DomainController - Revision history

Aleks at 15:38, 11 July 2024

2024-07-11T15:38:54Z

← Older revision		Revision as of 16:38, 11 July 2024
Line 377:		Line 377:
	Get-DnsServerResourceRecord -ZoneName "contoso.com" -RRType "srv"		Get-DnsServerResourceRecord -ZoneName "contoso.com" -RRType "srv"
	</syntaxhighlight>		</syntaxhighlight>

			== Add Domain controller ==
			Promote member server to domain controller:<syntaxhighlight lang="powershell">
			Install-ADDSdomaincontroller -InstallDns -DomainName "<domain>" -credential (Get-Credential)
			</syntaxhighlight>check domain promotion logs: $env:systemroot\debug\DCPROMO.LOG

Aleks: /* Join To domain */

2024-02-02T09:22:16Z

Join To domain

← Older revision		Revision as of 10:22, 2 February 2024
Line 4:		Line 4:

	Domain join the computer:		Domain join the computer:
	<syntaxhighlight lang="Powershell">Add-Computer –domainname <domain> -Credential <domain account> -restart		<syntaxhighlight lang="Powershell">Add-Computer –domainname <domain> -Credential <domain account> -restart</syntaxhighlight>

	== Domain Services / Ports required ==		== Domain Services / Ports required ==

Aleks: /* Lost Trust Relationship With Domain */

2024-02-02T09:20:53Z

Lost Trust Relationship With Domain

← Older revision		Revision as of 10:20, 2 February 2024
Line 310:		Line 310:

	Test local computer password:		Test local computer password:
	*'''Test-ComputerSecureChannel -verbose~~'''~~		<syntaxhighlight lang="Powershell">Test-ComputerSecureChannel -verbose</syntaxhighlight>

	Check the Servers Computer account is in the domain and is not disabled		Check the Servers Computer account is in the domain and is not disabled

	Reset the Computer machine account:		Reset the Computer machine account:
	*'''Reset-ComputerMachinePassword -Server <DomainController> -Credential <DomainAdmin>~~'''~~		<syntaxhighlight lang="Powershell">Reset-ComputerMachinePassword -Server <DomainController> -Credential <DomainAdmin></syntaxhighlight>
	*'''Reset-ComputerMachinePassword -Server DC01 -Credential DomainAdminAccount~~'''~~		<syntaxhighlight lang="Powershell">Reset-ComputerMachinePassword -Server DC01 -Credential DomainAdminAccount</syntaxhighlight>

	The other way to restore is to unjoin the Server from the domain and then re-join it to the domain.		The other way to restore is to unjoin the Server from the domain and then re-join it to the domain.

Aleks: /* Capture FSMO Roles from other domain controller */

2024-02-02T09:20:04Z

Capture FSMO Roles from other domain controller

← Older revision		Revision as of 10:20, 2 February 2024
Line 303:		Line 303:

	== Capture FSMO Roles from other domain controller ==		== Capture FSMO Roles from other domain controller ==
	*Move-ADDirectoryServerOperationMasterRole -Identity <domain controller hostname receiving roles> -OperationMasterRole schemamaster, domainnamingmaster, pdcemulator, ridmaster, infrastructuremaster -Force		<syntaxhighlight lang="Powershell">Move-ADDirectoryServerOperationMasterRole -Identity <domain controller hostname receiving roles> -OperationMasterRole schemamaster, domainnamingmaster, pdcemulator, ridmaster, infrastructuremaster -Force</syntaxhighlight>

	==Lost Trust Relationship With Domain==		==Lost Trust Relationship With Domain==

Aleks: /* Migrating to Eliminated State */

2024-02-02T09:18:29Z

Migrating to Eliminated State

← Older revision		Revision as of 10:18, 2 February 2024
Line 180:		Line 180:

	Stop and disable the FRS service on each domain controller:		Stop and disable the FRS service on each domain controller:
	Sc <servername>*stop ntfrs		<syntaxhighlight lang="Powershell">Sc <servername>stop ntfrs
	*Sc <servername>*config ntfrs start=disabled		Sc <servername>config ntfrs start=disabled</syntaxhighlight>

	== DFSR configuration Rebuild ==		== DFSR configuration Rebuild ==

Aleks at 09:16, 2 February 2024

2024-02-02T09:16:04Z

← Older revision		Revision as of 10:16, 2 February 2024
Line 1:		Line 1:
	==Join To domain==		==Join To domain==
	Set DNS to point to domain controllers:		Set DNS to point to domain controllers:
	*Get-netadapter \| Set-DnsClientServerAddress -ServerAddresses ("10.0.0.1","10.0.0.2")		<syntaxhighlight lang="Powershell">Get-netadapter \| Set-DnsClientServerAddress -ServerAddresses ("10.0.0.1","10.0.0.2")</syntaxhighlight>

	Domain join the computer:		Domain join the computer:
	*Add-Computer –domainname <domain> -Credential <domain account> -restart		<syntaxhighlight lang="Powershell">Add-Computer –domainname <domain> -Credential <domain account> -restart

	== Domain Services / Ports required ==		== Domain Services / Ports required ==
Line 15:		Line 15:

	Find all domain controllers in the domain:		Find all domain controllers in the domain:
	*Resolve-DnsName -Type ALL -Name _ldap._tcp.dc._msdcs.$env:userdnsdomain		<syntaxhighlight lang="Powershell">Resolve-DnsName -Type ALL -Name _ldap._tcp.dc._msdcs.$env:userdnsdomain</syntaxhighlight>

	Testing of Domain Replication between controllers can be done using "repadmin" command		Testing of Domain Replication between controllers can be done using "repadmin" command

	*repadmin /replsummary (Identifies domain controllers that are failing inbound replication or outbound replication, and summarizes the results in a report.)		<syntaxhighlight lang="Powershell">repadmin /replsummary (Identifies domain controllers that are failing inbound replication or outbound replication, and summarizes the results in a report.)</syntaxhighlight>

	Get detailed info on domain controller status:		Get detailed info on domain controller status:
	*dcdiag /v /c /e \| out-file C:\temp\dctest.txt		<syntaxhighlight lang="Powershell">dcdiag /v /c /e \| out-file C:\temp\dctest.txt</syntaxhighlight>

	Get FSMO Roles held by Domain Controllers		Get FSMO Roles held by Domain Controllers
	*netdom query FSMO		<syntaxhighlight lang="Powershell">netdom query FSMO</syntaxhighlight>

	== Domain Controller Troubleshooting ==		== Domain Controller Troubleshooting ==
Line 47:		Line 47:

	Then start the DFS service and check for event 4602 which will give you details on the DFSR status:		Then start the DFS service and check for event 4602 which will give you details on the DFSR status:
	*Get-WinEvent -LogName 'DFS Replication' \| Where-Object ID -EQ 4602 \| Format-Table -AutoSize -Wrap		<syntaxhighlight lang="Powershell">Get-WinEvent -LogName 'DFS Replication' \| Where-Object ID -EQ 4602 \| Format-Table -AutoSize -Wrap</syntaxhighlight>

	Check the output then stop the DFSR service.		Check the output then stop the DFSR service.
Line 66:		Line 66:

	Check current state on DC:		Check current state on DC:
	*dfsrmig /getglobalstate		<syntaxhighlight lang="Powershell">dfsrmig /getglobalstate</syntaxhighlight>

	This will return a state from 0-4, 0=Start, 1=Prepared, 2=Redirected, 3=Eliminated.		This will return a state from 0-4, 0=Start, 1=Prepared, 2=Redirected, 3=Eliminated.
Line 79:		Line 79:

	Verify the health of Active Directory Domain Services: run the following command to check sysvol share on each DC, also check disk space on the drive that contains the sysvol		Verify the health of Active Directory Domain Services: run the following command to check sysvol share on each DC, also check disk space on the drive that contains the sysvol
	*net share		<syntaxhighlight lang="Powershell">net share</syntaxhighlight>

	Check replication is healthy:		Check replication is healthy:
	*repadmin /ReplSum		<syntaxhighlight lang="Powershell">repadmin /ReplSum</syntaxhighlight>

	Check the following Reg key for the location of sysvol and confirm location HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters, also check the reg key "sysvolready" = 1		Check the following Reg key for the location of sysvol and confirm location HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters, also check the reg key "sysvolready" = 1
Line 92:		Line 92:

	Check the state of the sysvol and connectivity between domain controllers: Make sure all tests succeed before starting:		Check the state of the sysvol and connectivity between domain controllers: Make sure all tests succeed before starting:
	*Dcdiag /e /test:sysvolcheck /test:advertising		<syntaxhighlight lang="Powershell">Dcdiag /e /test:sysvolcheck /test:advertising</syntaxhighlight>

	Migrate the domain to the Prepared state: on full domain controller (not read-only) set the global state to prepared		Migrate the domain to the Prepared state: on full domain controller (not read-only) set the global state to prepared
	*dfsrmig /setglobalstate 1		<syntaxhighlight lang="Powershell">dfsrmig /setglobalstate 1</syntaxhighlight>

	Verify that the domain has migrated to the Prepared state:		Verify that the domain has migrated to the Prepared state:
	*dfsrmig /getglobalstate		<syntaxhighlight lang="Powershell">dfsrmig /getglobalstate</syntaxhighlight>

	Check all domain controllers have reached the Prepared State: (this can take some time)		Check all domain controllers have reached the Prepared State: (this can take some time)
	*dfsrmig /getmigrationstate		<syntaxhighlight lang="Powershell">dfsrmig /getmigrationstate</syntaxhighlight>

	Verify all domain controllers have reached the prepared state:		Verify all domain controllers have reached the prepared state:
Line 120:		Line 120:

	Once all domain controllers are functioning in the prepared state you can migrate to redirected state:		Once all domain controllers are functioning in the prepared state you can migrate to redirected state:
	*dfsrmig /setglobalstate 2		<syntaxhighlight lang="Powershell">dfsrmig /setglobalstate 2</syntaxhighlight>

	Check state with the following command:		Check state with the following command:
	*dfsrmig /getglobalstate		<syntaxhighlight lang="Powershell">dfsrmig /getglobalstate</syntaxhighlight>

	Check the migration status with the following command:		Check the migration status with the following command:
	*dfsrmig /getmigrationstate		<syntaxhighlight lang="Powershell">dfsrmig /getmigrationstate</syntaxhighlight>

	Verify the state of the sysvol on each domain controller: you want to see that the mapped share is the dfsr share(sysvol_dfsr\sysvol)		Verify the state of the sysvol on each domain controller: you want to see that the mapped share is the dfsr share(sysvol_dfsr\sysvol)
Line 147:		Line 147:

	Check migration status:		Check migration status:
	*dfsrmig /getmigrationstate		<syntaxhighlight lang="Powershell">dfsrmig /getmigrationstate</syntaxhighlight>

	Confirm AD replication is functioning correctly:		Confirm AD replication is functioning correctly:
	*repadmin /ReplSum		<syntaxhighlight lang="Powershell">repadmin /ReplSum</syntaxhighlight>

	Backup the state of the domain controllers: (run on each domain controller)		Backup the state of the domain controllers: (run on each domain controller)
	*Wbadmin start systemstatebackup		<syntaxhighlight lang="Powershell">Wbadmin start systemstatebackup</syntaxhighlight>

	Finally migrate to the eliminated state: (run on writable DC)		Finally migrate to the eliminated state: (run on writable DC)
	*dfsrmig /setglobalstate 3		<syntaxhighlight lang="Powershell">dfsrmig /setglobalstate 3</syntaxhighlight>

	Check global state:		Check global state:
	*dfsrmig /getglobalstate		<syntaxhighlight lang="Powershell">dfsrmig /getglobalstate</syntaxhighlight>

	Check migration state:		Check migration state:
	*dfsrmig /getmigrationstate		<syntaxhighlight lang="Powershell">dfsrmig /getmigrationstate</syntaxhighlight>

	Check the sysvol share:		Check the sysvol share:
	*net share		<syntaxhighlight lang="Powershell">net share</syntaxhighlight>

	Get DFS report:		Get DFS report:

Aleks at 09:12, 2 February 2024

2024-02-02T09:12:01Z

← Older revision		Revision as of 10:12, 2 February 2024
Line 6:		Line 6:
	*Add-Computer –domainname <domain> -Credential <domain account> -restart		*Add-Computer –domainname <domain> -Credential <domain account> -restart

			== Domain Services / Ports required ==
			Open the following ports on firewall for active directory domain services to function correctly:<syntaxhighlight lang="markdown">
			TCP - ["53", "88", "135", "139", "389", "445", "464", "636", "3268", "3269", "5722", "9389", "49152-65535"]
			UDP - ["53", "88", "123", "137", "138", "389", "445", "464", "49152-65535"]
			</syntaxhighlight>

	== Domain Controller Info ==		== Domain Controller Info ==

Aleks at 11:14, 24 January 2024

2024-01-24T11:14:05Z

← Older revision		Revision as of 12:14, 24 January 2024
Line 365:		Line 365:
	Can check for issues with the command:		Can check for issues with the command:
	*'''dcdiag /test:dns /v'''		*'''dcdiag /test:dns /v'''

			== Get DNS records from domain controller ==
			Use the following powershell command to access the DNS records on the domain controller:<syntaxhighlight lang="powershell">
			Get-DnsServerResourceRecord -ZoneName "contoso.com"
			</syntaxhighlight>you can specify specific types of records with the -rrtype flag<syntaxhighlight lang="powershell">
			Get-DnsServerResourceRecord -ZoneName "contoso.com" -RRType "srv"
			</syntaxhighlight>

Aleks: /* Time Service Configuration */

2023-11-24T10:35:57Z

Time Service Configuration

← Older revision		Revision as of 11:35, 24 November 2023
Line 242:		Line 242:

	== Time Service Configuration ==		== Time Service Configuration ==
	~~<pre>~~
	ll domain members should use NT5DS domain time.		All domain members should use NT5DS domain time.

	Desktops and member servers sync with any domain controller.		Desktops and member servers sync with any domain controller.

	Domain controllers sync with PDC emulator (one per domain)		Domain controllers sync with PDC emulator (one per domain)

	PDC emulator in child domain can sync with any domain controller in parent domain.		PDC emulator in child domain can sync with any domain controller in parent domain.

	PDC emulator in parent domain syncs with either a hardware clock or possibly an external source.		PDC emulator in parent domain syncs with either a hardware clock or possibly an external source.

	https://blogs.technet.microsoft.com/nepapfe/2013/03/01/its-simple-time-configuration-in-active-direc...		https://blogs.technet.microsoft.com/nepapfe/2013/03/01/its-simple-time-configuration-in-active-direc...

	for all domain members (aside from PDCe) should have happened by default but you can confirm by running;		for all domain members (aside from PDCe) should have happened by default but you can confirm by running;

			<syntaxhighlight lang="powershell" line>
	w32tm /unregister		w32tm /unregister
	net stop w32time		net stop w32time
Line 260:		Line 267:
	then check		then check
	w32tm /query /source		w32tm /query /source
	w32tm /query /configuration		w32tm /query /configuration</syntaxhighlight>
	~~-----------------------------------------------~~
	for the PDCe		for the PDCe
			<syntaxhighlight lang="powershell" line>
	w32tm /unregister		w32tm /unregister
	net stop w32time		net stop w32time
Line 269:		Line 277:
	w32tm /config /manualpeerlist:<preferred ip address> /syncfromflags:manual /reliable:yes /update		w32tm /config /manualpeerlist:<preferred ip address> /syncfromflags:manual /reliable:yes /update
	net stop w32time		net stop w32time
	net start w32time		net start w32time</syntaxhighlight>

	then check		then check
			<syntaxhighlight lang="powershell" line>
	w32tm /query /source		w32tm /query /source
	w32tm /query /configuration		w32tm /query /configuration</syntaxhighlight>

	~~</pre>~~
	https://docs.microsoft.com/en-gb/archive/blogs/nepapfe/its-simple-time-configuration-in-active-directory		https://docs.microsoft.com/en-gb/archive/blogs/nepapfe/its-simple-time-configuration-in-active-directory

Aleks: /* FSMO Roles */

2023-11-24T10:31:30Z

FSMO Roles

← Older revision		Revision as of 11:31, 24 November 2023
Line 332:		Line 332:

	===FSMO Roles===		===FSMO Roles===
	Move FSMO roles with powershell: [https://learn.microsoft.com/en-us/powershell/module/activedirectory/move-addirectoryserveroperationmasterrole?view=windowsserver2022-ps MS KB]		Move FSMO roles with powershell: [https://learn.microsoft.com/en-us/powershell/module/activedirectory/move-addirectoryserveroperationmasterrole?view=windowsserver2022-ps MS KB]<syntaxhighlight lang="powershell">
	*'''Move-ADDirectoryServerOperationMasterRole -Identity “Target_DC_Name” –OperationMasterRole 0,1,2,3,4~~'''~~		Move-ADDirectoryServerOperationMasterRole -Identity “Target_DC_Name” –OperationMasterRole 0,1,2,3,4
			</syntaxhighlight>
			*
	<pre>		<pre>
	ID FSMO Role		ID FSMO Role