Sign in
AD Troubleshooting
AD and Domain-related issues and troubleshooting methods for Active Directory.
Tags
ADCS
ADFS
Anecdotes
Architecture
CA Server
CLM / ILM
DFS
DFSN
DFSR/FRS
FIM
FIM CM
Kerberos
Logon performance
Musings
Pages
PKI
POC
PowerShell
Replication
RODC
Smartcards
Troubleshooting Active Directory
Windows 7 / W2k8 R2
Windows 8
Windows Server 2012
Browse by Tags
TechNet Blogs
>
AD Troubleshooting
>
All Tags
>
troubleshooting active directory
Tagged Content List
Blog Post:
Why am I seeing LsaSrv 45058 events on my client?
Ingolfur Arnar Stangeland
From Julio: I recently installed a new server running Windows 2008 R2 (as a DC) and the related computers running Windows 7 Pro. The computers are joined to the domain. In a computer, which is shared by two users (userA and UserB), I see the following event on the Event Viewer while userA was logged...
on
15 Nov 2012
Blog Post:
Why doesn't a user get locked out after a number of invalid password attempts greater than the domain account lockout policy?
Ingolfur Arnar Stangeland
We have an account lockout policy of 5 bad password attempts but we're seeing users presenting bad passwords up to several thousand times in the span of a 15 minutes. I'm concerned about whether the policy is active or if we have a possible brute force password attack being attempted. After...
on
17 Sep 2012
Blog Post:
How to bulk create 10000 users and groups for your test environment
Ingolfur Arnar Stangeland
For test lab scenarios where you quickly want to add a few thousand users you can run the following batch files in a DC: :Creates 10000 disabled user accounts with password Password1 For /l %%t IN (1,1,10000) do net user BulkUser%%t Password1 /add /PASSWORDREQ:YES /ACTIVE:NO :Bulk create 1000 groups...
on
20 Aug 2012
Blog Post:
ADFS case sensitivity
Ingolfur Arnar Stangeland
ADFS is case-sensitive for the most part - but there are some sections of ADFS 2.0 where you might not need an exact match. In general you should however still try to make sure you both compy with the standard format for public attributes and settings and maintain consistency when referring to internal...
on
8 May 2012
Blog Post:
I'm your Clone Baby DC
Ingolfur Arnar Stangeland
While doing some research on whether servers with identical Sids (I.e. that have been cloned without Sysprep) propose either a security risk or an operational risk I came across the following blog entry by Mark Russinovich (Dark Lord of the Sid). The essence of it is as follows (I love summarizing...
on
24 Apr 2012
Blog Post:
PreferLogonDC issues on W2k8 R2 DC's
Ingolfur Arnar Stangeland
A hotfix has recently been issued that resolves an issue where the Windows 7/Windows 2008 R2 client "forgets" its dynamic site name during the startup sequence. The net effect of this being that the client always makes additional generic DNS queries which return non-site specific DC names back to...
on
15 Apr 2012
Blog Post:
Deconstructing the KDC certificate processing functionality
Ingolfur Arnar Stangeland
For a DC to be able to service smartcard logons the DC must have a valid and suitable certificate present in the personal store of the computer account. This is typically autoenrolled for whenever a Windows CA server has been installed into the AD environment. The KDC service on W2k8 R2 monitors the...
on
2 Feb 2012
Blog Post:
Changing the Primary Domain DNS name of this computer to "" failed.
Ingolfur Arnar Stangeland
This is a bogus error message that can be safely ignored - it's caused by the domain join code ending up in a function which it doesn't need to run anyway during a domain join operation using the GUI. What's failing is the attempt to change the Primary DNS suffix of the machine after the domain join...
on
14 Jan 2012
Blog Post:
Primers for building a highly available Active Directory environment
Ingolfur Arnar Stangeland
Notes from the field on things to consider with regards to maintaining Active Directory: Hardware Diversity - this includes virtualization and SAN's. Read the official Microsoft notes on virtualization recommendations in the Technet article and KB below. DC's are designed to be redundant and distributed...
on
5 Jan 2012
Blog Post:
For configuration <CAName>, Online Responder revocation provider either has no CRL information or has stale CRL information
Ingolfur Arnar Stangeland
This is typically related to the CRL's of the issuing CA or Root CA having expired in their current CDP location. To resolve it check that all CA's are able to publish base CRL's and Delta CRL's to the locations defined on the OCSP Responders cert for that configuration. Another scenario is if...
on
9 Dec 2011
Blog Post:
Cached logons and CachedLogonsCount
Ingolfur Arnar Stangeland
A co-worker of mine had a case with the following description: We've set the CachedLogonsCount registry value to 1 on our workstations because we want to limit the number of cached user logons in the LSA cache on the system. However, this seems to have the side-effect of sometimes making it impossible...
on
6 Dec 2011
Blog Post:
SENS and Sensibility
Ingolfur Arnar Stangeland
SENS is an acronym for the System Event Notification Service. On Windows XP/W2k3 SENS is baked into Winlogon - in Vista+ it is a separate service hosted by one of the svchost.exe instances on the system. SENS is purely informational and reactive - other components subscribe to SENS notifications...
on
25 Nov 2011
Blog Post:
The return of PAC-mania [AKA some reasons why PAC verification can fail]
Ingolfur Arnar Stangeland
There's tons of good stuff out there on Kerberos PAC verification - but with current trends showing an increase in incoming cases related to this type of issue I though it would do me good to brush up on this and link the most relevant articles together. In short; PAC verification is the process where...
on
14 Nov 2011
Blog Post:
Bad Data error message in FIM CM web portal
Ingolfur Arnar Stangeland
A customer with a FIM CM installation called in with the following problem description: We have an issue with our FIM CM portal where some smartcards are failing unblock or retire operations. Some cards are working fine but others give a "Bad Data" error message when a management operation is attempted...
on
17 Oct 2011
Blog Post:
CAPI2 event ID 11 retake
Ingolfur Arnar Stangeland
A customer put the following questions to one of my colleagues: On a lot of our Windows 7 clients we've noticed they periodically try to download a CAB file from Windows Update , but as our workstations are required to access the Internet via Proxy and they aren't able to authenticate against it the...
on
27 Sep 2011
Blog Post:
The return of the son of Visio Network Topology Diagrammer
Ingolfur Arnar Stangeland
The Microsoft Active Directory Topology Diagrammer is back in a fresh new release from June 2011, a must-have tool for anyone with an AD infrastructure beyond the basic setup that wants to get a birds-eye view of their AD topology with the click of a button. Requires Microsoft Office Visio and lots...
on
12 Sep 2011
Blog Post:
Using Wevtutil to capture and view the CAPI2 Operational log
Ingolfur Arnar Stangeland
CAPI2 events are logged to Application Logs\Microsoft\Windows\CAPI 2\Operational. However, CAPI2 logging is off by default due to performance reasons. To enable CAPI2 Operational logging, wevtutil.exe sl Microsoft-Windows-CAPI2/Operational /e: true To clear the log so we only get the...
on
9 Sep 2011
Blog Post:
Massaging the XP registry for logon performance
Ingolfur Arnar Stangeland
There are two registry settings on Windows XP clients that have been observed to be key catalysts for slow boot/slow logon scenarios (also referred to as SBSL). On the Windows XP side (SP3 must be present on all clients): Turn on opportunistic locking on the XP clients: - Review http:...
on
29 Aug 2011
Blog Post:
How to create 1 million OU's and linked GPO's using PowerShell
Ingolfur Arnar Stangeland
If you find yourself with a dull moment on a Monday afternoon and feel like capacity testing your test lab with a large number of OU's and GPO's - then the following PowerShell script is for you. Note: *Don't* run this in a production environment - this is for testing purposes only. Sample PowerShell...
on
23 Aug 2011
Blog Post:
Credential Roaming and NTDS.dit bloat
Ingolfur Arnar Stangeland
Following up on a previous post about Credential Roaming (aka DIMS): http://blogs.technet.com/b/instan/archive/2009/05/26/considerations-for-implementing-credential-roaming.aspx With a recent DCR to Windows 7 & W2k8 R2 ( http://support.microsoft.com/kb/2520487 ) it is now possible to filter out...
on
14 Jun 2011
Blog Post:
ADCS CA Server disaster recovery steps when smartcard logon is required but no valid CRL can be published
Ingolfur Arnar Stangeland
Consider the following disaster recovery scenario: The CA has become temporarily unavailable, the current CRL and Delta CRL have expired and revocation checking is failing which is preventing smartcard logons. You have the private/public key pair of the CA certificate available and...
on
23 May 2011
Blog Post:
Why can't I see my local smartcard readers when I connect via RDP?
Ingolfur Arnar Stangeland
The way smartcard redirection works is that there is a code snipped in Winscard.dll that is only invoked at the point in time when it loads. If Winscard is being loaded in a Terminal Session - all calls to that specific instance of Winscard are redirected to Winscard.dll on the host initiating...
on
27 Mar 2011
Blog Post:
Smartcard Redirection Diaries
Ingolfur Arnar Stangeland
Last month we finally closed two bugs that I've been engaged in on and off for well over a year and released two related hotfixes in the February hotfix release batch. In late 2009, our Professional Support team got the following case from one of our ISV Partners (an established provider of security...
on
24 Mar 2011
Blog Post:
Automatic logon to RDS using Smartcards with multiple certificates (with or without TS Gateway)
Ingolfur Arnar Stangeland
Got the following escalation recently from a customer that was implementing TS Gateway and smartcards with multiple logon certificates: When we connect with RemoteApp from our external workstations to the internal Terminal Server SSO seems to work fine if there is only one logon certificate present...
on
27 Jan 2011
Blog Post:
DCDIAG and the Not-N'sync Home Server
Ingolfur Arnar Stangeland
A customer called in with questions about the following error she received in Dcdiag: I ran DCDIAG /V /E /C and found these errors at the end of it: Starting test: Intersite Doing intersite inbound replication test on site Contoso-HQ-CHI: Locating & Contacting Intersite Topology Generator (ISTG...
on
12 Jan 2011
Page 1 of 3 (69 items)
1
2
3