Active Directory

Decommissioning Domain Controller

by

Use of DCPROMO is still the proper way to remove a DC server in an Active Directory infrastructure. Certain situations, such as server crash or failure of the DCPROMO option, require manual removal of the DC from the system by cleaning up the server’s metadata. The following detailed steps will help you accomplish this: Step … Read more

Removing Lingering Objects in AD Using the LoL GUI Tool

by

Lingering objects in Active Directory can disrupt replication and introduce directory inconsistencies. Microsoft provides a graphical utility called the Lingering Object Liquidator (LoL) that simplifies detection and removal without relying solely on command-line tools. This guide outlines a structured troubleshooting approach and safe use of the LoL GUI tool. Understanding Lingering Objects Lingering objects occur … Read more

Repadmin Commands — Quick Reference and Use Cases

by

Repadmin is a command-line utility used to diagnose and manage Active Directory replication. It allows administrators to view topology, monitor health, force synchronization, and troubleshoot complex directory issues. It is installed with: Run from an elevated command prompt. Displays the master command list and syntax help. Command Categories 1️⃣ Forest & Domain Overview Replication Summary … Read more

🔐 Essential Windows Commands for Managing Passwords

by

Whether you’re a system admin, helpdesk technician, or a curious power user, password management is something you’ll deal with often. Here’s a neat little collection of powerful Windows command-line tools you can use to reset, set, and manage passwords—without opening a single window or GUI. 🔁 1. Reset a Password for an Active Directory User … Read more

Retrieve Active Directory User List from OU with Group Memberships

by

In this article, we’ll explore a PowerShell script to retrieve a list of users from a specified Organizational Unit (OU) in Active Directory (AD). This script also includes information about the groups to which each user belongs. Prerequisites PowerShell Script # Define the OU where the users reside$OUpath = ‘OU=Disabled user,DC=example,DC=com’# Define the path for … Read more

“Unable to load the specified offline registry have” When rejoining the domain

by

1) Open MMC 2) Add Security Configuration and Analysis tool 3) Right click Security Configuration and Analysis in the left pane and Select open database 4) In the file name, type in secnew.sdb, click open. 5) Select setup defltbase.inf as the template from the location C:\Windows\inf, and click open. 6) Right click Security Configuration and … Read more

Default Values of AD Password Policy.

by

Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy Topic Description Enforce password history Describes the best practices, location, values, policy management, and security considerations for the Enforce password history security policy setting. Maximum password age Describes the best practices, location, values, policy management, and security considerations for the Maximum password age security policy setting. Minimum password age Describes the best practices, … Read more

“The encryption type requested is not supported by the KDC” when the user tries to reset

by

In this case, the error can be resolved in one of two ways. Steps to configure the policy setting Network security: Configure encryption types allowed for Kerberos Method 1 – Local Security Policy Method 2 – Group Policy Object (GPO) If this is for the specific service account, for example, an SQL Service account. Steps to … Read more

Transfer FSMO Role

by

Transferring the RID Master, Infrastructure Master and PDC Emulator Role Checking the Current Role Holders You can learn about three domain-wide role holders, including their FQDNs, by running the following cmdlet:Get-ADDomain You can use the Get-ADDomain cmdlet again after transferring FSMO roles to make sure that the operation was successful. Transferring the Roles You can transfer a … Read more

How to Create Custom Attributes In Active Directory

by

Permissions and Requirements Register Schema snap-in Adding Custom Attributes Add the active directory schema snap-ins You will receive Schema Object Creation warning message indicating that creating schema objects is a permanent operation. Click Continue to proceed.  Now you will see the following Create New Attribute window. Enter the Common Name, LDAP Display Name. For example, if you … Read more

Migrate from a Run As account to Managed Identities

by

https://learn.microsoft.com/en-us/azure/site-recovery/how-to-migrate-run-as-accounts-managed-identity Prerequisites Before you migrate from a Run As account to a managed identity, ensure that you have the appropriate roles to create a system-assigned identity for your automation account and to assign it the Contributor role in the corresponding recovery services vault. Benefits of managed identities Here are some of the benefits of using … Read more

AD Connect Port Requirements.

by

Table 1 – Microsoft Entra Connect and On-premises AD This table describes the ports and protocols that are required for communication between the Microsoft Entra Connect server and on-premises AD. Protocol Ports Description DNS 53 (TCP/UDP) DNS lookups on the destination forest. Kerberos 88 (TCP/UDP) Kerberos authentication to the AD forest. MS-RPC 135 (TCP) Used … Read more