Active Directory Archives - Ceyhun KIRMIZITAS

29Jul 2013 by Ceyhun Kirmizitas 0 Comments

How to Join VMware ESXi to an Active Directory Domain

Active Directory, Identity, VMware, vSphere

Applies to: VMware ESXi 9.x / 8.x / 7.x / 6.7 / 6.5 / 6.0 / 5.5 / 5.1 VMware ESXi can use Microsoft Active Directory for direct host authentication. This lets administrators assign ESXi permissions to domain users and groups instead of maintaining separate local accounts on every host. Security note: Current VMware security guidance no longer recommends joining ESXi hosts directly to Active Directory as the default design. In centrally managed environments, prefer managing authentication and permissions through vCenter unless direct host-level AD authentication is specifically required. The original version of this article was written for ESXi 5.1. The capability still exists in current ESXi releases, but the interface and security defaults have changed. In This Article 1. Before You Join the Domain 2. Join ESXi to Active…

05Dec 2012 by Ceyhun Kirmizitas 0 Comments

How to Force DFSR SYSVOL Replication in Windows Server

Active Directory, Identity, Windows Server

Applies to: Windows Server 2025 / 2022 / 2019 / 2016 / 2012 R2 / 2012 / 2008 R2 / 2008 Sometimes SYSVOL changes need to replicate immediately between domain controllers instead of waiting for the normal DFS Replication schedule. The original version of this post used dfsrdiag SyncNow to trigger replication for the Domain System Volume replication group. The original method is worth preserving as an operational troubleshooting step, but it is important to separate a normal replication delay from a broken SYSVOL replication state. If SYSVOL or NETLOGON is missing, or DFSR is stopped by an error such as Event ID 2213 or 4012, forcing a connection is not the same as repairing SYSVOL. In This Article 1. Check SYSVOL Before Forcing Replication 2. Trigger DFSR SYSVOL Replication…

11Jun 2011 by Ceyhun Kirmizitas 0 Comments

How to Migrate SYSVOL Replication from FRS to DFSR

Active Directory, Identity, Windows Server

Applies to: Windows Server 2025 / 2022 / 2019 / 2016 / 2012 R2 / 2012 / 2008 R2 / 2008 Active Directory domain controllers use the SYSVOL share to replicate Group Policy files and logon scripts. Older domains can still use File Replication Service (FRS) for SYSVOL, while modern Windows Server environments use Distributed File System Replication (DFSR). If your domain still uses FRS, you should migrate SYSVOL replication to DFSR before introducing newer domain controllers. Windows Server 2019 and later cannot be promoted as replica domain controllers in a domain that still uses FRS for SYSVOL replication. In This Article 1. Before You Start 2. Check the Current Migration State 3. State 1 — Prepared 4. State 2 — Redirected 5. State 3 — Eliminated 6. Validate the…

07Apr 2011 by Ceyhun Kirmizitas 0 Comments

Fix WinRM Event ID 10154: Failed to Create WSMAN SPNs

Active Directory, Identity, Windows Server

Applies to: Windows Server 2025 / 2022 / 2019 / 2016 / 2012 R2 / 2012 / 2008 R2 / 2008 WinRM can log Event ID 10154 when it cannot register the WSMAN Service Principal Names (SPNs) required for Kerberos authentication. A typical event contains entries similar to: The WinRM service failed to create the following SPNs: WSMAN/server.contoso.com; WSMAN/server. In This Article 1. What Event ID 10154 Means 2. Check the Current SPNs 3. Check for Duplicate SPNs 4. Register Missing WSMAN SPNs 5. If the Error Is Access Denied 6. Why NETWORK SERVICE Is Not the AD Account 7. Verify WinRM 8. Key Takeaways 1. What Event ID 10154 Means WinRM uses SPNs for Kerberos authentication. In a normal domain configuration, the WSMAN SPNs are associated with the server's…

07May 2009 by Ceyhun Kirmizitas 0 Comments

Fix “No Site Name Is Available for This Machine” on Exchange Server

Active Directory, Exchange, Exchange Server SE / 2019 / 2016, Identity

Applies to: Exchange Server SE / 2019 / 2016 / 2013 / 2010 | Active Directory Domain Services When the Microsoft Exchange POP3 service cannot determine the Active Directory site for the server, it can fail with the following error: No site name is available for this machine. This is Windows error ERROR_NO_SITENAME (1919 / 0x77F). In most cases, the Exchange server IP subnet is missing from Active Directory Sites and Services or is mapped to the wrong AD site. In This Article 1. Check the Detected AD Site 2. Verify the Subnet in Active Directory Sites and Services 3. Correct the Subnet-to-Site Mapping 4. Validate the Fix 5. About the SiteName Registry Value 6. Key Takeaways 1. Check the Detected AD Site Run nltest /dsgetsite on the Exchange server.…

23Oct 2008 by Ceyhun Kirmizitas 0 Comments

How to Perform an Authoritative Restore of Active Directory Objects

Active Directory, Identity, Windows Server

Applies to: Windows Server 2025 / 2022 / 2019 / 2016 / 2012 R2 / 2012 / 2008 R2 / 2008 / 2003 R2 / 2003 An authoritative restore is used when you need to recover deleted or unwantedly changed Active Directory objects from backup and make the restored copy win replication against the copies held by other domain controllers. The original version of this article described this as an “authoritative DC restore.” More precisely, the domain controller is restored from backup and selected Active Directory objects or subtrees are then marked as authoritative with ntdsutil. In This Article 1. Check Active Directory Recycle Bin First 2. When Authoritative Restore Is Needed 3. Restore the Domain Controller from Backup 4. Mark the Object as Authoritative 5. Restart and Validate Replication…

08Sep 2008 by Ceyhun Kirmizitas 0 Comments

Configure Fine-Grained Password Policies in Active Directory

Active Directory, Identity, Windows Server

Applies to: Windows Server 2025 / 2022 / 2019 / 2016 / 2012 R2 / 2012 Fine-Grained Password Policies (FGPPs) let you apply different password and account lockout settings to different sets of users in the same Active Directory domain. This is useful when one domain-wide policy is not enough, for example when privileged or service accounts need different controls from standard user accounts. FGPPs were introduced with Windows Server 2008. For currently supported Windows Server versions, Microsoft documents them for Windows Server 2025, 2022, 2019, and 2016, with a domain functional level of Windows Server 2012 or higher. In This Article 1. What Is a Fine-Grained Password Policy? 2. Requirements and Scope 3. Understand Precedence 4. Configure an FGPP with ADAC 5. Configure an FGPP with PowerShell 6. Verify…

29Nov 2007 by Ceyhun Kirmizitas 0 Comments

How to Reset Default Domain Policy and Default Domain Controllers Policy

Active Directory, Identity, Windows Server

Applies to: Windows Server 2025 / 2022 / 2019 / 2016 / 2012 R2 / 2012 / 2008 R2 / 2008 / 2003 R2 / 2003 Dcgpofix.exe recreates the two default Group Policy Objects that are created with an Active Directory domain: Default Domain Policy and Default Domain Controllers Policy. This tool is intended for disaster recovery. It should not be used as a normal troubleshooting shortcut because it resets the default GPOs to Microsoft-defined defaults and can overwrite settings that were intentionally configured in those policies. In This Article 1. What Dcgpofix Restores 2. Before Running Dcgpofix 3. Reset Default Domain Policy 4. Reset Default Domain Controllers Policy 5. Reset Both Default GPOs 6. Validate the Result 7. Important Limitations 8. Key Takeaways 1. What Dcgpofix Restores Microsoft documents…

Category: Active Directory