dasko's questions

I am testing restoring a domain controller from system state backup to different hardware in a non production environment as a sanity check for our restoration procedure.

When i run the dcdiag command I get "blank info back" and all that is displayed are two lines as follows: Domain Controller Diagnosis

Performing initial setup:

and then I am returned to the command prompt. Even when I do dcdiag /v i get the same result.

I have double checked the DNS settings and Active Directory works properly. All FSMO roles are being held by this restored Domain Controller. I am able to join test pc's to the domain without issue etc

Is this a common issue or is there something that I am missing. Thanks.

I have a workstation in a domain that has failed with hardware related issues. The actual hard drive is fine and is not the issue with with the workstation. Since we have spares of these workstations, in the exact hardware configuration as the old one, can I just pull the hard drive and put it another exact same workstation. The reason we want to do this is to avoid having to reinstall all the CAD based software or other software that takes too long for the user to wait to be installed.

Is there any issue with it needing to be prepped back onto the network?

I personally don't see an issue with just taking the drive out and putting it back into another workstation of the same hardware and leaving it on the network. Since there are not going to be two of these workstation with the same SID (domain related) on the domain, I don't see the need for sysprep'ing it.

Is there anything wrong with this process?

Hi I have a two domain controller domain and i will refer to them as DC1 and DC2, here is some info on them.

• DC1 is or has all FMSO roles
• DC2 serves as another Domain Controller for replication
• DC1 is a basic server with a 3ware RAID 1 setup
• There is a buggy hard drive in DC1 and the 3ware rep recommends replacing the drive in slot 0 sooner than later.

Based on the above information I would like to know if the best practice way would be to move the FMSO roles to DC2 first and then turn off DC1, replace the bad drive and let it rebuild and then move the FSMO roles back to DC1. The reason I want the FSMO roles back to DC1 is that is is a one year old system whereas DC2 is about 6 years old and I don't want it to hold the roles.

Is there anything else I should be looking at too example would be should I move the roles and unjoin DC1 from the Domain and then do the steps above?

Any help is appreciated. Thanks.

We have a new Domain Controller that holds all FSMO roles. We also have two old hardware servers, about 4-5 years old each, set up as secondary Domain Controllers (or better described as Domain Controllers that are DNS servers too not holding any FSMO roles but are Global Catalog servers in the same Site). My question is do I run the risk of corruption in Active Directory if I have a drive failure, due to old hardware, on one of the secondary Domain Controllers. I am really trying to convince the client to buy a new hardware based server for our second Domain Controller but again budget is tight. Thanks.

I have a client with an Access Database that has been experiencing slow queries in the past few days. Here is some background first.

• it is currently running on Windows Server 2008
• the mdb file is on the server and there are some local installed front end parts on the workstations.
• we run over a gigabit ethernet and gigabit network switches
• this server is used for basic file sharing too and those other services DO NOT seem to run slow or exhibit any issues.
• this was working fine but has begun having slower queries or response times when you connect back to the database for queries.
• we have not changed anything on the server or done any updates to either the server or the database front end installation.
• we have always used a mapped drive letter to access it, both on the old server and on this new one, see next point for age of new server.
• I know people will say stop using Access as a database but the client is using legacy software with NO path to upgrade and it was working, in a tolerable fashion, on this Server 2008 platform for about 1.5 years already.

My question is basically is there anything that I should be looking at that is maybe obvious but I might be missing? We tried moving the files to another partition on a faster raid array and we got the same results.

Any help would be greatly appreciated.

I have a unique issue with a current server 2008 r2 deployment that is a member server on our internal domain. When I create a folder and set the permissions from the security tab, if I choose to lookup in the active directory name list and then hit the "Find Now" radio button, it takes really long to audit and present the users and security groups.

I tried this with a couple of the domain controllers and they are really quick to present the audited users.

I have verified my dns settings and did some nslookups to verify that computer names and such are queried quickly.

To clarify this server has a static ip address using the ipv4 settings or tab from network connections. ipv6 is left checked on.

Is there anything i can check to verify if there is an issue.

hi i have a problem with a 9.04 server deploy, i have two nics and both are now not visible after the server had been off for a month. the client had turned it off as they were moving and now when we boot up the nics are not seen under an ifconfig command, only the lo is listed.

i will have to check on monday to see wheter a sudo lshw -class network will show the nics as being there from a hardware perspective.

i do know the following:

• working prior to turning it off
• we had inet static for our ifaces file so they were hard coded to the ip's
• restarting the unit did not make a difference
• leds on the nic light up when an ethernet cable is plugged into it and then into a switch

we have not tried doing an ifconfig eth0 or eth1 up command yet, i have to wait for the client to get back onsite so that i can walk him through doing this over the phone.

does anyone have any idea why all of a sudden the nics, they are both intel based gig e ethernet, would just not show up anymore with their respective ip address based on the ifaces file? we did verify that the ifaces file has not changed, so i don't think it is anything with that.

thanks.

Just realized that one of my domain controllers, that is also a global catalog, is not listed in the reverse lookup zone with a PTR record, it is not there. The other two domain controllers are there.

There is a valid Host A record though in the forward lookup zone of DNS in Active Directory Zone for it though. Is there a way to force the PTR record? Is this something that i might have to manually do to create the record?

All three domain controllers are Server 2003.

Update, i tried using nslookup on the main domain controller, if i change the server for nslookup to another domain controller and then type in the word server and hit return i get non-existent domain? Am i reading nslookup the wrong way when it comes to the word server, i thought it would just return the value of the DNS server that nslookup is using for the queries.

Update 2: If i go to a workstation and change the tcp/ip settings for dns1 to point to the domain controller that does not have the PTR record and do an nslookup this is the error i get

nslookup * Can't find server name for address 192.168.16.221: Non-existent domain * Default servers are not available Default Server: UnKnown Address: 192.168.16.221

i am assuming i get this error since there is no PTR record? all other lookups with this Domain Controller resolve fine, such as google.com and other internal domain computer names. Will this cause issues for users logging in if i change the DHCP scope and use this problematic Domain Controller for their DNS1 entry?

Update 3: i restarted the server, i realized it not been restarted since a while ago when i did the dcpromo, when i logged back in and checked the Reverse Lookup Zone for all 3 Domain Controllers the PTR records was no there and the error above about non-existent domain does not come up when you do an nslookup it just goes right to the comman line for nslookup. Thanks again.

I have recently taken over a new client in a windows server 2003 domain environment. The only issue i see with the setup is that the second domain controller's dns entries might be wrong, hence why i am posting here. Here is the network setup.

• two domain controllers
• Domain controllers are DC1 and DC2

• both Domain Controllers are Active Directory Integrated and have their DNS AD integrated too.

• DC1 DNS settings dns1: points to itself so DC1, dns2: points to nothing, it is blank?

• DC2 DNS settings dns1: points to main domain controller with the fsmo roles so DC1, dns2: points to itself so DC2

i have always set the DNS entries of domain controllers to themselves for the first DNS entry and to the other domain controller for the second entry. If it were me doing this for the client my settings would look like this

• DC1 dns1 points to DC1, dns2 points to DC2

• DC2 dns1 points to itself so DC2, dns2 points to DC1

i thought that server 2003 addressed the issue with DNS island that used to happen to domain controllers in Windows Server 2000 enviroments?

Slight problem testing fail-over procedure with my two domain controllers.

I have two domain controllers, DC1 and DC2.

• DC1 has all FSMO roles, is Active Directory integrated DNS
• DC2 is Active Directory integrated DNS and is the DHCP server. The DHCP scope assigns DNS1 to dc1 and DNS2 to DC2 for clients.
• Both DC1 and DC2 are global catalog (GC)

The problem happens when I turn off dc1 to simulate the PDC FSMO role not being available. When I log in with a workstation it takes a long at the applying computer settings screen. It eventually logs in like about 3 minutes or less. Is that a common time frame?

Is this expected behavior? I have never been in a situation where I actually had to experience this problem but I am doing it as an exercise to test our network's reliability in case dc1 goes down for a period of a few hours. My understanding has always been that if you have proper DNS entries in your DHCP scope the workstation will just go to the second DNS entry to login if the first one fails.

I also tried setting the workstation DNS to have the DNS1 entry to DC2 (which is still turned on and running and DNS2 to be the DC1, which I turned off to simulate the failure) and I still get the same results, slow applying computer settings.

I turned dc1 back on and changed back the DNS settings to the way they were and the XP client logged back in quick as normal. So there is some disconnect when I turn off that first domain controller, DC1, that holds the FSMO roles, that causes this slow login issue.

need to move a domain controller, the first in the forest that holds all the fsmo roles, to another location in a clients building. it will require turning off this dc, call it dc1 for this question. i want to transfer the fsmo roles to a new domain controller call the new one dc2. dc2 is already on the network and has been promoted and made a domain controller, it's dns settings are set and it is also a global catalog (GC). the work is scheduled to be done after hours and i am also planning on moving the dhcp server to dc2.

i am looking for a best practices checklist of things to verify prior to moving fsmo roles and turning dc1 off? as far as i know there are no issues with replication between the dc's. my biggest worry is if i turn on dc1 after moving it and i have hardware issues or boot issues, i would rather move the fsmo roles to a known good one that is a few months old (dc2) vs still using a 5yr old box (dc1), this is part of my migration strategy too.

thanks for the help.

We have had a consultant install a database for a client that is based on Access 2007 with a front end (on each workstation) and I guess the database back end (on the file server, it is a server 2003 domain controller with very current hardware, memory etc...).

When we launch the database from the workstation we get our typical log in screen, when a user logs in and there is only one user on the database interface the whole thing flies really quickly, keystrokes are very very quick etc.

As soon as another user logs into the database interface or program, everything crawls to a slow latent halt. Keystrokes in field boxes take forever to appear, for example if you type in the word "find" the f would appear then about 10 seconds later the "i" would appear, then 10 seconds later "n" then "d".

The current company that sold the database to us is suggesting a trial and error approach and I am not interested in hacking the registry on the server just to see if it makes a difference.

I am in desperate need of help as I don't have time or interest in databases, please all suggestions are welcome at this point.

Just to note, the network has no issues from cabling to switches to other connections. Using any of the workstations for file server browsing and opening files, email, internet etc all work extremely quickly. The only thing that stops working right is the database.

seeing how it does not do a write verify unless scripted (or is it needed?) is it a decent option to dump a few folders to another server? i am just worried about whether the data, after being copied, might be corrupted but you would not be aware of it being buggy?

i have used it in the past without issue but am seeking feedback in case i missed something obvious.

is there a way that i can trace what is causing the issue, i had some user say he tried to send a very large attachment and thinks it may be related? any help would be appreciated as they are currently approaching the 18GB limit on the sbs 2003 sp2. thanks.

i currently have a client that will be adding replicated data from satellite locations in the number of approximately 80TB per year. with this said in year 2 we will have 160TB and so on year after year. i want to do some sort of raid 10 or raid 6 setup. i want to keep the servers to approximately 4u high and rack mounted. all suggestions welcome on a replication strategy. we will be wanting to have one instance of the data in house and the other to be co-located (any suggestions on co-locate sites too?).

the obvious hardware will be something like a rack mount server with hot swap trays and dual xeon based type processors. the use of the data is for archives of information, files will be made up of small file sizes.

i can add or expand to this question if it is too vague. thanks for looking.

My choice would be RAID 6 for a file server since you can lose two drives and it does not matter which set of two can die. From what I understand with RAID 10 you can lose two drives but if they happen to be on the same RAID 1 array then you are a out of luck? Any suggestions? Basic file server with about 200GB of data and it would act as a single point of backup for other workstations and servers.

hi i am looking for a recap of what i have done already to see if i missed anything.

i had two cities connected by wan using a ipsec persistent tunnel between gateways.

i had one DC (DOMAIN CONTROLLER) in each city that was a global catalog server (GC)

they were set up to replicate and i had them configured under Sites and Servers with their own subnet etc...

about 6 months ago the one city was removed and i was not able to gracefully remove, through dcpromo, the server that was there. it is no longer used and cannot be brought back. the company went from two sites down to single site. Problem is i had a whole bunch of kcc errors and replication bugs in the event viewer.

i wanted to clean up my active directory and decided to use the ntdsutil metadata cleanup commands.

i removed the server from the specifed site based on a procedure from petri website. I then removed the instances of the old DC and site from Sites and Servers. Then i went and cleaned up the DNS by removing Host A records, NS server name from both the local DNS forward lookup zone and the _msdcs

i also removed the reverse lookup zone for the subnet that no longer exists.

is there anything i missed? thanks in advance for any help. gd

What is considered best practice for sharing or allowing users from the internet that are not company related to have access to trac and svn?

Should it be on a DMZ, should it be internal with some form of SSH connection or using an https?

If you were to do it and be paranoid of security what should be the best practice list assuming basic firewall on the WAN, should the server be on its own leg on the network like a perimeter zone (away from internal users too, double firewalled).

thanks in advance.

i have a client where we have 10 notebook users. we want to back up their email (pst files), no option to install exchange at this location, and a common folder on their notebook named like their userid. It is in this folder that they will save their working documents.

they currently have a windows 2003 server just set up as a workgroup, there is no option to set up a domain since the employees buy their own notebooks and we have to use what they get. Typically it will be windows xp and Windows 7 business. (i can't get everyone to agree to join the domain since it is used for business and personal use too, i know it is not a good thing to work this way but this is what i have to deal with)

my concern is pst open files and missed backups, i was leaning towards something like deltacopy but it will not do open pst files. is there a best practices approach to this scenario, i can't take that much time to baby sit the backups, i just expect people to let the backup finish but there has been occasion where they have stopped it since it interfered with the "other" work they were doing.

any suggestions or help since this is becoming frustrating to police. thanks

i am moving to a new file server under Server 2008 Standard 32bit edition. I will refer to the older server as just "server", the new one i named as server2.

i have updated server2 and patched it. I have also joined the domain as member server and set up the raid structure. I have also moved the data over to the right spot. BUT here is what i am not 100% sure on.

The company wants to keep the old name of "server", i did not want to do that and was thinking of just making a cname alias in AD DNS forward lookup zone to point to the new ip address of server2 but you can reference it as server. In order to do the alias i would naturally remove or rename the old server or just unjoin it from the domain altogether.

I have read that you can just rename a computer to a previous name in AD as long as you have unjoined and removed it from the appropirate list under Active Directory? Can i just rename a server that is a member server in a domain? Do i have to change the sid or run newsid?

Just looking for some best practices. thanks in advance. gd