I have a AWS EC2 instance, specifically a t3.2xlarge, that has windows server 2019 and SQL Server 2016 Standard installed(license came from the instances, through AWS), I'd like to upgrade my server to SQL Server 2019. When I download and run SQL Server 2019 I'm prompted for a product key to upgrade my instance:

The product key is not pre-populated with the key of the original instance(2016). How do I locate the product key/upgrade SQL Server for a AWS EC2 instance?

You can google around for a number of solutions on this, the one I've attempted is this using these suggestions(doesn't work), this(doesn't work for 2016), and this(not a answer). Am I the first person trying to do a in place SQL server upgrade on a AWS server? The AWS interface it beyond unhelpful, the only article I find on this is RDS, not applicable to EC2's.

I'm am using the instructions here to upgrade my Windows Server 2012 AD Controller to Windows Server 2019. This server is a isolated AD controller that has no other server/clients connected to it in any way.

When I run the following on this server:

./adprep.exe /forestprep /forest Dev

I am presented with the following error:

Adprep could not contact the Schema FSMO STORMDEMO.DEV.EBM.COM. The Schema FSMO must be reachable for this operation to proceed. [Status/Consequence] The Active Directory Domain Services schema is not upgraded. [User Action] Check the log file ADPrep.log in the C:\Windows\debug\adprep\logs\20220119160049 directory for possible cause of failure .

Adprep encountered a Win32 error. Error code: 0x2095 Error message: A directory service error has occurred.

Adprep was unable to check the specified user's group membership. [Status/Consequence] Adprep has stopped without making changes. [User Action] Verify the specified user is a member of Enterprise Admins group and Schema Admins group if /forestprep is specified, or is a member of Domain Admins group if /domainprep is specified, or is a member of Enterprise Admins group if /rodcprep is specified .

Adprep encountered a Win32 error. Error code: 0x2095 Error message: A directory service error has occurred.

This error is preventing me with proceeding with my windows upgrade process. I've checked my user account running this and attempted to run it with a elevated and under the "Administrator" account but am always presented with the same error message. My user account and the "Administrator" user account are members of the mentioned groups above.

Googling the specific error message(0x2095 Error message: A directory service error has occurred.) only leads me to vague posts related to other operations without clear solutions.

Does anyone understand what causes this issue, and/or have a resolution to this issue?

Update 1

Both answers we're useful, I followed the suggestions and figured out that there was some confusion around the FSMO roles, the server name is "EBM-TFS" and when I ran "netdom query FSMO" I got the following:

Schema master               STORMDEMO.DEV.EBM.COM
Domain naming master        STORMDEMO.DEV.EBM.COM
PDC                         EBM-TFS.DEV.EBM.COM
RID pool manager            EBM-TFS.DEV.EBM.COM
Infrastructure master       EBM-TFS.DEV.EBM.COM

I was able to seize the "Schema Master" role using powershell(First I run Ntdsutil, which fails, then I run Move-ADDirectoryServerOperationMasterRole -Identity "EBM-TFS" -OperationMasterRole schemaMaster), however I wasn't able to seize the "Domain naming master" role with either that or "ntdsutil":

Move-ADDirectoryServerOperationMasterRole : The directory service is unavailable At line:1 char:1

• Move-ADDirectoryServerOperationMasterRole -Identity "EBM-TFS" -OperationMasterRo ...

ntdsutil:

fsmo maintenance: transfer naming master ldap_modify_sW error 0x34(52 (Unavailable). Ldap extended error message is 000020AF: SvcErr: DSID-0321041F, problem 5002 (UN AVAILABLE), data -2146893022

Win32 error returned is 0x20af(The requested FSMO operation failed. The current FSMO holder could not be contacted.) )

Didn't matter though as I was able to run suggestion three(Rerun adprep /forestprep without /forest Dev) by @joeqwerty and this was successful, and I was able to proceed with the windows upgrade process.

I had this same issue when trying to connect to SSAS via a MSMDPump file, as stated in this article.

String reference not set to an instance of a String. Parameter name: s (mscorlib)

I got the following error message when trying to connect to my MSMDPump.dll via SSMS:

This when I tried to connect via excel:

When I examined the Event Log on this server I would see "Audit Failures":

I have a development box that is (nearly every night) experiencing the same symptoms:

1. Can't RDP due to the "Black Screen of Death"

2. Can't issue remote powershell commands because the "Remote Registry" service is stuck in a "Starting..." state. Can't kill processes with "Stop-Process", "Get-Process" returns error:

Get-Process : Couldn't connect to remote machine.

3. Can't restart the RDP service (remotely) because the "Remote Desktop Services UserMode Port Redirector" service is stuck in a "Stopping..." state and you get the following error when you attempt it:

Error 1061: The service cannot accept control messages at this time.

4. Can't use "Invoke-Command" due to security restrictions.

5. In fact if you attempt to reboot ANY service on that box remotely is get's stuck in the "Starting..." state.

6. (SQL Server) Still able to connect but is experiencing various issues related to SQL Agent

I can still reboot the box via AWS but it'll just do the same thing the next night, the event log doesn't contain anything that indicates what is occurring on this server. I do see these sort of messages in the system log:

The server {XXX} did not register with DCOM within the required timeout.

Don't really tell me allot of than my server is "broken"...

I'm not sure how one can identify the root cause of this issue. Has anyone experience this sort of issue before, if so what solution did you come to?

Update 1

The issue got significantly worse and developed into a situation where I was being booted out of RDP every 15 minutes and needed to Force Stop the instance constantly, I replaced the server with a new one using the old data drives(but a new C drive) and still experience this issue on my new server every other day.

I've enabled remote powershell and can use that even when I can't RDP, I will gather performance metrics and attach to this ticket.

Update 2

Ok I'm making progress, remote straight up freezes when I try to make a remote connection to the system that is locked up, the following command(powershell) just never completes:

$session = New-PSSession -ComputerName DXYZServerNameHere

I enabled the local admin account on the server so I can connect to it without running against my centralized AD server, that doesn't work either, still get the black screen of death.

I have a monitoring product running against the server, sometimes it stops reporting when the server becomes unavaliable, other times it's keeps reporting mostly idle numbers (CPU under 10%, plenty of memory, no super heavy HD usage).

One of my co-workers figured out you can restart the server from the "Server Manager" on another system, doesn't really fix the issue though.

I experience this issue less frequently on other servers, generally I just reboot them to fix this short term.

Sort of out of ideas at this point, I'll continue to search around and see if anyone else has any ideas...

I have somewhat of a unique challenge, I'm trying to migrate a old legacy server from a locally installed version of Active Directory Domain Service to a centrally managed AWS Directory Service. As part of this migration I will be replicating the user accounts over from this same server to this new service (via a series of powershell scripts). While this process won't bring over the users passwords, most of the structures will be brought over automatically (Users/Groups/OU's/etc...) via the scripts.

I'd like to integrate this migration into my DevOps framework (this includes the need to create a automated rollback script). However as part of the migration process via a powershell script I will need to remove the locally installed version of AD and join the server to the new centrally managed service. As part of that process, I believe that I will lose any information currently stored in the AD's (preventing me from rolling back).

Is there any way to save this information (including passwords) short of imaging the whole server, or this complicated process involving other servers and ADMT etc.., so that if I wanted to undo my migration to the new service I could simply run some sort of script and have the server restored to the pre-migrated version, with the local AD server still installed and my credentials still preserved.

I feel that this should be possible, what I'd really like is to somehow disable (but not uninstall) the AD service on the local server, then join it to my centralized domain service, then if I need to rollback, re-enable my AD service and rejoin to it locally.

Searching around doesn't appear to generate any leads on "disabling" the "Active Directory Domain Services" Role, however there is certainly allot of discussion around the uninstallation process. Maybe one of these options will preserve the AD's configuration somewhere (so that if I reinstall it, it will still be there)?

I have a bit of a unique situation, I have a series of AWS servers that all have Active Directory installed on them (DNS and a bunch of other things too) and are Domain Controllers, I'm trying to migrate all of these to use a centralized AD service, AWS AD DS. The first step of my migration is to create a two way trust between one of my servers (in this case my dev server - 10.0.0.119) and this new service. I've followed these instructions on the server side (10.0.0.119) to establish a two way trust, looks something like this:

Of course it doesn't connect because I need to setup it in AWS:

Which is where I run into trouble, when I try to setup the two way relationship in AWS I can't seem to get it to connect to my server, I get the following error message:

The remote domain dev.ebm.com is not reachable. Please ensure your security group settings are correct and your conditional forwarder is configured properly.

I'm really not sure why though, my configuration matches what is specified on my server (same error if I set one way authentication or "Forest Trust"):

Both my new AD DS service endpoints are on the same subnet and VPC as my server:

I can ping both of these from my dev server without issue. I've disabled all firewalls on the server and I don't have any firewall restrictions in AWS on this network.

Not a great deal is written on this subject. A number of posts point to adding a IP routes to cover your server before adding the trust. However both that article and AWS interface state that:

Modify the route table in your directory to enable routing to public IP addresses through your VPC.

So I feel that's not the right direction.

The most likely place I think I might be confused on is the "Existing or new remote domain", I've tried all sorts of thing such as the servers name and the domain name, I'm pretty sure that should match the name of the domain, but all combinations I've tried don't seem to work.

There's also significant discussion about conditional forwarding, I've set this up on the client side. I've also made sure to include the dev server in the AWS DC side configuration. Doesn't seem to have any effect though.

Does anyone know where I'm off on this?

I have a tricky issue, I'm trying to install a certificate to sign a VBA file. I've purchased a third party certificate and followed the instructions here to install it and sign my VBA file with it. However, I'm getting the following error when I try to use my certificate:

No usable signing certificates

(I believe) This is because, even though I've been able to install my new certificate through MMC in both my user account and local computer under the "Personal" folder, I haven't yet been able to install my certificate through IE.

When I attempt to install my new certificate (SPC file) in IE, I'm able to select it in the Import Wizard, and specify all settings correctly, however when I finish the wizard:

And I receive the "Success" message, the certificates are not imported, in fact I see no change in the "Personal" screen. This is in stark contrast to the behavior that I see in MMC, where I repeat the same steps and after completing the wizard, the two certificates in my SPC are installed without issue.

I've tried restarting, importing the certificates basically everywhere in MMC, but I cannot get these certificates to install in IE and consequentially I cannot sign my VBA files.

Update 1

I've got my certificate to show up under "Other People" now, can't remove it or move it though, and I still get the same error in VBA when trying to sign my file with it, does my cert need to be in the "Personal" folder, or can one sign a VBA file with a cert in the "Other People" folder?

I wonder what criteria excel uses to determine if a particular cert is one that can be used to sign a file. So far I have not found any documentation on this. I have found a old post on conflicting versions. That could be the issue I suppose, but I'm not sure what aspect or version excel is looking for...

Update 2

I was issued a SPC file, (hypothesis) I believe I need to sign the file with the following instructions before I can use it. That, is considerably harder than it first seems. Seems my files "private key" is marked as non-exportable:

Export-PfxCertificate : Cannot export non-exportable private key.

I wonder why my third party cert authority provided me with a cert formatted in this manner. Seems I'm not the only one confused my this cert business either. Lots of discussion on the internet about this sort of thing, just not allot of particularity useful instructions on how to do it. I really hope I don't have to proceed down this path.

I have two servers, one old AD server (server A) and a brand new server (server B). I am trying to migrate from old to new so I setup my second server following these instructions and add the second server as a domain controller within the same domain.

So, everything is wonderful in serverland, both servers are on the old domain and are configured as domain controllers. Now I would like to shut off Server A (eventually will be decommissioned, but I would like to keep it as a backup for now). So I disable AD replication on server B and adjust the DNS settings so that server B no longer points at server A:

Then I shut off server A. Suddenly(on server B) I cannot access the AD's configuration either through "Active Directory Users and Computers" or "Active Directory Administrative Center". I get various derivations of:

Naming information cannot be located because: The RPC server is unavailable

Cannot connect to any domain. Refresh or try again when connection is available.

The following Domain Controller could not be contacted: 127.0.0.1. The specified domain either does not exist or could not be contacted.

So it seems like its working(I can login with domain credentials, third party applications utilizing AD seem to work), but I can't access anything. Am I missing something here, I don't see why server B doesn't just detect itself as the new AD server. I thought there is no longer a magical "Primary" AD server. Most people on the internet recommend demoting the old AD server, but I'd rather not in this case. Is it possible to complete the AD migration without demoting the old server?

Update 1

After update FSMO roles as @KatherineVillyard suggested I get most of the same errors, but in the "Active Directory Administrative Center" I get one new one that is interesting, when you select "Change domain controller" I get:

Cannot find an available server in the DEV domain that is running the Active Directory Web Service (ADWS).

This is interesting as I checked and I'm sure the service is running on my new box. I wonder if the issue is DNS related. I already tried re-adjusting the network settings and rebooting the server. Often times with these types of issues it seems that I'm just throwing things against the wall and seeing what sticks :(

Update 2

I have tried a great many things, however it seems that I can reproduce the issue by shutting down server A by merely just disabling the NetLogin service on Server A. Once this service on server A stops responding you no longer have access to that domain(similar type errors thrown) through any of the snap-in controls on either server.

I also noticed something funny, when you run the following command on server B:

nltest /DSGetDC:MYDOMAINHERE

You get the following(assuming netlogin is running on both servers):

DC: \\(SERVER A)
Address: \\(SERVER A IP ADDRESS)
Dom Guid: XXXX
Dom Name: (MYDOMAINHERE)
Forest Name: (MYDOMAINHERE)
Dc Site Name: Default-First-Site-Name
Our Site Name: Default-First-Site-Name...

Another thing I notice on the new server(B) is that if you run("dcdiag /test:advertising") you get the following message(no issues on the old server(A)):

Testing server: Default-First-Site-Name\(Server B)
Starting test: Advertising
Warning: DsGetDcName returned information for \\(Server A).(MYDOMAINHERE), when we were trying to reach (Server B).
SERVER IS NOT RESPONDING or IS NOT CONSIDERED SUITABLE.
......................... (Server B) failed test Advertising

This really strikes me as an issue with some sort of DNS configuration on the new server(B), but I've removed every single reference to server A in server B's DNS Manager and rebooted the server. This whole thing is a bit of a black box, where does "DSGetDC" pull this information? The "(DNS) server", which should be server B, which shouldn't have any reference to server A, clearly I'm missing something here :(

I have a server(windows server 2012) that had Windows AD(Active Directory) installed and is used as part of an application that I maintain. Most of the time my application programmatically manages this server, adding, editing, and removing users as it see's fit. However occasionally I want to make modifications by hand, for example I want to add a user.

Typically I use the "Active Directory users and Computers" snap-in via MMC. However when I attempt to create the user through this application I am presented with a interesting issue:

Windows forces me to append a suffix matching the name of my AD instance.

If I try the same thing through the "Active Directory Administrative Center" I have a similar issue:

For some reason windows doesn't allow me to create users without this mandatory suffix. However I don't seem to have this issue when I create users programmatically. The application that I work with depends on users not having a suffix.

How to I get around AD's requirements in the UI(Add a user with a blank suffix)?

Why does AD even have this requirement in the front end, but not when adding users programmatically?