The Curious Engineer

All blogs / DevOps / SRE / infrastructure

AD Troubleshooting

learn.microsoft.com/en-us/archive/blogs/instan

AD and Domain-related issues and troubleshooting methods for Active Directory.

DevOps / SRE / infrastructureSecurityMicrosoft blogsMSDN archive

’10’15’20’25
Posts
153 from 3 Apr 2008 to 16 Jul 2013
Posting
archived, read-only
Kind
personal blog
Feed
https://learn.microsoft.com/en-us/archive/blogs/instan/feed.xml

2013 15

  1. Iceland vNext evolution
  2. Peeling the onion - how many layers should your PKI have?
  3. Assigning a static RPC port to ADLDS or ADAM for replication
  4. God mode on Windows 8
  5. ADCS and dedicated CRL-signing certificates
  6. PowerShelling your DC's
  7. Getting FIM CM to inventory all certificate requests made outside of the FIM CM Portal
  8. ADFS, Antivirus and Backup and Monitoring
  9. The Power of POSH and Get-Help
  10. Installing ADFS 2.1 on Windows Server 2012 with Windows Internal Database fails if local GPO granting User Rights is overwritten at the Domain or OU-level
  11. Upgrading from ADFS 2.0 to ADFS 2.1
  12. Fiddling with ADFS - end the infinite authentication loop
  13. Quick inventory of all certificates expiring in the next XX days
  14. Setting up your first ADFS POC
  15. Tweaking ADCS performance

2012 33

  1. TPM-CSP Autoenrollment failing with 0x8010002e SCARD_E_NO_READERS_AVAILABLE
  2. ADCS has become site-aware in Windows Server 2012
  3. Why am I seeing LsaSrv 45058 events on my client?
  4. XP and W2k3 Clients are by default unable to enroll from W2k12 CA servers
  5. Installing NDES restarts CertSvc service on target CA server
  6. The tale of the phantom cached logon entry
  7. The end of days [for XP support]
  8. Why doesn't a user get locked out after a number of invalid password attempts greater than the domain account lockout policy?
  9. How to get email notifications about expiring certificates from FIM CM 2010
  10. How to bulk create 10000 users and groups for your test environment
  11. How to identify if your ADCS has issued any certificates with public keys <1024 bits (in preparation for KB2661254)
  12. Quick and dirty inventory of certificate requests on a CA server
  13. Random Kryptonotes
  14. Sending all mail using a postcard vs. using an envelope to protect it
  15. Cheat sheet for DFS-N and DFS-R on Windows 2008 R2 and Windows 7
  16. The certificate template requires too many RA signatures
  17. Certificate Enrollment Web Services primers
  18. Debunking Slow Logon Myths
  19. Controlling CSP selection during autoenrollment through the pKIDefaultCSPs attribute
  20. ADFS case sensitivity
  21. Windows 8 shortcut keys
  22. I'm your Clone Baby DC
  23. Cheat sheet for Smartcard Redirection on W2k8 R2 RDP servers
  24. PreferLogonDC issues on W2k8 R2 DC's
  25. Enrollment from Windows XP clients against Windows 8 CA server failing
  26. New hotfix for intermittent OCSP revocation failure issues on domain controllers available
  27. Alternative methods to getting a standalone CA to issue smartcard certificates
  28. Event ID 16944 - Certificate OID error on Domain Controllers during a successful smartcard logon
  29. Using S/MIME certificates for non-repudiation
  30. Deconstructing the KDC certificate processing functionality
  31. Changing the Primary Domain DNS name of this computer to "" failed.
  32. Primers for building a highly available Active Directory environment
  33. The Dark Side of Virtualization

2011 30

  1. Using Wevtutil to capture and view the ADFS Debug log
  2. Windows 8 features
  3. For configuration <CAName>, Online Responder revocation provider either has no CRL information or has stale CRL information
  4. Cached logons and CachedLogonsCount
  5. SENS and Sensibility
  6. The return of PAC-mania [AKA some reasons why PAC verification can fail]
  7. The Legacy of the Past Tense
  8. Bad Data error message in FIM CM web portal
  9. CAPI2 event ID 11 retake
  10. ADFS Event ID 364 on ADFS 2.0 proxy
  11. The return of the son of Visio Network Topology Diagrammer
  12. Event ID 29 when starting KDC service on Windows Server 2008 R2 DC's
  13. Using Wevtutil to capture and view the CAPI2 Operational log
  14. The effect on Cached Logons when Smart Card is required for interactive logon is set
  15. Massaging the XP registry for logon performance
  16. How to create 1 million OU's and linked GPO's using PowerShell
  17. Debug shortcuts for FIM/ILM/CLM
  18. Credential Roaming and NTDS.dit bloat
  19. ADCS CA Server disaster recovery steps when smartcard logon is required but no valid CRL can be published
  20. Smartcard logon using certificates from a 3rd party on a Domain Controller and KDC Event ID 29
  21. Setting up ADFS 2.0 as an IDP for Visma Proceedo
  22. The CA certificate that disappeared after the CMOS battery died
  23. Why is autoenrollment only happening if initiated manually through the MMC?
  24. Need to implement a test CA from scratch?
  25. Why can't I see any certificate templates when creating a certificate request within the IIS 7.x MMC?
  26. Why can't I see my local smartcard readers when I connect via RDP?
  27. Smartcard Redirection Diaries
  28. OCSP error when verifying with Enterprise PKI MMC (PKIVEW)
  29. Automatic logon to RDS using Smartcards with multiple certificates (with or without TS Gateway)
  30. DCDIAG and the Not-N'sync Home Server

2010 23

  1. Credential Providers simplified pt1
  2. The 4 basic principles of PKI Troubleshooting
  3. The problem with problems...
  4. ISA/TMG team in Sweden is hiring
  5. CAPI2 Event ID 11 errors on machines that don't have access to the Internet
  6. Remote EFS decryption and Trusted for Delegation requirements
  7. How FIM2010 CM & CLM 2007 search for users
  8. Can't find script engine "VBScript" for script after installing MS10-020
  9. Everything you wanted to know about Extended Validation but were afraid to ask
  10. The importance of being up to date
  11. The case of the mysterious 10 minute logon delay
  12. UseSubjectAltName and smartcard logon
  13. Exchange Powershell get-user cmdlet only recognizes certificates using the X500 format
  14. Event 6398 and Forefront Server Security
  15. AD Recycle Bin and the conspicuously cloned user accounts conundrum
  16. The Smartcard Removal Policy Service and VPN
  17. W2k3 R2 Adprep and isDefunct
  18. The disappearing IAS certificate mystery
  19. The caveats of using Group Policy Preferences on Terminal Servers
  20. FIM 2010 and the effects of inheriting problems from your parent (OS)
  21. Deconstructing the Smartcard Removal Policy Service
  22. Windows 7 attempts to make LDAP queries to root domain during enrollment operations
  23. Enforce Smartcard on Access Check in Windows 2008 R2

2009 37

  1. Windows 2020?
  2. Optimizing DFS Referrals: SiteCostedReferrals and PreferLogonDC
  3. The story of the Mysteriously Malfunctioning Mail Router (AKA EDNS and Exchange Escapedes)
  4. Fun with LDIFDE and MS09-056
  5. Troubleshooting autoenrollment
  6. Troubleshooting AD with Network Monitoring tools
  7. Changes in default encryption type for Kerberos pre-authentication on Vista and Windows 7 clients cause security audit events 675 and 680 on Windows Server 2003 DC's
  8. The case of the mysterious account lockout coming from Exchange
  9. Why living in the future is bad when you're a CA server (aka the story of 0x800b0101 CERT_E_EXPIRED)
  10. Troubleshooting account lockout the PSS way
  11. Using Ultrasound for troubleshooting FRS
  12. Problems with introducing a new Windows Server 2008 DC into a Windows 2003 forest
  13. EFS and Windows 2008 file servers
  14. How to make things better by making them worse
  15. What happens in a Journal Wrap?
  16. What are Userenv 1030 and 1058 events?
  17. Trusts and isolated names and logon performance
  18. RODC’s and Port Exhaustion
  19. Caveats for using RemoteApp and Roaming Profiles
  20. New features in Windows 7
  21. The golden rules of user resource management
  22. New AD features in Windows Server 2008 R2
  23. NDES and certificate renewal with a Windows Server 2003 Back-end CA
  24. Installing DPM Agent on target server fails:
  25. Considerations for implementing Credential Roaming
  26. Government issued ID cards and smartcard logons
  27. Troubleshooting RODC's: Troubleshooting RODC location in the DMZ
  28. CLM error: the directory property cannot be found in the cache
  29. Troubleshooting CLM: The directory property cannot be found in the cache
  30. How to install CLM 2007 on Windows Server 2008
  31. QFE vs GDR/LDR hotfixes
  32. GDR vs QFE/LDR
  33. Why should I restore System State rather than troubleshoot?
  34. Using a custom template for Subordinate CA's
  35. Converting AD attributes using FILETIME to a meaningful value
  36. The Windows Filtering Platform has blocked a bind to a local port
  37. Schannel 36872 or Schannel 36870 on a Domain Controller

2008 15

  1. Configuring a Windows Server 2008 front-end web enrollment server for delegation
  2. Requiring Smart Cards for logon - what happens when CRL publication fails
  3. Dude, where's my Forest Root?
  4. Windows
  5. Time travel and factors that increase client startup or login time
  6. What happens when a group is deleted
  7. Netlogon 5719 and the Disappearing Domain [Controller]
  8. What is logged to the Userenv.log file?
  9. Troubleshooting RODC's: Troubleshooting domain joins against RODC's
  10. Naming schemes to avoid in AD
  11. Troubleshooting AD Replication
  12. OS Security settings that affect CLM
  13. Troubleshooting the intermittent slow logon or slow startup
  14. AD Troubleshooting Blog Images
  15. The magical 2 minute logon delay mystery