AD DS operation failed - Dcpromo error - FSMO role broken

I was about to remove a domain controller of a customer so many times before when the error below appeared.

Active Directory Domain Services Installation Wizard
---------------------------
The operation failed because:

Active Directory Domain Services could not transfer the remaining data in directory partition DC=ForestDnsZones,DC=company,DC=com to
Active Directory Domain Controller \\DC.company.com.

"The directory service is missing mandatory configuration information, and is unable to determine the ownership of floating single-master operation roles."


Very strange considering that running "netdom query fsmo" gives the result that one of the other domain controllers owns all FSMO roles. The Event Viewer is in this case your best friend.

Log Name:      Directory Service

Source:        Microsoft-Windows-ActiveDirectory_DomainService

Date:          2014-02-01 14:44:13

Event ID:      2091

Task Category: Replication

Level:         Warning

Keywords:      Classic

User:          ANONYMOUS LOGON

Computer:      DC.COMPANY.COM

Description:

Ownership of the following FSMO role is set to a server which is deleted or does not exist. 

   

The DC mentioned in the Event Viewer warning was an old Windows Server DC removed more than 5 years ago!

Let's move on, make sure to open ADSIEdit on the affected FSMO Role owner and make the necessary changes there.


How to obtain the correct setting:

1. On the affected role owner open ADSIEdit.
2. Click on Default Naming Context [DC.Company.Com].
   
3. Click on DC=Company,DC=Com.
4. Double click on CN=Infrastructure at the bottom of the list of folders.
5. Locate the fSMORoleOwner attribute and click on it.
6. Click the Edit button.
7. CTRL+C to copy the contents of the attribute.
8. Click CANCEL twice.

1. Correct the problematic settings:
   1. Right click the ADSI Edit root and click on Connect to…
   2. Use the following connection point:
      1. DC=DomainDNSZones,DC=Company,DC=Com
         
   3. Click on Default Naming Context [DC.Company.Com] to populate it.
   4. Click on DC=DomainDNSZones,DC=Company,DC=Com folder.
   5. Double click on CN=Infrastructure.
   6. Locate the fSMORoleOwner attribute and click on it.
   7. Click the Edit button.
   8. CTRL+V to paste the correct setting.
   9. Click OK and then Apply.
   10. Repeat steps 2.1-2.9 to correct DC=ForestDNSZones,DC=Comapny,DC=Com.

Once the above steps were completed on the FSMO Role owner for Infrastructure I was able to properly demote the DC.

Event ID 12339 and 12344: File Server Resource Manager failed to find claim list

Problem: You are running a Windows Server 2012 file server and you see the error messages in your logs every 15 minutes or so.

1) Event ID: 12339
File Server Resource  Manager failed to find the claim list 'Global Resource Property List' in Active Directory (ADsPath: LDAP://dc1.domain.local/CN=Global Resource Property List,CN=Resource Property Lists,CN=Claims Configuration,CN=Services,CN=Configuration,DC=domain,DC=local).  Please check that the claims list configured for this machine in Group Policy exists in Active Directory.
 2) Event ID: 12344
File Server Resource  Manager finished syncing claims from Active Directory and encountered errors during the sync (0x80072030, There is no such object on the server.) Please check previous event logs for details.

Solution: You can either upgrade the Active Directory schema to version 56 (Windows Server 2012) or safely ignore the error messages.

If you can update the schema of your domain. Follow these steps:

1)
 log on to Windows Server 2012 as Administrator of your domain
2)
 Copy from "support \adprep" in the media of Windows Server 2012 to "c:\"
3)
run this command
 c:\adprep\adprep.exe /forestprep

Unable to delete a DC - dcpromo error

Deleting a DC is most of the time a rather straightforward procedure but a few weeks ago i received the error message below trying to uninstall a customers DC.

"The operation failed because: the attempt at remote directory server serverx.customerdomain.local to remove directory server CN=ServerX,CN=Servers,CN=customerdomain,CN=Sites,CN=Configuration...
was unsuccessful. "Access is denied"

The account which i was running dcpromo with was both Domain Admin and Enterprise Admin, i could ping the other DC's, i checked with ADSI edit that my account had the rights to delete the DC. Everything seemed ok.

So what was the problem? I had a look in Sites and Services and found the solution to my problem. The DC had the checkbox "Protect object from accidental deletion" ticked. I unchecked the tickbox and could then run the dcpromo without any problems.

How to configure NTP server for Windows Server 2008 R2

To configure the NTP server in Windows is not exactly complicated, but because you get various different suggestions when googling I thought I would just write a short tutorial that I know works. Instruction is verified on Windows Server 2008 R2. What is needed is essentially three short lines:

w32tm /config /manualpeerlist:pool.ntp.org,0x8 /syncfromflags:MANUAL
net stop w32time
net start w32time

Don't forget to disable time sync if you have virtual server.

Which NTP Server should you choose? Or should you choose several? Yes, redundancy is never wrong, and considering how easy it is to set up several, it is preferred. SP Technical Research Institute provides a free time sync service.

So, tell me. Give me an example. Coming below ...
Run the following in a elevated command prompt:

w32tm /config /manualpeerlist:"ntp1.sp.se,0x8 ntp2.sp.se,0x8" /syncfromflags:MANUAL

net stop w32time
net start w32time

P.S. One tip is of course to check the system log afterwards to see that the time sync seems to work.

How to export a list of users from an Active Directory group

Every now and then you will come across these little annoying problems while working with Active Directory, which should be easy to solve but requires special tools, for example, that there is no way to export all members of a group in Active Directory Users & Computers . That's when "dsquery" and "dsget" comes into the picture. Here is how to list all members of a particular group.

List all members of the group "MYGROUP":

dsquery group -name MYGROUP | DSGET group -members

You can always send the results to a text file by adding  "> mygroup-members.txt" in the end.

Automatic creation of user folders for home, roaming profile and redirected folders

Every now and then I get the question: "how do you automatically create user home folder, roaming profile and/or redirected folders?". Luckily, Microsoft Directory Services team posted a very good article on this.

http://blogs.technet.com/b/askds/archive/2008/06/30/automatic-creation-of-user-folders-for-home-roaming-profile-and-redirected-folders.aspx

How to install network shared printer in Windows 7 without admin rights

In Windows XP, you can install a network printer as a "normal" user but not in Windows 7. Windows 7 and Windows Server 2008 R2 requires that the printer installation package is digitally signed or built into Windows. This means that most printers can not be added by a normal user without administrator rights on their computer. Microsoft has written an excellent article on how to make a Group Policy that allows ordinary users with Windows 7 to install the printer without having to be an administrator on their computer.


http://technet.microsoft.com/en-us/library/cc753269.aspx

How to manage KMS activation in an environment with multiple domains

To successfully launch a KMS server is usually pretty straightforward, but if you have multiple domains that KMS server needs to handle. How do you do? That has Shariq Sheik written a good article about.

http://www.shariqsheikh.com/blog/index.php/201008/can-one-kms-server-activate-clients-in-multiple-domains/