when you’re a little too careless about virtualizing your domain controllers, cloning, migrating, backing up and restoring, returning from vacation and deciding that having a single box holding all the fsmo roles is dangerous to the network, you will inevitably find yourself in the same situation i’ve found myself in. a tell-tale sign that you need to manually reset the kdc secure channel on your problematic domain controller can be diagnosed with the following symptoms: any mechanism that relies on kerberos authentication tickets will fail practically all subsystem services and listening endpoints will cease to function (non kdc-related services like […]
if you’ve found yourself here then chances are you messed up one of your domain controllers or at least one of your dhcp servers. i admit i did. more than once. and i’m tired of querying for the elusive “remove-dhcpserverv4failover” powershell script to force delete the windows server dhcp failover relationship. the way content makes its way onto this site is usually split into two categories: repetition, and one time specialized content not found on the internet (at least difficult). pick the server you want to keep. look at your dhcp leases and determine which might be the most […]
a few years ago in a past life i performed an active directory migration from a 2003 functional level to 2008 r2 with admt 3.2 accompanied by an exchange 2007 to 2010 migration. the only problem i ran into was that the old x500 addresses for the mailboxes aren’t migrated to the new mail system. the cached auto-complete email addresses in outlook use the x500 address for internal emails which caused internal to internal email to fail. once the auto-complete addresses were wiped out everything was fine and outlook began creating new auto-complete data with correct x500 data. it’s a […]
if you have ever wanted to decommission an old file/sql server while bringing another online to replace it and keep the existing hostname alive as an alias of the new system, you may want to force a duplicate spn. setspn.exe has had duplicate spn detection built-in to it since the windows server 2008 release when using the “-s” option. you can bypass the duplicate spn detection by using the “-a” option however. creation of a duplicate spn is blocked when targeting a windows server 2012 r2 dc using setspn with the -a option. the error message displayed is the same […]
in outlook 2007 through outlook 2010 all domain-joined outlook clients would initially query active directory for autodiscover information and ultimately find a service connection point (scp) value that would point them to their nearest client access server’s autodiscover virtual directory. if that failed then they would revert to using dns like any non-domain-joined outlook client. non-domain-joined computer lookup order: https://company.com/autodiscover/autodiscover.xml https://autodiscover.company.com/autodiscover/autodiscover.xml local xml file http://company.com/autodiscover/autodiscover.xml (looking for a redirect website) scp autodiscover record domain-joined computer lookup order: scp lookup https root domain query https autodiscover domain query http redirect method srv record query
recently i had the impulse to populate existing ad user object property fields with phone numbers, titles, companies, and office; however, i wanted to use powershell to bulk import instead of the old ldifde method or manual labor. it was actually quite easy, but it does require some time massaging the csv file in excel.