InteXX's questions

I have two Windows Server DCs, SERVER3 and SERVER4. SERVER3 is the PDCe.

On SERVER3 I changed the DNS forwarders from my ISP to OpenDNS, expecting the change to automatically sync to SERVER4.

It's been over forty-eight hours now, with no sign of success.

How concerned should I be? Does this mean that my DCs aren't syncing correctly, or simply that forwarders aren't considered in a sync operation?

FYI I'm manually checking the sync status every so often using ADRST. (I'd love to automate that somehow, with emailed status reports, but such knowledge escapes me.)

Here's a small piece of my topology:

SERVER2   - ePDC           (SERVER 2016 Essentials)
SERVER3   - Peer DC        (SERVER 2022 Standard)
RECEPTION - Workstation    (Windows 10 21H2)

SERVER2 is down for a week, waiting on a part from Dell. In the meantime I'm on RECEPTION trying to browse to a share on SERVER3 so I can copy over some large files (USB2 only on that machine, so there's no hope of anything fast with that).

I'm getting this error on RECEPTION:

Windows cannot access \\SERVER3\Files
0x80070035
The network path was not found

or

Windows cannot access \\SERVER3\Files
0x00004005
Unspecified error

Things I've tried:

1. Turned off the firewall on SERVER3
2. Enabled SMB in Windows Features
3. Enabled Network Sharing/File Discovery on both SERVER3 and RECEPTION
4. Enabled and started all services mentioned here

I can ping SERVER3 from RECEPTION without any problem. This also occurs from other workstations in the LAN. For some reason I'm unable to get to SERVER3 via File Explorer.

What further do I need to do so that I can connect to SERVER3?

---- EDIT 2022-09-29 ----

I was able to bring SERVER2 (the PDCe) back online—the Dell parts are still on order, but it's in a VM and I was able to move it over to a temporary host—and suddenly the connectivity problem from the workstations to the DC peer SERVER3 abated.

I have no idea why this happened.

On my Hyper-V 2019 server, which is joined to the domain that's hosted on one of its VMs, I'm running on the 192.168.0.0/24 subnet. I'm setting up a demo of a new DC for a customer, so I need it to run on a different subnet, 192.168.4.0/24.

To accommodate this, I've created a NAT network following this guidance. It works. However, I'd like to go a step further than what the guidance provides for. I'd like to be able to RDP into the new server from within VMs on the 192.168.0.0/24 range.

The general concept for doing this seems to be addressed in this answer, and also in this guidance, but detailed how-to configuration steps elude me. Search results aren't turning up much beyond what I've already done.

I must admit that I haven't tried anything toward this, as I don't want to risk making a newbie-type mistake and fouling up what I already have that works. I hope to hear from the experts on this one, those who already know how to do it and can explain the necessary steps.

How can I allow access into VMs on the internal 192.168.4.0/24 range from VMs on the external 192.168.0.0/24 range?

Using MMC, I'm attempting to remotely manage the Windows Defender Firewall on our Hyper-V Server 2019 instance (no GUI, CLI only). The NetBIOS name is SERVER1.

The Windows Defender Firewall Remote Management rules are enabled:

Name                  : RemoteFwAdmin-In-TCP
DisplayName           : Windows Defender Firewall Remote Management (RPC)
Description           : Inbound rule for the Windows Defender Firewall to be remotely managed via RPC/TCP.
DisplayGroup          : Windows Defender Firewall Remote Management
Group                 : @FirewallAPI.dll,-30002
Enabled               : True
Profile               : Any
Platform              : {}
Direction             : Inbound
Action                : Allow
EdgeTraversalPolicy   : Block
LooseSourceMapping    : False
LocalOnlyMapping      : False
Owner                 : 
PrimaryStatus         : OK
Status                : The rule was parsed successfully from the store. (65536)
EnforcementStatus     : NotApplicable
PolicyStoreSource     : PersistentStore
PolicyStoreSourceType : Local

Name                  : RemoteFwAdmin-RPCSS-In-TCP
DisplayName           : Windows Defender Firewall Remote Management (RPC-EPMAP)
Description           : Inbound rule for the RPCSS service to allow RPC/TCP traffic for the Windows Defender Firewall.
DisplayGroup          : Windows Defender Firewall Remote Management
Group                 : @FirewallAPI.dll,-30002
Enabled               : True
Profile               : Any
Platform              : {}
Direction             : Inbound
Action                : Allow
EdgeTraversalPolicy   : Block
LooseSourceMapping    : False
LocalOnlyMapping      : False
Owner                 : 
PrimaryStatus         : OK
Status                : The rule was parsed successfully from the store. (65536)
EnforcementStatus     : NotApplicable
PolicyStoreSource     : PersistentStore
PolicyStoreSourceType : Local

However, when I click the Inbound Rules node, MMC crashes:

Not that it helps much, but here's the stack trace info:

FX:{b05566ac-fe9c-4368-be02-7a4cbb7cbe11}
Object reference not set to an instance of an object.
System.NullReferenceException
   at Microsoft.WindowsFirewall.SnapIn.Wrappers.FirewallRules.Reload(String[] ruleIdFilter)
   at Microsoft.WindowsFirewall.SnapIn.ExceptionsListView.Refresh()
   at Microsoft.WindowsFirewall.SnapIn.NativeMethods.EnhancedMmcListView`1.ForceRefresh()
   at Microsoft.WindowsFirewall.SnapIn.NativeMethods.EnhancedMmcListView`1.OnShow()
   at Microsoft.ManagementConsole.View.ProcessNotification(Notification notification)
   at Microsoft.ManagementConsole.ViewMessageClient.ProcessNotification(Notification notification)
   at Microsoft.ManagementConsole.Internal.IMessageClient.ProcessNotification(Notification notification)
   at Microsoft.ManagementConsole.Executive.SnapInNotificationOperation.ProcessNotification()
   at Microsoft.ManagementConsole.Executive.Operation.OnThreadTransfer(SimpleOperationCallback callback)

...and here's the Application event log entry:

As expected, the Security and Maintenance control panel is useless for this.

When I try this from another machine on the network, MMC doesn't crash—but the Inbound/Outbound rule lists stay empty. No relevant event log entries are produced there.

How can I track this down and fix it so I can remotely manage the server's firewall?

--UPDATE--

I just now got the MMC crash on the other machine.

I'd like to wire up a VM with LAN access but restrict it from accessing the Internet. I've come across a couple of comments—such as this one—indicating that this can be done via two NICs, but the exact configuration details are a bit hazy.

Here's some background on what's driving this effort:

A recent Windows Update (not sure which one) has toppled the mighty QuickBooks. I've been able to set it aright inside a new network-isolated Win10 VM, so as to prevent Windows Updates from shuffling in the door (I'll have to connect it briefly for activation, but oh well). It's presently at a patch level that's lower than the offending update, and I'd like to keep it that way—at least for the near-term future.

But frequent and repeated access via Hyper-V Manager is, well... cumbersome at best. If I were able to RDP into it, that'd also mean I could share local drive resources for manually copying various files back and forth.

For the automated nightly backups I can write a PowerShell script to do something like this:

1. Shut down the VM
2. Mount the VHDX
3. Use RoboCopy to sync a folder
4. Dismount the VHDX
5. Start the VM

The comment sort of hints that the setup is something easy to put together. Well... easy if you know how!

For example:

one in the isolated test and another in the production network

Is he talking VLANs?

Make sure both nics are set to not register in DNS

How does one accomplish this? Does he mean omit the DNS server entries on the NICs' IPv4 property sheets?

Just set a static record on each sides DNS

See above.

Is this what's called a 'DMZ?'

I know a little bit about DNS, but absolutely nothing about VLANs. Not that I'm against studying up on the wonderful topic, but I'm loathe to chase down rabbit holes to learn about something that may ultimately wind up not contributing to what I'm after. That's why I appreciate you fine folks so much—you actually know how to pull this stuff off, and what parts/pieces it takes to do it.

Shucks, I can't even figure out whether he's talking about standing up another VM in addition to my QuickBooks VM.

I've tried my due diligence, searching for solutions, but I'm afraid I'm not familiar enough with the terminology here to even know what to look for. Search results are coming up with how-tos for everything but. I was lucky to find the one that I did.

There's a ton of stuff out there about Copy-VMFile, but that flows the wrong way. I need guest-to-host, not host-to-guest. The search engines don't seem to be smart enough to figure this out from my keywords (e.g. hyper-v get files from isolated vm or hyper-v internal network access no internet). All links point to Rome, not from it. All links think I'm complaining about no Internet access. I'm not. I want to know how to restrict it ON PURPOSE.

I don't have time to wait for these two behemoths to slug it out. I need to keep moving and slip past the clumsy feet of the lumbering giants. This has already set me behind with my critical accounting work.

What steps (like you're coaching a beginner, please) do I need to take in order to build what he's talking about?

I used the guidance found here to add a set of firewall rules to my GPO. I performed these steps:

1. Exported all rules from my DC
2. Imported them into my GPO
3. Deleted the ones I didn't want
4. Applied the GPO to a LAN computer (gpupdate)

Unfortunately, instead of the existing rules being updated/enabled, I ended up with duplicate rules.

This Q&A proposes the same question, but the linked document in the answer doesn't explain how to update an existing rule—only how to create a new one. Nor am I finding anything for this in searches. The creation of new rules seems to be everyone's interest. But not in this case.

How can I use GPO to enable an existing predefined/stock rule, rather than create a duplicate?

I'm attempting a config-only VM export using this script, which was originally posted nearly ten years ago.

Hyper-V internals have clearly changed since then, as I'm getting an error message:

Failed to save with Error 'The device does not recognize the command.'

I'm not finding any indication as to what this command might be, for purposes of troubleshooting, but at first glance an apparent candidate is the ExportSystemDefinition() call:

$Out = $Service.ExportSystemDefinition($VM.Path.Path, $Target, $Export.GetText(1))

However, PowerShell IntelliSense completes for this method call. So it must be valid. It might be a Gen1/Gen2 thing, since Gen2 likely didn't exist back then (my VM is Gen2).

When I run the script $task.JobState equals 10, but I'm not sure what this error code is or how to look it up.

How can I get this to work?

I have this template installed:

However, it fails to appear in the editor:

I tried downloading and running the .MSI from here, but that didn't help matters.

This template appears to be installed correctly. How can I enable it in GPEdit?

I'm trying to normalize Item-Level Targeting for several GPPs that I've created. Manually slogging through each one via the GUI is just about the last thing I want to do. The terms tedious and error-prone come to mind.

I've been researching a way to script this, but alas I'm coming up empty.

Is there a way to get a list of GPPs that have ILT turned on, to include an output of each ILT configuration?

I'm running into an odd situation: domain group membership as reported by Group Policy differs from that of Active Directory.

DOMAIN\user.name was already a member of DOMAIN\some_group_1. I added it to the AD group DOMAIN\some_group_2. The command gpresult /v now reports that DOMAIN\user.name is NOT a member of DOMAIN\some_group_2, while the Active Directory Users and Computers snap-in clearly shows that it is.

Both groups have Global scope and were created using the WSE 2016 Dashboard.

This situation is preventing Group Policy Preferences from creating a registry entry for this user, an entry that's targeted for all users in DOMAIN\some_group_2.

Why isn't Group Policy picking up the new membership?

As an aside, Get-ADPrincipalGroupMembership user.name run at the DC reports that the user is a member of Domain Users only.

--EDIT--

I should clarify that I'm connecting to the domain using two computers via two methods: 1) LAN; 2) Remote VPN. The symptoms are identical on both connections.

After an in-place upgrade from TFS 2018 to ADS 2019, I'm in the process of migrating all of my TFS nomenclature to ADS. For example, the supporting service accounts have been changed from TFS_Service / TFS_Build / TFS_Reports to ADS_Service / ADS_Build / ADS_Reports.

I've completed all the service accounts and the Elastic Search extension as well (the index files were stored in D:\TfsData); I expect to have no difficulty with the DNS/ARR configurations.

However, I'm stuck on the Data Tier. My plans are to:

1. Install a new SQL Server instance
2. Point the Application Tier to the new instance
3. Restore from backup into the new instance

How can I edit the Application Tier to point to a new Data Tier? (It's currently at SERVER3\TFS and will change to SERVER3\ADS.) I'm finding documentation on migrating everything to new hardware, but nothing on simply pointing to a new Data Tier.

In Hyper-V 2016, I'm getting an error "Operation not supported" when attempting to move my VM configurations from a USB drive to the default folders. I have only one host machine; I exported them to the drive so I could perform some hardware upgrades that necessitated an OS reinstall. (The new disk array is still building, so I'll forego moving the VHDXs for now. The configurations are working, but I'd like to get them off the USB drive.)

The options I'm choosing are detailed in the screenshots below.

Things I've tried:

1. Shutting down the VM (An Ubuntu Server instance)
2. Moving just the main configuration, leaving out Checkpoints and Smart Paging
3. Running the migration in PowerShell

PowerShell:

$Path = "C:\ProgramData\Microsoft\Windows\Hyper-V"
Move-VM -Name "MATRIX" -DestinationHost "SERVER1" -VirtualMachinePath $Path -SnapshotFilePath $Path -SmartPagingFilePath $Path

This fails with the same error:

The operation is not supported.

How can I successfully move these configurations to their default locations on the Hyper-V host?

My Hyper-V host has two physical NICs; I've been running my VMs on one of them successfully for quite some time now.

I now have attached a NAS device to the second NIC. I followed the tip provided by longneck here, but unfortunately the NIC speed in the NAS steps down to the lowest common denominator—the older 10/100 switch that connects the host with the workstations.

So I've opted for #1 in his second tip, here. As anticipated, this enables me to connect to the NAS from the VM. However, the NAS can't connect to the Internet to receive OS updates, send email, etc.

At first I thought it might be due to multiple default gateways on the host, so I fixed that:

I also tried configuring a NAT network, as discussed here, and setting the gateway of NIC 2 to 192.168.3.1. But that requires multiple gateways on the host, so I probably shouldn't have expected it to work in any case. (And, since only a single NAT network is supported on a host, I had to temporarily remove my Docker NAT, a configuration I wouldn't have been pleased with.)

These are the NICs on the PDC VM:

The NAS can connect to the PDC VM and receive an IP configuration from DHCP:

I can ping the NAS from the host, as well as from the PDC VM:

192.168.2.1 is the LAN interface for our SOHO NAT router. I suspect this problem may have something to do with that—it's possible that the 192.168.3.0/24 subnet can't connect to the gateway for the 192.168.2.0/24 subnet.

Is this solved with something called 'routing?'

--EDIT--

I don't understand routing, although I did find a bit of an explanation here.

So I entered this command:

route ADD 192.168.3.0 MASK 255.255.255.0 192.168.2.1 IF 19

Here're the results:

    C:\Users\Admin>route print /4
===========================================================================
Interface List
  3...00 15 5d ea 3d 97 ......Hyper-V Virtual Ethernet Adapter #3
 19...54 9f 35 00 84 c0 ......Hyper-V Virtual Ethernet Adapter #2
  9...54 9f 35 00 84 be ......Hyper-V Virtual Ethernet Adapter
  1...........................Software Loopback Interface 1
 11...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
  7...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
 35...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.2.1     192.168.2.11     36
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    331
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    331
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    331
      172.17.48.0    255.255.240.0         On-link       172.17.48.1    271
      172.17.48.1  255.255.255.255         On-link       172.17.48.1    271
    172.17.63.255  255.255.255.255         On-link       172.17.48.1    271
      192.168.2.0    255.255.255.0         On-link      192.168.2.11    291
     192.168.2.11  255.255.255.255         On-link      192.168.2.11    291
    192.168.2.255  255.255.255.255         On-link      192.168.2.11    291
     192.168.3.11  255.255.255.255         On-link      192.168.3.11    281
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    331
        224.0.0.0        240.0.0.0         On-link      192.168.2.11    291
        224.0.0.0        240.0.0.0         On-link       172.17.48.1    271
        224.0.0.0        240.0.0.0         On-link      192.168.3.11    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    331
  255.255.255.255  255.255.255.255         On-link      192.168.2.11    291
  255.255.255.255  255.255.255.255         On-link       172.17.48.1    271
  255.255.255.255  255.255.255.255         On-link      192.168.3.11    281
===========================================================================
Persistent Routes:
  Network Address          Netmask  Gateway Address  Metric
          0.0.0.0          0.0.0.0      192.168.2.1       1
===========================================================================

C:\Users\Admin>route ADD 192.168.3.0 MASK 255.255.255.0 192.168.2.1 IF 19
 OK!

C:\Users\Admin>route print /4
===========================================================================
Interface List
  3...00 15 5d ea 3d 97 ......Hyper-V Virtual Ethernet Adapter #3
 19...54 9f 35 00 84 c0 ......Hyper-V Virtual Ethernet Adapter #2
  9...54 9f 35 00 84 be ......Hyper-V Virtual Ethernet Adapter
  1...........................Software Loopback Interface 1
 11...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
  7...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
 35...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.2.1     192.168.2.11     36
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    331
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    331
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    331
      172.17.48.0    255.255.240.0         On-link       172.17.48.1    271
      172.17.48.1  255.255.255.255         On-link       172.17.48.1    271
    172.17.63.255  255.255.255.255         On-link       172.17.48.1    271
      192.168.2.0    255.255.255.0         On-link      192.168.2.11    291
     192.168.2.11  255.255.255.255         On-link      192.168.2.11    291
    192.168.2.255  255.255.255.255         On-link      192.168.2.11    291
      192.168.3.0    255.255.255.0      192.168.2.1     192.168.3.11     26
     192.168.3.11  255.255.255.255         On-link      192.168.3.11    281
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    331
        224.0.0.0        240.0.0.0         On-link      192.168.2.11    291
        224.0.0.0        240.0.0.0         On-link       172.17.48.1    271
        224.0.0.0        240.0.0.0         On-link      192.168.3.11    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    331
  255.255.255.255  255.255.255.255         On-link      192.168.2.11    291
  255.255.255.255  255.255.255.255         On-link       172.17.48.1    271
  255.255.255.255  255.255.255.255         On-link      192.168.3.11    281
===========================================================================
Persistent Routes:
  Network Address          Netmask  Gateway Address  Metric
          0.0.0.0          0.0.0.0      192.168.2.1       1
===========================================================================

C:\Users\Admin>

But... still no success. My NAS still can't connect to the Internet.

--EDIT #2--

I should explain better what I mean when I say that the NAS 'steps down' to 10/100.

When I configure the cabling to include the Gb switch, as suggested by longneck here, the admin interface for the NAS reports bandwidth of 10/100. However, when I run a cable from the physical NIC on the Hyper-V host directly to the NIC on the NAS, the NAS reports Gb speeds:

(I'm not onsite, so I'm presently unable to reroute the cables to get a screen shot of the slower report.)

Also, note in the image above the reported speed of the disconnected eth1— 1Gbps. When the Gb switch is in place and I swap the cable from eth0 to eth1, the disconnected eth0 then shows 1Gpbs and the connected eth1 shows 10/100. I can only surmise that this has something to do with the slower 10/100 switch to which the 1Gpbs switch is connected via a separate cable.

I need Gb speeds on the NAS, so apparently this can't be done with cabling. For the meantime I've opted for his suggested software configuration; thus the 1Gpbs report above. (But under this configuration the NAS can't connect to the Internet, as described earlier.)

Here's the model 1Gpbs switch I'm using:

I've been reading documentation until my vision is blurred.

I'm sure this has a simple solution, but all the docs I'm finding go into excruciating detail on how to set something up—nothing on whether a particular configuration is a good fit for my situation.

I have a Hyper-V 2016 host with two physical NICs. All the VMs (PDC included) are bound to a vSwitch that's bound to one of the NICs; that cable goes to a physical switch to which all the workstations are connected. Straightforward stuff. It's been working for years.

Now I need to plug a NAS device into the second physical NIC so that it can see the PDC on the first. (I can't plug the NAS into the physical switch because that switch has to stay at 10/100 for our older CAT5 cabling. The NAS needs Gb speeds. We tried a Gb switch there and we were getting intermittent dropped connections on workstations.)

Is VLAN the solution for this? Teaming? Bridging? I'm lost, I'm afraid. And my eyes are swimming for the tech docs I'm trying to decode.

The NICs are 192.168.2.11 and 192.168.2.21, respectively. The VMs are on 192.168.2.11.

--EDIT--

As it turns out, bridging is not an option. This is Hyper-V Server, so there's no GUI. Ref. here: "Network Bridge can be set up or removed only through Network Connections."

I'm consistently getting this error and download failure:

PS C:\Users\Admin> docker run -ti microsoft/windowsservercore powershell
Unable to find image 'microsoft/windowsservercore:latest' locally
latest: Pulling from microsoft/windowsservercore
3889bb8d808b: Downloading [==================================================>]  4.07 GB/4.07 GB
423d66441981: Downloading [==================================================>] 1.203 GB/1.203 GB
C:\Program Files\Docker\docker.exe: read tcp 192.168.0.11:60315->72.21.81.200:443: wsarecv: An existing connection was forcibly closed by the remote host..
See 'C:\Program Files\Docker\docker.exe run --help'.

I presume this is happening because of my slow connection speed (1Mbps). The hello-world:nanoserver sample downloads and works fine.

I don't mind downloading this as a BITS job, but I'll need to know two things:

1. The download URL
2. Where to save the file on my Hyper-V 2016 host server, so that Docker can load it

I'm issuing this command on the Hyper-V host SERVER2:

Clear; Get-VM | ForEach { 
  Write-Host "Migrating: "$_.Name;
  Move-VMStorage `
    -VM $_ `
    -DestinationStoragePath "\\SERVER1\D$";
}

Both servers are domain-joined, non-clustered.

This is the result I'm getting:

Move-VMStorage : Storage migration for virtual machine 'ADMIN' (4F452569-7DB9-4606-9371-A905267A7B0F) failed with error 'General access denied error' (0x80070005). Migration did not succeed. Could not start mirror operation for the VHD file 'D:\Virtual Hard Disks\ADMIN.vhdx' to '\SERVER1\D$\Virtual Hard Disks\ADMIN.vhdx': 'General access denied error'('0x80070005'). You do not have permission to perform the operation. Contact your administrator if you believe you should have permission to perform this operation.

ACLs are correctly configured:

PS C:\Users\domain.admin> Get-Acl 'D:\Virtual Hard Disks' | FL


Path   : Microsoft.PowerShell.Core\FileSystem::D:\Virtual Hard Disks
Owner  : BUILTIN\Administrators
Group  : DOMAIN\Domain Users
Access : CREATOR OWNER Allow  268435456
         NT AUTHORITY\SYSTEM Allow  FullControl
         BUILTIN\Administrators Allow  FullControl
         BUILTIN\Users Allow  CreateFiles, AppendData
         BUILTIN\Users Allow  ReadAndExecute, Synchronize
         NT VIRTUAL MACHINE\Virtual Machines Allow  CreateFiles, AppendData, Read, Synchronize
         DOMAIN\SERVER2$ Allow  -2147483642
         DOMAIN\SERVER2$ Allow  CreateFiles, AppendData, Read, Synchronize
Audit  :
Sddl   : O:BAG:DUD:AI(A;OICIIO;GA;;;CO)(A;OICI;FA;;;SY)(A;OICI;FA;;;BA)(A;CI;DCLC;;;BU)(A;OICI;0x1200a9;;;BU)(A;OICI;0x
         12008f;;;S-1-5-83-0)(A;CIIO;DCLCGR;;;S-1-5-21-369066176-630964511-2072824237-1119)(A;;0x12008f;;;S-1-5-21-3690
         66176-630964511-2072824237-1119)

and:

C:\Users\domain.admin>net localgroup Administrators
Alias name     Administrators
Comment        Administrators have complete and unrestricted access to the compu
ter/domain

Members

-------------------------------------------------------------------------------
Administrator
DOMAIN\Domain Admins
The command completed successfully.

C:\Users\domain.admin>net group "Domain Admins"  <==(on the PDC)
Group name     Domain Admins
Comment        Designated administrators of the domain

Members

-------------------------------------------------------------------------------
Administrator            domain.admin
The command completed successfully.

C:\Users\domain.admin>whoami
DOMAIN\domain.admin

I've delegated Kerberos as discussed here. Incoming and outgoing migrations are enabled on both machines, on Kerberos under any available network. Both firewalls are off.

I've contacted my administrator and I don't know what's wrong either.

Where to look next?

I recall reading somewhere that it's advisable to not make changes directly to the Default Domain GPO, but instead to create a new GPO that inherits from Default.

This sounds reasonable. I'm a developer, so the concept of encapsulation appeals to me.

However, I'm not able to figure out how to get my new GPO to inherit from Default. I've created and linked it in the domain, but changes in Default aren't reflected in the new one.

The title pretty much says it all...

The domain is on a guest VM (Essentials 2012 R2), to which I joined the Hyper-V 2012 R2 host. For reasons not appropriate for discussion here, recently I briefly switched back to Workstation mode. Now that I've rejoined the domain, however, I'm finding that I can't access essential services remotely using the Domain Admin's credentials (Services MMC, Disk Management, etc.). I didn't change any firewall rules during my time away (only an hour or so).

In fact I can't even navigate to its UNC path or any shares (e.g. \\SERVER1). I get this famous error:

I can RDP into it just fine, using Domain Admin credentials. I've used the net localgroup administrators command to verify that the Domain Admin is indeed in the local Administrators group.

How can I get back to where I was before I left the domain? Everything was going great--I was managing disk partitions, local users and groups, VM settings... you name it. Do I have to delete and recreate the Domain Admin's profile on the host? Is something in there looking for the 'old' account (which is actually the same account)?

EDIT to provide add'l troubleshooting info

(I've adjusted the tags a bit to better reflect the topic, as my understanding of the nature of the problem evolves.)

Per Mark's suggestion I deleted and recreated the Domain Admin profile on \\SERVER1, as described in the article he linked. For extra measure, just to be safe, I did the leave/rejoin again—this time taking care to delete the old AD object for \\SERVER1 (which I'd neglected to do the first time).

Still no luck. I have all functionality on \\SERVER1 from all workstations, but not from the PDC.

Thinking I may have some sort of SID caching issue going on, I turned to PsGetSID. It seems a domain member has two SIDs: 1) its machine SID and 2) its domain SID (reference here). Here's what I get when running it on \\SERVER1:

Not sure quite how to deal with that...

But anyway—I'm narrowing it down a bit. Apparently the PDC thinks the Domain Admin account is disabled on \\SERVER1.

This when on the PDC and navigating w/File Explorer:

And this when trying to connect w/MMC's Event Viewer:

So there's a common thread here. I just don't know how to figure out what it is or how to fix it.

UPDATE:

I was using the wrong syntax for PsGetSID for the second SID (you're supposed to exclude the leading backslashes and just use the computer name, followed by a $). I can see now that the domain SID is identical to the one shown in AD. So at least that possibility's eliminated.

First I'll say that I've just now discovered that my practice of making changes directly to the Default Domain Policy isn't the recommended way of doing things. I admit I'm not sure why this is the case, but I'll go with it.

Now, that said... I'm preparing to wipe and reinstall the OS for my WSE 2012 R2 PDC. I've made several changes to the Default Domain Policy over the past year—being careful to save a backup with each change—and I'm going to want to restore those changes to the new domain.

But I think this can't be done with my current backups, due to the new SIDs that'll be generated with the reinstall (among other unknown complications that may arise).

What I'd like to do is write a script/program against an API of some sort to read from the policy ONLY THE FEW SETTINGS THAT I'VE CHANGED and save them into a file for later restoration back to the new server. I don't have many, but I do have enough to make prohibitive a task of wading through the TreeView, tracking them down and manually copying them one-by-one.

The XML files that are produced by the standard GPO backup feature (as well as Backup-GPO) appear far more complex than the minimum necessary and I fear trouble if I use them to restore to the new GPO. I don't need all the plumbing, just the settings/values that I've changed from default.

In other words, I'm looking for a minimalist GPO backup/restore mechanism—even if I have to write it myself. The files produced by the current one seem to be overkill, like trouble waiting to happen.

We're a small shop, running a Dell T420 (dual CPU, only one present, 6 cores) w/32GB RAM as our main server. We have only 5 VMs, one of which is our WSE 2012 DC.

From time to time, and at a rate for which we've not been able to establish a reliable pattern, all of our VMs concurrently spike to 100% CPU. The host remains quiet at 4-5%. A host warm boot doesn't provide relief, but a cold boot at least puts things back in the box until the problem reoccurs.

Sometimes we can get a week or more of calm seas out of it; sometimes only a day. An unreliable pattern seems to be that it kicks off sometime during an extended idle period, i.e. overnight. An examination of the server's temperature logs first led us to suspect overheating, but further investigation into recent incidents have spoiled that lead.

We also found descriptions of similar problems on the Dell forums, with claims of resolution by installing the latest round of Dell updates. We recently engaged in a project to do just that (as an aside, it was quite an adventure getting ~700GB of VHDs safely off of and then back onto that machine), but to our utter dismay it didn't help.

We're absolutely befuddled. So is Microsoft support (or at least first tier support is, even though they try not to act like it). I'm including below our SystemInfo output.

Does anyone know where to start looking?

Thanks

===================================

Host Name:                 SERVER1
OS Name:                   Microsoft Hyper-V Server 2012 R2
OS Version:                6.3.9600 N/A Build 9600
OS Manufacturer:           Microsoft Corporation
OS Configuration:          Standalone Server
OS Build Type:             Multiprocessor Free
Registered Owner:          Windows User
Registered Organization:   
Product ID:                06401-029-0000043-76293
Original Install Date:     4/3/2014, 4:07:15 PM
System Boot Time:          5/4/2014, 1:56:47 PM
System Manufacturer:       Dell Inc.
System Model:              PowerEdge T420
System Type:               x64-based PC
Processor(s):              1 Processor(s) Installed.
                           [01]: Intel64 Family 6 Model 45 Stepping 7 GenuineIntel ~2200 Mhz
                           [Intel(R) Xeon(R) CPU E5-2430 0 @ 2.20 GHz] (manually added)
BIOS Version:              Dell Inc. 2.1.2, 1/20/2014
Windows Directory:         C:\Windows
System Directory:          C:\Windows\system32
Boot Device:               \Device\HarddiskVolume1
System Locale:             en-us;English (United States)
Input Locale:              en-us;English (United States)
Time Zone:                 (UTC-09:00) Alaska
Total Physical Memory:     32,723 MB
Available Physical Memory: 12,716 MB
Virtual Memory: Max Size:  37,587 MB
Virtual Memory: Available: 17,129 MB
Virtual Memory: In Use:    20,458 MB
Page File Location(s):     C:\pagefile.sys
Domain:                    OIT
Logon Server:              \\SERVER1
Hotfix(s):                 31 Hotfix(s) Installed.
                           [01]: KB2843630
                           [02]: KB2862152
                           [03]: KB2868626
                           [04]: KB2876331
                           [05]: KB2883200
                           [06]: KB2884846
                           [07]: KB2887595
                           [08]: KB2892074
                           [09]: KB2893294
                           [10]: KB2894179
                           [11]: KB2898514
                           [12]: KB2898871
                           [13]: KB2901101
                           [14]: KB2901128
                           [15]: KB2903939
                           [16]: KB2904266
                           [17]: KB2908174
                           [18]: KB2909210
                           [19]: KB2911106
                           [20]: KB2913760
                           [21]: KB2916036
                           [22]: KB2917929
                           [23]: KB2919394
                           [24]: KB2919442
                           [25]: KB2922229
                           [26]: KB2923300
                           [27]: KB2923768
                           [28]: KB2928193
                           [29]: KB2928680
                           [30]: KB2930275
                           [31]: KB2939087
Network Card(s):           3 NIC(s) Installed.
                           [01]: Broadcom NetXtreme Gigabit Ethernet
                                 Connection Name: NIC1
                                 DHCP Enabled:    No
                                 IP address(es)
                           [02]: Broadcom NetXtreme Gigabit Ethernet
                                 Connection Name: NIC2
                                 DHCP Enabled:    Yes
                                 DHCP Server:     192.168.1.12
                                 IP address(es)
                                 [01]: 192.168.1.135
                                 [02]: fe80::915b:8de0:712e:29f1
                           [03]: Hyper-V Virtual Ethernet Adapter
                                 Connection Name: vEthernet (External NIC 1_Internal)
                                 DHCP Enabled:    No
                                 IP address(es)
                                 [01]: 192.168.1.11
                                 [02]: fe80::2d35:f582:4958:9eb2
Hyper-V Requirements:      A hypervisor has been detected. Features required for Hyper-V will not be displayed.

== EDIT ======================

I've found the solution to this issue; I waited for over a year to make sure we didn't encounter any more instances of the problem.

Moderators: I'd like to request a reopening of the question, so that I can post the answer.