Questions[dcpromo](server)

Setup first: I had a Windows Server 2008 domain for testing. The PDC died a horrible death, I was able to seize most FSMO roles (but not all) and drop them on another DC, but missed the RID Master role (if I recall correctly). The machine was shaky, though - it would lock up tight if someone tried to access a file via SMB, though Explorer, FTP, and CLI were fine - so it was not a good option for long-term DC operation. I have a Server 2019 instance that I'm also using for testing, so I moved it into the domain and added the active directory functions to it; on reboot it wanted to be made into a DC as they do. Trying to make it into a DC failed because it couldn't reach the dead PDC to get the RID Master information. I went back and read the articles I'd been following, found that it wasn't enough to be in the admin group, to seize the RID Master role I actually had to be logged in as Administrator, so tried that, seized RID Master onto the 2008 server, rebooted the 2019 server, told it to upgrade itself to DC, and sat back and waited.

And waited.

And waited.

It has now been nine days and the 2019 server is still "configuring this server to be a domain controller" and spinning its little progress bar. The Cancel button is, of course, grayed out. Can anyone suggest a next thing to do? Or is my entire domain now fatally hooped?

I've already taken a look at these questions:

• Migrate Windows Server 2008 to another server
• Migrate Windows Server 2008 to a new hard disk
• Migrate Windows Server 2008 to a new hard disk 2

But I don't think they solve my situation.

I have a 32-bit installation of Server 2008 on an old Dell Dimension 3000. It's been slowly dying the past few years, and it's time to get rid of it. I also have a Dell PowerEdge 2950 with Server 2008 Standard 64-bit on it, which I want to use to replace the Dimension 3000.

The old server is acting as a DNS server, DHCP server and Domain Controller. How can I migrate this configuration to the PowerEdge? It looks like the full backup option won't work, since the source is 32-bit and I'd like to keep the PowerEdge on 64-bit. Is there a tool I can use for this or do I need to reconfigure manually?

My organization used to have a Windows 2000 Server Ed. Domain Controller with DNS role also installed. It serviced 5 other servers and about 15 workstations. A few months ago, the motherboard went out and as it was a fairly old server anyway, my supervisor proposed we install a newer version of Windows Server (finally!) on an Intel NUC5i3MYHE we had just purchased, with the intent of installing some light server roles on it (fileserver, DNS, internal webserver, etc.).

The install of Server 2012 R2 on the box went smoothly, as did adding AD DS and DNS roles, and promotion to domain controller (since the existing domain was now offline due to the old server failure, I set the new DC up as the same domain name, and selected the option "New Forest" during dcpromo.exe).

The first time I put the new DC on the LAN, we had problems with people not being able to log into their computers. I realized my mistake (I have a pretty hectic avg. workday), not setting up the User Accounts in AD, and so promptly took it offline, at which time my end-users were able to log back into their workstations using their old accounts (cached on their local computers as "Offline Files"). For the record, I have not set up forward and reverse lookup zones in DNS yet. As I understand, I need AD DS working first and it is apparently not working (100%, anyway).

A couple days later, I got everyone set up with their same usernames they had had before the original DC crashed, with some requiring new passwords to meet complexity requirements. Here's where the snag is.

The EU's who already had passwords that met the complexity requirements had no problems logging in using their classic passwords. But for those whose password was required to change, they get a message when logging in w/ their old account, something to the effect of "Please lock this computer and sign in using the current domain credentials," which they try, but their machines (XP SP3 and W7, Pro Eds) will not let them in w/ the newly-created passwords, using their classic usernames.

I really do not want to set up a whole new round of usernames and passwords for each user, but I fear that the ones whose passwords did not change aren't logging into the new DC at all, but rather their old "Offline Files," and the users whose passwords did change, are able to access Desktop/My Docs, but only by entering their classic password and accessing the locally cached offline files as well.

FWIW, I noticed in my event log on the new server, Error ID 4013, which I found some info on here: https://technet.microsoft.com/en-us/library/cc735842(v=ws.10).aspx

...but when I follow the link for AD DS Troubleshooting found there, it takes me to a generic "Windows Server 2003/2003 R2 Retired Content" page, which is peculiar because it was a 2012 R2 machine that generated Error ID 4013 and yes, it was the correct one on the link (matched verbiage from my server).

I have tried logging in and out several times on several workstations, w/ various credentials and no luck, I can only get on the domain w/ the old passwords. If anyone can point me in the right direction, I'd be very grateful, I really don't deal w/ AD DS that much as my role in the company has shifted over the years from Network Admin to more of a Web Dev kind of role. I have Event Logs I can give you all, if that will help, the other warnings were RE: ADWS (Web Services) which I'm not sure is helpful, so I didn't include it, but let me know! Thanks in advance for your suggestions!

Running in to an issue at a new location with promoting a new domain controller. We will call the new server "newserv".

Error is - "An Active Directory domain controller for the domain "mydomain" could not be contacted." -

• newserv can ping domain controllers by FQDN (ie DC1.mydomain)
• newserv cannot ping domain controller without .mydomain
• NSLOOKUP on newserv shows default server as PDC.mydomain
• NSLOOKUP set type=all --> _ldap.tcp.dc._msdcs.mydomain shows all SRV service locations, with correct ip addresses.
• newserv has static ip, primary and secondary DNS pointing to DC1.mydomain & DC2.mydomain
• If I just try to join the domain, the error details state the SRV record query shows all of my domain controllers, however they could not be contacted.

Some things i've tried, other notes;

• I've tried setting primary DNS to point to itself.
• I've tried adding DNS suffix "mydomain" under advanced DNS settings.
• newserv can join different domain no issue.

• My domain does not have a suffix. It is just "mydomain" - I've run in to issues with this with joining MAC OS to the domain in the past.

• Server is a Virtual Machine running in HyperV which is joined to a different domain.

I'm imagining this might be some kind of DNS issue, but I don't know where to start in addressing it.

Any help greatly appreciated.

I'm opening a new site (physical and logical) in my international Windows domain.

The site is connected to the main office by a VPN over a slow connection (I'm using pfsense as my main router and ClearOS as my VPN manager, which is the same setup I use at all my sites). I can't do anything about improving the connection at the moment.

I've just setup two brand new physical machines, each running an instance of a brand-new clean install of Windows Server 2012 R2 (with all updates) on top of VMware ESXi 6 (again, this is the same at all my sites, except some are running ESXi 5.5 and some are running 6).

When I try to promote the servers to Domain Controller, I am getting the following error:

The wizard cannot gain access to the list of domains in the forest.

Clicking on Show more gives me the following details:

This condition may be caused by a DNS lookup problem. For information about troubleshooting common DNS lookup problems, please see the following Microsoft Web site: http://go.microsoft.com/fwlink/?LinkId=5171

The error is: The RPC server is unavailable.

Following the recommendations here https://technet.microsoft.com/en-us/library/cc526682.aspx, I have tried issuing the commands ipconfig /registerdns and ipconfig /flushdns and then trying the promotion again, to no effect.

Some additional "symptoms" of my slow connection:

1. The above error take about 5 to 10 minutes to appear after attempting the initial step of the promotion process (in another question I posted that the process was hanging, but I simply wasn't waiting long enough).
2. I successfully joined both servers to the Domain, but one took about 5 minutes to join and the other took about 10 minutes to join.
3. After joining the Domain, I had to reboot and then I logged in as a Domain Admin user. Logging in took about 10 minutes on one machine and 20 minutes on the other machine.
4. All that said, I can ping the remote DC in the main office continuously (over the VPN, using the local IP) with no problem. Average ping is around 250ms. The ping is not the problem, it is the bandwidth over the local DSL connection which is about 5mbit down and 750kb up, but shared amongst the entire office of about 10 users.

Here are some additional errors from my event viewer:

DFSR Event 1202: (On one machine only)

The DFS Replication service failed to contact a domain controller to access configuration information. The service will try again during the next configuration polling cycle. This event can be caused by TCP/IP connectivity, firewall, Active Directory Domain Services, or DNS issues.

Group Policy Preprocessing Event 1006: (On both machines)

The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). Look in the Details tab for error code and description.

Can anyone give me any troubleshooting clues on how to figure out why I can't successfully promote these servers to DCs? I've used almost this identical setup in a dozen different branches around the world with no problems, so I'm thinking this must be something unique to the local connection...