Recent Discussions
AOVPN / Reasoncode 16
We have an always on vpn configuration. This worked fine till few months ago, users can't get connected anymore. After reboot of NPS server, all works fine for some time (random, sometimes 1 day, 2 days, 1 week), till the users can't get connected again. Reboot of nps server solves it. When users can't connect, I see an event on NPS server with reason code 16 Network Policy Server denied access to a user. Contact the Network Policy Server administrator for more information. User: Security ID: xxx Account Name:xxx Account Domain: xxx Fully Qualified Account Name: xx Client Machine: Security ID: NULL SID Account Name: - Fully Qualified Account Name: - Called Station Identifier: x.x.x.x Calling Station Identifier: x.x.x.x NAS: NAS IPv4 Address: x.x.x.x NAS IPv6 Address: - NAS Identifier: server-VPN01 NAS Port-Type: Virtual NAS Port: 14 RADIUS Client: Client Friendly Name: server-VPN01 Client IP Address: x.x.x.x Authentication Details: Connection Request Policy Name: Virtual Private Network (VPN) Connections Network Policy Name: Virtual Private Network (VPN) Connections Authentication Provider: Windows Authentication Server: server-NPS01 Authentication Type: PEAP EAP Type: Microsoft: Smart Card or other certificate (EAP-TLS) Account Session Identifier: 33373834 Logging Results: Accounting information was written to the local log file. Reason Code: 16 Reason: Authentication failed due to a user credentials mismatch. Either the user name provided does not map to an existing user account or the password was incorrect. As said, reboot of nps solves issues temporary. Already installed new nps server but same issue. Any suggestions where to check ?
SystemSettings. exe on Windows server 2025 crashes after installing Xbox game
I installed the Microsoft App Store on Windows Server and installed Minecraft. However, entering the system>display>graphics tab in the settings will cause the settings to crash.I tested both Bedrock and Java and found this issue. I think any Xbox game in the Microsoft Store should be able to reproduce this issue. + System - Provider [ Name] Application Error [ Guid] {a0e9b465-b939-57d7-b27d-95d8e925ff57} EventID 1000 Version 0 Level 2 Task 100 Opcode 0 Keywords 0x8000000000000000 - TimeCreated [ SystemTime] 2025-12-04T08:55:23.2042032Z EventRecordID 27146 Correlation - Execution [ ProcessID] 10988 [ ThreadID] 20000 Channel Application Computer WIN-JSD290TH0EL - Security [ UserID] S-1-5-21-868965638-952098041-1598110278-1002 - EventData AppName SystemSettings.exe AppVersion 10.0.26100.7019 AppTimeStamp f88449de ModuleName Windows.Gaming.Preview.dll ModuleVersion 10.0.26100.7019 ModuleTimeStamp 8e7f4dfa ExceptionCode c0000005 FaultingOffset 000000000003aadd ProcessId 0x1230 ProcessCreationTime 0x1dc64fbb631455a AppPath C:\Windows\ImmersiveControlPanel\SystemSettings.exe ModulePath C:\Windows\System32\Windows.Gaming.Preview.dll IntegratorReportId f2340132-82be-40d6-9c76-ec8fcbb9d19e PackageFullName windows.immersivecontrolpanel_10.0.8.1000_neutral_neutral_cw5n1h2txyewy PackageRelativeAppId microsoft.windows.immersivecontrolpanel
Allow VMs attached to internal switch on hyper-V win2k19 access Internet
Hi, I have 4 VMs attached to an internal switch with IPs 10.10.0.*, assigned 10.10.0.1 to the switch. One of the NICs on the host has the 192.168.1.70 which I shared its connection with the internal switch but I am not able to browse internet from the VMs. What can be missing? ThanksAllow Hyper-V VM attached to Internal Switch access internet and host folders
I have Created an internal switch and attached it to 4 VMs (for a lab setup) on a win2k19 hyper-V host. The hyper-V is in the my local home subnet 192.168.0.1. The 4 VMs are configured with following IPs and gateway. VM1 10.10.0.10 -DefaultGateway 10.10.0.1 VM2 10.10.0.11 -DefaultGateway 10.10.0.1 VM3 10.10.0.12 -DefaultGateway 10.10.0.1 VM4 10.10.0.13 -DefaultGateway 10.10.0.1 In the lab document, it is not indicated how/where to assign the 10.10.0..1 IP? When I check the vEthernet (Private Network), It has "DHCP" for IP and got my local DNS IP. Checking its status, I see DHCP Enabled: Yes Autoconfiguration IPv4 Address: 169.254.32.39 IPv4 Subnet Mask: 255.255.0.0 IPv4 Default Gateway: Not sure where this 169.254.... IP comes from? I tried assigning the IP 10.10.0.1 to this but it fails. In fact I need to allow VMs to access some host folders as well as internet to download some Microsoft tools. Thanks for your helpBreaking Certutil changes in WS2025
I noticed yesterday that a certutil command I thought I could always rely on no longer works in Server 2025: >certutil -cainfo xchg CertUtil: -CAInfo command FAILED: 0x80070057 (WIN32: 87 ERROR_INVALID_PARAMETER) CertUtil: The parameter is incorrect. Executing certutil -cainfo xchg was a handy command which would ask the local certificate authority to output it's current CA Exchange certificate in Base64 format. If the CA didn't have a valid exchange cert at the time, it would immediately create a new one. Think of a CA Exchange certificate as a short-lived TLS cert which the CA provides clients when they need to upload private key material for archival. Anyway, looking at the help for certutil, the command still exists, however, it requires a new parameter: xchg [Index] -- CA exchange cert So, I figured [Index] had to refer to the CA certificate index. When you initially deploy an ADCS certification authority, the CA's initial certificate is at index 0. When you renew/re-key the CA, the new CA cert is at index 1. I tried using 0 for the [Index] parameter. No dice: >certutil -cainfo xchg 0 CertUtil: -CAInfo command FAILED: 0x80070057 (WIN32: 87 ERROR_INVALID_PARAMETER) CertUtil: The parameter is incorrect. I can't think of what else that parameter would be. Has anyone been able to successfully used this command on WS2025? If so, please share how!
Volume Activation role questions
We have a DC, running Server 2016 to decommission (call it old server). One of the roles it had was Volume Activation (VA). This is Active Directory based and the keys AD holds are both for clients (Win11) and servers (2016/19/22/25). I have removed the VA role from the server and tested with a server which I added to the domain and the OS activated successfully, so it looks like it is working. I noticed the _vlmcs SRV DNS record was not deleted and is still pointing to the old server. Since the old server is no longer having the VA role, is it safe to delete the DNS record for the _vlmcs SRV record? What else do I need to take into account? Thanks in advanceLAPS: Meaning of Setting - Short words with unique prefixes
The update to LAPS for Windows 11 24H2 and Windows Server 2025 introduced new configuration options including the ability to use passphrases rather than passwords. Operationally this is add some benefits. However, the official documentation - https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-concepts-passwords-passphrases#passphrase-word-lists doesn't provide a very good explanation for the setting "Short words with unique prefixes" The examples in the documentation and observations from implementation do not align with the short description. For example, from implementation: IodineIslandNectarRagweedCivilianZillion The word phrases are not exactly short; 6+6+6+7+8+7 = 40 characters, and nor is their a unique prefix. Does anyone have a better explanation as to the meaning of passwordcomplexity setting 8 in LAPS (post 24H2)? Cheers Paul P.S. the LAPS password above is no longer valid as it has been rotated.Access denied. 0x80090010 Enroll cert of Windows hello for Business with on-prem PKI CA Server
We have created Certficate Template from on-prem CA Server ( Windows server 2019 ) using this link : https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/rdp-sign-in?tabs=intune However We can not Enroll Certificate Windows Hello for Business Certificate from User's Desktop ( Windows 11 ) and every time error occurred or Access Denied ( Certificate enrollment for Domain\UserName failed to enroll for a WHfBCertificateAuthentication certificate with request ID N/A from -ERCA.Domain.local\Domain-ERCA-CA-1 (Access denied. 0x80090010 (-2146893808 NTE_PERM)) We have also given Read and Enroll permission to EveryOne and Autheticated Users from CA Certficiate template , but still same erro Please advise if anything more can be done to resolve this issue.Server 2025 Evaluation Version not activating
Hi all, in my test environment I have a fresh server 2025 build (eval version), but not matter what I do I can't get it to activate to allow the 180 days. Following the information on the Windows Server 2025 Eval website: https://www.microsoft.com/en-us/evalcenter/evaluate-windows-server-2025 I have done everything as instructed apart from: "Evaluation versions of Windows Server must be activated over the internet in the first 10 days to avoid automatic shutdown." Searching for an answer online only brings up how to activate a purchased license which is NOT what I want to do. I want to activate the 180 evaluation days. How can I do this please?
Active Directory Restoration in Isolated Environment
Introduction: Active Directory is centralized Database which stores the objects like users, groups, computers, printers, shares, service accounts in an hierarchical structure. It is one of the most critical and important services in IT Infrastructure as it provides centralized authentication and authorization, allows administrators to manage access to resources, enforce security policies etc., Objective \ Purpose: The purpose of this article is to provide detailed steps to recover the entire Active Directory forest from Good Backup taken using native backup "Windows Server Backup" and Backup taken through "Azure VM Backup" in an isolated environment to check the backup working status. This builds the confidence of restoring the AD and bringing to production in case of a disaster like complete loss of Production domain or malware attack or any other attack etc., Environment Background: ----------------------------- In this article, the Active Directory environment is considered to be having Root domain as test.com and Child Domain as child.test.com in Azure Cloud. Operating system used is Windows server 2019 and Windows server 2025. Recovery Approaches: ------------------------- Active Directory can be recovered using many methods, viz., 1. Active directories recycle bin: To restore only the deleted objects, but this option is not suitable for recovering complete AD 2. System State Backup: This helps in restoring Active Directory Database in DSRM mode by marking authoritative or non-authoritative based on requirement. 3. Complete VM Backup: This is the best option to restore complete Domain Controller Building the Isolated Environment in Azure: ------------------------------------------------ 1. Create a separate VNET 2. Subnet for Azure Bastion and Subnet for deploying virtual machine 3. NSG to allow only communication inside the VNET and block other communications Restore Procedure: -------------------------- Restoring the Root Domain DC: 1. Search the domain Controller VM in Azure console 2. Select recover and create new 3. Fill in the details of the isolated environment so that the VM will be re-created 4. Login with domain admin privileges 5. Verify the DNS assigned using IPCONFIG /ALL 6. Change the DNS IP address on network properties to Server IP Address 7. Perform Ipconfig /registerdns so that the IP of new DC will be updated 8. Run Command : Net Share to check SYSVOL and NETLOGON is showing up 9. Boot the system into DSRM Mode by selecting the option in msconfig 10. Once it is booted in DSRM Mode, login using local administrator credential If it is needed to restore the system state of any other date after restoring the complete VM, then using "Windows Server Backup Wizard" choose recover and follow the steps; else skip this step and continue with step 11. >Select Backup Location >Specify the backup source >Select date and time >Select the recovery type as system restore >Recovery options as Original >Review and Confirm 11. Open Command Prompt as administrator and mark all the naming context as authoritative using ntdsutil >ntdsutil >activate instance ntds >authoritative restore >restore subtree "DC=test,DC=com" Repeat the above steps for the other Naming context like "CN=Configuration,DC=test,DC=com", "CN=Schema,CN=Configuration,DC=test,DC=com", "DC=ForestDNSZones,DC=test,DC=com", "DC=DomainDNSZones,DC=test,DC=com" as well. Reboot the server in normal mode and perform the following steps for making sysvol as authoritative: Mark the sysvol as authoritative by changing the msDFSR-Enabled value to 1 >net stop dfsr >Open Active Directory Users and Computers, go to View and enable Advanced Features >Navigate to Domain Controllers -> Your DC -> DFSR-Localsettings -> Domain System Volume >Right-click SYSVOL Subscription, select Properties, and then Attribute Editor >Find msDFSR-Options, click Edit, change the value to 1, and click OK >Run repadmin /syncall /Aed from an elevated command prompt to force replication of the AD changes >Run net start dfsr in an elevated command prompt on the authoritative DC. >Run dfsrdiag /pollad from an elevated command prompt on the authoritative DC Verify the domain controller is holding the FSMO roles if not seize the roles. Steps are as follows: >ntdsutil >Roles >Connections >Connect to Server <Recovered VM> >quit >seize PDC Emulator Repeat the above steps to seize the other roles (Infrastructure, Schema master, RID Master and Domain Naming master) Check the time synchronization by using w32tm /query /source. Now Domain Controller is completely recovered from backup. Check the health of domain controller using DCDIAG Command. Restoring the Child Domain DC: 1. Search the domain Controller VM in Azure console 2. Select recover and create new 3. Fill in the details of the isolated environment so that the VM will be recreated 4. login with domain admin privileges 5. Verify the DNS assigned using IPCONFIG /ALL 6. Change the DNS IP address on network properties to Server IP Address 7. Perform Ipconfig /registerdns so that the IP of new DC will be updated 8. Run Command : Net Share to check SYSVOL and NETLOGON is showing up 9. Boot the system into DSRM Mode by selecting the option in msconfig 10. Once it is booted in DSRM Mode, login using local administrator credential If it is needed to restore the system state of any other date after restoring the complete VM then using "Windows Server Backup Wizard" choose recover and follow the steps; else skip this step and continue with step 11. >Select Backup Location >Specify the backup source >Select date and time >Select the recovery type as system restore >Recovery options as Original >Review and Confirm 11. Open Command Prompt as administrator and mark all the naming context as authoritative using ntdsutil >ntdsutil >activate instance ntds >authoritative restore >restore subtree "DC=Child,DC=test,DC=com" Repeat the above steps for the other Naming context. Reboot the server in normal mode and Perform the following steps for making sysvol as authoritative: Mark the sysvol as authoritative by changing the msDFSR-Enabled value to 1 >net stop dfsr >Open Active Directory Users and Computers, go to View and enable Advanced Features >Navigate to Domain Controllers -> Your DC -> DFSR-Localsettings -> Domain System Volume >Right-click SYSVOL Subscription, select Properties, and then Attribute Editor >Find msDFSR-Options, click Edit, change the value to 1, and click OK >Run repadmin /syncall /Aed from an elevated command prompt to force replication of the AD changes >Run net start dfsr in an elevated command prompt on the authoritative DC. >Run dfsrdiag /pollad from an elevated command prompt on the authoritative DC Verify the domain controller is holding the FSMO roles if not seize the roles. Steps are as follows: >ntdsutil >Roles >Connections >Connect to Server <Recovered VM> >quit >seize PDC Emulator Repeat the above steps to seize the other Domain specific roles (Infrastructure, RID Master) Check the time synchronization by using w32tm /query /source. Verify the DNS Resolution for Root Domain and Child domain from both Root DC and Child DC. Verify the Parent and child trust using AD Trust console and validate the Trust connection. Now Domain Controller is completely recovered from backup. Check the health of domain controller using DCDIAG Command. In case it is planned to move this to Production environment to make these as first root DC and first child DC, then following steps are to be performed to cleanup the stale entries of non-functional DC. >ntdsutil >metadata cleanup >Connections >Connect to server <server> >quit >Select Operation Target >list domains >Select Domain <number> >List Servers in site >Select Server <number> >quit >remove selected server Confirm for removal as 'Yes' Repeat the above cleanup steps in both Root Domain DC and Child Domain DC for the non-functioning domain controller. Verify the Dcdiag, repadmin /showrepl, repadmin /replsummary to check health of Domain controller and replications. This completes the recovery of both Root Domain and Child Domain.QOS and MTU settings
A contractor has asserted that latency delays are caused by a "misconfiguration" of the hardware of certain machines that produces flooding of the network with bad packets. They have asserted that they find this when checking out a new site. Is this also associated with a Quality of Service setting on a site's server if it would then release such large number of packets to the network? Does this also require careful adjustment of the MTU (Max. Trans. Unit) settings on each base server? (MS Server setting???) Or does the server simply transmit all the packets it receives from networked machines?Language Bug
I'd like to report a bug between WS2025 (english version not affected) and WAC. I tried to download Windows Server 2025 evaluation Italian version from https://www.microsoft.com/en-us/evalcenter/download-windows-server-2025?msockid=1c4d54ba113b6b020d1942b710e66a95, I installed all the updates, installed WAC App, present in start (but also by downloading from the website) once the procedure was completed the WAC website opens in Edge but the "Sign in" button does not send any command. there is a problem translating a command because it is accentedS2D FaultDomainAwareness
We're setting up a 2 Node windows 2025 cluster with storage spaces direct After creating the pool we created two virtual disk but see the following output PS C:\WINDOWS\system32> Get-VirtualDisk | Format-List FriendlyName, Size, FaultDomainAwareness FriendlyName : ClusterPerformanceHistory Size : 25769803776 FaultDomainAwareness : StorageScaleUnit FriendlyName : S2DVOL01 Size : 10995116277760 FaultDomainAwareness : FriendlyName : S2DVOL02 Size : 10995116277760 FaultDomainAwareness : The FaultDomainAwareness is empty for the two virtual disk created on the storage pool which is configured like this PS C:\WINDOWS\system32> Get-StoragePool –FriendlyName S2D-CLHV-001-Pool | Format-List FriendlyName, Size, FaultDomainAwarenessDefault FriendlyName : S2D-CLHV-001-Pool Size : 57592038555648 FaultDomainAwarenessDefault : StorageScaleUnit is there something wrong ?Public network on NIC instead of domain network
On a Windows Server 2025 Standard Edition, I have 2 NICs: a 10Gbps NIC and 1Gbps NIC. Both NICs have a static IP address, but only the faster 10Gbps has a default gateway. The faster NIC correctly identifies as the domain network but the slower NIC says it is on a public network. The DNS settings and suffixes are the same for both cards. I have another Windows 2025 server with the same setup but both NICs identify as the domain network. Any ideas on how to fix this? Thanks.
Recent Blogs
- 5 MIN READWe’re thrilled to announce the arrival of Native NVMe support in Windows Server 2025—a leap forward in storage innovation that will redefine what’s possible for your most demanding workloads. Modern ...Dec 15, 2025
- Great news for IT pros managing the next generation of Windows devices! Windows Admin Center now supports Arm-based Copilot+ PCs, bringing the powerful, browser-based management experience you rely o...Dec 12, 2025
