForZone' option. I have tested: #other DC and DNS server in other site Resolve-DnsName enterpriseregistration.jens.be -Server XXDC02 Test-NetConnection XXDC02-Port 135 Test-NetConnection XXDC02-Port 53 Get-DnsServerZone -Name "enterpriseregistration.jens.be" repadmin /syncall /AdeP All test have passed and succesfull. Replication scope = Forest Other DCs have DNS role Zone contains NS records for other DCs Zone exists on other DCs But still having the same issue when trying to demoteHyper-V live mig failing from 2025 host to 2022 host
I'm having an issue with my one hyper-v cluster. I have 4 Server 2022 hosts, and 1 Server 2025 host. Live migration works INBOUND to the 2025 host, but live migrations fail OUTBOUND from the 2025 host. I have tried everything I can think of to make sure settings are ok. I have tried both setting it to use all networks, and the specific network. I've matched the live migration NIC settings to mirror what the 2022 hosts have. I've made sure the Hyper-V Live Migration settings all match. They use CredSSP and compression. Nothing seems to be working. Is there some really subtle 2025 bug that doesn't allow for live migrations to lower OS version hosts?
Can't roll-back from 25h2 to 24h2.
A few days ago, my PC automatically updated from version 24H2 to 25H2, and ever since then, I've been experiencing persistent issues that I haven't been able to resolve. Unfortunately, the option to roll back to the previous version seems to be unavailable, which has made troubleshooting even more difficult. I've tried just about everything I could think of—tweaking settings, running diagnostics, checking for compatibility problems, and even reaching out to support forums—but nothing has worked so far. It's been incredibly frustrating, and I'm still stuck with the same problem.Allow to take RDP from Laptop only and not from IP
Hello Experts, We have scenario where , We want to Allow to take RDP from His Laptop only. Which mean user is allowed to take of RDP of Some Server only from his Laptop and not from any other Computers. We have already checked for Windows firewall but it is working for IP based , and We want for Machine based. as user is roaming between Offices. Please suggest if there is any GPO or Policy or Firewall Rule using which If possible to take RDP using Machine based and not IP based. Thanks
windows 2019 KB5066586 & KB5070883 both have error 0x800f0985
Stuck and need suggestions, I have tried SFC & DISM recovery commands, Resetting the Windows Update subsystem Manually downloading the patches Trying to patch though power shell get-windwosupdatelog doesn't provide any insight. cbs.log & dism.log don't provide any insight Tried to update the Servicing Stack Update (SSU) for Windows Server with KB070883 that came out on Oct 23 2025, but it won't install either I get 0x800f0985. Suggestions other than in Place upgrade?
Recent Blogs
- 7 MIN READWelcome to part one of my blog series on Cross Forest Certificate Enrollment. Nowadays, businesses often run across multiple Forests for distinct reasons. You would like to ensure secure authenticati...Oct 22, 2025
- 5 MIN READAbout media-based upgrade to Windows Server 2025 With N-4 media based upgrades, you can upgrade your organization’s physical devices and virtual machines directly from Windows Server 2012R2, Window...Sep 23, 2025
