To remove protection that prevents an OU from accidental deletion

To remove protection that prevents an OU from accidental deletion

1.Log on to the computer as a member of the Domain Admins group.

2.Open Active Directory Users and Computers.

3.Click View, and then click Advanced Features.

4.First, clear permissions on the OU for which you want to remove protection. To do this, right-click the OU, and then click Properties.

5.In OU Properties, click the Security tab, and then click Advanced.

6.In Permission Entries, select the Deny entry for the Everyone group, and then click Remove.

7.Click OK to close the Advanced Security Settings, and then click OK to close OU Properties.

8.Second, clear permissions on the parent container of the OU for which you want to remove protection. To do this, right-click the parent container, and then click Properties.

9.In ContainerProperties, click the Security tab.

10.In Group or user names, select the Everyone group, and then clear the Deny check box for Delete All Child Objects, and then click OK to close Container Properties.

目的地端伺服器目前拒絕複寫要求

錯誤訊息如下:

解決方法:
試試看檢查下面幾項動作
1.Netlogon Service有沒有啟動或者服務重新啟動
2.是否有此值 HKLM\System\CCS\Services\NTDS\Parameters 底下的 "DSA Not Writable" .. 有的話把他刪除&重新開機
3.確定 repadmin /options dc1 是否還會有該兩項選項..有的話嘗試用先前的指令在試試看
repadmin /options DC1 -DISABLE_INBOUND_REPL
repadmin /options DC1 -DISABLE_OUTBOUND_REPL
4.確定 repadmin /options dc2 是否還會有該兩項選項..有的話嘗試用先前的指令在試試看
repadmin /options DC2 -DISABLE_INBOUND_REPL
repadmin /options DC2 -DISABLE_OUTBOUND_REPL
5.拒絕複寫要求的問題解決

設定DC為Time Server

設定網域環境中一台DC為Time Server,首先先確定在DC上目前Time Server的指向.



如果Time Server未指向正確的Server,請參考下列指令來完成Time Server的指向設定.



完成上述Time Server的指向設定,接著再做最後一次確認,確認無誤後即可完成.



小叮嚀:
• 確認 W32Time 服務已設定自動啟動.
• 確認防火牆設定允許 UDP 123 封包穿透.

關於 Shared Folders and Shared-Folder Permissions

關於 Shared Folders and Shared-Folder Permissions 在 Member Server 與 Domain Controller 所需要的權限:
Members of the Administrators or Power Users group can share folders on a Windows member server. You have to be a member of the Administrators or Server Operators group to share folders on a domain controller of a domain.

What is the Server Operators?

關於Server Operators的權限範圍如下:
Members of this group can perform server management tasks such as creating, changing, and deleting shared printers, shared directories, and files. They can also back up and restore files, lock the server console and shutdown the system. They cannot modify system policies or start and stop services.

Changing the Primary Domain DNS name of this computer to "XXX" failed.

Windows 7 or Windows Server 2008 Jion Domain 時會產生此錯誤,聽說這是微軟的 BUG 會在 Hotfix 中解決,另外,您也可以在此電腦上手動新增 DNS Suffix 或者如有多筆 DNS 紀錄,調整主要 DNS 紀錄看是否可以解決這樣的問題.

NTDS Replication Error

同一個AD Site裡,W2K3 DC與W2K8 RODC並存,會發生如下的錯誤訊息,此錯誤訊息可忽略的說明如下:

Event Type: Error
Event Source: NTDS Replication
Event Category: DS RPC Client
Event ID: 1645
Date: 11/29/2010
Time: 10:04:26 AM
User: NT AUTHORITY\ANONYMOUS LOGON
Computer: Server Name
Description:
Active Directory did not perform an authenticated remote procedure call (RPC) to another domain controller because the desired service principal name (SPN) for the destination domain controller is not registered on the Key Distribution Center (KDC) domain controller that resolves the SPN.


訊息解釋說明如下:
-The event is caused when W2K8 RODC’s ask (full) W2K3 DC’s to provide change notification.
-This event may indicate that full DC’s and RODC’s are in the same AD site.
-Do not add the e351… AD replication SPN for the RODC as implied by the message text for the 1645 event. RODC's do not register the replication SPN.
-If the existence of the full DC in the same AD site as the RODC is temporary, ignore this event. Otherwise, place full DC’s and RODC’s in different AD sites.

子網域發生USN RollBack

由於此台DC為子域中唯一一台網域控制站，所以暫時先添加另一台網域控制站入子域，使其與問題DC先進行複製，之後再對問題DC進行降級。同時為了避免與父系網域之間的複製再次導致Inbound & Outbound複製被disable，請手動刪除與父系網域DC之間的複製連結。

而子網域發生USN RollBack 建議採用以下步驟進行.看是否有機會可以避免重作網域的可能性

處理步驟:
1. 加入新Win 2003 Server
2. 在 Child DC,開啟 AD 站台及服務 手動將 Child DC 下 NTDS 中與 Root DC "自動產生"連線 刪除
3. 修改機碼

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters
修改此機碼值為 “0” “Dsa Not Writable”

4. repadmin 開啟 Inbound /outbound 覆寫

repadmin /options Child DC -DISABLE_INBOUND_REPL
repadmin /options Child DC -DISABLE_OUTBOUND_REPL

5. 請確認 Netlogon Service 狀態為 “啟動”
6. 進行 New Child DC dcpromo
7. 確認新DC 覆寫正常後.進行 Old Child DC 降級
8. 確認新DC 正常與父網域覆寫後,進行Old Child DC 升級網域
9. 再確認網域覆寫無誤後.就可以進行轉移角色回 Old Child DC

參考文件:
How to detect and recover from a USN rollback in Windows Server 2003