Home | Site Map | Cisco How To |  Net How To | Windows Vista | Case Studies | Forums | Services | Donations | Careers | About Us | Contact Us|

Active Directory 0702 Re: I cant put a Group in a Group ?? Re: ifmember.exe bat script fails due to perms... RE: listing windows 2000 domains Re: Login restriction Re: LSASS.exe consuming 100% of CPU on Windows 2003 DC/GC Re: migration planning, need suggestions/advice Re: Netlogon Errors Re: NT Domain to AD migration Re: Planning to Deploy SP2 on Windows Server 2003 with AD (GC) Re: Possible GPO Setting Failure Re: Printer not publishing in Directory? Re: R2 Schema Extension RE: redirection My Documents Re: Remote Desktop connection Top From: Phillip Drummond <w@s.com> To: none Subject: Re: I cant put a Group in a Group ?? Date: 09/27/2007 12:06:50 google and learn the differences between global groups and domain local groups "steve" <stevesemple@lycos.com> wrote in message news:1190910758.608600.58960@50g2000hsm.googlegroups.com... > Through some advice on this group Im trying to stop all but > administrators and specific users and groups from being able to log on > to a couple of computers. > This means that I go to > > Start / Programs / Administrative Tools / Local Security Policy > > Then  /Security Settings / Local Policies / User Rights Assignments > and remove Users from the Logon Locally Profile and then add the > groups and/or users I specifically want to access this computer. > > I have tested this by removing users and then specifically adding user > joe1 and it works great. > > In our small school, for our purposes we have two groups staff and > students. > > We want staff to be able to access this computer and just a few > students. > > I thought, it would make sense to create a group in AD called Library > and then add to that group all the Groups and users that I want to > have access to that computer. > > However I cant seem to add the group Staff to the Library group. When > I search for groups it only finds the built in groups not any of the > groups that we created. > > I dont understand this. > > Cant I add a security group that I created to another group. This > would mean that when ever I put Library group into permissions > properties it would include staff and other individuals that I > explicityly put in it ?? > > Thanks > Top From: steve <stevesemple@lycos.com> To: none Subject: Re: I cant put a Group in a Group ?? Date: 09/27/2007 14:26:59 Ok I pulled out my book and and did some reading. I have never quite understood this but I think what you are saying is. I would apreaciate some feed back on if Im right. A Global Group can have users added and I suppose Universal Groups added, but it cant have other Global groups added. I need to create a Local Group and then add the Global groups to it. Am I right on that. I have read several articles on it but still have not got my head around it. Thanks. Top From: steve <stevesemple@lycos.com> To: none Subject: Re: I cant put a Group in a Group ?? Date: 09/27/2007 15:01:34 Actually I miss spoke Global Groups Cannot be added to Local Groups Local Groups CAN be added to Global Groups Top From: Richard Mueller [MVP] <rlmueller-nospam@ameritech.nospam.net> To: none Subject: Re: I cant put a Group in a Group ?? Date: 09/27/2007 20:25:29 "steve" <stevesemple@lycos.com> wrote in message news:1190923294.629122.29670@50g2000hsm.googlegroups.com... > Actually I miss spoke > > Global Groups Cannot be added to Local Groups > > Local Groups CAN be added to Global Groups Assuming the domain is not in Windows 2000 Mixed Mode: Global groups can: 1. Have users accounts and global groups (in the same domain) as members. 2. Be members of Universal and domain local groups in any domain, and global groups in the same domain. Domain Local groups can: 1. Have users, global groups, and universal groups from any domain as members, and domain local groups from the same domain. 2. Be members of domain local groups in the same domain. Universal Groups can: 1. Have users, global groups, and universal groups from any domain as members. 2. Be members of domain local and universal groups in any domain. If you are in Windows 2000 Mixed Mode the only group nesting allowed is: Global groups can be members of domain local groups. -- Richard Mueller Microsoft MVP Scripting and ADSI Hilltop Lab - http://www.rlmueller.net -- Top From: alazarevich@gmail.com <alazarevich@gmail.com> To: none Subject: Re: ifmember.exe bat script fails due to perms... Date: 09/26/2007 10:45:41 Nevermind, it was some other problem, stupid on my part. ifmember.exe works fine. On Sep 25, 8:22 pm, "alazarev...@gmail.com" <alazarev...@gmail.com> wrote: > Hi, > > On an NT4 PDC (server1), the following NETLOGON batch script runs > fine: > > \\server1\NETLOGON\ifmember.exe "DOMAIN\Projects" > if errorlevel 1 ( >    net use /delete p: >    net use p: \\samba-server\projects > ) > > That same batch script on a 2003 AD domain controller fails with: > > System error 1314 has occurred. > A required privilege is not held by the client. > > Other parts of the script run fine, so it''s not an issue with the > script running. What is the actual privilege that I need to give. > ifmember.exe already has R+X, so I'm gussing 2003 AD has some > restrictions on the group policy objects that I need to allow access > to by a regular domain user. What is that policy object, and what are > the perms I need to give? > > I really prefer not to use VB or anything complication. All I need are > simple batch scripts to do a couple of simple group checks and mount > shares if needed. > > Thanks in advance! > > Alex Top From: Thylo <Thylo@discussions.microsoft.com> To: none Subject: RE: listing windows 2000 domains Date: 09/27/2007 22:25:01 Hi TDR, Do you have multiple domains and domain controllers? Or is it a single domain with only one domain controller or only 2003 domain controllers? If it is a single domain and only 2003 domain controllers, then the 2003 domain will be an "upgraded" version of the 2000 domain. If you still have a 2000 domain controller it will still need be running in mixed mode, rather than "Windows Server 2003" functionality mode. If it is still in mixed mode and you only have Windows 2003 domain controllers, it can be safely changed to native mode. To check, go to AD Users and Computers, right-click on your domain and click on "Properties." You should get your answer on the "General" tab. Hope that helps, -- Leigh MCSE (NT4, 2000) "TDR" wrote: > hi, i'm wondering if it is possible to list the windows 2000 domains that > exist on a windows 2003 server.  would they show in active directory if the > upgrade (which was done by an external IT person 2 years ago, who was > managing our network and who is now not available) was completed properly? > > how do i determine what steps were not completed during the upgrade? > > thanks, Top From: Chris M <nobody@nowhere.special> To: none Subject: Re: Login restriction Date: 09/26/2007 10:28:23 NH wrote: > Is it possible to restrict login on a computer for 1 username ? > if yes, how can I do that ? > Thanks. You can change the computer's local security policy and add the username to the 'Deny logon locally' policy setting. Make sure that the changes won't get overwritten by a group policy from the domain. Alternatively you could put the computer into its own OU and apply a domain GPO to that. Cheers, Chris. Top From: Jorge Silva <jorgesilva_pt@hotmail.com> To: none Subject: Re: Login restriction Date: 09/26/2007 12:17:37 Hi You want to allow only one person to logon in a given computer? As Chris said you can achieve this by using GPO, but what about the Admins? They should be allowed to logon in all computers to troubleshooting and Workstationn maintenance, etc (Administrative Tasks). or You want that a given user account be allowed to logon only in one computer for that domain? If this is your objective, then you can use the user account properties "Allow log on to..." in AD to restrict the machine(s) where the user is allowed to login. -- I hope that the information above helps you. Have a Nice day. Jorge Silva MCSE, MVP Directory Services "NH" <nh@noreply.com> wrote in message news:OF0KlxEAIHA.5312@TK2MSFTNGP02.phx.gbl... > Is it possible to restrict login on a computer for 1 username ? > if yes, how can I do that ? > Thanks. > Top From: NH <nh@noreply.com> To: none Subject: Re: Login restriction Date: 09/26/2007 13:55:56 I want to allow only 1 user (and members of domain administrator group) to logon on 12 different computers.  If another user try to logon on one of these computers, access must be denied. "Jorge Silva" <jorgesilva_pt@hotmail.com> a écrit dans le message de news: %23G5kdEGAIHA.2268@TK2MSFTNGP02.phx.gbl... > Hi > You want to allow only one person to logon in a given computer? > As Chris said you can achieve this by using GPO, but what about the > Admins? They should be allowed to logon in all computers to > troubleshooting and Workstationn maintenance, etc (Administrative Tasks). > or > You want that a given user account be allowed to logon only in one > computer for that domain? > If this is your objective, then you can use the user account properties > "Allow log on to..." in AD to restrict the machine(s) where the user is > allowed to login. > > -- > I hope that the information above helps you. > Have a Nice day. > > Jorge Silva > MCSE, MVP Directory Services > "NH" <nh@noreply.com> wrote in message > news:OF0KlxEAIHA.5312@TK2MSFTNGP02.phx.gbl... >> Is it possible to restrict login on a computer for 1 username ? >> if yes, how can I do that ? >> Thanks. >> Top From: Jorge Silva <jorgesilva_pt@hotmail.com> To: none Subject: Re: Login restriction Date: 09/26/2007 14:48:33 In that case you can use the GPO option provided by me and Chris. -- I hope that the information above helps you. Have a Nice day. Jorge Silva MCSE, MVP Directory Services "NH" <nh@noreply.com> wrote in message news:eQwI07GAIHA.4584@TK2MSFTNGP03.phx.gbl... >I want to allow only 1 user (and members of domain administrator group) to >logon on 12 different computers.  If another user try to logon on one of >these computers, access must be denied. > > "Jorge Silva" <jorgesilva_pt@hotmail.com> a écrit dans le message de news: > %23G5kdEGAIHA.2268@TK2MSFTNGP02.phx.gbl... >> Hi >> You want to allow only one person to logon in a given computer? >> As Chris said you can achieve this by using GPO, but what about the >> Admins? They should be allowed to logon in all computers to >> troubleshooting and Workstationn maintenance, etc (Administrative Tasks). >> or >> You want that a given user account be allowed to logon only in one >> computer for that domain? >> If this is your objective, then you can use the user account properties >> "Allow log on to..." in AD to restrict the machine(s) where the user is >> allowed to login. >> >> -- >> I hope that the information above helps you. >> Have a Nice day. >> >> Jorge Silva >> MCSE, MVP Directory Services >> "NH" <nh@noreply.com> wrote in message >> news:OF0KlxEAIHA.5312@TK2MSFTNGP02.phx.gbl... >>> Is it possible to restrict login on a computer for 1 username ? >>> if yes, how can I do that ? >>> Thanks. >>> Top From: NH <nh@noreply.com> To: none Subject: Re: Login restriction Date: 09/27/2007 06:26:36 And what options should I choose in GPO to be able to do what I want ? Thanks for your support. "Jorge Silva" <jorgesilva_pt@hotmail.com> a écrit dans le message de news: uM6hzYHAIHA.4656@TK2MSFTNGP04.phx.gbl... > In that case you can use the GPO option provided by me and Chris. > > -- > I hope that the information above helps you. > Have a Nice day. > > Jorge Silva > MCSE, MVP Directory Services > "NH" <nh@noreply.com> wrote in message > news:eQwI07GAIHA.4584@TK2MSFTNGP03.phx.gbl... >>I want to allow only 1 user (and members of domain administrator group) to >>logon on 12 different computers.  If another user try to logon on one of >>these computers, access must be denied. >> >> "Jorge Silva" <jorgesilva_pt@hotmail.com> a écrit dans le message de >> news: %23G5kdEGAIHA.2268@TK2MSFTNGP02.phx.gbl... >>> Hi >>> You want to allow only one person to logon in a given computer? >>> As Chris said you can achieve this by using GPO, but what about the >>> Admins? They should be allowed to logon in all computers to >>> troubleshooting and Workstationn maintenance, etc (Administrative >>> Tasks). >>> or >>> You want that a given user account be allowed to logon only in one >>> computer for that domain? >>> If this is your objective, then you can use the user account properties >>> "Allow log on to..." in AD to restrict the machine(s) where the user is >>> allowed to login. >>> >>> -- >>> I hope that the information above helps you. >>> Have a Nice day. >>> >>> Jorge Silva >>> MCSE, MVP Directory Services >>> "NH" <nh@noreply.com> wrote in message >>> news:OF0KlxEAIHA.5312@TK2MSFTNGP02.phx.gbl... >>>> Is it possible to restrict login on a computer for 1 username ? >>>> if yes, how can I do that ? >>>> Thanks. >>>> Top From: Chris M <nobody@nowhere.special> To: none Subject: Re: Login restriction Date: 09/27/2007 08:18:13 NH wrote: > And what options should I choose in GPO to be able to do what I want ? > Thanks for your support. Put the 12 computers into their own OU in Active Directory and create a new GPO linked to that OU. In the GPO, go to Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment Define the 'Log on locally' setting to only include the Domain Admins group and the user that you wish to allow access. When your computers refresh their policy (doing gpupdate /force on each machine will do it immediately), the settings will be in place. Hope this helps. -- Chris. >> "NH" <nh@noreply.com> wrote in message >> news:eQwI07GAIHA.4584@TK2MSFTNGP03.phx.gbl... >>> I want to allow only 1 user (and members of domain administrator group) to >>> logon on 12 different computers.  If another user try to logon on one of >>> these computers, access must be denied. >>> >>> "Jorge Silva" <jorgesilva_pt@hotmail.com> a écrit dans le message de >>> news: %23G5kdEGAIHA.2268@TK2MSFTNGP02.phx.gbl... >>>> Hi >>>> You want to allow only one person to logon in a given computer? >>>> As Chris said you can achieve this by using GPO, but what about the >>>> Admins? They should be allowed to logon in all computers to >>>> troubleshooting and Workstationn maintenance, etc (Administrative >>>> Tasks). >>>> or >>>> You want that a given user account be allowed to logon only in one >>>> computer for that domain? >>>> If this is your objective, then you can use the user account properties >>>> "Allow log on to..." in AD to restrict the machine(s) where the user is >>>> allowed to login. >>>> >>>> -- >>>> I hope that the information above helps you. >>>> Have a Nice day. >>>> >>>> Jorge Silva >>>> MCSE, MVP Directory Services >>>> "NH" <nh@noreply.com> wrote in message >>>> news:OF0KlxEAIHA.5312@TK2MSFTNGP02.phx.gbl... >>>>> Is it possible to restrict login on a computer for 1 username ? >>>>> if yes, how can I do that ? Top From: NH <nh@noreply.com> To: none Subject: Re: Login restriction Date: 09/27/2007 12:37:28 Thank you very much. "Chris M" <nobody@nowhere.special> a écrit dans le message de news: fdgak7$i5f$1@aioe.org... > NH wrote: >> And what options should I choose in GPO to be able to do what I want ? >> Thanks for your support. > > Put the 12 computers into their own OU in Active Directory and create a > new GPO linked to that OU. > > In the GPO, go to Computer Configuration -> Windows Settings -> Security > Settings -> Local Policies -> User Rights Assignment > > Define the 'Log on locally' setting to only include the Domain Admins > group and the user that you wish to allow access. > > When your computers refresh their policy (doing gpupdate /force on each > machine will do it immediately), the settings will be in place. > > Hope this helps. > > -- > Chris. > >>> "NH" <nh@noreply.com> wrote in message >>> news:eQwI07GAIHA.4584@TK2MSFTNGP03.phx.gbl... >>>> I want to allow only 1 user (and members of domain administrator group) >>>> to logon on 12 different computers.  If another user try to logon on >>>> one of these computers, access must be denied. >>>> >>>> "Jorge Silva" <jorgesilva_pt@hotmail.com> a écrit dans le message de >>>> news: %23G5kdEGAIHA.2268@TK2MSFTNGP02.phx.gbl... >>>>> Hi >>>>> You want to allow only one person to logon in a given computer? >>>>> As Chris said you can achieve this by using GPO, but what about the >>>>> Admins? They should be allowed to logon in all computers to >>>>> troubleshooting and Workstationn maintenance, etc (Administrative >>>>> Tasks). >>>>> or >>>>> You want that a given user account be allowed to logon only in one >>>>> computer for that domain? >>>>> If this is your objective, then you can use the user account >>>>> properties "Allow log on to..." in AD to restrict the machine(s) where >>>>> the user is allowed to login. >>>>> >>>>> -- >>>>> I hope that the information above helps you. >>>>> Have a Nice day. >>>>> >>>>> Jorge Silva >>>>> MCSE, MVP Directory Services >>>>> "NH" <nh@noreply.com> wrote in message >>>>> news:OF0KlxEAIHA.5312@TK2MSFTNGP02.phx.gbl... >>>>>> Is it possible to restrict login on a computer for 1 username ? >>>>>> if yes, how can I do that ? Top From: Jeff Flack <jeffflack@hotmail.com> To: none Subject: Re: LSASS.exe consuming 100% of CPU on Windows 2003 DC/GC Date: 09/26/2007 10:47:08 Download some diagnostic tools.  Handle in particular.  Get the PID and then run a handle on it from command line.  It should give you a little more info - For instance, I was able to see that windows UPDATE was killing me (SUS, rather) by running handles. Cheers flack- "David" <david.fike@gmail.com> wrote in message news:1190816388.906574.55550@g4g2000hsf.googlegroups.com... > Hello all, > >     This issue of mine has already been resolved for the time being, > but I was hoping someone might be able to identify what caused the > issue to begin with. What I've got here is: > > A Windows 2003 SP1 Domain Controller that is also a Global Catalog. It > is not holding any of the FSMO roles in our domain/forest. Early > yesterday, I discovered that the LSASS.exe process was spiking with > 85%-100% usage of the CPU. It maintained this level all throughout the > day and into the evening. I disconnected the NIC and the LSASS process > immediately dropped to its normal usage (2%-4%) and I left the NIC > disconnected for 30 minutes. After reconnecting the NIC, the process > immediately resumed its spike. I decided to install SP2 on this > server, and after the installation and reboot LSASS had dropped a > little bit to about 70%-80% sustained CPU usage. However, when I came > in this morning I saw that LSASS has dropped back down to its normal > levels sometime in the middle of the night and it appears to be > remaining at normal levels. There are no unusual events in the Event > Log, and the other GC in this domain was not experiencing any issues. > I was hoping someone might be able to tell me what the cause of this > may have been and why it seemed to work itself out. Thanks! > Top From: Jorge Silva <jorgesilva_pt@hotmail.com> To: none Subject: Re: migration planning, need suggestions/advice Date: 09/26/2007 12:29:34 Hi Check inline: > getting down to the wire now so i need to make final decisions... > currently have 3 forests, each with 1 domain. 1 domain has an exchange > org. > need to consolidate all of this into a new forest with a new exchange org. Ok. > the new forest will be a simple one with only a secure root domain, and an > HQ child domain. Secure root Domain? what is that? > so the users and machines from the current 3 domains will be moved into > the HQ domain. Doesn't sound a good option to have a child domain with that description. > does everyone recommend ADMT? ADMT is good and easy to implement. > if so what gotchas can i expect? The best is to test it, but most situations everything goes well. > can ADMT handle this job easily? Yes. > how will existing mailboxes be handled? You don't mentioned anything about exchange in the second forest, but you can use the exchange migration tool to migrate the mailboxes to the other fores and then connect the mailboxes to the user accounts. You can get more detail about this in MS sweb site or in Exchange ngs. > is there true domain synchronization? No. Is an object migration. > when its over is the new domain a mess that needs tons of cleanup? You only migrate what you want to, so you shouldn't need to clean nothing after migration. > i have done several very large migrations but have always used Quest > tools. i am not familiar with ADMT. Download the White paper ADMT and test it on a lab.. > if someone with experience could give me a VERY high level step by step as > to what order i should do things in, > based on your experience, i would greatly appreciate it. everything is in MS web site and how to use that tool. -- I hope that the information above helps you. Have a Nice day. Jorge Silva MCSE, MVP Directory Services "Phillip Drummond" <w@s.com> wrote in message news:%23dqfkGEAIHA.4592@TK2MSFTNGP03.phx.gbl... > getting down to the wire now so i need to make final decisions... > currently have 3 forests, each with 1 domain. 1 domain has an exchange > org. > need to consolidate all of this into a new forest with a new exchange org. > > the new forest will be a simple one with only a secure root domain, and an > HQ child domain. > so the users and machines from the current 3 domains will be moved into > the HQ domain. > > does everyone recommend ADMT? > if so what gotchas can i expect? > can ADMT handle this job easily? > how will existing mailboxes be handled? > is there true domain synchronization? > when its over is the new domain a mess that needs tons of cleanup? > > i have done several very large migrations but have always used Quest > tools. i am not familiar with ADMT. > if someone with experience could give me a VERY high level step by step as > to what order i should do things in, > based on your experience, i would greatly appreciate it. > > thank you > Top From: Phillip Drummond <w@s.com> To: none Subject: Re: migration planning, need suggestions/advice Date: 09/26/2007 12:46:50 thank you. yes, the root domain will exist solely to hold child domains. there will be no users or computers in the root domain. does ADMT include the exchange migration piece or is this a separate tool? the new forest will have a new exchange org "Jorge Silva" <jorgesilva_pt@hotmail.com> wrote in message news:uHxYJLGAIHA.5312@TK2MSFTNGP02.phx.gbl... > Hi > Check inline: >> getting down to the wire now so i need to make final decisions... >> currently have 3 forests, each with 1 domain. 1 domain has an exchange >> org. >> need to consolidate all of this into a new forest with a new exchange >> org. > Ok. > >> the new forest will be a simple one with only a secure root domain, and >> an HQ child domain. > Secure root Domain? what is that? > >> so the users and machines from the current 3 domains will be moved into >> the HQ domain. > Doesn't sound a good option to have a child domain with that description. > >> does everyone recommend ADMT? > ADMT is good and easy to implement. > >> if so what gotchas can i expect? > The best is to test it, but most situations everything goes well. > >> can ADMT handle this job easily? > Yes. > >> how will existing mailboxes be handled? > You don't mentioned anything about exchange in the second forest, but you > can use the exchange migration tool to migrate the mailboxes to the other > fores and then connect the mailboxes to the user accounts. You can get > more detail about this in MS sweb site or in Exchange ngs. > >> is there true domain synchronization? > No. Is an object migration. > >> when its over is the new domain a mess that needs tons of cleanup? > You only migrate what you want to, so you shouldn't need to clean nothing > after migration. > >> i have done several very large migrations but have always used Quest >> tools. i am not familiar with ADMT. > Download the White paper ADMT and test it on a lab.. > >> if someone with experience could give me a VERY high level step by step >> as to what order i should do things in, >> based on your experience, i would greatly appreciate it. > everything is in MS web site and how to use that tool. > -- > I hope that the information above helps you. > Have a Nice day. > > Jorge Silva > MCSE, MVP Directory Services > "Phillip Drummond" <w@s.com> wrote in message > news:%23dqfkGEAIHA.4592@TK2MSFTNGP03.phx.gbl... >> getting down to the wire now so i need to make final decisions... >> currently have 3 forests, each with 1 domain. 1 domain has an exchange >> org. >> need to consolidate all of this into a new forest with a new exchange >> org. >> >> the new forest will be a simple one with only a secure root domain, and >> an HQ child domain. >> so the users and machines from the current 3 domains will be moved into >> the HQ domain. >> >> does everyone recommend ADMT? >> if so what gotchas can i expect? >> can ADMT handle this job easily? >> how will existing mailboxes be handled? >> is there true domain synchronization? >> when its over is the new domain a mess that needs tons of cleanup? >> >> i have done several very large migrations but have always used Quest >> tools. i am not familiar with ADMT. >> if someone with experience could give me a VERY high level step by step >> as to what order i should do things in, >> based on your experience, i would greatly appreciate it. >> >> thank you >> Top From: Jorge Silva <jorgesilva_pt@hotmail.com> To: none Subject: Re: migration planning, need suggestions/advice Date: 09/26/2007 12:56:33 > thank you. yes, the root domain will exist solely to hold child domains. > there will be no users or computers in the root domain. In my opinion this is a bad design, and all it does "according with your needs" is a waste of resources, hardware and people. > does ADMT include the exchange migration piece or is this a separate tool? > the new forest will have a new exchange org Is a separate tool, comes with exchange. -- I hope that the information above helps you. Have a Nice day. Jorge Silva MCSE, MVP Directory Services "Phillip Drummond" <w@s.com> wrote in message news:eebEPVGAIHA.4836@TK2MSFTNGP06.phx.gbl... > thank you. yes, the root domain will exist solely to hold child domains. > there will be no users or computers in the root domain. > > does ADMT include the exchange migration piece or is this a separate tool? > the new forest will have a new exchange org > > "Jorge Silva" <jorgesilva_pt@hotmail.com> wrote in message > news:uHxYJLGAIHA.5312@TK2MSFTNGP02.phx.gbl... >> Hi >> Check inline: >>> getting down to the wire now so i need to make final decisions... >>> currently have 3 forests, each with 1 domain. 1 domain has an exchange >>> org. >>> need to consolidate all of this into a new forest with a new exchange >>> org. >> Ok. >> >>> the new forest will be a simple one with only a secure root domain, and >>> an HQ child domain. >> Secure root Domain? what is that? >> >>> so the users and machines from the current 3 domains will be moved into >>> the HQ domain. >> Doesn't sound a good option to have a child domain with that description. >> >>> does everyone recommend ADMT? >> ADMT is good and easy to implement. >> >>> if so what gotchas can i expect? >> The best is to test it, but most situations everything goes well. >> >>> can ADMT handle this job easily? >> Yes. >> >>> how will existing mailboxes be handled? >> You don't mentioned anything about exchange in the second forest, but you >> can use the exchange migration tool to migrate the mailboxes to the other >> fores and then connect the mailboxes to the user accounts. You can get >> more detail about this in MS sweb site or in Exchange ngs. >> >>> is there true domain synchronization? >> No. Is an object migration. >> >>> when its over is the new domain a mess that needs tons of cleanup? >> You only migrate what you want to, so you shouldn't need to clean nothing >> after migration. >> >>> i have done several very large migrations but have always used Quest >>> tools. i am not familiar with ADMT. >> Download the White paper ADMT and test it on a lab.. >> >>> if someone with experience could give me a VERY high level step by step >>> as to what order i should do things in, >>> based on your experience, i would greatly appreciate it. >> everything is in MS web site and how to use that tool. >> -- >> I hope that the information above helps you. >> Have a Nice day. >> >> Jorge Silva >> MCSE, MVP Directory Services >> "Phillip Drummond" <w@s.com> wrote in message >> news:%23dqfkGEAIHA.4592@TK2MSFTNGP03.phx.gbl... >>> getting down to the wire now so i need to make final decisions... >>> currently have 3 forests, each with 1 domain. 1 domain has an exchange >>> org. >>> need to consolidate all of this into a new forest with a new exchange >>> org. >>> >>> the new forest will be a simple one with only a secure root domain, and >>> an HQ child domain. >>> so the users and machines from the current 3 domains will be moved into >>> the HQ domain. >>> >>> does everyone recommend ADMT? >>> if so what gotchas can i expect? >>> can ADMT handle this job easily? >>> how will existing mailboxes be handled? >>> is there true domain synchronization? >>> when its over is the new domain a mess that needs tons of cleanup? >>> >>> i have done several very large migrations but have always used Quest >>> tools. i am not familiar with ADMT. >>> if someone with experience could give me a VERY high level step by step >>> as to what order i should do things in, >>> based on your experience, i would greatly appreciate it. >>> >>> thank you >>> > Top From: Phillip Drummond <w@s.com> To: none Subject: Re: migration planning, need suggestions/advice Date: 09/26/2007 13:06:20 the root/child design allows for growth and delagation of rights at the domain level. its actually a microsoft recommended design for the type of growth we expect "Jorge Silva" <jorgesilva_pt@hotmail.com> wrote in message news:uRdJOaGAIHA.5868@TK2MSFTNGP05.phx.gbl... >> thank you. yes, the root domain will exist solely to hold child domains. >> there will be no users or computers in the root domain. > In my opinion this is a bad design, and all it does "according with your > needs" is a waste of resources, hardware and people. > >> does ADMT include the exchange migration piece or is this a separate >> tool? >> the new forest will have a new exchange org > Is a separate tool, comes with exchange. > > -- > I hope that the information above helps you. > Have a Nice day. > > Jorge Silva > MCSE, MVP Directory Services > "Phillip Drummond" <w@s.com> wrote in message > news:eebEPVGAIHA.4836@TK2MSFTNGP06.phx.gbl... >> thank you. yes, the root domain will exist solely to hold child domains. >> there will be no users or computers in the root domain. >> >> does ADMT include the exchange migration piece or is this a separate >> tool? >> the new forest will have a new exchange org >> >> "Jorge Silva" <jorgesilva_pt@hotmail.com> wrote in message >> news:uHxYJLGAIHA.5312@TK2MSFTNGP02.phx.gbl... >>> Hi >>> Check inline: >>>> getting down to the wire now so i need to make final decisions... >>>> currently have 3 forests, each with 1 domain. 1 domain has an exchange >>>> org. >>>> need to consolidate all of this into a new forest with a new exchange >>>> org. >>> Ok. >>> >>>> the new forest will be a simple one with only a secure root domain, and >>>> an HQ child domain. >>> Secure root Domain? what is that? >>> >>>> so the users and machines from the current 3 domains will be moved into >>>> the HQ domain. >>> Doesn't sound a good option to have a child domain with that >>> description. >>> >>>> does everyone recommend ADMT? >>> ADMT is good and easy to implement. >>> >>>> if so what gotchas can i expect? >>> The best is to test it, but most situations everything goes well. >>> >>>> can ADMT handle this job easily? >>> Yes. >>> >>>> how will existing mailboxes be handled? >>> You don't mentioned anything about exchange in the second forest, but >>> you can use the exchange migration tool to migrate the mailboxes to the >>> other fores and then connect the mailboxes to the user accounts. You can >>> get more detail about this in MS sweb site or in Exchange ngs. >>> >>>> is there true domain synchronization? >>> No. Is an object migration. >>> >>>> when its over is the new domain a mess that needs tons of cleanup? >>> You only migrate what you want to, so you shouldn't need to clean >>> nothing after migration. >>> >>>> i have done several very large migrations but have always used Quest >>>> tools. i am not familiar with ADMT. >>> Download the White paper ADMT and test it on a lab.. >>> >>>> if someone with experience could give me a VERY high level step by step >>>> as to what order i should do things in, >>>> based on your experience, i would greatly appreciate it. >>> everything is in MS web site and how to use that tool. >>> -- >>> I hope that the information above helps you. >>> Have a Nice day. >>> >>> Jorge Silva >>> MCSE, MVP Directory Services >>> "Phillip Drummond" <w@s.com> wrote in message >>> news:%23dqfkGEAIHA.4592@TK2MSFTNGP03.phx.gbl... >>>> getting down to the wire now so i need to make final decisions... >>>> currently have 3 forests, each with 1 domain. 1 domain has an exchange >>>> org. >>>> need to consolidate all of this into a new forest with a new exchange >>>> org. >>>> >>>> the new forest will be a simple one with only a secure root domain, and >>>> an HQ child domain. >>>> so the users and machines from the current 3 domains will be moved into >>>> the HQ domain. >>>> >>>> does everyone recommend ADMT? >>>> if so what gotchas can i expect? >>>> can ADMT handle this job easily? >>>> how will existing mailboxes be handled? >>>> is there true domain synchronization? >>>> when its over is the new domain a mess that needs tons of cleanup? >>>> >>>> i have done several very large migrations but have always used Quest >>>> tools. i am not familiar with ADMT. >>>> if someone with experience could give me a VERY high level step by step >>>> as to what order i should do things in, >>>> based on your experience, i would greatly appreciate it. >>>> >>>> thank you >>>> >> Top From: Phillip Drummond <w@s.com> To: none Subject: Re: migration planning, need suggestions/advice Date: 09/26/2007 13:53:11 with ADMT in my configuration, will i have to do migrate one domain at a time to the target domain? or can i do multiple? if only one, how do you recommend i go about this so that there are no permission problems while one domain is migrated and others are not? "Phillip Drummond" <w@s.com> wrote in message news:edyXGgGAIHA.3400@TK2MSFTNGP03.phx.gbl... > the root/child design allows for growth and delagation of rights at the > domain level. its actually a microsoft recommended design for the type of > growth we expect > "Jorge Silva" <jorgesilva_pt@hotmail.com> wrote in message > news:uRdJOaGAIHA.5868@TK2MSFTNGP05.phx.gbl... >>> thank you. yes, the root domain will exist solely to hold child domains. >>> there will be no users or computers in the root domain. >> In my opinion this is a bad design, and all it does "according with your >> needs" is a waste of resources, hardware and people. >> >>> does ADMT include the exchange migration piece or is this a separate >>> tool? >>> the new forest will have a new exchange org >> Is a separate tool, comes with exchange. >> >> -- >> I hope that the information above helps you. >> Have a Nice day. >> >> Jorge Silva >> MCSE, MVP Directory Services >> "Phillip Drummond" <w@s.com> wrote in message >> news:eebEPVGAIHA.4836@TK2MSFTNGP06.phx.gbl... >>> thank you. yes, the root domain will exist solely to hold child domains. >>> there will be no users or computers in the root domain. >>> >>> does ADMT include the exchange migration piece or is this a separate >>> tool? >>> the new forest will have a new exchange org >>> >>> "Jorge Silva" <jorgesilva_pt@hotmail.com> wrote in message >>> news:uHxYJLGAIHA.5312@TK2MSFTNGP02.phx.gbl... >>>> Hi >>>> Check inline: >>>>> getting down to the wire now so i need to make final decisions... >>>>> currently have 3 forests, each with 1 domain. 1 domain has an exchange >>>>> org. >>>>> need to consolidate all of this into a new forest with a new exchange >>>>> org. >>>> Ok. >>>> >>>>> the new forest will be a simple one with only a secure root domain, >>>>> and an HQ child domain. >>>> Secure root Domain? what is that? >>>> >>>>> so the users and machines from the current 3 domains will be moved >>>>> into the HQ domain. >>>> Doesn't sound a good option to have a child domain with that >>>> description. >>>> >>>>> does everyone recommend ADMT? >>>> ADMT is good and easy to implement. >>>> >>>>> if so what gotchas can i expect? >>>> The best is to test it, but most situations everything goes well. >>>> >>>>> can ADMT handle this job easily? >>>> Yes. >>>> >>>>> how will existing mailboxes be handled? >>>> You don't mentioned anything about exchange in the second forest, but >>>> you can use the exchange migration tool to migrate the mailboxes to the >>>> other fores and then connect the mailboxes to the user accounts. You >>>> can get more detail about this in MS sweb site or in Exchange ngs. >>>> >>>>> is there true domain synchronization? >>>> No. Is an object migration. >>>> >>>>> when its over is the new domain a mess that needs tons of cleanup? >>>> You only migrate what you want to, so you shouldn't need to clean >>>> nothing after migration. >>>> >>>>> i have done several very large migrations but have always used Quest >>>>> tools. i am not familiar with ADMT. >>>> Download the White paper ADMT and test it on a lab.. >>>> >>>>> if someone with experience could give me a VERY high level step by >>>>> step as to what order i should do things in, >>>>> based on your experience, i would greatly appreciate it. >>>> everything is in MS web site and how to use that tool. >>>> >>>> >>>> -- >>>> I hope that the information above helps you. >>>> Have a Nice day. >>>> >>>> Jorge Silva >>>> MCSE, MVP Directory Services >>>> "Phillip Drummond" <w@s.com> wrote in message >>>> news:%23dqfkGEAIHA.4592@TK2MSFTNGP03.phx.gbl... >>>>> getting down to the wire now so i need to make final decisions... >>>>> currently have 3 forests, each with 1 domain. 1 domain has an exchange >>>>> org. >>>>> need to consolidate all of this into a new forest with a new exchange >>>>> org. >>>>> >>>>> the new forest will be a simple one with only a secure root domain, >>>>> and an HQ child domain. >>>>> so the users and machines from the current 3 domains will be moved >>>>> into the HQ domain. >>>>> >>>>> does everyone recommend ADMT? >>>>> if so what gotchas can i expect? >>>>> can ADMT handle this job easily? >>>>> how will existing mailboxes be handled? >>>>> is there true domain synchronization? >>>>> when its over is the new domain a mess that needs tons of cleanup? >>>>> >>>>> i have done several very large migrations but have always used Quest >>>>> tools. i am not familiar with ADMT. >>>>> if someone with experience could give me a VERY high level step by >>>>> step as to what order i should do things in, >>>>> based on your experience, i would greatly appreciate it. >>>>> >>>>> thank you >>>>> >>>> >>>> >>> > Top From: Jorge Silva <jorgesilva_pt@hotmail.com> To: none Subject: Re: migration planning, need suggestions/advice Date: 09/26/2007 15:01:47 Inline: > the root/child design allows for growth and delagation of rights at the > domain level. its actually a microsoft recommended design for the type of > growth we expect I don't see the need. You can do delegation at the top root domain, you don't gain anything by having child domains to do that. Remember Domains are not Security Boundaries, only Forests are. >with ADMT in my configuration, will i have to do migrate one domain at a >time to the target domain? or can i do multiple? if only one, how do you >recommend i go about this so that there are no permission problems while >one domain is migrated and others are not? http://www.microsoft.com/downloads/details.aspx?FamilyId=6F86937B-533A-466D-A8E8-AFF85AD3D212&displaylang=en http://www.microsoft.com/downloads/details.aspx?familyid=D99EF770-3BBB-4B9E-A8BC-01E9F7EF7342&displaylang=en -- I hope that the information above helps you. Have a Nice day. Jorge Silva MCSE, MVP Directory Services "Phillip Drummond" <w@s.com> wrote in message news:edyXGgGAIHA.3400@TK2MSFTNGP03.phx.gbl... > the root/child design allows for growth and delagation of rights at the > domain level. its actually a microsoft recommended design for the type of > growth we expect > "Jorge Silva" <jorgesilva_pt@hotmail.com> wrote in message > news:uRdJOaGAIHA.5868@TK2MSFTNGP05.phx.gbl... >>> thank you. yes, the root domain will exist solely to hold child domains. >>> there will be no users or computers in the root domain. >> In my opinion this is a bad design, and all it does "according with your >> needs" is a waste of resources, hardware and people. >> >>> does ADMT include the exchange migration piece or is this a separate >>> tool? >>> the new forest will have a new exchange org >> Is a separate tool, comes with exchange. >> >> -- >> I hope that the information above helps you. >> Have a Nice day. >> >> Jorge Silva >> MCSE, MVP Directory Services >> "Phillip Drummond" <w@s.com> wrote in message >> news:eebEPVGAIHA.4836@TK2MSFTNGP06.phx.gbl... >>> thank you. yes, the root domain will exist solely to hold child domains. >>> there will be no users or computers in the root domain. >>> >>> does ADMT include the exchange migration piece or is this a separate >>> tool? >>> the new forest will have a new exchange org >>> >>> "Jorge Silva" <jorgesilva_pt@hotmail.com> wrote in message >>> news:uHxYJLGAIHA.5312@TK2MSFTNGP02.phx.gbl... >>>> Hi >>>> Check inline: >>>>> getting down to the wire now so i need to make final decisions... >>>>> currently have 3 forests, each with 1 domain. 1 domain has an exchange >>>>> org. >>>>> need to consolidate all of this into a new forest with a new exchange >>>>> org. >>>> Ok. >>>> >>>>> the new forest will be a simple one with only a secure root domain, >>>>> and an HQ child domain. >>>> Secure root Domain? what is that? >>>> >>>>> so the users and machines from the current 3 domains will be moved >>>>> into the HQ domain. >>>> Doesn't sound a good option to have a child domain with that >>>> description. >>>> >>>>> does everyone recommend ADMT? >>>> ADMT is good and easy to implement. >>>> >>>>> if so what gotchas can i expect? >>>> The best is to test it, but most situations everything goes well. >>>> >>>>> can ADMT handle this job easily? >>>> Yes. >>>> >>>>> how will existing mailboxes be handled? >>>> You don't mentioned anything about exchange in the second forest, but >>>> you can use the exchange migration tool to migrate the mailboxes to the >>>> other fores and then connect the mailboxes to the user accounts. You >>>> can get more detail about this in MS sweb site or in Exchange ngs. >>>> >>>>> is there true domain synchronization? >>>> No. Is an object migration. >>>> >>>>> when its over is the new domain a mess that needs tons of cleanup? >>>> You only migrate what you want to, so you shouldn't need to clean >>>> nothing after migration. >>>> >>>>> i have done several very large migrations but have always used Quest >>>>> tools. i am not familiar with ADMT. >>>> Download the White paper ADMT and test it on a lab.. >>>> >>>>> if someone with experience could give me a VERY high level step by >>>>> step as to what order i should do things in, >>>>> based on your experience, i would greatly appreciate it. >>>> everything is in MS web site and how to use that tool. >>>> >>>> >>>> -- >>>> I hope that the information above helps you. >>>> Have a Nice day. >>>> >>>> Jorge Silva >>>> MCSE, MVP Directory Services >>>> "Phillip Drummond" <w@s.com> wrote in message >>>> news:%23dqfkGEAIHA.4592@TK2MSFTNGP03.phx.gbl... >>>>> getting down to the wire now so i need to make final decisions... >>>>> currently have 3 forests, each with 1 domain. 1 domain has an exchange >>>>> org. >>>>> need to consolidate all of this into a new forest with a new exchange >>>>> org. >>>>> >>>>> the new forest will be a simple one with only a secure root domain, >>>>> and an HQ child domain. >>>>> so the users and machines from the current 3 domains will be moved >>>>> into the HQ domain. >>>>> >>>>> does everyone recommend ADMT? >>>>> if so what gotchas can i expect? >>>>> can ADMT handle this job easily? >>>>> how will existing mailboxes be handled? >>>>> is there true domain synchronization? >>>>> when its over is the new domain a mess that needs tons of cleanup? >>>>> >>>>> i have done several very large migrations but have always used Quest >>>>> tools. i am not familiar with ADMT. >>>>> if someone with experience could give me a VERY high level step by >>>>> step as to what order i should do things in, >>>>> based on your experience, i would greatly appreciate it. >>>>> >>>>> thank you >>>>> >>>> >>>> >>> > Top From: Phillip Drummond <w@s.com> To: none Subject: Re: migration planning, need suggestions/advice Date: 09/27/2007 08:16:02 the design aloows for true separation during mergers and acquisitions... most companies, when bought out dont want to become an OU in someone elses domain. so this allows us to create child domains for them, and allow them to simply control their own domain without having to granularly delagate rights at the ou level... make sense? how does ADMT handle mailboxes? or doesnt it? in other words when i migrate a user will their mailbox be created in the new domain or will i have to either manually create a mailbox for every user, or use exchange mnigration tools after the user is migrated? "Jorge Silva" <jorgesilva_pt@hotmail.com> wrote in message news:%23KsjMgHAIHA.5752@TK2MSFTNGP02.phx.gbl... > Inline: >> the root/child design allows for growth and delagation of rights at the >> domain level. its actually a microsoft recommended design for the type of >> growth we expect > I don't see the need. You can do delegation at the top root domain, you > don't gain anything by having child domains to do that. Remember Domains > are not Security Boundaries, only Forests are. > >>with ADMT in my configuration, will i have to do migrate one domain at a >>time to the target domain? or can i do multiple? if only one, how do you >>recommend i go about this so that there are no permission problems while >>one domain is migrated and others are not? > http://www.microsoft.com/downloads/details.aspx?FamilyId=6F86937B-533A-466D-A8E8-AFF85AD3D212&displaylang=en > http://www.microsoft.com/downloads/details.aspx?familyid=D99EF770-3BBB-4B9E-A8BC-01E9F7EF7342&displaylang=en > -- > I hope that the information above helps you. > Have a Nice day. > > Jorge Silva > MCSE, MVP Directory Services > "Phillip Drummond" <w@s.com> wrote in message > news:edyXGgGAIHA.3400@TK2MSFTNGP03.phx.gbl... >> the root/child design allows for growth and delagation of rights at the >> domain level. its actually a microsoft recommended design for the type of >> growth we expect >> "Jorge Silva" <jorgesilva_pt@hotmail.com> wrote in message >> news:uRdJOaGAIHA.5868@TK2MSFTNGP05.phx.gbl... >>>> thank you. yes, the root domain will exist solely to hold child >>>> domains. there will be no users or computers in the root domain. >>> In my opinion this is a bad design, and all it does "according with your >>> needs" is a waste of resources, hardware and people. >>> >>>> does ADMT include the exchange migration piece or is this a separate >>>> tool? >>>> the new forest will have a new exchange org >>> Is a separate tool, comes with exchange. >>> >>> -- >>> I hope that the information above helps you. >>> Have a Nice day. >>> >>> Jorge Silva >>> MCSE, MVP Directory Services >>> "Phillip Drummond" <w@s.com> wrote in message >>> news:eebEPVGAIHA.4836@TK2MSFTNGP06.phx.gbl... >>>> thank you. yes, the root domain will exist solely to hold child >>>> domains. there will be no users or computers in the root domain. >>>> >>>> does ADMT include the exchange migration piece or is this a separate >>>> tool? >>>> the new forest will have a new exchange org >>>> >>>> >>>> >>>> "Jorge Silva" <jorgesilva_pt@hotmail.com> wrote in message >>>> news:uHxYJLGAIHA.5312@TK2MSFTNGP02.phx.gbl... >>>>> Hi >>>>> Check inline: >>>>>> getting down to the wire now so i need to make final decisions... >>>>>> currently have 3 forests, each with 1 domain. 1 domain has an >>>>>> exchange org. >>>>>> need to consolidate all of this into a new forest with a new exchange >>>>>> org. >>>>> Ok. >>>>> >>>>>> the new forest will be a simple one with only a secure root domain, >>>>>> and an HQ child domain. >>>>> Secure root Domain? what is that? >>>>> >>>>>> so the users and machines from the current 3 domains will be moved >>>>>> into the HQ domain. >>>>> Doesn't sound a good option to have a child domain with that >>>>> description. >>>>> >>>>>> does everyone recommend ADMT? >>>>> ADMT is good and easy to implement. >>>>> >>>>>> if so what gotchas can i expect? >>>>> The best is to test it, but most situations everything goes well. >>>>> >>>>>> can ADMT handle this job easily? >>>>> Yes. >>>>> >>>>>> how will existing mailboxes be handled? >>>>> You don't mentioned anything about exchange in the second forest, but >>>>> you can use the exchange migration tool to migrate the mailboxes to >>>>> the other fores and then connect the mailboxes to the user accounts. >>>>> You can get more detail about this in MS sweb site or in Exchange ngs. >>>>> >>>>>> is there true domain synchronization? >>>>> No. Is an object migration. >>>>> >>>>>> when its over is the new domain a mess that needs tons of cleanup? >>>>> You only migrate what you want to, so you shouldn't need to clean >>>>> nothing after migration. >>>>> >>>>>> i have done several very large migrations but have always used Quest >>>>>> tools. i am not familiar with ADMT. >>>>> Download the White paper ADMT and test it on a lab.. >>>>> >>>>>> if someone with experience could give me a VERY high level step by >>>>>> step as to what order i should do things in, >>>>>> based on your experience, i would greatly appreciate it. >>>>> everything is in MS web site and how to use that tool. >>>>> >>>>> >>>>> -- >>>>> I hope that the information above helps you. >>>>> Have a Nice day. >>>>> >>>>> Jorge Silva >>>>> MCSE, MVP Directory Services >>>>> "Phillip Drummond" <w@s.com> wrote in message >>>>> news:%23dqfkGEAIHA.4592@TK2MSFTNGP03.phx.gbl... >>>>>> getting down to the wire now so i need to make final decisions... >>>>>> currently have 3 forests, each with 1 domain. 1 domain has an >>>>>> exchange org. >>>>>> need to consolidate all of this into a new forest with a new exchange >>>>>> org. >>>>>> >>>>>> the new forest will be a simple one with only a secure root domain, >>>>>> and an HQ child domain. >>>>>> so the users and machines from the current 3 domains will be moved >>>>>> into the HQ domain. >>>>>> >>>>>> does everyone recommend ADMT? >>>>>> if so what gotchas can i expect? >>>>>> can ADMT handle this job easily? >>>>>> how will existing mailboxes be handled? >>>>>> is there true domain synchronization? >>>>>> when its over is the new domain a mess that needs tons of cleanup? >>>>>> >>>>>> i have done several very large migrations but have always used Quest >>>>>> tools. i am not familiar with ADMT. >>>>>> if someone with experience could give me a VERY high level step by >>>>>> step as to what order i should do things in, >>>>>> based on your experience, i would greatly appreciate it. >>>>>> >>>>>> thank you >>>>>> >>>>> >>>>> >>>> >> Top From: kj [SBS MVP] <KevinJ.SBS@SPAMFREE.gmail.com> To: none Subject: Re: migration planning, need suggestions/advice Date: 09/27/2007 13:39:17 Phillip Drummond wrote: > the design aloows for true separation during mergers and > acquisitions... most companies, when bought out dont want to become > an OU in someone elses domain. so this allows us to create child > domains for them, and allow them to simply control their own domain > without having to granularly delagate rights at the ou level... make > sense? The forest empty root domain faded from popularity when the true AD security boundary (forest) was understood. Many "recommendations" remain in MS KB's that are really obsolete. If you have a TAM, you could be eligible for a free MCS AD design review which would well be worth your while. You have alternative choices for your design objectives. > > how does ADMT handle mailboxes? or doesnt it? in other words when i > migrate a user will their mailbox be created in the new domain or > will i have to either manually create a mailbox for every user, or > use exchange mnigration tools after the user is migrated? ADMT doesn't migrate anything Exchange. You will need to use Exchange migration tools, Exchange version dependant. > > "Jorge Silva" <jorgesilva_pt@hotmail.com> wrote in message > news:%23KsjMgHAIHA.5752@TK2MSFTNGP02.phx.gbl... >> Inline: >>> the root/child design allows for growth and delagation of rights at >>> the domain level. its actually a microsoft recommended design for >>> the type of growth we expect >> I don't see the need. You can do delegation at the top root domain, >> you don't gain anything by having child domains to do that. Remember >> Domains are not Security Boundaries, only Forests are. >> >>> with ADMT in my configuration, will i have to do migrate one domain >>> at a time to the target domain? or can i do multiple? if only one, >>> how do you recommend i go about this so that there are no >>> permission problems while one domain is migrated and others are not? >> http://www.microsoft.com/downloads/details.aspx?FamilyId=6F86937B-533A-466D-A8E8-AFF85AD3D212&displaylang=en >> http://www.microsoft.com/downloads/details.aspx?familyid=D99EF770-3BBB-4B9E-A8BC-01E9F7EF7342&displaylang=en >> -- >> I hope that the information above helps you. >> Have a Nice day. >> >> Jorge Silva >> MCSE, MVP Directory Services >> "Phillip Drummond" <w@s.com> wrote in message >> news:edyXGgGAIHA.3400@TK2MSFTNGP03.phx.gbl... >>> the root/child design allows for growth and delagation of rights at >>> the domain level. its actually a microsoft recommended design for >>> the type of growth we expect >>> "Jorge Silva" <jorgesilva_pt@hotmail.com> wrote in message >>> news:uRdJOaGAIHA.5868@TK2MSFTNGP05.phx.gbl... >>>>> thank you. yes, the root domain will exist solely to hold child >>>>> domains. there will be no users or computers in the root domain. >>>> In my opinion this is a bad design, and all it does "according >>>> with your needs" is a waste of resources, hardware and people. >>>> >>>>> does ADMT include the exchange migration piece or is this a >>>>> separate tool? >>>>> the new forest will have a new exchange org >>>> Is a separate tool, comes with exchange. >>>> >>>> -- >>>> I hope that the information above helps you. >>>> Have a Nice day. >>>> >>>> Jorge Silva >>>> MCSE, MVP Directory Services >>>> "Phillip Drummond" <w@s.com> wrote in message >>>> news:eebEPVGAIHA.4836@TK2MSFTNGP06.phx.gbl... >>>>> thank you. yes, the root domain will exist solely to hold child >>>>> domains. there will be no users or computers in the root domain. >>>>> >>>>> does ADMT include the exchange migration piece or is this a >>>>> separate tool? >>>>> the new forest will have a new exchange org >>>>> >>>>> >>>>> >>>>> "Jorge Silva" <jorgesilva_pt@hotmail.com> wrote in message >>>>> news:uHxYJLGAIHA.5312@TK2MSFTNGP02.phx.gbl... >>>>>> Hi >>>>>> Check inline: >>>>>>> getting down to the wire now so i need to make final >>>>>>> decisions... currently have 3 forests, each with 1 domain. 1 >>>>>>> domain has an exchange org. >>>>>>> need to consolidate all of this into a new forest with a new >>>>>>> exchange org. >>>>>> Ok. >>>>>> >>>>>>> the new forest will be a simple one with only a secure root >>>>>>> domain, and an HQ child domain. >>>>>> Secure root Domain? what is that? >>>>>> >>>>>>> so the users and machines from the current 3 domains will be >>>>>>> moved into the HQ domain. >>>>>> Doesn't sound a good option to have a child domain with that >>>>>> description. >>>>>> >>>>>>> does everyone recommend ADMT? >>>>>> ADMT is good and easy to implement. >>>>>> >>>>>>> if so what gotchas can i expect? >>>>>> The best is to test it, but most situations everything goes well. >>>>>> >>>>>>> can ADMT handle this job easily? >>>>>> Yes. >>>>>> >>>>>>> how will existing mailboxes be handled? >>>>>> You don't mentioned anything about exchange in the second >>>>>> forest, but you can use the exchange migration tool to migrate >>>>>> the mailboxes to the other fores and then connect the mailboxes >>>>>> to the user accounts. You can get more detail about this in MS >>>>>> sweb site or in Exchange ngs. >>>>>>> is there true domain synchronization? >>>>>> No. Is an object migration. >>>>>> >>>>>>> when its over is the new domain a mess that needs tons of >>>>>>> cleanup? >>>>>> You only migrate what you want to, so you shouldn't need to clean >>>>>> nothing after migration. >>>>>> >>>>>>> i have done several very large migrations but have always used >>>>>>> Quest tools. i am not familiar with ADMT. >>>>>> Download the White paper ADMT and test it on a lab.. >>>>>> >>>>>>> if someone with experience could give me a VERY high level step >>>>>>> by step as to what order i should do things in, >>>>>>> based on your experience, i would greatly appreciate it. >>>>>> everything is in MS web site and how to use that tool. >>>>>> >>>>>> >>>>>> -- >>>>>> I hope that the information above helps you. >>>>>> Have a Nice day. >>>>>> >>>>>> Jorge Silva >>>>>> MCSE, MVP Directory Services >>>>>> "Phillip Drummond" <w@s.com> wrote in message >>>>>> news:%23dqfkGEAIHA.4592@TK2MSFTNGP03.phx.gbl... >>>>>>> getting down to the wire now so i need to make final >>>>>>> decisions... currently have 3 forests, each with 1 domain. 1 >>>>>>> domain has an exchange org. >>>>>>> need to consolidate all of this into a new forest with a new >>>>>>> exchange org. >>>>>>> >>>>>>> the new forest will be a simple one with only a secure root >>>>>>> domain, and an HQ child domain. >>>>>>> so the users and machines from the current 3 domains will be >>>>>>> moved into the HQ domain. >>>>>>> >>>>>>> does everyone recommend ADMT? >>>>>>> if so what gotchas can i expect? >>>>>>> can ADMT handle this job easily? >>>>>>> how will existing mailboxes be handled? >>>>>>> is there true domain synchronization? >>>>>>> when its over is the new domain a mess that needs tons of >>>>>>> cleanup? i have done several very large migrations but have always >>>>>>> used >>>>>>> Quest tools. i am not familiar with ADMT. >>>>>>> if someone with experience could give me a VERY high level step >>>>>>> by step as to what order i should do things in, >>>>>>> based on your experience, i would greatly appreciate it. >>>>>>> >>>>>>> thank you -- /kj Top From: Technical <Technical@discussions.microsoft.com> To: none Subject: RE: Netlogon Errors Date: 09/27/2007 12:43:06 looks like connectivity problem .check the imp services and the DNS entry "Jeff" wrote: > On several servers this morning I was unable to login and received the > following message: > > Event Type: Error > Event Source: NETLOGON > Event Category: None > Event ID: 5719 > Date:  9/27/2007 > Time:  8:16:32 AM > User:  N/A > Computer: Server > Description: > This computer was not able to set up a secure session with a domain > controller in domain <mydomain> due to the following: > Not enough storage is available to process this command. > This may lead to authentication problems. Make sure that this computer is > connected to the network. If the problem persists, please contact your > domain administrator. > > ADDITIONAL INFO > If this computer is a domain controller for the specified domain, it sets up > the secure session to the primary domain controller emulator in the > specified domain. Otherwise, this computer sets up the secure session to any > domain controller in the specified domain. > > For more information, see Help and Support Center at > http://go.microsoft.com/fwlink/events.asp. > Data: > 0000: 17 00 00 c0               ...À > > > There were also corresponding events related to the browser service: > > Event Type: Warning > Event Source: BROWSER > Event Category: None > Event ID: 8021 > Date:  9/27/2007 > Time:  4:58:47 AM > User:  N/A > Computer: Server > Description: > The browser service was unable to retrieve a list of servers from the > browser master \\browsemaster on the network > \Device\NetBT_Tcpip_{ACFFABF0-6F47-49AC-A2F4-74B69CA04954}. > >  Browser master: \\browsemaster Network: > \Device\NetBT_Tcpip_{ACFFABF0-6F47-49AC-A2F4-74B69CA04954} > >  This event may be caused by a temporary loss of network connectivity. If > this message appears again, verify that the server is still connected to the > network. The return code is in the Data text box. > > For more information, see Help and Support Center at > http://go.microsoft.com/fwlink/events.asp. > Data: > 0000: 34 00 00 00               4... > > > How do I troubleshoot this? > > Thanks, > > Jeff Top From: Al Mulnick <amulnick_No_SPAM@ncDOTrr.com> To: none Subject: Re: Netlogon Errors Date: 09/27/2007 12:52:52 Did you get any patches lately? New applications? Have any lan issues lately? Any other changes? You may be able to get past it just with a simple reboot to allow whatever changed to fully install.  If the error persists, you may want to have a closer look.  Performance monitor might be a good place to start looking for resources leaks, especially in non-paged memory. Al "Jeff" <jeffpoling@yahoo.com> wrote in message news:uM70%23DSAIHA.4844@TK2MSFTNGP02.phx.gbl... > On several servers this morning I was unable to login and received the > following message: > > Event Type: Error > Event Source: NETLOGON > Event Category: None > Event ID: 5719 > Date:  9/27/2007 > Time:  8:16:32 AM > User:  N/A > Computer: Server > Description: > This computer was not able to set up a secure session with a domain > controller in domain <mydomain> due to the following: > Not enough storage is available to process this command. > This may lead to authentication problems. Make sure that this computer is > connected to the network. If the problem persists, please contact your > domain administrator. > > ADDITIONAL INFO > If this computer is a domain controller for the specified domain, it sets > up the secure session to the primary domain controller emulator in the > specified domain. Otherwise, this computer sets up the secure session to > any domain controller in the specified domain. > > For more information, see Help and Support Center at > http://go.microsoft.com/fwlink/events.asp. > Data: > 0000: 17 00 00 c0               ...À > There were also corresponding events related to the browser service: > > Event Type: Warning > Event Source: BROWSER > Event Category: None > Event ID: 8021 > Date:  9/27/2007 > Time:  4:58:47 AM > User:  N/A > Computer: Server > Description: > The browser service was unable to retrieve a list of servers from the > browser master \\browsemaster on the network > \Device\NetBT_Tcpip_{ACFFABF0-6F47-49AC-A2F4-74B69CA04954}. > > Browser master: \\browsemaster Network: > \Device\NetBT_Tcpip_{ACFFABF0-6F47-49AC-A2F4-74B69CA04954} > > This event may be caused by a temporary loss of network connectivity. If > this message appears again, verify that the server is still connected to > the network. The return code is in the Data text box. > > For more information, see Help and Support Center at > http://go.microsoft.com/fwlink/events.asp. > Data: > 0000: 34 00 00 00               4... > How do I troubleshoot this? > > Thanks, > > Jeff Top From: Charles Woolever <info@existingstations.com> To: none Subject: Re: NT Domain to AD migration Date: 09/25/2007 16:20:18 Right now we're upgrading to W2K. You mention 2003. Is the process the same? Charles In article <#KkHFqw$HHA.5360@TK2MSFTNGP03.phx.gbl>, "Jorge Silva" <jorgesilva_pt@hotmail.com> wrote: > Hi > * Backup the Servers. > > * Take at least one BDC Offline (In case of UPGRADE FAILURE you always can > promote it to a PDC). The only drawback to this method is that all changes > that were made while the safe BDC was offline are lost. To minimize this > loss, you could periodically turn the safe BDC on and off (when the domain > is in a stable state) during the upgrade process, to update its safe copy of > the directory. > > To convert the BDC to a PDC: Start -> Programs -> Administrative Tools -> > Server Manager -> Select the BDC, then go to the Computer Menu -> choose > Promote to primary Domain Controller. > > * Make sure that the Hardware and apps meets the requirements. > > * Make sure that all Apps installed are compatible with W2K3 and don't cause > problems with the upgrade process or pos upgrade process. > > * Run from command prompt: > > Cdsource\I386\winnt32.exe /checkupgradeonly > > - Before Upgrade: > > * You can install a new computer (more powerful) make it a BDC, SYNCRONIZE > and promote it to PDC and them perform the upgrade on the new PDC. > > * Windows 2000/XP always prefer Kerberos authentication, so if the newly > upgraded NT4 to Windows 2003 goes down (Offline), the client machines won't > be able to authenticate in the domain. > > * If this is the case, before upgrade the NT.4 PDC, make the necessary > changes on the registry (NT4Emulator). If the NT4Emulator is configured on > the newly PDC, and you want o upgrade the Existent BDCs, you also need to > create a registry entry on the BDCs (NeutralizeNT4Emulator) before the > upgrade. > > Check: > > Windows 2000-based clients connect only to the domain controller that was > upgraded from Windows NT 4.0 in a mixed-mode domain > > http://support.microsoft.com/?kbid=284937 > > How to prevent overloading on the first domain controller during domain > upgrade > > http://support.microsoft.com/kb/298713/ > > Once that all domain controllers are upgraded, remove the registry settings > created in the previous steps. > > Note: This sometimes may not need: E.g - if all existent BDCs will be sun > upgraded to Windows 2003. > > - Dns Planning: > > Prior to beginning the upgrade from Windows NT Server 4.0 to the Windows > Server 2003 Active Directory service, ensure that you have designed a DNS > and Active Directory namespace and have either configured DNS servers or are > planning to have the Active Directory Installation Wizard automatically > install the DNS service on the domain controller. > > Active Directory is integrated with DNS in the following ways: > > Active Directory and DNS have the same hierarchical structure. Although > separate and implemented differently for different purposes, an > organization's namespace for DNS and Active Directory have an identical > structure. For example, microsoft.com is both a DNS domain and an Active > Directory domain. > > DNS zones can be stored in Active Directory. If you are using the Windows > Server DNS service, primary zone files can be stored in Active Directory for > replication to other Active Directory domain controllers. > > Active Directory uses DNS as a locator service, resolving Active Directory > domain, site, and service names to an IP address. To log on to an Active > Directory domain, an Active Directory client queries its configured DNS > server for the IP address of the Lightweight Directory Access Protocol > (LDAP) service running on a domain controller for a specified domain. > > While Active Directory is integrated with DNS and they share the same > namespace structure, it is important to distinguish the basic difference > between them: > > DNS is a name resolution service. DNS clients send DNS name queries to their > configured DNS server. The DNS server receives the name query and either > resolves the name query through locally stored files or consults another DNS > server for resolution. DNS does not require Active Directory to function. > Active Directory is a directory service. Active Directory provides an > information repository and services to make information available to users > and applications. Active Directory clients send queries to Active Directory > servers using LDAP. In order to locate an Active Directory server, an Active > Directory client queries DNS. Active Directory requires DNS to function. > > If use BIND DNS servers Make sure that you have BIND 8.1.2 > > - Supports: Srv records, Dynamic Updates, Doesn't Support Secure Dynamic > Updates (this is one disadvantage over the MS Dns server Servers, and > represents security issues). > > - Create Primary Zone > > If Use 2003 DNS > > * Create Primary Zone > > * You can use an pre existent Dns or you can create it during the upgrade > process. > > * Convert to AD-Integrated. > > * NetDiag /fix (This is an extra measure, to register the necessary dns > records). > > Check: > > Troubleshooting DNS > > http://technet2.microsoft.com/windowsserver/en/library/e42d510a-443d-4c31-96da > -f66a67a89d861033.mspx?mfr=true > > How to Verify the Creation of SRV Records for a Domain Controller > > http://support.microsoft.com/?id=241515 > > Verify DNS server responsiveness using the nslookup command > > http://technet2.microsoft.com/windowsserver/en/library/f8761f04-d665-4507-9509 > -ebb92bbb66ef1033.mspx?mfr=true > > - The Upgrade. > > * Check if you're on the PDC -> Start -> Programs -> Administrative Tools -> > Server Manager. Right click on Network Neighborhood -> check the name. > > Run from command prompt: > > Cdsource\I386\winnt32 > > * The first server running Windows NT Server 4.0 that you must upgrade is > the primary domain controller (PDC), then you upgrade all remaining BDCs. To > check if you're on the PDC: Start -> Programs -> Administrative Tools -> > Server Manager. > > Check: > > How To Upgrade a Windows NT 4.0-Based PDC to a Windows Server 2003-Based > Domain Controller > http://support.microsoft.com/?id=326209 > > If you don't have windows 2000 (Only NT4 and Windows 2003) in the domain > choose the FFL (Forest Functional Level) Windows 2003 interim. > > * Make sure that your DCs Dns properties point to Right Dns server (usually > the Dc is also a Dns server so it must point to itself). > > * Once you have upgraded the Windows NT Server 4.0 and earlier PDC, you can > proceed to upgrade all remaining BDCs. > > * Make sure that you have 1 GC per site (GCs are needed unless: you only > have one domain, or the DFL is prior to Windows 2000 or Windows 2003). > > * Make sure that network clients point to the Network Dns server only > (Usually the DC). > > * If everything is ok, then and if all DCs are already Windows 2003, now > it's time to remove the registry entries (NT4Emulator, > NeutralizeNT4Emulator), and make the DFL and FFL windows 2003. > > Verifying Active Directory Installation > > http://technet2.microsoft.com/WindowsServer/en/Library/3d157c1a-5c80-... > > > Migrating from Windows NT Server 4.0 to Windows Server 2003 > > http://www.microsoft.com/downloads/details.aspx?FamilyID=e92cf6a0-76f... > Upgrading from Windows NT Server 4.0 > http://www.microsoft.com/windowsserver2003/upgrading/nt4/default.mspx > > > -- > I hope that the information above helps you. > Have a Nice day. > > Jorge Silva > MCSE, MVP Directory Services > "Charles Woolever" <info@existingstations.com> wrote in message > news:info-386A50.20013724092007@news-server.rochester.rr.com... > > I'm helping a small company move from an NT Domain to active directory. > > I've prepped a few things. Some added details: > > > > 1) 1 PCD and 3 BDCs. All 4 have NT4. PCD and 1 BDC are too old to > > upgrade to W2K Server. One BDC on a "newer" machine will get promoted to > > a PCD (old PCD demoted). Old PCD will be left running as a member. Old > > BDC will get turned off. This leaves "newer" PCD and "newer" BDC. > > > > 2) Two "newer" machines will be upgraded to W2K Server. The PDC will > > have AD enabled. > > > > 3) My understanding is that the wizard for AD will see that it was a PDC > > and "convert" things over. > > > > 4) The current domain for NT is..."NT_DOMAIN". I assume that AD will > > want the domain that is used in Internal DNS and what externally is > > used, abcde.com. How will the wizard convert users from "NT_DOMAIN" to > > abcde.com? The suffix used all over already is abcde.com. I was using > > BIND on a Linux box and I'm converting over to MS DDNS for AD and > > dynamic support. > > > > 5) Domain is a simple domain, no tree or forests. No branch offices. It > > actually serves them fine but they want to upgrade to a better Exchange > > and SQL version. All other servers are already W2K. Desktops are W2K and > > XP Pro. > > > > This is a small company with minimal use of servers. There is a file > > server with permissions set via groups for that. There is no print > > server; printers are accessed via TPC/IP. They have Exchange 5.5 SP4. > > Once they move to AD, then they are going to upgrade to Exchange 2003. I > > know I need the AD connector from the W2K server CD for Exchange. There > > is also WINS and DHCP on W2K server. > > > > One other possible issue is a MS SQL 6.5 server that handles a financial > > package. My understanding is they have talked to the company who made > > the software and they are stuck with 6.5. They are looking at purchasing > > a new package ($10K+) but are stuck right now with SQL6.5. > > > > I'd love to hear some tips and suggestions for getting migrated over. > > What to do first, etc.? > > > > Thanks, > > > > Charles Top From: Jorge Silva <jorgesilva_pt@hotmail.com> To: none Subject: Re: NT Domain to AD migration Date: 09/25/2007 16:34:50 Windows 2000? Remember that 2000 is under MS extended support, and soon will be no support for 2000. The steps are basically the same. -- I hope that the information above helps you. Have a Nice day. Jorge Silva MCSE, MVP Directory Services "Charles Woolever" <info@existingstations.com> wrote in message news:info-C59B1D.17201825092007@news-server.rochester.rr.com... > Right now we're upgrading to W2K. You mention 2003. Is the process the > same? > > Charles > > In article <#KkHFqw$HHA.5360@TK2MSFTNGP03.phx.gbl>, > "Jorge Silva" <jorgesilva_pt@hotmail.com> wrote: > >> Hi >> * Backup the Servers. >> >> * Take at least one BDC Offline (In case of UPGRADE FAILURE you always >> can >> promote it to a PDC). The only drawback to this method is that all >> changes >> that were made while the safe BDC was offline are lost. To minimize this >> loss, you could periodically turn the safe BDC on and off (when the >> domain >> is in a stable state) during the upgrade process, to update its safe copy >> of >> the directory. >> >> To convert the BDC to a PDC: Start -> Programs -> Administrative Tools -> >> Server Manager -> Select the BDC, then go to the Computer Menu -> choose >> Promote to primary Domain Controller. >> >> * Make sure that the Hardware and apps meets the requirements. >> >> * Make sure that all Apps installed are compatible with W2K3 and don't >> cause >> problems with the upgrade process or pos upgrade process. >> >> * Run from command prompt: >> >> Cdsource\I386\winnt32.exe /checkupgradeonly >> >> - Before Upgrade: >> >> * You can install a new computer (more powerful) make it a BDC, >> SYNCRONIZE >> and promote it to PDC and them perform the upgrade on the new PDC. >> >> * Windows 2000/XP always prefer Kerberos authentication, so if the newly >> upgraded NT4 to Windows 2003 goes down (Offline), the client machines >> won't >> be able to authenticate in the domain. >> >> * If this is the case, before upgrade the NT.4 PDC, make the necessary >> changes on the registry (NT4Emulator). If the NT4Emulator is configured >> on >> the newly PDC, and you want o upgrade the Existent BDCs, you also need to >> create a registry entry on the BDCs (NeutralizeNT4Emulator) before the >> upgrade. >> >> Check: >> >> Windows 2000-based clients connect only to the domain controller that was >> upgraded from Windows NT 4.0 in a mixed-mode domain >> >> http://support.microsoft.com/?kbid=284937 >> >> How to prevent overloading on the first domain controller during domain >> upgrade >> >> http://support.microsoft.com/kb/298713/ >> >> Once that all domain controllers are upgraded, remove the registry >> settings >> created in the previous steps. >> >> Note: This sometimes may not need: E.g - if all existent BDCs will be sun >> upgraded to Windows 2003. >> >> - Dns Planning: >> >> Prior to beginning the upgrade from Windows NT Server 4.0 to the Windows >> Server 2003 Active Directory service, ensure that you have designed a DNS >> and Active Directory namespace and have either configured DNS servers or >> are >> planning to have the Active Directory Installation Wizard automatically >> install the DNS service on the domain controller. >> >> Active Directory is integrated with DNS in the following ways: >> >> Active Directory and DNS have the same hierarchical structure. Although >> separate and implemented differently for different purposes, an >> organization's namespace for DNS and Active Directory have an identical >> structure. For example, microsoft.com is both a DNS domain and an Active >> Directory domain. >> >> DNS zones can be stored in Active Directory. If you are using the Windows >> Server DNS service, primary zone files can be stored in Active Directory >> for >> replication to other Active Directory domain controllers. >> >> Active Directory uses DNS as a locator service, resolving Active >> Directory >> domain, site, and service names to an IP address. To log on to an Active >> Directory domain, an Active Directory client queries its configured DNS >> server for the IP address of the Lightweight Directory Access Protocol >> (LDAP) service running on a domain controller for a specified domain. >> >> While Active Directory is integrated with DNS and they share the same >> namespace structure, it is important to distinguish the basic difference >> between them: >> >> DNS is a name resolution service. DNS clients send DNS name queries to >> their >> configured DNS server. The DNS server receives the name query and either >> resolves the name query through locally stored files or consults another >> DNS >> server for resolution. DNS does not require Active Directory to function. >> Active Directory is a directory service. Active Directory provides an >> information repository and services to make information available to >> users >> and applications. Active Directory clients send queries to Active >> Directory >> servers using LDAP. In order to locate an Active Directory server, an >> Active >> Directory client queries DNS. Active Directory requires DNS to function. >> >> If use BIND DNS servers Make sure that you have BIND 8.1.2 >> >> - Supports: Srv records, Dynamic Updates, Doesn't Support Secure Dynamic >> Updates (this is one disadvantage over the MS Dns server Servers, and >> represents security issues). >> >> - Create Primary Zone >> >> If Use 2003 DNS >> >> * Create Primary Zone >> >> * You can use an pre existent Dns or you can create it during the upgrade >> process. >> >> * Convert to AD-Integrated. >> >> * NetDiag /fix (This is an extra measure, to register the necessary dns >> records). >> >> Check: >> >> Troubleshooting DNS >> >> http://technet2.microsoft.com/windowsserver/en/library/e42d510a-443d-4c31-96da >> -f66a67a89d861033.mspx?mfr=true >> >> How to Verify the Creation of SRV Records for a Domain Controller >> >> http://support.microsoft.com/?id=241515 >> >> Verify DNS server responsiveness using the nslookup command >> >> http://technet2.microsoft.com/windowsserver/en/library/f8761f04-d665-4507-9509 >> -ebb92bbb66ef1033.mspx?mfr=true >> >> - The Upgrade. >> >> * Check if you're on the PDC -> Start -> Programs -> Administrative >> Tools -> >> Server Manager. Right click on Network Neighborhood -> check the name. >> >> Run from command prompt: >> >> Cdsource\I386\winnt32 >> >> * The first server running Windows NT Server 4.0 that you must upgrade is >> the primary domain controller (PDC), then you upgrade all remaining BDCs. >> To >> check if you're on the PDC: Start -> Programs -> Administrative Tools -> >> Server Manager. >> >> Check: >> >> How To Upgrade a Windows NT 4.0-Based PDC to a Windows Server 2003-Based >> Domain Controller >> http://support.microsoft.com/?id=326209 >> >> If you don't have windows 2000 (Only NT4 and Windows 2003) in the domain >> choose the FFL (Forest Functional Level) Windows 2003 interim. >> >> * Make sure that your DCs Dns properties point to Right Dns server >> (usually >> the Dc is also a Dns server so it must point to itself). >> >> * Once you have upgraded the Windows NT Server 4.0 and earlier PDC, you >> can >> proceed to upgrade all remaining BDCs. >> >> * Make sure that you have 1 GC per site (GCs are needed unless: you only >> have one domain, or the DFL is prior to Windows 2000 or Windows 2003). >> >> * Make sure that network clients point to the Network Dns server only >> (Usually the DC). >> >> * If everything is ok, then and if all DCs are already Windows 2003, now >> it's time to remove the registry entries (NT4Emulator, >> NeutralizeNT4Emulator), and make the DFL and FFL windows 2003. >> >> Verifying Active Directory Installation >> >> http://technet2.microsoft.com/WindowsServer/en/Library/3d157c1a-5c80-... >> Migrating from Windows NT Server 4.0 to Windows Server 2003 >> >> http://www.microsoft.com/downloads/details.aspx?FamilyID=e92cf6a0-76f... >> Upgrading from Windows NT Server 4.0 >> http://www.microsoft.com/windowsserver2003/upgrading/nt4/default.mspx >> -- >> I hope that the information above helps you. >> Have a Nice day. >> >> Jorge Silva >> MCSE, MVP Directory Services >> "Charles Woolever" <info@existingstations.com> wrote in message >> news:info-386A50.20013724092007@news-server.rochester.rr.com... >> > I'm helping a small company move from an NT Domain to active directory. >> > I've prepped a few things. Some added details: >> > >> > 1) 1 PCD and 3 BDCs. All 4 have NT4. PCD and 1 BDC are too old to >> > upgrade to W2K Server. One BDC on a "newer" machine will get promoted >> > to >> > a PCD (old PCD demoted). Old PCD will be left running as a member. Old >> > BDC will get turned off. This leaves "newer" PCD and "newer" BDC. >> > >> > 2) Two "newer" machines will be upgraded to W2K Server. The PDC will >> > have AD enabled. >> > >> > 3) My understanding is that the wizard for AD will see that it was a >> > PDC >> > and "convert" things over. >> > >> > 4) The current domain for NT is..."NT_DOMAIN". I assume that AD will >> > want the domain that is used in Internal DNS and what externally is >> > used, abcde.com. How will the wizard convert users from "NT_DOMAIN" to >> > abcde.com? The suffix used all over already is abcde.com. I was using >> > BIND on a Linux box and I'm converting over to MS DDNS for AD and >> > dynamic support. >> > >> > 5) Domain is a simple domain, no tree or forests. No branch offices. It >> > actually serves them fine but they want to upgrade to a better Exchange >> > and SQL version. All other servers are already W2K. Desktops are W2K >> > and >> > XP Pro. >> > >> > This is a small company with minimal use of servers. There is a file >> > server with permissions set via groups for that. There is no print >> > server; printers are accessed via TPC/IP. They have Exchange 5.5 SP4. >> > Once they move to AD, then they are going to upgrade to Exchange 2003. >> > I >> > know I need the AD connector from the W2K server CD for Exchange. There >> > is also WINS and DHCP on W2K server. >> > >> > One other possible issue is a MS SQL 6.5 server that handles a >> > financial >> > package. My understanding is they have talked to the company who made >> > the software and they are stuck with 6.5. They are looking at >> > purchasing >> > a new package ($10K+) but are stuck right now with SQL6.5. >> > >> > I'd love to hear some tips and suggestions for getting migrated over. >> > What to do first, etc.? >> > >> > Thanks, >> > >> > Charles Top From: Charles Woolever <info@existingstations.com> To: none Subject: Re: NT Domain to AD migration Date: 09/25/2007 17:05:07 Yes, I knew that. The first step is to 2000 and then to 2003. Thanks. Charles In article <u5ncjv7$HHA.4476@TK2MSFTNGP06.phx.gbl>, "Jorge Silva" <jorgesilva_pt@hotmail.com> wrote: > Windows 2000? Remember that 2000 is under MS extended support, and soon will > be no support for 2000. > The steps are basically the same. > > -- > I hope that the information above helps you. > Have a Nice day. > > Jorge Silva > MCSE, MVP Directory Services Top From: Jorge Silva <jorgesilva_pt@hotmail.com> To: none Subject: Re: NT Domain to AD migration Date: 09/25/2007 18:09:10 Good luck. -- I hope that the information above helps you. Have a Nice day. Jorge Silva MCSE, MVP Directory Services "Charles Woolever" <info@existingstations.com> wrote in message news:info-040D89.18050625092007@news-server.rochester.rr.com... > Yes, I knew that. The first step is to 2000 and then to 2003. Thanks. > > Charles > > In article <u5ncjv7$HHA.4476@TK2MSFTNGP06.phx.gbl>, > "Jorge Silva" <jorgesilva_pt@hotmail.com> wrote: > >> Windows 2000? Remember that 2000 is under MS extended support, and soon >> will >> be no support for 2000. >> The steps are basically the same. >> >> -- >> I hope that the information above helps you. >> Have a Nice day. >> >> Jorge Silva >> MCSE, MVP Directory Services Top From: Meinolf Weber <meiweb(nospam)@gmx.de> To: none Subject: Re: Planning to Deploy SP2 on Windows Server 2003 with AD (GC) Date: 09/26/2007 02:02:19 Hello saqib, Please post the complete error message. Also check the event viewer for errors and post them here. Best regards Meinolf Weber Disclaimer: This posting is provided "AS IS" with no warranties, and confers no rights. > Dear, > > Iam trying to update my server SP2 on Windows Server 2003 with AD its > our Global catlog server but its not able to be deployed giving the > msg Access denid even iam using admin ID. please tell which steps to > be taken before deployment so that I can deploy it without any network > disturbance. > > saqib ahmad > Top From: saqib ahmad <saqibahmad@discussions.microsoft.com> To: none Subject: Re: Planning to Deploy SP2 on Windows Server 2003 with AD (GC) Date: 09/27/2007 04:18:00 Dear , It just gives the msg "Access denied" and rollout back every thing. "Meinolf Weber" wrote: > Hello saqib, > > Please post the complete error message. Also check the event viewer for errors > and post them here. > > Best regards > > Meinolf Weber > Disclaimer: This posting is provided "AS IS" with no warranties, and confers > no rights. > > > Dear, > > > > Iam trying to update my server SP2 on Windows Server 2003 with AD its > > our Global catlog server but its not able to be deployed giving the > > msg Access denid even iam using admin ID. please tell which steps to > > be taken before deployment so that I can deploy it without any network > > disturbance. > > > > saqib ahmad > > > Top From: Meinolf Weber <meiweb(nospam)@gmx.de> To: none Subject: Re: Planning to Deploy SP2 on Windows Server 2003 with AD (GC) Date: 09/27/2007 04:27:01 Hello saqib, Do you work at the server or how will you install it. GPO or RDP? Best regards Meinolf Weber Disclaimer: This posting is provided "AS IS" with no warranties, and confers no rights. > Dear , > > It just gives the msg "Access denied" and rollout back every thing. > > "Meinolf Weber" wrote: > >> Hello saqib, >> >> Please post the complete error message. Also check the event viewer >> for errors and post them here. >> >> Best regards >> >> Meinolf Weber >> Disclaimer: This posting is provided "AS IS" with no warranties, and >> confers >> no rights. >>> Dear, >>> >>> Iam trying to update my server SP2 on Windows Server 2003 with AD >>> its our Global catlog server but its not able to be deployed giving >>> the msg Access denid even iam using admin ID. please tell which >>> steps to be taken before deployment so that I can deploy it without >>> any network disturbance. >>> >>> saqib ahmad >>> Top From: saqib ahmad <saqibahmad@discussions.microsoft.com> To: none Subject: Re: Planning to Deploy SP2 on Windows Server 2003 with AD (GC) Date: 09/27/2007 23:27:00 Dear Ian directly deploying on server by administrator ID . saqib ahmad "Meinolf Weber" wrote: > Hello saqib, > > Do you work at the server or how will you install it. GPO or RDP? > > Best regards > > Meinolf Weber > Disclaimer: This posting is provided "AS IS" with no warranties, and confers > no rights. > > > Dear , > > > > It just gives the msg "Access denied" and rollout back every thing. > > > > "Meinolf Weber" wrote: > > > >> Hello saqib, > >> > >> Please post the complete error message. Also check the event viewer > >> for errors and post them here. > >> > >> Best regards > >> > >> Meinolf Weber > >> Disclaimer: This posting is provided "AS IS" with no warranties, and > >> confers > >> no rights. > >>> Dear, > >>> > >>> Iam trying to update my server SP2 on Windows Server 2003 with AD > >>> its our Global catlog server but its not able to be deployed giving > >>> the msg Access denid even iam using admin ID. please tell which > >>> steps to be taken before deployment so that I can deploy it without > >>> any network disturbance. > >>> > >>> saqib ahmad > >>> > Top From: Meinolf Weber <meiweb(nospam)@gmx.de> To: none Subject: Re: Planning to Deploy SP2 on Windows Server 2003 with AD (GC) Date: 09/28/2007 01:45:47 Hello saqib, Check out this one, even it is for SP1: http://support.microsoft.com/kb/873148 Best regards Meinolf Weber Disclaimer: This posting is provided "AS IS" with no warranties, and confers no rights. > Dear > > Ian directly deploying on server by administrator ID . > > saqib ahmad > > "Meinolf Weber" wrote: > >> Hello saqib, >> >> Do you work at the server or how will you install it. GPO or RDP? >> >> Best regards >> >> Meinolf Weber >> Disclaimer: This posting is provided "AS IS" with no warranties, and >> confers >> no rights. >>> Dear , >>> >>> It just gives the msg "Access denied" and rollout back every thing. >>> >>> "Meinolf Weber" wrote: >>> >>>> Hello saqib, >>>> >>>> Please post the complete error message. Also check the event viewer >>>> for errors and post them here. >>>> >>>> Best regards >>>> >>>> Meinolf Weber >>>> Disclaimer: This posting is provided "AS IS" with no warranties, >>>> and >>>> confers >>>> no rights. >>>>> Dear, >>>>> >>>>> Iam trying to update my server SP2 on Windows Server 2003 with AD >>>>> its our Global catlog server but its not able to be deployed >>>>> giving the msg Access denid even iam using admin ID. please tell >>>>> which steps to be taken before deployment so that I can deploy it >>>>> without any network disturbance. >>>>> >>>>> saqib ahmad >>>>> Top From: Jorge Silva <jorgesilva_pt@hotmail.com> To: none Subject: Re: Possible GPO Setting Failure Date: 09/26/2007 12:31:25 Hi Never saw something like that, however you can check in GPO ngs to get more detailled information about that behavior. -- I hope that the information above helps you. Have a Nice day. Jorge Silva MCSE, MVP Directory Services "myoman" <myoman@discussions.microsoft.com> wrote in message news:A1734124-2F9B-448B-9664-5892A6AF7159@microsoft.com... > Environment: > 2 - 2003 R2 SP2 Domain Controllers on the same subnet and connected via > gig > Ethernet. > Servers are new hardware with updated FW. > Client computers are from XP sp2 image with Sysprep. > > I'm helping a peer migrate to AD and we have hit a small, annoying > problem: > The GPO setting "Add the Administrators security group to the roaming user > profile share" seems to be working only about 80 percent of the time. This > is > totally random in nature. A user profile that is created at 10:00 will > have > the NTFS permissions properly applied but one that is created at 11:30 > will > not. Everything else is working great. Event Logs on both DC's show > nothing > out of the ordinary. In fact, no errors are reported at all for AD, DNS > and > FRS. Client EventLogs show nothing either. We are about to enable the > verbose > Winlogon/UserEnv logging option for the clients. > > We have several GPOs in use and the GPO in question is applied to the OU > that contains the client machines and RSOP shows that the GPO is indeed > applied. No errors at all. > > Does anyone have any advice for what should we be looking for on the > servers? Clients? I'd be happy to provide any additional info. > > Thanks for the help, > > Craig > Top From: GeoffD <GeoffD@discussions.microsoft.com> To: none Subject: Re: Printer not publishing in Directory? Date: 09/25/2007 15:10:06 I'm experiencing the same behavior. I have one site, two DCs, and a single server dedicated to printer sharing. Recently, newly created printers stopped appearing in AD. I've confirmed that the server has the SELF create/delete child objects right. I haven't tried the "Check published state" solution, yet, but I will. Still, I'd like to know why the printers aren't getting published at creation time the way they used to. I haven't seen any error events from the spooler relating to this issue. What else could I do to troubleshoot? "Chris Lukowski" wrote: > W00t!!! That did it. Here's the solution for all to see: > > The spooler checks if the printers are in the AD only at init time or if > defined by policy.  Unpublish and publish should do the trick but since it > is not set the policy to verify and publish periodically. > > gpedit.msc > > > Computer Configuration > Administrative Templates > Printers > Check Published state > > > The spooler will verify the printers are published and if not "should" > publish them. > > > --All I had to do was enable that GP setting, restart the spooler, and bang! > My missing printers appeared in the Directory! > > "Jorge Silva" wrote: > > > Hi > > check > > http://groups.google.com/group/microsoft.public.win2000.printing/browse_thread/thread/613aea40906f5b74/74a865bf8ad5d27b?lnk=st&q=Printers+don%27t+show+in+Active+Directory&rnum=2&hl=en#74a865bf8ad5d27b > > > > > > -- > > I hope that the information above helps you. > > Have a Nice day. > > > > Jorge Silva > > MCSE, MVP Directory Services > > "Chris Lukowski" <ChrisLukowski@discussions.microsoft.com> wrote in message > > news:4E3EEC9A-3FA7-4D8F-B7BE-6E69D3E97008@microsoft.com... > > >I just added a new printer to our file and print server running Server 2003 > > > R2. For some reason it's days later and it's still not listed in the > > > Directory. I even tried unchecking, applying, and rechecking and applying > > > the > > > "List in Directory" box but that did nothing. The printer's share name is > > > KyoceraPreticketing. Is there an unmentioned cap on name lengths that > > > could > > > be a problem here? This isn't the first time this has happened either. > > > We're > > > a small shop with only 2 or 3 DCs so I doubt replication is an issue. Can > > > you > > > help me out because I'm stumped? > > > > > > Top From: Jorge Silva <jorgesilva_pt@hotmail.com> To: none Subject: Re: Printer not publishing in Directory? Date: 09/25/2007 15:29:31 restart the printspooler and check the GPO option stated before. -- I hope that the information above helps you. Have a Nice day. Jorge Silva MCSE, MVP Directory Services "GeoffD" <GeoffD@discussions.microsoft.com> wrote in message news:27D6FCB4-FE64-4E75-9429-7BA8A986678E@microsoft.com... > I'm experiencing the same behavior. I have one site, two DCs, and a single > server dedicated to printer sharing. Recently, newly created printers > stopped > appearing in AD. > > I've confirmed that the server has the SELF create/delete child objects > right. > > I haven't tried the "Check published state" solution, yet, but I will. > Still, I'd like to know why the printers aren't getting published at > creation > time the way they used to. I haven't seen any error events from the > spooler > relating to this issue. > > What else could I do to troubleshoot? > > "Chris Lukowski" wrote: > >> W00t!!! That did it. Here's the solution for all to see: >> >> The spooler checks if the printers are in the AD only at init time or if >> defined by policy.  Unpublish and publish should do the trick but since >> it >> is not set the policy to verify and publish periodically. >> >> gpedit.msc >> Computer Configuration >> Administrative Templates >> Printers >> Check Published state >> The spooler will verify the printers are published and if not "should" >> publish them. >> --All I had to do was enable that GP setting, restart the spooler, and >> bang! >> My missing printers appeared in the Directory! >> >> "Jorge Silva" wrote: >> >> > Hi >> > check >> > http://groups.google.com/group/microsoft.public.win2000.printing/browse_thread/thread/613aea40906f5b74/74a865bf8ad5d27b?lnk=st&q=Printers+don%27t+show+in+Active+Directory&rnum=2&hl=en#74a865bf8ad5d27b >> > >> > >> > -- >> > I hope that the information above helps you. >> > Have a Nice day. >> > >> > Jorge Silva >> > MCSE, MVP Directory Services >> > "Chris Lukowski" <ChrisLukowski@discussions.microsoft.com> wrote in >> > message >> > news:4E3EEC9A-3FA7-4D8F-B7BE-6E69D3E97008@microsoft.com... >> > >I just added a new printer to our file and print server running Server >> > >2003 >> > > R2. For some reason it's days later and it's still not listed in the >> > > Directory. I even tried unchecking, applying, and rechecking and >> > > applying >> > > the >> > > "List in Directory" box but that did nothing. The printer's share >> > > name is >> > > KyoceraPreticketing. Is there an unmentioned cap on name lengths that >> > > could >> > > be a problem here? This isn't the first time this has happened >> > > either. >> > > We're >> > > a small shop with only 2 or 3 DCs so I doubt replication is an issue. >> > > Can >> > > you >> > > help me out because I'm stumped? >> > >> > >> > Top From: Will <westes-usc@noemail.nospam> To: none Subject: Re: Problems With Kerberos Authentication Date: 09/25/2007 17:50:39 "Jorge Silva" <jorgesilva_pt@hotmail.com> wrote in message news:e7q9Uw6$HHA.3716@TK2MSFTNGP03.phx.gbl... > Network browsing is NetBIOS resolution dependent, that's by design, in > different subnets you need WINS. We are not using Network Browsing, if by that you mean the use of Network Neighborhood.    When you turn off NetBIOS over TCP you lose that capability entirely. We were issuing command line net view \\DC4 which is a specific command directed at specific hostname, resolvable through DNS. -- Will > "Will" <westes-usc@noemail.nospam> wrote in message > news:_pudnZIIsf7b_GTbnZ2dnUVZ_r6rnZ2d@giganews.com... >> "Paul Bergson [MVP-DS]" <pbergson@allete_nospam.com> wrote in message >> news:uhyCru2$HHA.4880@TK2MSFTNGP03.phx.gbl... >>> Do you point your dc to a WINS server on its NIC configuration?  It >>> needs >> to >>> be on the same subnet as where you are attempting this test or be >> registered >>> with a WINS server. >> >> We haven't used WINs in seven years, and nearly every machine we have is >> on >> a different subnet.    We turn off NetBIOS over TCP, and ports 137, 138, >> and >> 139 are dirty words in our office. :) >> >> In any case, I don't see any attempt by client to locate the server by >> any >> method other than DNS.   The problem is the client is sending out a >> Kerberos >> request just for this one DC using some malformed Kerberos request and >> getting back a rejection.   All of that activity takes place between >> client >> and another DC on port 88 (from memory). >> >> Note that from my example, DC1, DC2, DC3, and DC4 are all on different >> subnets than the client.   Net View works to all DCs except DC4.   So >> subnetting is not the unique variable associated with the failure case. >> >> -- >> Will Top From: Jorge Silva <jorgesilva_pt@hotmail.com> To: none Subject: Re: Problems With Kerberos Authentication Date: 09/25/2007 18:12:00 That's correct, I was just re-stating previous posts regardind to that resolution mechanism. Regarding to the Access is DENIED error, did you tried the KB that I provided you? -- I hope that the information above helps you. Have a Nice day. Jorge Silva MCSE, MVP Directory Services "Will" <westes-usc@noemail.nospam> wrote in message news:q72dnW-4l7pdDWTbnZ2dnUVZ_hudnZ2d@giganews.com... > "Jorge Silva" <jorgesilva_pt@hotmail.com> wrote in message > news:e7q9Uw6$HHA.3716@TK2MSFTNGP03.phx.gbl... >> Network browsing is NetBIOS resolution dependent, that's by design, in >> different subnets you need WINS. > > We are not using Network Browsing, if by that you mean the use of Network > Neighborhood.    When you turn off NetBIOS over TCP you lose that > capability entirely. > > We were issuing command line net view \\DC4 which is a specific command > directed at specific hostname, resolvable through DNS. > > -- > Will > >> "Will" <westes-usc@noemail.nospam> wrote in message >> news:_pudnZIIsf7b_GTbnZ2dnUVZ_r6rnZ2d@giganews.com... >>> "Paul Bergson [MVP-DS]" <pbergson@allete_nospam.com> wrote in message >>> news:uhyCru2$HHA.4880@TK2MSFTNGP03.phx.gbl... >>>> Do you point your dc to a WINS server on its NIC configuration?  It >>>> needs >>> to >>>> be on the same subnet as where you are attempting this test or be >>> registered >>>> with a WINS server. >>> >>> We haven't used WINs in seven years, and nearly every machine we have is >>> on >>> a different subnet.    We turn off NetBIOS over TCP, and ports 137, 138, >>> and >>> 139 are dirty words in our office. :) >>> >>> In any case, I don't see any attempt by client to locate the server by >>> any >>> method other than DNS.   The problem is the client is sending out a >>> Kerberos >>> request just for this one DC using some malformed Kerberos request and >>> getting back a rejection.   All of that activity takes place between >>> client >>> and another DC on port 88 (from memory). >>> >>> Note that from my example, DC1, DC2, DC3, and DC4 are all on different >>> subnets than the client.   Net View works to all DCs except DC4.   So >>> subnetting is not the unique variable associated with the failure case. >>> >>> -- >>> Will Top From: Will <westes-usc@noemail.nospam> To: none Subject: Re: Problems With Kerberos Authentication Date: 09/25/2007 18:41:00 "Jorge Silva" <jorgesilva_pt@hotmail.com> wrote in message news:OM1A2l8$HHA.3916@TK2MSFTNGP02.phx.gbl... > That's correct, I was just re-stating previous posts regardind to that > resolution mechanism. > > Regarding to the Access is DENIED error, did you tried the KB that I > provided you? Maybe I'm thinking of the wrong one, but the KB you sent was for resetting the password of a domain controller? That sounds like a serious thing to do, potentially destabilizing, and why would it be an appropriate step to take when it is the client that is malforming a Kerberos request to use the DC?   I'm willing to try it if there is a reason to try it, but it seemed a bit random. -- Will > "Will" <westes-usc@noemail.nospam> wrote in message > news:q72dnW-4l7pdDWTbnZ2dnUVZ_hudnZ2d@giganews.com... >> "Jorge Silva" <jorgesilva_pt@hotmail.com> wrote in message >> news:e7q9Uw6$HHA.3716@TK2MSFTNGP03.phx.gbl... >>> Network browsing is NetBIOS resolution dependent, that's by design, in >>> different subnets you need WINS. >> >> We are not using Network Browsing, if by that you mean the use of Network >> Neighborhood.    When you turn off NetBIOS over TCP you lose that >> capability entirely. >> >> We were issuing command line net view \\DC4 which is a specific command >> directed at specific hostname, resolvable through DNS. >> >> -- >> Will >> >>> "Will" <westes-usc@noemail.nospam> wrote in message >>> news:_pudnZIIsf7b_GTbnZ2dnUVZ_r6rnZ2d@giganews.com... >>>> "Paul Bergson [MVP-DS]" <pbergson@allete_nospam.com> wrote in message >>>> news:uhyCru2$HHA.4880@TK2MSFTNGP03.phx.gbl... >>>>> Do you point your dc to a WINS server on its NIC configuration?  It >>>>> needs >>>> to >>>>> be on the same subnet as where you are attempting this test or be >>>> registered >>>>> with a WINS server. >>>> >>>> We haven't used WINs in seven years, and nearly every machine we have >>>> is on >>>> a different subnet.    We turn off NetBIOS over TCP, and ports 137, >>>> 138, and >>>> 139 are dirty words in our office. :) >>>> >>>> In any case, I don't see any attempt by client to locate the server by >>>> any >>>> method other than DNS.   The problem is the client is sending out a >>>> Kerberos >>>> request just for this one DC using some malformed Kerberos request and >>>> getting back a rejection.   All of that activity takes place between >>>> client >>>> and another DC on port 88 (from memory). >>>> >>>> Note that from my example, DC1, DC2, DC3, and DC4 are all on different >>>> subnets than the client.   Net View works to all DCs except DC4.   So >>>> subnetting is not the unique variable associated with the failure case. >>>> >>>> -- >>>> Will Top From: Jorge Silva <jorgesilva_pt@hotmail.com> To: none Subject: Re: Problems With Kerberos Authentication Date: 09/25/2007 18:50:41 I though that the error was from server. If you type the \\ipaddress of the server can you get access to it? -- I hope that the information above helps you. Have a Nice day. Jorge Silva MCSE, MVP Directory Services "Will" <westes-usc@noemail.nospam> wrote in message news:5aOdnRCYR4oQAWTbnZ2dnUVZ_v2unZ2d@giganews.com... > "Jorge Silva" <jorgesilva_pt@hotmail.com> wrote in message > news:OM1A2l8$HHA.3916@TK2MSFTNGP02.phx.gbl... >> That's correct, I was just re-stating previous posts regardind to that >> resolution mechanism. >> >> Regarding to the Access is DENIED error, did you tried the KB that I >> provided you? > > Maybe I'm thinking of the wrong one, but the KB you sent was for resetting > the password of a domain controller? > > That sounds like a serious thing to do, potentially destabilizing, and why > would it be an appropriate step to take when it is the client that is > malforming a Kerberos request to use the DC?   I'm willing to try it if > there is a reason to try it, but it seemed a bit random. > > -- > Will >> "Will" <westes-usc@noemail.nospam> wrote in message >> news:q72dnW-4l7pdDWTbnZ2dnUVZ_hudnZ2d@giganews.com... >>> "Jorge Silva" <jorgesilva_pt@hotmail.com> wrote in message >>> news:e7q9Uw6$HHA.3716@TK2MSFTNGP03.phx.gbl... >>>> Network browsing is NetBIOS resolution dependent, that's by design, in >>>> different subnets you need WINS. >>> >>> We are not using Network Browsing, if by that you mean the use of >>> Network Neighborhood.    When you turn off NetBIOS over TCP you lose >>> that capability entirely. >>> >>> We were issuing command line net view \\DC4 which is a specific command >>> directed at specific hostname, resolvable through DNS. >>> >>> -- >>> Will >>> >>>> "Will" <westes-usc@noemail.nospam> wrote in message >>>> news:_pudnZIIsf7b_GTbnZ2dnUVZ_r6rnZ2d@giganews.com... >>>>> "Paul Bergson [MVP-DS]" <pbergson@allete_nospam.com> wrote in message >>>>> news:uhyCru2$HHA.4880@TK2MSFTNGP03.phx.gbl... >>>>>> Do you point your dc to a WINS server on its NIC configuration?  It >>>>>> needs >>>>> to >>>>>> be on the same subnet as where you are attempting this test or be >>>>> registered >>>>>> with a WINS server. >>>>> >>>>> We haven't used WINs in seven years, and nearly every machine we have >>>>> is on >>>>> a different subnet.    We turn off NetBIOS over TCP, and ports 137, >>>>> 138, and >>>>> 139 are dirty words in our office. :) >>>>> >>>>> In any case, I don't see any attempt by client to locate the server by >>>>> any >>>>> method other than DNS.   The problem is the client is sending out a >>>>> Kerberos >>>>> request just for this one DC using some malformed Kerberos request and >>>>> getting back a rejection.   All of that activity takes place between >>>>> client >>>>> and another DC on port 88 (from memory). >>>>> >>>>> Note that from my example, DC1, DC2, DC3, and DC4 are all on different >>>>> subnets than the client.   Net View works to all DCs except DC4.   So >>>>> subnetting is not the unique variable associated with the failure >>>>> case. >>>>> >>>>> -- >>>>> Will Top From: Andy C <acracchiolo@fluidmaster.com> To: none Subject: Re: Problems With Kerberos Authentication Date: 09/25/2007 19:09:58 I cannot get into the 'network' it says access denied.  So I cant get a computer name or anything to do that to.  I was wondering how I could find the computer that is generating that network name on my network neighborhood. "Jorge Silva" <jorgesilva_pt@hotmail.com> wrote in message news:uRuSd78$HHA.5164@TK2MSFTNGP05.phx.gbl... >I though that the error was from server. > If you type the \\ipaddress of the server can you get access to it? > > -- > I hope that the information above helps you. > Have a Nice day. > > Jorge Silva > MCSE, MVP Directory Services > "Will" <westes-usc@noemail.nospam> wrote in message > news:5aOdnRCYR4oQAWTbnZ2dnUVZ_v2unZ2d@giganews.com... >> "Jorge Silva" <jorgesilva_pt@hotmail.com> wrote in message >> news:OM1A2l8$HHA.3916@TK2MSFTNGP02.phx.gbl... >>> That's correct, I was just re-stating previous posts regardind to that >>> resolution mechanism. >>> >>> Regarding to the Access is DENIED error, did you tried the KB that I >>> provided you? >> >> Maybe I'm thinking of the wrong one, but the KB you sent was for >> resetting the password of a domain controller? >> >> That sounds like a serious thing to do, potentially destabilizing, and >> why would it be an appropriate step to take when it is the client that is >> malforming a Kerberos request to use the DC?   I'm willing to try it if >> there is a reason to try it, but it seemed a bit random. >> >> -- >> Will >>> "Will" <westes-usc@noemail.nospam> wrote in message >>> news:q72dnW-4l7pdDWTbnZ2dnUVZ_hudnZ2d@giganews.com... >>>> "Jorge Silva" <jorgesilva_pt@hotmail.com> wrote in message >>>> news:e7q9Uw6$HHA.3716@TK2MSFTNGP03.phx.gbl... >>>>> Network browsing is NetBIOS resolution dependent, that's by design, in >>>>> different subnets you need WINS. >>>> >>>> We are not using Network Browsing, if by that you mean the use of >>>> Network Neighborhood.    When you turn off NetBIOS over TCP you lose >>>> that capability entirely. >>>> >>>> We were issuing command line net view \\DC4 which is a specific command >>>> directed at specific hostname, resolvable through DNS. >>>> >>>> -- >>>> Will >>>> >>>>> "Will" <westes-usc@noemail.nospam> wrote in message >>>>> news:_pudnZIIsf7b_GTbnZ2dnUVZ_r6rnZ2d@giganews.com... >>>>>> "Paul Bergson [MVP-DS]" <pbergson@allete_nospam.com> wrote in message >>>>>> news:uhyCru2$HHA.4880@TK2MSFTNGP03.phx.gbl... >>>>>>> Do you point your dc to a WINS server on its NIC configuration?  It >>>>>>> needs >>>>>> to >>>>>>> be on the same subnet as where you are attempting this test or be >>>>>> registered >>>>>>> with a WINS server. >>>>>> >>>>>> We haven't used WINs in seven years, and nearly every machine we have >>>>>> is on >>>>>> a different subnet.    We turn off NetBIOS over TCP, and ports 137, >>>>>> 138, and >>>>>> 139 are dirty words in our office. :) >>>>>> >>>>>> In any case, I don't see any attempt by client to locate the server >>>>>> by any >>>>>> method other than DNS.   The problem is the client is sending out a >>>>>> Kerberos >>>>>> request just for this one DC using some malformed Kerberos request >>>>>> and >>>>>> getting back a rejection.   All of that activity takes place between >>>>>> client >>>>>> and another DC on port 88 (from memory). >>>>>> >>>>>> Note that from my example, DC1, DC2, DC3, and DC4 are all on >>>>>> different >>>>>> subnets than the client.   Net View works to all DCs except DC4.   So >>>>>> subnetting is not the unique variable associated with the failure >>>>>> case. >>>>>> >>>>>> -- >>>>>> Will >>>> >>>> Top From: Andy C <acracchiolo@fluidmaster.com> To: none Subject: Re: Problems With Kerberos Authentication Date: 09/25/2007 19:20:01 SORRY WRONG POST "Andy C" <acracchiolo@fluidmaster.com> wrote in message news:Ox6NWG9$HHA.5184@TK2MSFTNGP02.phx.gbl... >I cannot get into the 'network' it says access denied.  So I cant get a >computer name or anything to do that to.  I was wondering how I could find >the computer that is generating that network name on my network >neighborhood. > > "Jorge Silva" <jorgesilva_pt@hotmail.com> wrote in message > news:uRuSd78$HHA.5164@TK2MSFTNGP05.phx.gbl... >>I though that the error was from server. >> If you type the \\ipaddress of the server can you get access to it? >> >> -- >> I hope that the information above helps you. >> Have a Nice day. >> >> Jorge Silva >> MCSE, MVP Directory Services >> "Will" <westes-usc@noemail.nospam> wrote in message >> news:5aOdnRCYR4oQAWTbnZ2dnUVZ_v2unZ2d@giganews.com... >>> "Jorge Silva" <jorgesilva_pt@hotmail.com> wrote in message >>> news:OM1A2l8$HHA.3916@TK2MSFTNGP02.phx.gbl... >>>> That's correct, I was just re-stating previous posts regardind to that >>>> resolution mechanism. >>>> >>>> Regarding to the Access is DENIED error, did you tried the KB that I >>>> provided you? >>> >>> Maybe I'm thinking of the wrong one, but the KB you sent was for >>> resetting the password of a domain controller? >>> >>> That sounds like a serious thing to do, potentially destabilizing, and >>> why would it be an appropriate step to take when it is the client that >>> is malforming a Kerberos request to use the DC?   I'm willing to try it >>> if there is a reason to try it, but it seemed a bit random. >>> >>> -- >>> Will >>>> "Will" <westes-usc@noemail.nospam> wrote in message >>>> news:q72dnW-4l7pdDWTbnZ2dnUVZ_hudnZ2d@giganews.com... >>>>> "Jorge Silva" <jorgesilva_pt@hotmail.com> wrote in message >>>>> news:e7q9Uw6$HHA.3716@TK2MSFTNGP03.phx.gbl... >>>>>> Network browsing is NetBIOS resolution dependent, that's by design, >>>>>> in different subnets you need WINS. >>>>> >>>>> We are not using Network Browsing, if by that you mean the use of >>>>> Network Neighborhood.    When you turn off NetBIOS over TCP you lose >>>>> that capability entirely. >>>>> >>>>> We were issuing command line net view \\DC4 which is a specific >>>>> command directed at specific hostname, resolvable through DNS. >>>>> >>>>> -- >>>>> Will >>>>> >>>>>> "Will" <westes-usc@noemail.nospam> wrote in message >>>>>> news:_pudnZIIsf7b_GTbnZ2dnUVZ_r6rnZ2d@giganews.com... >>>>>>> "Paul Bergson [MVP-DS]" <pbergson@allete_nospam.com> wrote in >>>>>>> message >>>>>>> news:uhyCru2$HHA.4880@TK2MSFTNGP03.phx.gbl... >>>>>>>> Do you point your dc to a WINS server on its NIC configuration?  It >>>>>>>> needs >>>>>>> to >>>>>>>> be on the same subnet as where you are attempting this test or be >>>>>>> registered >>>>>>>> with a WINS server. >>>>>>> >>>>>>> We haven't used WINs in seven years, and nearly every machine we >>>>>>> have is on >>>>>>> a different subnet.    We turn off NetBIOS over TCP, and ports 137, >>>>>>> 138, and >>>>>>> 139 are dirty words in our office. :) >>>>>>> >>>>>>> In any case, I don't see any attempt by client to locate the server >>>>>>> by any >>>>>>> method other than DNS.   The problem is the client is sending out a >>>>>>> Kerberos >>>>>>> request just for this one DC using some malformed Kerberos request >>>>>>> and >>>>>>> getting back a rejection.   All of that activity takes place between >>>>>>> client >>>>>>> and another DC on port 88 (from memory). >>>>>>> >>>>>>> Note that from my example, DC1, DC2, DC3, and DC4 are all on >>>>>>> different >>>>>>> subnets than the client.   Net View works to all DCs except DC4. >>>>>>> So >>>>>>> subnetting is not the unique variable associated with the failure >>>>>>> case. >>>>>>> >>>>>>> -- >>>>>>> Will >>>>> >>>>> >>>> >>>> Top From: Will <westes-usc@noemail.nospam> To: none Subject: Re: Problems With Kerberos Authentication Date: 09/25/2007 20:23:59 "Jorge Silva" <jorgesilva_pt@hotmail.com> wrote in message news:uRuSd78$HHA.5164@TK2MSFTNGP05.phx.gbl... >I though that the error was from server. > If you type the \\ipaddress of the server can you get access to it? Yes, as stated in original message, either of these variants works: net view \\dc4.my.domain.com        // the FQDN net view \\<ip-of-dc4> Only simple NetBIOS name version fails: net view \\dc4 What's truly bizarre to me is that the client generates *NO* kerberos traffic for the two variants that work, but seems to feel a need to generate Kerberos traffic (ill formed request) for the case that fails. The whole algorithm for how authentication is done appears totally different for the two cases of FQDN versus simple NetBIOS name. -- Will > "Will" <westes-usc@noemail.nospam> wrote in message > news:5aOdnRCYR4oQAWTbnZ2dnUVZ_v2unZ2d@giganews.com... >> "Jorge Silva" <jorgesilva_pt@hotmail.com> wrote in message >> news:OM1A2l8$HHA.3916@TK2MSFTNGP02.phx.gbl... >>> That's correct, I was just re-stating previous posts regardind to that >>> resolution mechanism. >>> >>> Regarding to the Access is DENIED error, did you tried the KB that I >>> provided you? >> >> Maybe I'm thinking of the wrong one, but the KB you sent was for >> resetting the password of a domain controller? >> >> That sounds like a serious thing to do, potentially destabilizing, and >> why would it be an appropriate step to take when it is the client that is >> malforming a Kerberos request to use the DC?   I'm willing to try it if >> there is a reason to try it, but it seemed a bit random. >> >> -- >> Will >>> "Will" <westes-usc@noemail.nospam> wrote in message >>> news:q72dnW-4l7pdDWTbnZ2dnUVZ_hudnZ2d@giganews.com... >>>> "Jorge Silva" <jorgesilva_pt@hotmail.com> wrote in message >>>> news:e7q9Uw6$HHA.3716@TK2MSFTNGP03.phx.gbl... >>>>> Network browsing is NetBIOS resolution dependent, that's by design, in >>>>> different subnets you need WINS. >>>> >>>> We are not using Network Browsing, if by that you mean the use of >>>> Network Neighborhood.    When you turn off NetBIOS over TCP you lose >>>> that capability entirely. >>>> >>>> We were issuing command line net view \\DC4 which is a specific command >>>> directed at specific hostname, resolvable through DNS. >>>> >>>> -- >>>> Will >>>> >>>>> "Will" <westes-usc@noemail.nospam> wrote in message >>>>> news:_pudnZIIsf7b_GTbnZ2dnUVZ_r6rnZ2d@giganews.com... >>>>>> "Paul Bergson [MVP-DS]" <pbergson@allete_nospam.com> wrote in message >>>>>> news:uhyCru2$HHA.4880@TK2MSFTNGP03.phx.gbl... >>>>>>> Do you point your dc to a WINS server on its NIC configuration?  It >>>>>>> needs >>>>>> to >>>>>>> be on the same subnet as where you are attempting this test or be >>>>>> registered >>>>>>> with a WINS server. >>>>>> >>>>>> We haven't used WINs in seven years, and nearly every machine we have >>>>>> is on >>>>>> a different subnet.    We turn off NetBIOS over TCP, and ports 137, >>>>>> 138, and >>>>>> 139 are dirty words in our office. :) >>>>>> >>>>>> In any case, I don't see any attempt by client to locate the server >>>>>> by any >>>>>> method other than DNS.   The problem is the client is sending out a >>>>>> Kerberos >>>>>> request just for this one DC using some malformed Kerberos request >>>>>> and >>>>>> getting back a rejection.   All of that activity takes place between >>>>>> client >>>>>> and another DC on port 88 (from memory). >>>>>> >>>>>> Note that from my example, DC1, DC2, DC3, and DC4 are all on >>>>>> different >>>>>> subnets than the client.   Net View works to all DCs except DC4.   So >>>>>> subnetting is not the unique variable associated with the failure >>>>>> case. >>>>>> >>>>>> -- >>>>>> Will >>>> >>>> Top From: Andy C <acracchiolo@fluidmaster.com> To: none Subject: Re: R2 Schema Extension Date: 09/27/2007 19:40:07 Do you have any more information on this error? "Toby1Kinobe" <tw@tw.com> wrote in message news:fdhbse$ls7$1@news-01.bur.connect.com.au... > Hi, > > I am trying to upgrade server 2003 (sp2) to R2 and am getting errors > whilst extending the Schema (from 30 to 31). In the debug log I have an > ldif.err.31 which reads: > > Entry DN: > CN=PosixAccount,CN=Schema,CN=Configuration,DC=xxx,DC=xxx,DC=xxx,DC=xxx,DC=xxx > Add error on line 1519: Unwilling To Perform > > The server side error is "Schema update failed: Rdn-Att-Id has wrong > syntax." > > An error has occurred in the program > > I believe that some 3rd party application (not sure what, maybe the 1 mac > pc on our domain) may have incorrectly extended the schema at some stage. > This appears to be a Unix type error (we dont have nor ever have had unix > services on the network). > Has anyone seen this before/resolved the issue? > I have see 1 post that suggests I need to defunct the offending UID > attribute, any thoughts? > > We are getting very frustrated with this as its holding up many other > projects, any help would be gratefully received, > > Thanks > Top From: Toby1Kinobe <toby1kinobe@gmail.com> To: none Subject: Re: R2 Schema Extension Date: 09/27/2007 20:17:39 Sorry what other information do you need?, the error from the debug log is posted below. The R2 schema extension fails, Thanks "Andy C" <acracchiolo@fluidmaster.com> wrote in message news:%23QZsfgWAIHA.4836@TK2MSFTNGP06.phx.gbl... > Do you have any more information on this error? > "Toby1Kinobe" <tw@tw.com> wrote in message > news:fdhbse$ls7$1@news-01.bur.connect.com.au... >> Hi, >> >> I am trying to upgrade server 2003 (sp2) to R2 and am getting errors >> whilst extending the Schema (from 30 to 31). In the debug log I have an >> ldif.err.31 which reads: >> >> Entry DN: >> CN=PosixAccount,CN=Schema,CN=Configuration,DC=xxx,DC=xxx,DC=xxx,DC=xxx,DC=xxx >> Add error on line 1519: Unwilling To Perform >> >> The server side error is "Schema update failed: Rdn-Att-Id has wrong >> syntax." >> >> An error has occurred in the program >> >> I believe that some 3rd party application (not sure what, maybe the 1 mac >> pc on our domain) may have incorrectly extended the schema at some stage. >> This appears to be a Unix type error (we dont have nor ever have had unix >> services on the network). >> Has anyone seen this before/resolved the issue? >> I have see 1 post that suggests I need to defunct the offending UID >> attribute, any thoughts? >> >> We are getting very frustrated with this as its holding up many other >> projects, any help would be gratefully received, >> >> Thanks >> Top From: Ryan Hanisco <RyanHanisco@discussions.microsoft.com> To: none Subject: Re: R2 Schema Extension Date: 09/27/2007 22:29:01 Hi Toby, Is this a 64 bit machine.  There are occasionally some issues with that and a few work arounds? -- Ryan Hanisco MCSE, MCTS: SQL 2005, Project+ www.techsterity.com Chicago, IL Remember: Marking helpful answers helps everyone find the info they need quickly. "Toby1Kinobe" wrote: > Sorry what other information do you need?, the error from the debug log is > posted below. The R2 schema extension fails, > Thanks > > "Andy C" <acracchiolo@fluidmaster.com> wrote in message > news:%23QZsfgWAIHA.4836@TK2MSFTNGP06.phx.gbl... > > Do you have any more information on this error? > > > > > > "Toby1Kinobe" <tw@tw.com> wrote in message > > news:fdhbse$ls7$1@news-01.bur.connect.com.au... > >> Hi, > >> > >> I am trying to upgrade server 2003 (sp2) to R2 and am getting errors > >> whilst extending the Schema (from 30 to 31). In the debug log I have an > >> ldif.err.31 which reads: > >> > >> Entry DN: > >> CN=PosixAccount,CN=Schema,CN=Configuration,DC=xxx,DC=xxx,DC=xxx,DC=xxx,DC=xxx > >> Add error on line 1519: Unwilling To Perform > >> > >> The server side error is "Schema update failed: Rdn-Att-Id has wrong > >> syntax." > >> > >> An error has occurred in the program > >> > >> I believe that some 3rd party application (not sure what, maybe the 1 mac > >> pc on our domain) may have incorrectly extended the schema at some stage. > >> This appears to be a Unix type error (we dont have nor ever have had unix > >> services on the network). > >> Has anyone seen this before/resolved the issue? > >> I have see 1 post that suggests I need to defunct the offending UID > >> attribute, any thoughts? > >> > >> We are getting very frustrated with this as its holding up many other > >> projects, any help would be gratefully received, > >> > >> Thanks > >> > > > > > Top From: Toby1Kinobe <toby1kinobe@gmail.com> To: none Subject: Re: R2 Schema Extension Date: 09/27/2007 23:22:39 Hi Ryan, No unfortunately it is a 32bit machine. We have tried seizing the FSMO role on different DC's in the domain and attempted the upgrade again (at Microsoft's request) and still no joy (we are essentialy just passing the broken schema around!). I feel that we need to find the entry in the schema that is confilicting with the R2 base schema (possibly possix, as per the dump) and either delete it or rectify the conflict. Not sure how we go about this though and MS dont seem to have a answers, this has been with them for a number of weeks. Cheers, Toby "Ryan Hanisco" <RyanHanisco@discussions.microsoft.com> wrote in message news:EC5674E9-70EE-4CE0-AF06-A56BFB956F18@microsoft.com... > Hi Toby, > > Is this a 64 bit machine.  There are occasionally some issues with that > and > a few work arounds? > -- > Ryan Hanisco > MCSE, MCTS: SQL 2005, Project+ > www.techsterity.com > Chicago, IL > > Remember: Marking helpful answers helps everyone find the info they need > quickly. > "Toby1Kinobe" wrote: > >> Sorry what other information do you need?, the error from the debug log >> is >> posted below. The R2 schema extension fails, >> Thanks >> >> "Andy C" <acracchiolo@fluidmaster.com> wrote in message >> news:%23QZsfgWAIHA.4836@TK2MSFTNGP06.phx.gbl... >> > Do you have any more information on this error? >> > >> > >> > "Toby1Kinobe" <tw@tw.com> wrote in message >> > news:fdhbse$ls7$1@news-01.bur.connect.com.au... >> >> Hi, >> >> >> >> I am trying to upgrade server 2003 (sp2) to R2 and am getting errors >> >> whilst extending the Schema (from 30 to 31). In the debug log I have >> >> an >> >> ldif.err.31 which reads: >> >> >> >> Entry DN: >> >> CN=PosixAccount,CN=Schema,CN=Configuration,DC=xxx,DC=xxx,DC=xxx,DC=xxx,DC=xxx >> >> Add error on line 1519: Unwilling To Perform >> >> >> >> The server side error is "Schema update failed: Rdn-Att-Id has wrong >> >> syntax." >> >> >> >> An error has occurred in the program >> >> >> >> I believe that some 3rd party application (not sure what, maybe the 1 >> >> mac >> >> pc on our domain) may have incorrectly extended the schema at some >> >> stage. >> >> This appears to be a Unix type error (we dont have nor ever have had >> >> unix >> >> services on the network). >> >> Has anyone seen this before/resolved the issue? >> >> I have see 1 post that suggests I need to defunct the offending UID >> >> attribute, any thoughts? >> >> >> >> We are getting very frustrated with this as its holding up many other >> >> projects, any help would be gratefully received, >> >> >> >> Thanks >> >> >> > >> > >> Top From: kj [SBS MVP] <KevinJ.SBS@SPAMFREE.gmail.com> To: none Subject: Re: R2 Schema Extension Date: 09/27/2007 23:36:00 Toby1Kinobe wrote: > Hi, > > I am trying to upgrade server 2003 (sp2) to R2 and am getting errors > whilst extending the Schema (from 30 to 31). In the debug log I have > an ldif.err.31 which reads: > > Entry DN: > CN=PosixAccount,CN=Schema,CN=Configuration,DC=xxx,DC=xxx,DC=xxx,DC=xxx,DC=xxx > Add error on line 1519: Unwilling To Perform > > The server side error is "Schema update failed: Rdn-Att-Id has wrong > syntax." > > An error has occurred in the program > > I believe that some 3rd party application (not sure what, maybe the 1 > mac pc on our domain) may have incorrectly extended the schema at > some stage. This appears to be a Unix type error (we dont have nor > ever have had unix services on the network). > Has anyone seen this before/resolved the issue? > I have see 1 post that suggests I need to defunct the offending UID > attribute, any thoughts? > > We are getting very frustrated with this as its holding up many other > projects, any help would be gratefully received, > > Thanks You might find googling; wrong syntax schema r2 Rdn-Att-Id some help in progressing with your problem. -- /kj Top From: Toby1Kinobe <toby1kinobe@gmail.com> To: none Subject: Re: R2 Schema Extension Date: 09/28/2007 00:29:37 This is a serious problem so sensible responses/or none at all please KJ "kj [SBS MVP]" <KevinJ.SBS@SPAMFREE.gmail.com> wrote in message news:%232qRWkYAIHA.4200@TK2MSFTNGP04.phx.gbl... > Toby1Kinobe wrote: >> Hi, >> >> I am trying to upgrade server 2003 (sp2) to R2 and am getting errors >> whilst extending the Schema (from 30 to 31). In the debug log I have >> an ldif.err.31 which reads: >> >> Entry DN: >> CN=PosixAccount,CN=Schema,CN=Configuration,DC=xxx,DC=xxx,DC=xxx,DC=xxx,DC=xxx >> Add error on line 1519: Unwilling To Perform >> >> The server side error is "Schema update failed: Rdn-Att-Id has wrong >> syntax." >> >> An error has occurred in the program >> >> I believe that some 3rd party application (not sure what, maybe the 1 >> mac pc on our domain) may have incorrectly extended the schema at >> some stage. This appears to be a Unix type error (we dont have nor >> ever have had unix services on the network). >> Has anyone seen this before/resolved the issue? >> I have see 1 post that suggests I need to defunct the offending UID >> attribute, any thoughts? >> >> We are getting very frustrated with this as its holding up many other >> projects, any help would be gratefully received, >> >> Thanks > > You might find googling; > > wrong syntax schema r2 Rdn-Att-Id > > some help in progressing with your problem. > > -- > /kj > Top From: kj [SBS MVP] <KevinJ.SBS@SPAMFREE.gmail.com> To: none Subject: Re: R2 Schema Extension Date: 09/28/2007 00:43:21 Toby1Kinobe wrote: > This is a serious problem so sensible responses/or none at all please > KJ I agree, but the first such hit should direct you here which has a potential resolution. Have you already seen it? http://www.activedir.org/ma/default.aspx?msg=11874 > > "kj [SBS MVP]" <KevinJ.SBS@SPAMFREE.gmail.com> wrote in message > news:%232qRWkYAIHA.4200@TK2MSFTNGP04.phx.gbl... >> Toby1Kinobe wrote: >>> Hi, >>> >>> I am trying to upgrade server 2003 (sp2) to R2 and am getting errors >>> whilst extending the Schema (from 30 to 31). In the debug log I have >>> an ldif.err.31 which reads: >>> >>> Entry DN: >>> CN=PosixAccount,CN=Schema,CN=Configuration,DC=xxx,DC=xxx,DC=xxx,DC=xxx,DC=xxx >>> Add error on line 1519: Unwilling To Perform >>> >>> The server side error is "Schema update failed: Rdn-Att-Id has wrong >>> syntax." >>> >>> An error has occurred in the program >>> >>> I believe that some 3rd party application (not sure what, maybe the >>> 1 mac pc on our domain) may have incorrectly extended the schema at >>> some stage. This appears to be a Unix type error (we dont have nor >>> ever have had unix services on the network). >>> Has anyone seen this before/resolved the issue? >>> I have see 1 post that suggests I need to defunct the offending UID >>> attribute, any thoughts? >>> >>> We are getting very frustrated with this as its holding up many >>> other projects, any help would be gratefully received, >>> >>> Thanks >> >> You might find googling; >> >> wrong syntax schema r2 Rdn-Att-Id >> >> some help in progressing with your problem. >> >> -- >> /kj -- /kj Top From: Toby1Kinobe <toby1kinobe@gmail.com> To: none Subject: Re: R2 Schema Extension Date: 09/28/2007 01:20:28 kj, yes I have seen this article. Unfortunately it seems to be the only article on the net that I can find that resembles our issue. Unfortunately the post does not contain a workaround for us. This case has been raised with MS, who seem to be struggling to resolve it. I was just hoping someone out there may have seen this error before or could offer any fix suggestions. Cheers for your efforts "kj [SBS MVP]" <KevinJ.SBS@SPAMFREE.gmail.com> wrote in message news:%23vy9$JZAIHA.3400@TK2MSFTNGP03.phx.gbl... > Toby1Kinobe wrote: >> This is a serious problem so sensible responses/or none at all please >> KJ > > I agree, but the first such hit should direct you here which has a > potential resolution. Have you already seen it? > > http://www.activedir.org/ma/default.aspx?msg=11874 > >> >> "kj [SBS MVP]" <KevinJ.SBS@SPAMFREE.gmail.com> wrote in message >> news:%232qRWkYAIHA.4200@TK2MSFTNGP04.phx.gbl... >>> Toby1Kinobe wrote: >>>> Hi, >>>> >>>> I am trying to upgrade server 2003 (sp2) to R2 and am getting errors >>>> whilst extending the Schema (from 30 to 31). In the debug log I have >>>> an ldif.err.31 which reads: >>>> >>>> Entry DN: >>>> CN=PosixAccount,CN=Schema,CN=Configuration,DC=xxx,DC=xxx,DC=xxx,DC=xxx,DC=xxx >>>> Add error on line 1519: Unwilling To Perform >>>> >>>> The server side error is "Schema update failed: Rdn-Att-Id has wrong >>>> syntax." >>>> >>>> An error has occurred in the program >>>> >>>> I believe that some 3rd party application (not sure what, maybe the >>>> 1 mac pc on our domain) may have incorrectly extended the schema at >>>> some stage. This appears to be a Unix type error (we dont have nor >>>> ever have had unix services on the network). >>>> Has anyone seen this before/resolved the issue? >>>> I have see 1 post that suggests I need to defunct the offending UID >>>> attribute, any thoughts? >>>> >>>> We are getting very frustrated with this as its holding up many >>>> other projects, any help would be gratefully received, >>>> >>>> Thanks >>> >>> You might find googling; >>> >>> wrong syntax schema r2 Rdn-Att-Id >>> >>> some help in progressing with your problem. >>> >>> -- >>> /kj > > -- > /kj > Top From: kj [SBS MVP] <KevinJ.SBS@SPAMFREE.gmail.com> To: none Subject: Re: R2 Schema Extension Date: 09/28/2007 01:29:15 Toby1Kinobe wrote: > kj, yes I have seen this article. Unfortunately it seems to be the > only article on the net that I can find that resembles our issue. > Unfortunately the post does not contain a workaround for us. This > case has been raised with MS, who seem to be struggling to resolve > it. I was just hoping someone out there may have seen this error > before or could offer any fix suggestions. > Cheers for your efforts Sorry, not much else to add. Any idea on what vendor did the extension? Good luck with the problem/resolution. > > "kj [SBS MVP]" <KevinJ.SBS@SPAMFREE.gmail.com> wrote in message > news:%23vy9$JZAIHA.3400@TK2MSFTNGP03.phx.gbl... >> Toby1Kinobe wrote: >>> This is a serious problem so sensible responses/or none at all >>> please KJ >> >> I agree, but the first such hit should direct you here which has a >> potential resolution. Have you already seen it? >> >> http://www.activedir.org/ma/default.aspx?msg=11874 >> >>> >>> "kj [SBS MVP]" <KevinJ.SBS@SPAMFREE.gmail.com> wrote in message >>> news:%232qRWkYAIHA.4200@TK2MSFTNGP04.phx.gbl... >>>> Toby1Kinobe wrote: >>>>> Hi, >>>>> >>>>> I am trying to upgrade server 2003 (sp2) to R2 and am getting >>>>> errors whilst extending the Schema (from 30 to 31). In the debug >>>>> log I have an ldif.err.31 which reads: >>>>> >>>>> Entry DN: >>>>> CN=PosixAccount,CN=Schema,CN=Configuration,DC=xxx,DC=xxx,DC=xxx,DC=xxx,DC=xxx >>>>> Add error on line 1519: Unwilling To Perform >>>>> >>>>> The server side error is "Schema update failed: Rdn-Att-Id has >>>>> wrong syntax." >>>>> >>>>> An error has occurred in the program >>>>> >>>>> I believe that some 3rd party application (not sure what, maybe >>>>> the 1 mac pc on our domain) may have incorrectly extended the >>>>> schema at some stage. This appears to be a Unix type error (we >>>>> dont have nor ever have had unix services on the network). >>>>> Has anyone seen this before/resolved the issue? >>>>> I have see 1 post that suggests I need to defunct the offending >>>>> UID attribute, any thoughts? >>>>> >>>>> We are getting very frustrated with this as its holding up many >>>>> other projects, any help would be gratefully received, >>>>> >>>>> Thanks >>>> >>>> You might find googling; >>>> >>>> wrong syntax schema r2 Rdn-Att-Id >>>> >>>> some help in progressing with your problem. >>>> >>>> -- >>>> /kj >> >> -- >> /kj -- /kj Top From: MattMJF <MattMJF@discussions.microsoft.com> To: none Subject: RE: redirection My Documents Date: 09/27/2007 13:47:01 One solution is on servers where users RDC/TS into, disable any folder redirection and/or force mandatory profile for any terminal services sessions.  You can do this via a GPO applied to OU where servers are located in or you can do this via local GPO on server(s) itself then use "enable loopback' setting.  Also, on user account properties, terminal services tab, you can remove the U:\ drive path and configure a mandatory profile just for TS sessions. These are a variety of ideas.  Pick the one to research and works best for your environment. ~ Matt ~ "rocker40" wrote: > I have a policy for redirection for My documents. I had a issue with my > domain controller and had to rebuild it. i reinstalled the policy and it > works. the issue is I have some users and myself log into servers through TS > sometimes to do different things. When we do that my Documents are moved over > too. I do not want them to pull thier my Documents when they log into a > server but I need them to on thier local machines. Doe sthat make sense? I > thought I had that way before but if I did I not sure what I did make that > happen. > Thanks > Dave Top From: Richard Mueller [MVP] <rlmueller-nospam@ameritech.nospam.net> To: none Subject: Re: Remote Desktop connection Date: 09/27/2007 22:11:59 Dave_R wrote: >I want a user who is out of state when login remotely to start an app. > > I have Windows 2003 Server configured as DC running DNS, DHCP and File > Server. > > I created "USer1" in AD and added to Builtin Remote Desktop Users group. > > When "USer1" logs in remotely gets an error " To logon you must be granted > Allow logon thru Terminal Services right.." > > Can somebody please help me step ny step how to logon "USer1" > successfully? In addition, check "Allow Access" on the "Dial-in" tab of the user properties in Active Directory Users & Computers. -- Richard Mueller Microsoft MVP Scripting and ADSI Hilltop Lab - http://www.rlmueller.net -- Top From: pooradmin <jskiba99@gmail.com> To: none Subject: Re: Remote Desktop connection Date: 09/27/2007 22:37:59 On Sep 27, 11:11 pm, "Richard Mueller [MVP]" <rlmueller- nos...@ameritech.nospam.net> wrote: > Dave_R wrote: > >I want a user who is out of state when login remotely to start an app. > > > I have Windows 2003 Server configured as DC running DNS, DHCP and File > > Server. > > > I created "USer1" in AD and added to Builtin Remote Desktop Users group. > > > When "USer1" logs in remotely gets an error " To logon you must be granted > > Allow logon thru Terminal Services right.." > > > Can somebody please help me step ny step how to logon "USer1" > > successfully? > > In addition, check "Allow Access" on the "Dial-in" tab of the user > properties in Active Directory Users & Computers. > > -- > Richard Mueller > Microsoft MVP Scripting and ADSI > Hilltop Lab -http://www.rlmueller.net > -- Think that's just for the RAS connections, vpn, dialin.  Theres a checkbox on the terminal service tab "deny this user permission to log onto any terminal server"  that should be unchecked.  There are also 2 policies in group policy for the machine that need checked, since its a domain controller that the user is going to log onto they need to be either an administrator on that machine or added to the one policy below to log on locally. Computer Configuration   Windows Settings     Security Settings       Local Policies         User Rights Assignment          Allow Log on Through Terminal Service          Allow log on locally Hope that helps -J www.pooradmin.com Top Post your questions, comments, feedbacks and suggestions