Windows Server 2003 | Directory Services-Users getting kicked out from Terminal Server session | null session pipes

Eligible Product: Windows Server 2003 SP1 Problem Product: Windows Server 2003 SP1 Problem Description ============================================ It is an Active Directory domain. When users/clients log into Citrix server in child domain, then if they log in with Active Directory account it...

Troubleshooting NETLOGON Event 5774, 5775, and 5781

http://support.microsoft.com/kb/259277 SUMMARY One or more error messages may be logged in the System event log if the Netlogon service registration or deregistration process does not succeed. This article describes these error messages and offers some troubleshooting considerations.   MORE INFORMATION...

KDC Event ID 11

Event ID KDC 11 in the System log of domain controllers   This is the Knowledge Base Article for KDC 11 Event ID Microsoft Support KB 321044 There is a script to be used inspite of ldifde dump. Please allow...

How to Create a User-Defined Service

http://support.microsoft.com/kb/137890 How to Create a User-Defined Service   SUMMARY The Windows NT Resource Kit provides two utilities that allow you to create a Windows NT user-defined service for Windows NT applications and some 16-bit applications (but not for batch files). ...

Access is denied

When you face the issue of access is denied, please refer to the following sequence of steps for troubleshooting: • Binding Order of NIC Cards • SMB • DFS Service -- > started and Running • Permissions on SYSVOL •...

The Format of the specified network name is invalid

The Format of the specified network name is invalid. • Binding Order of the NIC Card • SMB • DNS • Enable NETBIOS over TCP/IP • The "Register this connection in DNS" - Checked...

Not able to access Domain via \\domainname\sysvol errormessage: "No network provider accepted the given network path"

Not able to access Domain via \\domainname\sysvol errormessage: "No network provider accepted the given network path" • Binding Order • TCP/IP Net BIOS Helper Service • MaxPacketSize and EnablePMTUBHDetect in case of WAN • Disable TCPChimney, EnableRSS, and TCPA in...

Not enough storage is available to complete this operation

Not enough storage is available to complete this operation To resolve this problem, add the MaxTokenSize registry entry and the MaxUserPort registry entry on the affected domain controllers. To do this, follow these steps: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos\Parameters New DWORD Value. 'MaxTokenSize' =...

The authentication service is unknown

The authentication service is unknown. • Check the NetLogon Service. • Binding order of the NIC card. • Update the NIC Drivers...

There are no more endpoints available from the endpoint mapper

There are no more endpoints available from the endpoint mapper. "No more endpoints available" means the RPC endpoint mapper, which runs on port 135 TCP, was not able to use a port above 1024 for a service that runs over...

Run the Dfsutil /PurgeMupCache command

Run the Dfsutil /PurgeMupCache command As taken from KB 887303 Run the Dfsutil.exe program with the /PurgeMupCache switch to flush the local DFS/MUP cached information. The Dfsutil.exe program is included in the Windows 2000 Server Support Tools and the Windows...

Make sure that the domain controllers are not in a journal wrap state

Make sure that the domain controllers are not in a journal wrap state As taken from KB 887303 To see if a domain controller is in a journal wrap state, view the File Replication service log in Event Viewer, and...

Make sure that the Bypass traverse checking right is granted to the required groups

Make sure that the Bypass traverse checking right is granted to the required groups As taken from KB 887303 The Bypass traverse checking right must be granted to the following groups on the domain controllers: · Administrators · Authenticated Users...

Examine the contents and the permissions of the Sysvol folder

Examine the contents and the permissions of the Sysvol folder As taken from KB 887303 By default, the Sysvol folder is located in the %systemroot% folder. The Sysvol folder contains the domain's Group Policy objects, the Sysvol and Netlogon shares,...

Make sure that Distributed File System (DFS) is enabled on all computers

Make sure that Distributed File System (DFS) is enabled on all computers As taken from KB 887303 All domain controllers must run the Distributed File System service because the Sysvol share is a DFS volume. Additionally, the DFS client must...

Make sure that the TCP/IP NetBIOS Helper service is started on all computers

Make sure that the TCP/IP NetBIOS Helper service is started on all computers As taken from KB 887303 All computers on the network must run the TCP/IP NetBIOS Helper service. To verify that the TCP/IP NetBIOS Helper service is running...

Examine the Server Message Block signing (SMB signing) settings on the client computers and member servers

Examine the Server Message Block signing (SMB signing) settings on the client computers and member servers As taken from KB 887303 The Server Message Block (SMB) signing settings define whether the computers on the network digitally sign communications. If the...

Examine the DNS settings and network properties on the servers and client computers

Examine the DNS settings and network properties on the servers and client computers As taken from KB 887303 In the local area connection properties, Client for Microsoft Networks must be enabled on all servers and client computers. The File and...

CrashOnAuditFail

CrashOnAuditFail Crashonauditfail This Registry Setting "Crashonauditfail" if enabled will cause the Domain Controller server to reboot when the size of Audit Logs is to full capacity and there is no more space to write Audit Event Logs without overwriting the...

Windows Fast Logon Optimization Feature

Windows Fast Logon Optimization Feature http://technet.microsoft.com/en-us/library/cc780527.aspx Fast Logon Optimization Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2 Fast Logon Optimization The Fast Logon Optimization feature is set by default...

Group Policy slow link detection

Group Policy slow link detection http://technet.microsoft.com/en-us/library/cc978717.aspx Group Policy slow link detection Computer Configuration\Administrative Templates\System\Group Policy Description Defines a slow connection for purposes of applying and updating Group Policy. If the rate at which data is transferred from the domain controller...

How a slow link is detected for processing user profiles and Group Policy

How a slow link is detected for processing user profiles and Group Policy http://support.microsoft.com/kb/227260 How a slow link is detected for processing user profiles and Group Policy SUMMARY This article describes how a slow link is detected in Windows 2000...

EnablePMTUDiscovery

EnablePMTUDiscovery EnablePMTUDiscovery is a registry key that can enable the windows operating system to discover the working MTU size in effect itself by sending packets of variable size to the destination. By sending packets of data in variable sizes the...

How to Troubleshoot Black Hole Router Issues

How to Troubleshoot Black Hole Router Issues http://support.microsoft.com/kb/314825 How to Troubleshoot Black Hole Router Issues SUMMARY This article defines the term "black hole" router, describes a method of locating black hole routers, and suggests three ways to avoid the data...

How to force Kerberos to use TCP instead of UDP in Windows Server 2003, in Windows XP, and in Windows 2000

How to force Kerberos to use TCP instead of UDP in Windows Server 2003, in Windows XP, and in Windows 2000 http://support.microsoft.com/kb/244474 How to force Kerberos to use TCP instead of UDP in Windows SUMMARY The Windows Kerberos authentication package...

Access this computer from the network

Access this computer from the network   http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/gp/524.mspx?mfr=true Access this computer from the network   Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment   Description   Determine which users and groups are allowed to connect to the computer over the network....

Active Directory Replication in Depth - USN

Active Directory Replication in Depth - USN   How to find USN of an Object from Active Directory:   C:\>repadmin /showobjmeta * [DN path of object] > obj_delhi.txt   * = All Dc's [DN path of object] = Object whose...

How does the Active Directory Replication Model Works

How does the Active Directory Replication Model Works http://technet.microsoft.com/en-us/library/cc772726(v=ws.10).aspx How does the Active Directory Replication Model Works Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2, Windows Server 2008, Windows...

Things to consider when you host Active Directory domain controllers in virtual hosting environments

Considerations when hosting Active Directory domain controller in virtual hosting environments http://support.microsoft.com/kb/888794 Things to consider when you host Active Directory domain controllers in virtual hosting environments SUMMARY A virtual hosting environment lets you run multiple guest operating systems on a...

Common Mistakes When Upgrading a Windows 2000 Domain To a Windows 2003 Domain

Common Mistakes When Upgrading a Windows 2000 Domain To a Windows 2003 Domain http://support.microsoft.com/kb/555040 Common Mistakes When Upgrading a Windows 2000 Domain To a Windows 2003 Domain SUMMARY This KB helps avoiding common mistakes while upgrading their system. SYMPTOMS A...

Restartable AD DS Step-by-Step Guide

Restartable AD DS Step-by-Step Guide http://technet.microsoft.com/en-us/library/cc732714.aspx Restartable AD DS Step-by-Step Guide   Applies To: Windows Server 2008, Windows Server 2008 R2   You can use Microsoft Management Console (MMC) snap-ins, or the Net.exe command-line tool, to stop or restart Active...

Restartable AD DS :: Restartable Active Directory Domain Service

Restartable AD DS Restartable Active Directory Domain Service As taken from: Restartable AD DS Step-by-Step Guide http://technet.microsoft.com/en-us/library/cc732714.aspx You can change the default by modifying the DsrmAdminLogonBehavior registry entry. By modifying the value for that registry entry, you can log on...

How to delete orphaned domain controllers from domain

How to delete orphaned domain controllers from domain Orphaned DC This article tells you the Action Plan on How to delete an Orphaned Domain Controller from the Active Directory Domain. To delete orphaned domain controllers from domain in future, follow...

How to detect Stale Accounts from AD

How to detect Stale Accounts from AD   Stale Account Detection   Stale account detection is required so that unused computer and user accounts can be removed from Active Directory. On domain controllers running Windows Server 2003 and Windows Server...

You cannot open file shares or Group Policy snap-ins on a domain controller

You cannot open file shares or Group Policy snap-ins on a domain controller http://support.microsoft.com/kb/839499 SUMMARY You cannot open file shares or the Group Policy snap-ins on a Windows Server 2003 domain controller or on a Windows 2000 Server domain controller....

Overview of SMB Signing

Overview of SMB Signing How to determine whether SMB signing is enabled in a network monitor trace To determine whether SMB signing is enabled, required at the server, or both, view the Negotiate Dialect Response from the server: SMB: R...

Microsoft SMB Protocol Packet Exchange Scenario

Microsoft SMB Protocol Packet Exchange Scenario This topic gives an example of a Microsoft SMB Protocol packet exchange between a client and a server. The following steps are an overview of the process: 1. The client and server establish a...

Group Policy Troubleshooting

Group Policy Troubleshooting   + enabled Gptext logging: Value Path: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Value Name: GPTextDebugLevel Value Type: REG_DWORD Value Data: 1002 (hex) Output: %systemroot%\debug\usermode\gptext.log        ...

Authoritative Userenv 1030 and 1058 Troubleshooting Guide

Authoritative Userenv 1030 and 1058 Troubleshooting Guide   Authoritative Userenv 1030 and 1058 Troubleshooting Guide Number          :           SOX030714700054 TITLE: Authoritative Userenv 1030 and 1058 Troubleshooting Guide Problem Windows Server 2003 Standard ID: SOX030714700054   Problem Description SYMPTOMS ========   Windows...

Group Policy and Slow Links

Group Policy and Slow Links   Group Policy does not apply when connecting remotely over a slow link http://technet.microsoft.com/en-us/library/cc759191.aspx    Group Policy slow link detection http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/gp/35.mspx?mfr=true   Extra Links for further study: Logon Optimization http://msdn.microsoft.com/en-us/library/aa374350.aspx   Specifying Group Policy for...

How FRS Works

How FRS Works   http://technet.microsoft.com/library/Cc962202   FRS provides redundancy for the content of designated NTFS shares between Windows 2000 servers. The servers can be interconnected in any topology such as a ring or a star configuration. With an appropriate topology...

Useful shelf life of a system-state backup of Active Directory

Useful shelf life of a system-state backup of Active Directory APPLIES TO ·         Microsoft Windows Server 2003, Standard Edition (32-bit x86) ·         Microsoft Windows Server 2003, Enterprise Edition (32-bit x86) ·         Microsoft Windows Server 2003, Enterprise Edition for Itanium-based Systems...

Domain Controller Diagnostics Tool (dcdiag.exe)

Dcdiag http://technet.microsoft.com/en-us/library/cc776854.aspx Domain Controller Diagnostics Tool (dcdiag.exe) Applies To: Windows Server 2003 with SP1 What does DCDiag.exe do? This command-line tool analyzes the state of one or all domain controllers in a forest and reports any problems to assist in...

Monitoring Active Directory Health

Monitoring Active Directory Health http://technet.microsoft.com/en-us/library/cc180912.aspx Monitoring Active Directory Health Active Directory Management Pack (ADMP) monitors Active Directory — and the external components that are related to Active Directory — to ensure that their ongoing behavior falls within the bounds of...

NetBIOS

NetBIOS In Windows, Microsoft has developed a proprietary protocol for name resolution. Windows Internet Name Server WINS for short. WINS stores names of computers in a format called NetBIOS and for communication it uses a proprietary protocol called NetBUI....

Troubleshooting Common Login ‘n’ Startup Issues

Troubleshooting Common Login 'n' Startup Issues To troubleshoot, To fix and To resolve common issues that are related to User Login and Start Up; we can look into a couple of things before calling the support professional. If you are...

Login ‘n’ Startup :: Understanding Logon and Authentication

Login n Startup Understanding Logon and Authentication http://technet.microsoft.com/en-us/library/bb457114.aspx ============================================================================== When a user logs on to a computer, a series of steps begins that makes up the authentication process. Authentication validates user identity and defines resources that a user can access....

DNS

DNS D.N.S. Server:             Domain Name Server is the server / service responsible for hosting DNS Zones; And also to resolve an FqDN to an IP Address.   If the DNS Zone is Dynamic (as is the case in Active...

Folder Redirection

Folder Redirection Folder Redirection Overview http://technet.microsoft.com/en-us/library/cc732275.aspx Applies To: Windows 8, Windows Server 2008 R2, Windows Server 2012 Folder Redirection User settings and user files are typically stored in the local user profile, under the Users folder. The files in local user profiles...

Dcpromo Demotion

Dcpromo Demotion The command to demote a Domain Controller (forcefully) is as follows:            dcpromo /forceremoval   The logs are found at the same location as for normal dcpromo operation; which was used to promote the server as Domain Controller....

Active Directory Database Mounting

Active Directory Database Mounting Active Directory Database Mounting and Snapshot creation is a technique where in you can store instances of the whole Active Directory by taking its snapshot, and then you can mount these snapshots to activate that instance...

Windows Server Core - Part 01

Windows Server Core - Part 01 To manage a server that is running a Server Core installation and is a domain member using an MMC snap-in 1.    Start an MMC snap-in, such as Computer Management. 2.    In the left pane,...

Windows Server Core - Part 02 - dcpromo

Windows Server Core - Part 02 - dcpromo Appendix of Unattended Installation Parameters http://technet.microsoft.com/en-us/library/cc732086.aspx Appendix of Unattended Installation Parameters Applies To: Windows Server 2008, Windows Server 2008 R2 The tables in this appendix provide the information that you need to...

Active Directory Sites and Services

Active Directory Sites and Services Step-by-Step Guide to Active Directory Sites and Services http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/directory/activedirectory/stepbystep/adsrv.mspx Step-by-Step Guide to Active Directory Sites and Services   This guide explains how to use the Active Directory Sites and Services snap-in to administer replication topology...

Active Directory Replication

Active Directory Replication Active Directory Replication is process of replicating Active Directory data from one Domain Controller to another. It is an automated process which has its own schedule; which when occurs replicates initial data, data changes and new data...

Account Lockout

Account Lockout Account Lockout is the Lockout of an user’s / service account due to entering incorrect credentials more than what is specified in the Account Lockout Section of the Password Policy for the Domain; after which you cannot use...

Csvde

Csvde http://technet.microsoft.com/hi-in/library/cc771621(en-us,WS.10).aspx Csvde Applies To: Windows Server 2008 Csvde Imports and exports data from Active Directory Lightweight Directory Services (AD LDS) using files that store data in the comma-separated value (CSV) format. You can also support batch operations based on...

UAC

UAC The policies for User Account Control can be checked by going to:   Group policy Editor>>Computer configuration>>Windows settings>>Security settings>>Local policies>>Security Options.   User Account Control http://technet.microsoft.com/en-us/library/cc772207.aspx User Account Control Updated: May 1, 2008 Applies To: Windows Server 2008, Windows...

GINA Registry

GINA Registry What if you want to publish your own version of the Windows Logon screen? What if you want to alter the look and feel of the Windows Login Prompt?   Use Window GINA dll registry location. Windows Uses...

Permissions

Permissions The Security ACL on a file/folder can be used to give access rights/permissions to users in an Active Directory Domain. Use the xcacls tool to modify / view permissions on files and folders. Xcacls http://support.microsoft.com/kb/825751 http://support.microsoft.com/kb/318754   For Example;...

Groups

Groups A Group is an object that can contain another security principle as its members. And it can be a member of another group as well. As the two domains are in the different forests, we only can add users...

Service Accounts

Service Accounts A Service Account is a special purpose user account created in Active Directory with which different services are / can be configured to Run As.. These Services when configured in the Logon Tab of the Properties section of...

Security

Security   19 Smart Tips for Securing Active Directory http://technet.microsoft.com/en-us/magazine/cc160982.aspx Active Directory Group Policy   Does Active Directory keep you up at night? One could easily understand why. It is most likely the largest and most critical distributed system in...

What Are Access Tokens?

What Are Access Tokens? http://technet.microsoft.com/en-us/library/cc759267.aspx Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2   What Are Access Tokens?   An access token is a protected object that contains information...

SYSVOL

SYSVOL SYSVOL is the default share available on a Domain Controller that holds the data for Group Policy Settings. Whenever a Group Policy is made; a GPO is created and its templates lie inside SYSVOL share. So, after a successful...

Optimize Active Directory Disk Performance

Optimize Active Directory Disk Performance Active Directory is a database and has the performance issues of a database. Familiar with SQL or Exchange? You know what works and what does not. AD has the database component and log files which...

DSRM

DSRM Configure Your Server Wizard sets a blank recovery mode password http://support.microsoft.com/kb/271641 English Language Version After you have installed the hotfix, you can use the Setpwd.exe tool (located in the %SystemRoot%\System32 folder) to replace the null password with a strong...

Windows Server Basics

Windows Server Basics   1.    What is Active Directory? Active Directory is a network-based object store and service that locates and manages resources, and makes these resources available to authorized users and groups. An underlying principle of the Active Directory...

Force Users to Logon to Windows (Windows 95/98/Me)

  Usually users can simply press 'Cancel' at the Windows logon box to bypass the login process and gain access to the local computer. This tweak will logout the user if the authentication fails or the user clicks Cancel. Like...

Start Windows Without Prompting for a Password (Windows 95/98/Me)

  Does Windows prompt you for a password every time you boot up even though you're the only one using the PC? Follow these instructions to make Windows automatically start up without prompting you for a password. Windows 9x passwords...

Drivers that are loaded in safe mode

Drivers that are loaded in safe mode Safe mode starts Windows with only the basic drivers and services listed here. Devices and drivers that start in safe mode · Floppy disk drives (internal and USB) · Internal CD-ROM drives (ATA,...

Basic Troubleshooting steps

Basic Troubleshooting Steps These are the basic troubleshooting steps that will come in handy for almost all of the relevant issues with in an Active Directory Domain Environment where in it needs troubleshooting. These are some basics that need to...

Windows server licenses

Windows server licenses     About Licensing Client Access Licenses and Management Licenses If the workstations in your organization are networked, you likely depend on network server software to perform certain functions, such as file and print sharing. To legally...

Windows server 2008

Windows server 2008       M A P S     Microsoft Assessment and Planning Solution Accelerator (formerly Windows Vista Hardware Assessment) http://www.microsoft.com/technet/solutionaccelerators/hardwareassessment/wv/default.mspx Microsoft Assessment and Planning Toolkit Solution Accelerator Assessment Scenarios http://technet.microsoft.com/en-us/library/cc297227.aspx   Security & SMB   http://support.microsoft.com/kb/942564...

Techniques to detect the installed roles on a 2008 server

First: If you execute the following command: > servermanagercmd.exe -query roles.xml An XML file of all the roles and features installed will be created. You could then parse that file to determine what roles and features are installed. Second:...

GINA

GINA GINA Registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Value = GinaDLL REG_SZ   The defaults are: Ginadll:REG_SZ:MSGINA.DLL   A Graphical Identification and Authentication dynamic-link library (DLL). The GINA is a replaceable DLL component that is loaded by the Winlogon executable. The GINA implements the authentication...