Active Directory New Issue

Hi everyone!

i am experiencing some issues over the network.... first one is realting to active directory, whenever i Use to create a new account in the directory i recive a message (please find the enclosed screenshot).

Also i have experienced that few users are unable to logged into the Domain they are receiving a message related to Time syncronization with the Domain, due to which they can't use the domain services......

I would appreciate your quick help. by the way server running windows 2003.

fanacool,
No screen shot that i can see. But i would say for the other problem that one of your domain controllers is not synchronised time wise with your other DC's. This is very important for an AD. If you havent set up the time server on all your DC then you may have the second problem you are describing.

Screenshot

Fanacool
A silly question do you have a globale catalogue server?
Looks to me you need to check out the state of network connections between your DC. I am assuming you have more than one DC but it would be good if you could give us more information on your set up. Type of windows AD 2000 or 2003. set up of your DC and the different roles ect.

you can also check out this e-book. The definitive guide to active directory troubleshooting

Windows 2003
I have only one Domain Controller...... and i haven't setup any time server, rather i remember i have never ever configured a time server in the domain and it was running perfectly alright....

Well i faced similar problem a day ago (time synrconization one), what i did was it joined that computer on workgroup and then re-join it to my domain and things went ok on that client but the client troubling today is pretty tough..... giving me too much hard time.

In that case you would probably want to check to see if you have set the DC as global catalogue. See also my edit in my last post

Need a little help about this global catalogue thing.

here you go :
understanding globale catalogues

From microsoft technet.

Read that and the other link I supplied it should help explain things a bit.

If you only have on DC then it should be holding all the FSMO roles i wulod imagaine, it depends on your network config, need more information.

If this is the case then sounds ike AD on the DC could be corrupt, you could do a restore ?

or use sites and services to change the fsmo roles to make sue there is a GC available ?

By default Active Directory Domain Controllers will only allow users to log in if the time is syncronized within a certain period of time. In other words, I believe this default time is 5 minutes.

So if the server time is 9:00am and the PC time is 9:20am , in many cases it will not allow to connect due to the time difference. This is a "feature" that microsoft added to help with securiyt issues.


I would use a NTP server address and have your server synch with it, then set up your policy to synch all pcs with the server time.

I use time.nist.gov for my external NTP server and have no problems.

Hope this helps some.

As for the global catalog, you should have one installed by default with Active Directory, did you move the GC role to another server by chance?

Well the problem has been resolved.....

We have a new server which will be up by monday..... all i did was copied the AD into that server as it will be replacing the one we are currently using...... Is it to do something with copying the AD..... although the new one is not online yet.

How are you planning to do this migration? Are you just going to power off the old DC? I wouldnt think you could just copy everything over to a new server like they were data files due to security rights on the SID's etc. Someone is more than happy to correct me if I am wrong.

I would be more inclined to promote the new server as another DC let it sit for X amount of time. Roll all the FSMO roles over to the new DC and then power down the old DC to see if everything still works correctly. If it doesnt then you can bring the old one back up. But with the way AD is constructed when you promote the new DC it should copy all the settings and in turn become its own box. Then when you move the FSMO roles over to it the old server should be nothing more than another DC which you could demote and take offline.

As i said AD is already been copied, I will promot the new server in the Domain and yes will let it work for a while with the old present......

Thanx for the advice.

Just thought you might like a tool specifically designed for migrating AD. Maybe not this time, but for future migrations? In any event, check ADMT 3.0 out:
http://www.microsoft.com/downloads/d...displaylang=en

Fanacool
When you say you copied the AD into the other server what do you mean by that?
Normally when you are inserting a new server into the domain you have nothing to copy. You just do a DCpromo and let windows copy the ad and roles to the new server. You may need to verify that the roles are copied properly and that in "sites and services"(i think) the syncronisation is working. You can also check that easily in the event viewer. Also if you have the option I would keep the two servers on line. Of course that depends on if it is a buisness domain, your personnel network or a school lab. If it is a buisness domain I would recomened the two DC. For the other options 1 is ok.

Since English is not my first language so sometimes my responeses looks vague and boggling.... I mean i migrated the AD and other things to the new server. Exactly this what i did, selected it a memeber of existing domain and AD users and policies got copied in it.... Both will be running for some time and when i feel that things are running ok i will take out the old one and let this be working..... Not completly take out the old one rather prmote the new one ...... It is a business envoirnment... runnnig two DC ..... whts the advantage?

Dont worry about your level of english it is good enought to explain what you need. There are two big advantages to having two DC. The first one is load balancing. Both of client machines and for the different services that may be running in your enviroment. The second and most important one if your company is dependant on its IT infrastructure is to avoid a sinlge point of failure. That is if one of your DC dies then the other one is still running so your users can still log on and work.

So it will be running as a BDC, and if the main Primary gets fail this will be still running and giving services to the internal users....... But One thing...... How can i achieve the same thing for external users (the users that access my application server via Internet).... I mean is there a possibility that i can provide the same sort of backup thing to them too.