Nejčastěji odpovídající uživatel
DC is not in the domain controller's OU

Dotaz
-
I got problems with my DC and ran DCDIAG which reported a problem i don't know how to fix:
Starting test: MachineAccount
Checking machine account for DC DC2 on DC DC2.
* The current DC is not in the domain controller's OU
The account DC2 is not trusted for delegation. It cannot replicate.
The account DC2 is not a DC account. It cannot replicate.
Warning: Attribute userAccountControl of DC2 is: 0x1000 = ( WORKSTATION_TRUST_ACCOUNT )
Typical setting for a DC is 0x82000 = ( SERVER_TRUST_ACCOUNT | TRUSTED_FOR_DELEGATION )
This may be affecting replication?
* SPN found :LDAP/DC2.xxxx.local/xxxx.local
* SPN found :LDAP/DC2.xxxx.local
* SPN found :LDAP/DC2
* SPN found :LDAP/DC2.xxxx.local/xxxx
* SPN found :LDAP/d1655dfb-59e5-48b3-8c68-232b4d3aaca0._msdcs.xxxx.local
* SPN found :E3514235-4B06-11D1-AB04-00C04FC2DCD2/d1655dfb-59e5-48b3-8c68-232b4d3aaca0/xxxx.local
* SPN found :HOST/DC2.xxxx.local/xxxx.local
* SPN found :HOST/DC2.xxxx.local
* SPN found :HOST/DC2
* SPN found :HOST/DC2.xxxx.local/xxxx
* SPN found :GC/DC2.xxxx.local/xxxx.local
......................... DC2 failed test MachineAccount
Odpovědi
-
Should find it here.
Regards, Dave Patrick ....
Microsoft Certified Professional
Microsoft MVP [Windows Server] Datacenter Management
Disclaimer: This posting is provided "AS IS" with no warranties or guarantees, and confers no rights.- Označen jako odpověď Regamoks úterý 19. listopadu 2019 17:44
-
May need to restore a known good recent backup.
Regards, Dave Patrick ....
Microsoft Certified Professional
Microsoft MVP [Windows Server] Datacenter Management
Disclaimer: This posting is provided "AS IS" with no warranties or guarantees, and confers no rights.- Označen jako odpověď Regamoks úterý 19. listopadu 2019 17:44
-
How is Exchange going to "behave" if i restore a 2 month old version off the DC (there is no change of users in that time frame)?
I'd ask that one of experts in dedicated forums over here.
https://social.technet.microsoft.com/Forums/office/en-US/home?category=exchangeserver
(please don't forget to mark helpful replies as answer)
Regards, Dave Patrick ....
Microsoft Certified Professional
Microsoft MVP [Windows Server] Datacenter Management
Disclaimer: This posting is provided "AS IS" with no warranties or guarantees, and confers no rights.- Označen jako odpověď Regamoks úterý 19. listopadu 2019 17:44
-
Expanded tree further - but still problem: https://1drv.ms/u/s!AtStjN0soI68ezjHf6lyFfcsrd4?e=ckAna7
The Domain Controller is running in an Hyper-v environment and i just restored a 1 year old version (without network connection) and the UAC=0x82000.
How is Exchange going to "behave" if i restore a 2 month old version off the DC (there is no change of users in that time frame)?
- Označen jako odpověď Regamoks úterý 19. listopadu 2019 17:44
Všechny reakce
-
Assuming other DCs, you might transfer or seize roles to another healthy one, demote, reboot, promote again.
Regards, Dave Patrick ....
Microsoft Certified Professional
Microsoft MVP [Windows Server] Datacenter Management
Disclaimer: This posting is provided "AS IS" with no warranties or guarantees, and confers no rights. -
-
Hello,
Thank you for posting in our forum.
Agree with Dave.If we have other DCs ,we should transfer/seize FSMO roles to another healthy DC,then demote old DC,reboot,promote again.
For the transfer of FSMO roles, we can refer to:Step-By-Step: Migrating Active Directory FSMO Roles From Windows Server 2012 R2 to 2016
For demoting old DC, we can refer to:Demoting Domain Controllers and Domains
More information about metadata clean up please refer to the following article:Clean up Active Directory Domain Controller server metadata
Best regards,
CynthiaPlease remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com. -
I found this guide which i think apply:
https://support.microsoft.com/en-au/help/2022387/active-directory-replication-error-8453-replication-access-was-denied
But I'm not able to "7 . Double-click the UserAccountControl attribute, and then record its decimal value" because the attribute don't show up in the list.
-
No DC2 is the only domain controller in the domain.
Please run;- Dcdiag /v /c /d /e /s:%computername% >c:\dcdiag.log
- repadmin /showrepl >C:\repl.txt
- ipconfig /all > C:\dc1.txt
- ipconfig /all > C:\dc2.txt
then put unzipped text files up on OneDrive and share a link.
Regards, Dave Patrick ....
Microsoft Certified Professional
Microsoft MVP [Windows Server] Datacenter Management
Disclaimer: This posting is provided "AS IS" with no warranties or guarantees, and confers no rights. -
-
-
I'd check in ADUC that the domain controller is in Domain Controllers OU
Also appears that the userAccountControl attribute is 0x1000 where it should be 0x82000
Regards, Dave Patrick ....
Microsoft Certified Professional
Microsoft MVP [Windows Server] Datacenter Management
Disclaimer: This posting is provided "AS IS" with no warranties or guarantees, and confers no rights. -
Yes i have figured out that the "MachineAccount" is set to 0x1000 = ( WORKSTATION_TRUST_ACCOUNT ) => 0x82000.
I can't find the MachineAccount" in ADUC.
I tried to fix it according to (as mentioned just before your first posting): https://support.microsoft.com/en-au/help/2022387/active-directory-replication-error-8453-replication-access-was-denied
I'm logged in as domain\administrator.
-
Should find it here.
Regards, Dave Patrick ....
Microsoft Certified Professional
Microsoft MVP [Windows Server] Datacenter Management
Disclaimer: This posting is provided "AS IS" with no warranties or guarantees, and confers no rights.- Označen jako odpověď Regamoks úterý 19. listopadu 2019 17:44
-
-
May need to restore a known good recent backup.
Regards, Dave Patrick ....
Microsoft Certified Professional
Microsoft MVP [Windows Server] Datacenter Management
Disclaimer: This posting is provided "AS IS" with no warranties or guarantees, and confers no rights.- Označen jako odpověď Regamoks úterý 19. listopadu 2019 17:44
-
Expanded tree further - but still problem: https://1drv.ms/u/s!AtStjN0soI68ezjHf6lyFfcsrd4?e=ckAna7
The Domain Controller is running in an Hyper-v environment and i just restored a 1 year old version (without network connection) and the UAC=0x82000.
How is Exchange going to "behave" if i restore a 2 month old version off the DC (there is no change of users in that time frame)?
- Označen jako odpověď Regamoks úterý 19. listopadu 2019 17:44
-
How is Exchange going to "behave" if i restore a 2 month old version off the DC (there is no change of users in that time frame)?
I'd ask that one of experts in dedicated forums over here.
https://social.technet.microsoft.com/Forums/office/en-US/home?category=exchangeserver
(please don't forget to mark helpful replies as answer)
Regards, Dave Patrick ....
Microsoft Certified Professional
Microsoft MVP [Windows Server] Datacenter Management
Disclaimer: This posting is provided "AS IS" with no warranties or guarantees, and confers no rights.- Označen jako odpověď Regamoks úterý 19. listopadu 2019 17:44
-
-