We occasionally receive support calls which revolve around the topics of “why is the Active Directory database on DC A different in size than that on DC B?”. It’s easy to dismiss the question out of hand but there are real life scenarios where this can...

A while back I did a blog post regarding the user interface and settings for configuring a service account correctly to allow the more complex Kerberos delegation scenarios to take place. I recently had a customer issue I helped with that gave a...

Certificate Services in Server 2008 has had a lot of changes and enhancements. Some are obvious and documented well, and others are not obvious and not so well documented. Case in point is an additional aspect of Server 2008 certificate web enrollment...

We have internal discussion lists in Microsoft that act as clearinghouses for technical issues or hot topics. One of the first thing a fledgling or newly assimilated Microsoftie must do is decide what discussion lists to join for their role. I am...

I had some really good questions after the previous post and so I wanted to post the replies so all could see. Also, stay tuned for next week's post on the usage of /SHOWREPL before we move on to other topics. Thanks to Matheeshta and IanCurtis...

A few times of the past we’ve received calls from customers where they had some really interesting concerns with using smartcards for domain authentication. There’s some base knowledge to be had with respect to Kerberos. Just a quick mention-yes...

Occasionally I'll try to post about issues which are particularly time consuming or difficult. The main goal is to shortcut the Headache step in the Problem->Headeache->Resolution routine....

One of the more complex technologies that a Microsoft Directory Services specialist supports is Kerberos authentication. When Windows 2000 debuted this was something that was documented well in RFC and whitepaper, but perhaps not thoroughly understood...

A while back we had a customer contact us that was seeing something with authentication that they were struggling with understanding. They had a lot of small, remote sites where it was impractical to have a local domain controller. So each site...

We get some really unique issues at times that strain patience and understanding. With Kerberos this is doubly true since it is already as complex and extensible as any person could ever ask for. This one may be particularly interesting to those who are...

In my soliloquy of AD logon you heard some broad generalities intended to give a general understanding of the intended design and how it all fits together. In this post I hope to give you a more detailed idea of how it works. How to enable user...

One of the most exciting and fulfilling things that I get out of my job is the opportunity to resolve unique customer concerns and scenarios. I’ve said this before in prior blog posts, but this one in particular, I think, will illustrate that. One...

We had enough folks have trouble with this earlier this year that I wanted to take a moment to talk about Daylight Savings Time (DST). We’re about to have time changes in some regions so this is a hot topic right now for many people. Your first...

It struck me the other day what a statistical improbability it was that I haven’t really talked much about lingering object problems in AD yet in this blog. They are one hot topic to support people, even if they are not our most common problem. The hot...

Some readers may scoff a little when I talk about how under appreciated the whole Active Directory scheme is. Not schem a but scheme. I’m talking about the entire client and server interaction and how they work together to provide all of the distributed...

OK, well public hotfixes have always been a freebie if you first call into our support line to get them. However, now you can get the hotfix via the web. No fuss, no muss. Just go to this link and give the KB article number related to the hotfix...

I recently received a few questions from the blog. I usually ask if the person minds if I post the question and reply, and in this case the person said he didn’t mind. Special thanks to Matt Sinfield for his good question. Hopefully this will help...

One of the cool things about this job is the way we get to trail blaze new issues as they happen and before any solution or workaround is in sight. We’re the pioneers in a way. This is one example. We’ve had a few customer’s recently mention that...

Some of my colleagues recently had a real puzzler of an issue. When they are that good I want to share it out with everyone so that they don’t have to take the time themselves. The symptoms were when attempting to connect via terminal services from...

A while back I posted about troubleshooting a problem where a customer had seen a home grown application was not working as expected. The app was designed to run in a web site which the user would connect to from Internet Explorer on a client. The HTTP...

We have a lot of folks out there who use client side caching as a way to have consistent copies of the work they do as they travel and are not always well-connected to their corporate networks. If you redirect a folder like My Documents, such as...

Some of the fun we in product support have is that, once a new product is released nowadays, we get to chart the unexplored waters of new security settings interoperating with our customers real world environments. With Windows XP and Server 2003...

Kerberos delegation scenarios can be some of the most difficult problems for an admin to troubleshoot and resolve. Much of that has to do with the variety of services (also known as applications in non-Kerberos speak) which can be delegated to and from...

The last few posts we talked about authentication, specifically Kerberos. Some of the most lengthy support incidents we can see are the ones where our Directory Services folks are contacted by our SQL support team to assist with authentication failures. So let’s talk about troubleshooting those types of issue. Now, for those out there that have looked on the web on this topic, you know that there is some good info out there. I will discuss some of that, add some more, and tie it together a bit to make troubleshooting these issues more linear, less confusion....

A common thing we need to deal with as Directory Services people is difficulty adding a client as a domain member, also known as ‘domain join’. For Windows SKUs which support being a domain member this is the first step into having the computer take advantage...