Kerberos fallback to NTLM

Ravindra Pamidi — Thu, 19 Mar 2009 13:26:00 GMT

Scenario: Case where NTLM is chosen instead of Kerberos as the authentication protocol and how SPNego Logging was used to trace the source of the problem. Environment: Windows Server 2008 / IIS 7.0 / SharePoint 2007 all running on the same server...(read more)

Dcdiag NcSecDesc test failure on Windows 2008 Domain Controllers KB published

Ravindra Pamidi — Wed, 04 Feb 2009 18:41:00 GMT

We now have a KB article 967482 published regarding the NcSecDesc error described in my earlier post. Dcdiag fails for NCSecDesc test on Windows 2008 Domain Controllers http://support.microsoft.com/default.aspx?scid=kb;EN-US;967482...(read more)

Windows Server 2008 Domain Controllers fail NcSecDesc (Naming Context Security Descriptors) test when dcdiag is run

Ravindra Pamidi — Wed, 15 Oct 2008 02:45:00 GMT

We are increasingly beginning to see customers calling us regarding the following error . I thought it would be best to blog it for benefit of others.

Scenario:

You have a minimum on one Windows 2008 Domain Controller deployed in a Windows 2003 Domain. When you run dcdiag on or against a Windows Server 2008 domain controller, the Naming Context Security Descriptors (NcSecDesc) test fails. The test passes for Windows Server 2003 domain controllers in the same domain.

Starting test: NCSecDesc

Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have

Replicating Directory Changes In Filtered Set

access rights for the naming context:

DC=DomainDnsZones,DC=CONTOSO,DC=COM

Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have

Replicating Directory Changes In Filtered Set

access rights for the naming context:

DC=ForestDnsZones,DC=CONTOSO,DC=COM

......................... DC2K8001 failed test NCSecDesc

If you have not run adprep /rodcprep, dcdiag.exe returns an error when it runs the NCSecDesc test. This test checks that the security descriptors on the naming context heads have appropriate permissions for replication. The error indicates that the Enterprise Domain Controllers group does not have Replicating Directory Changes In Filtered Set access rights for the DNS application directory partitions.

If you do not plan to add an RODC to the forest, you can disregard this error. If you plan to add an RODC to the forest, you must run adprep /rodcprep.

More Information:

Known Issues for Installing and Removing AD DS

http://technet.microsoft.com/en-us/library/cc754463.aspx

Ravindra Pamidi's Blog

Kerberos fallback to NTLM

Dcdiag NcSecDesc test failure on Windows 2008 Domain Controllers KB published

Windows Server 2008 Domain Controllers fail NcSecDesc (Naming Context Security Descriptors) test when dcdiag is run