Pugazh Network

The following sequence describes how the Locator is able to find a domain controller: On the client (the computer locating the domain controller), the Locator is initiated as an RPC to the local Net Logon service. The Locator application programming interface (API) (DsGetDcName) is implemented by the Net Logon service. The client collects the information that is needed to select a domain controller and passes the information to the Net Logon service by using the DsGetDcName API. The Net Logon service on the client uses the collected information to look up a domain controller for the specified domain in one of two ways: For a DNS name, Net Logon queries…

Among the most important features of Windows 2000 include the facts that all domain controllers in the same domain are peers of one another and any domain controller can make directory updates. However, given the way in which directory updates are replicated from one domain controller to another, it is possible that difficulties can arise. For example, if the necessary domain controllers are not connected by a replication topology the appropriate domain controllers do not receive directory updates when replication occurs. Also, in order for the (Domain Controller) Locator to find a domain controller, it must have accurate information so that it can properly locate the resource. If a domain controller is incorrectly…

We can repair the in three ways 1. Domain-re-joining the Windows computer  2. Using Test-ComputerSecureChannel command using repairing switch. 3. Reset-ComputerMachinePassword command: 4. netdom resetpwd /s:server /ud:domain\User /pd:* to reset a machine password  Finally you can verify the secure channel nltest.exe /sc_verify:pugazh.co.in How to re-join the machine without reboot

As a Premier Field Engineer, I visit new customers every week and every customer, and I mean every customer, has the KDC 11 events in their system event logs. Consequently, I have to explain to customers what this means and how to clean it up. But rather than just saying, “Look, these accounts have a duplicate SPN’s and use setspn or adsiedit to clean them up”, I like giving the back story about how duplicate SPN’s break authentication and what would happen if the KDC issued Kerberos tickets for resources with duplicate SPN’s.  So, here’s the dialogue of my weekly explanation of Kerberos and duplicate SPN’s. By the end, most…

How to Track the Who, What, When and Where of Active Directory Attribute Changes – Part I (The Case of the Mysteriously Modified UPN) Quick Review – The story you’re about to hear is true and the names have been changed to protect the innocent… Some unknown process, running on some unknown computer, at some unknown time was changing the UPN on the Active Directory user accounts. Since Contoso is running Windows Server 2003 R2 X64 Domain Controllers, we recommended they search the Security event log for Event ID 642 which indicates a successful “User Account Change”. The Event ID includes information that identifies the attribute which was changed and…

Note:  This is general best practice guidance for implementing schema extensions, not the testing of their functionality.  There may be some additional best practices around design and functionality of schema extensions that should be considered.  Understand that the implementation of a schema extension may well succeed, but the functionality around the extension may not behave as expected. As with any change to the Active Directory infrastructure, the two primary concerns around implementing a schema extension are: 1. Have you tested it, so you can be reasonably sure it will behave as expected when implemented in production? 2. Do you have a roll-back plan?  And is it tested? Digging into the…