A common warning message for anyone who has installed Active Directory on Windows Server 2008 or Windows 2008 R2, especially on the first domain controller in a forest or domain is: A delegation for this DNS server cannot be created because the authoritative...

In an effort to consolidate the great troubleshooting solutions offered in this thread , we have summarized the information contained here into a TechNet Wiki article at the following location: How to list Active Directory group members Please...

A few days ago we posted a document to TechNet that outlines some of the various port requirements for Active Directory. We gathered the port information from various KB articles and consolidated them into one document. I think it should serve as a great...

Here are two methods to enter Directory Services Restore Mode (DSRM) in Windows Server 2008 or Windows Server 2008 R2: From the Desktop use the graphical user interface (GUI) Msconfig tool. Click Start . In Start Search , type msconfig and then...

ADMT v3.2 is now available at http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=20C0DB45-DB16-4D10-99F2-539B7277CCDB The ADMT Migration Guide is also updated to cover ADMT v3.1 and ADMT v3.2 and is available for download at...

Active Directory Administrative Center provides network administrators with an enhanced Active Directory data management experience and a rich graphical user interface (GUI). Administrators can use Active Directory Administrative Center to perform common...

We have published a topic about upgrading domain controllers to Windows Server 2012: http://technet.microsoft.com/library/hh994618.aspx. It covers a lot of useful background information to help you prepare for an Active Directory upgrade, including...

Active Directory Domain Services (AD DS) Best Practices Analyzer (BPA) is a server management tool that can help you implement best practices in the configuration of your Active Directory environment. AD DS BPA scans the AD DS server role as it is installed...

Although some versions of Active Directory Users and Computers (dsa.msc) may expose a schema option to add Managed Service Accounts (msDS-ManagedServiceAccount). You should not use this option. This option is exposed because it is a schema option, but...

We finally published the procedures for allowing a user or group to logon locally (at the console) to a domain controller. All the administrative groups, like server operators, backup operations, account operations, and administrators have this right...

When you run adprep /forestprep, you are updating the Active Directory schema forest version. Several people have asked, what is the forest schema version for Windows Server 2008 R2. To learn more about adprep and forestprep and schema versions, read...

A TechNet Wiki topic regarding Kerberos error 0x7 has just been posted http://social.technet.microsoft.com/wiki/contents/articles/kerberos-error-code-0x7-kdc-err-s-principal-unknown.aspx based on the popularity of the forum thread http://social.technet...

While this has been true for a while, I figured that it is worth mentioning that if you are running Windows 7, you can download the Remote Server Administration Tools (RSAT) for Windows 7 . If you’ve used the Administration Tools for Windows XP (Adminpak...

We have published a new topic and script about how to test an Active Directory schema extension for potential conflicts before you apply the extension. The topic is http://technet.microsoft.com/en-us/library/testing-for-active-directory-schema-extension...

We have updated the TechNet article, Technologies for Federating Multiple Forests , to include the prerequisites for employing Kerberos over external trusts. Highlights of the updates from the article are: The trust has to be created using the fully...

Accidental deletion of Active Directory objects is a common occurrence for users of Active Directory Domain Services (AD DS) and Active Directory Lightweight Directory Services (AD LDS). In Windows Server 2008 Active Directory domains, you could recover...

Windows Server 2008 R2 domain controllers include a new feature named Offline Domain Join. A new utility named Djoin.exe lets you join a computer to a domain, without contacting a domain controller while completing the domain join operation, by obtaining...

Last night I published an article titled Service Principal Names (SPNs) on the TechNet Wiki. Actually, I've been working on it on and off this entire week. This is something I was asked to do a while ago by Customer Support Services (CSS). The goal of...

If you are looking to sysprep your computers to remove the unique information, you can find sysprep in its new location under the %windir%\system32\sysprep folder. There isn’t much to the interface, but if you are just trying to remove the unique information...

The DS forum posts, Netlogon error 5719 and Event 5719 Netlogon Problem , have been consolidated into the following TechNet Wiki article: Event ID 5719 source Netlogon (dsforum2wiki) Please look the article over and let us know what you...

We have published a topic that explains how to upgrade domain controllers to Windows Server 2008 and Windows Server 2008 R2. This topic is based on customer experiences that have been resolved by Microsoft Customer Support. It covers how to prepare for...

I was reminded of the infamous forward link 5171 today. We had quite a time figuring out all the circumstances in which people were getting this message with the following words "This condition may be caused by a DNS lookup problem" and then displayed...

Breaking guidance change: Although you can use Setspn -A , you should use Setspn -S instead because -S will verify that there are no duplicate SPNs. However, if you are using Windows Server 2003 or earlier, you will not be able to use the -S switch because...

I've seen several posts on the new "authentication assurance" feature coming in Windows Server 2008 R2. The term we decided to go with is authentication mechanism assurance because it is actually the authentication mechanism that is assured. Authentication...

TechNet had duplicated content about Active Directory functional levels. The duplication caused inconsistencies as one location got updated but not the other. So the duplication has been eliminated, but I am told it has made it harder to find for some...