Param's questions

I have a domain controller running Windows Server 2008 R2 Standard.

Question:

Are all Windows 7 Group Policy objects applicable to Windows 8 and Windows 10?

OR

Do I need to create a separate policy for Windows 8 and Windows 10 PCs on the Windows Server 2008 R2 Standard domain controller?

Recently, I changed wallpaper on the group policy but it has not been reflected on Windows 10 PCs.

What do I need to do to resolve this issue? Do I need to migrate my domain controller to Windows Server 2012 to resolve this problem?

I need to find out the time it takes to resolve DNS for a specific website.

For example: I need to find out in how many milliseconds it takes to resolve abc.com using the 8.8.8.8 global DNS server and using the local DNS server.

Can I get this information using the nslookup command? I tried this but it doesn't show the time taken.

Domain Controller: Windows Server 2008 R2 Standard

Client OS: Windows 7 Professional

Can we configure an NTP Server with authentication on Windows OS, i.e Windows Server 2008 R2 Standard or Windows 7 operating system?

I need to sync time securely for my Cisco switch and a router so that is the reason I need to configure secure the NTP server on Windows System.

On enterprise or medium size company where is DHCP server installed? What is normal practice followed, in terms of DHCP server?

Here, I have DHCP server installed on one of my core switch.

Problem which i face is that my domain controller which is also a DNS server, don't update, if I select dynamic update with secure only.

So I have to keep both — nonsecure & secure dynamic update on my DNS Windows server, which is risky.

Please help

I have two Domain Controller, both are DNS server and i have set Forwarder for both ( as per below Print-screen )

but i have not disable recursion on both server ( please see below print-screen )

there is one recommendation to disable DNS recursion. I think if i disable DNS recursion it will affect performance, but i also want to have best security placed. Please let me know what should i do? should i disable DNS recursion?

Server OS = Windows Server 2008 R2 Std ( Domain Controller )

Client OS = windows XP & 7

Whenever we add Laptop / Desktop in to Domain. After that if User want to have information of Certain Object / other Department Users information such as Email address, Department, mobile number, Job title etc.. He can easily get by running LDAP query right? Is there any way to protect such information? Please correct me if i am wrong?

I just want to know, which port need to be open if i place firewall between Windows Client ( XP or 7 ) and Domain Controller ( Window Server 2008 R2 )

Please note it is between Client and DC and not between DC to DC

I have searched on google, but in google the answer which i got is between Client as well as from DC to DC.

As per my finding I need to open.

1. TCP & UDP port 88 for Kerberos Authentication
2. TCP & UDP 389 for LDAP
3. TCP & UDP 445 for SMB/CIFS/SMB2
4. TCP and UDP port 464 for Kerberos Password Change
5. TCP Port 3268 & 3269 for Global Catalog
6. TCP and UDP port 53 for DNS
7. TCP and UDP Dynamic - 1025 to 5000 ( Windows Server 2003 ) & start from 49152 to 65535 ( Windows Server 2008 ) for DCOM, RPC, EPM

Let me know, if I'm missing something.

Note:- It's between Client and DC only.

Domain Controller: Windows Server 2008 R2

Client: Windows 7

For the past 3-4 days, I was trying to register some client desktops / laptops to get their DNS entry dynamically by various methods such as ipconfig /registerdns & re-adding to domain.

Still they didn't get registered with the DC (DNS manager). In the DNS, Dynamic updates is set to Secure only (It is an Active Directory Integrated Zone).

For testing, I changed the Dynamic update to Nonsecure and Secure and after running ipconfig /registerdns, it gets registered.

I don't understand why it doesn't get registered when Dynamic update is set to Secure only.

I know Secure only means it will register and update only if it gets authenticated.

But my question is the client desktop / laptop is already joined to a Domain and I also re-joined to the domain. Still it doesn't get registered in DNS (when Dynamic update is set to Secure only)

It's a security risk if I keep Dynamic update set to to Nonsecure and Secure.

Server OS - Windows Server 2008 R2 Standard

Client OS - Windows 7

WSUS Server Version - 3.2.7600.226

Around 4 days has been passed, still Windows Client is showing Last Status Report as 'Not Yet Reported'

I have run the wuauclt /detectnow command from 2nd day onward, still it shows the Last Status Report as 'Not Yet Reported'

Please see the print-screen for more Detail. and let me know Why? it is showing Report as 'Not Yet Reported' and what should i do, to resolve the issue.

Domain Controller - Windows Server 2008 R2 Standard

Client OS - Window Server 2003 ( Terminal Server )

I am unable to ping my Active Directory Domain Name i.e corp.abc.com. ( Please see the print-screen )

I am successfully able to nslookup & ping my DC server ip address ( Please see the print-screen )

I am also attaching print-screen of IP configuration.

Can you tell me why i am unable to ping, but successfully able to resolve through nslookup command and also able to ping with DC server ip address

Is there any way to automatically get an acknowledgment on the Domain Controller, as soon as a Group Policy Object (example: ABC) is applied to a PC on the domain?

Server OS: Windows Server 2008 R2 Standard Edition (Domain Controller)

Client OS: Windows XP or Windows 7 (Desktops and Laptops)

Using the Domain Controller, can I track how many PCs (Windows XP and Windows 7), a particular Group Policy Object is applied to?

I.e. As soon as one Group Policy has been applied, then, the PC must send an acknowledgement to the Domain controller that this policy has been applied.

We have approximately 500 desktops and laptops. Laptops may sometimes not be connected to the LAN.

Is there any way to accomplish this task using any software?

On a Windows Server 2008 R2 Standard Edition Domain Controller, with Windows 7 and Windows XP clients, is it "OK" to keep the setting below for Event Log files?

And which setting will apply? Between Maximum log size of 1 GB or Retain Log to 30 days, which will take precedence?

One Domain user with laptop is gone abroad. I had change some user policy for that Domain User. I have connected his laptop via internet through VPN to my Local Network.

I am getting the following error, when i am trying to update the policy, however i am able to successfully update the computer policy ( please see the print-screen )

" The processing of Group Policy failed. Windows could not resolve the user name. This could be caused by one of more of the following: a) Name Resolution failure on the current domain controller. b) Active Directory Replication Latency (an account created on another domain co ntroller has not replicated to the current domain controller).

To diagnose the failure, review the event log or run GPRESULT /H GPReport.html f rom the command line to access information about Group Policy results. "

I have checked through nslookup, i am successfully able to resolve my domain name. I have also added my FQDN in host file in his laptop. I can successfully ping my DC via ip address and via FQDN.

I have also checked that his Username is getting resolve via Security permission on folder ( ACL )

Please let me know where is the problem.

I have received lots of failure audits on my server. From the log, I have identified the particular machine that is the culprit. How can I identify which process is sending the login request?

Do you have any idea how to find out?

Below is the detail of the log.

Security log on \QKSRVDC212:

[2465151] Microsoft-Windows-Security-Auditing

    Type:     FAILURE AUDIT 

    Computer: QKSRVDC212.Corp.abc.com

    Time:     7/26/2012 9:31:00 AM   ID:       4625 

An account failed to log on.
  Subject:
    Security ID:        S-1-0-0
    Account Name:       -
    Account Domain:     -
    Logon ID:       0x0
  Logon Type:           3

  Account For Which Logon Failed:
    Security ID:        S-1-0-0
    Account Name:       Quality
    Account Domain:     QDMNT140

  Failure Information:
    Failure Reason:     Unknown user name or bad password.
    Status:         0xc000006d
    Sub Status:     0xc0000064

  Process Information:
    Caller Process ID:  0x0
    Caller Process Name:    -

  Network Information:
    Workstation Name:   QDMNT140
    Source Network Address: 10.1.1.185
    Source Port:        3973

  Detailed Authentication Information:
    Logon Process:      NtLmSsp 
    Authentication Package: NTLM
    Transited Services: -
    Package Name (NTLM only):   -
    Key Length:     0

Domain Controller OS: Windows Server 2008 R2
Client OS: Windows XP, Windows 7

• Windows XP client name: Client1
• Windows XP client name: Client2

I had login as abc.local\Q2020 on Client1 and accessing other Client2 shared folder via Start > Run > \\Client2

By defualt it is taking the Credential of the user which I have login i.e abc.local\Q2020, while accessing the shared folder on Client2.

I want that it must ask me a credential, so that i can give credential of different User, which has the rights of shared folder on Client2

Can you guide me - how can i give credential of different domain user while i am logged as abc.local\Q2020?

I've searched online, but am unable to find any information; why this error is occurring?

It has flooded my Event Viewer: with an interval of 1 minute, this Error keeps popping up. (i.e. the frequency is 1 minute)

I don't have any IIS installed.

This server is purely a Domain controller and no other role has been added.

Please suggest what should I do?

Server OS - Window Server 2008 R2 Standard Edition.

More details:

Log Name:      System
Source:        Schannel
Date:          6/28/2012 6:06:11 PM
Event ID:      36888
Task Category: None
Level:         Error
Keywords:      
User:          SYSTEM
Computer:      QKSRVDC212.Corp.abc.com
Description:
The following fatal alert was generated: 10. The internal error state is 1203.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Schannel" Guid="{1F678132-5938-4686-9FDC-C8FF68F15C85}" />
    <EventID>36888</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2012-06-28T12:36:11.801245500Z" />
    <EventRecordID>9305</EventRecordID>
    <Correlation />
    <Execution ProcessID="524" ThreadID="3516" />
    <Channel>System</Channel>
    <Computer>QKSRVDC212.Corp.abc.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="AlertDesc">10</Data>
    <Data Name="ErrorState">1203</Data>
  </EventData>
</Event>

Client OS - Window XP

Domain Controller:- Window server 2008 Standard R2

I had one Windows XP system. I want to find out when the system has started or boot ( at what time and date ). I don't know which parameter / word should I search for in Event Log.

For finding out shutdown time, I simply find the word "Shutdown" in Event Log.

Can you guide me which word should I should search for to determine Start up or boot time?

I want to accomplish the following task: A user must not have rights to save on their Desktop, My Documents, My Music, My Videos, My Pictures, etc.

I have already prevented and hidden all drives via GPO. However, user are still able to store files in the locations listed above.

Server OS: Windows Server 2008 R2

Client OS: Windows XP, Windows Vista and Windows 7

I just read the following article --

"In a domain, time synchronization takes place when Windows Time Service turns on during system startup and periodically while the system is running."

( http://technet.microsoft.com/en-us/library/cc779145%28v=ws.10%29.aspx )

From the above article i get to know that the first sync it take as soon as i start my system, but after that in how many minutes or second or in how many periodic interval my windows client ( Window XP, window7 or window server 2008 member ) synch with my Domain controller (PDC emulator )???

Do you have any idea, and how should i verify my synch time interval?

My Domain Controller is Window server 2008 R2 Standard

We can start 3 Remote Desktop sessions on Window Server 2003 without installing TS Licenses. (Two Remote Session (with mstsc) & third with mstsc /console or mstsc /admin i.e console session)

This no longer works in Window Server 2008.

It allows only to take two Remote Desktop sessions. When I go to start the third session with mstsc /admin, it ask me to disconnect one session.

How can I start a third remote session without installing TS Licenses?