Access is denied errors

This issue typically indicates a Kerberos authentication problem, although there are several exceptions. To resolve the replication failure in this case, resolve the authentication failure before you try to fix the replication problem. To resolve this issue:

1. Make sure the Access this computer from network user right in the source server's security policy includes the appropriate groups. To do this, check the <computername>_userrights.txt file in the Directory Services MPSReports to confirm which groups are listed. Everyone, Authenticated Users, and Enterprise Domain Controllers must have that user right for successful replication.

2. Make sure the Kerberos Key Distribution Center (KDC) service is started.

3. Make sure the Trust computer for delegation check box is selected on the General tab of the domain controller Properties dialog box in Active Directory Users and Computers.

4. Using Adsiedit or Ldp (both included in the Windows 2000 Support Tools), confirm that the userAccountControl attribute is set to 532480. To check this, perform the following steps:

• Type adsiedit.msc from Start, Run.
• Expand the Domain NC container.
• Expand the object below, i.e. DC=Contoso, DC=COM.
• Expand OU=Domain Controllers.
• Right-click CN=<domain_controller>, and select Properties.
• Under Select a property to view, select userAccountControl and verify the value is 532480.

5. If the problem exists between domain controllers from different domains, check the trust relationship by doing the following:

• Open Active Directory Domains and Trusts.
• Right-click the desired domain and select Properties.
• Click the Trusts tab.
• Highlight the domain to verify and click Edit.
• Click Verify.

The Netdom tool included in the Windows 2000 Support Tools can also be used to verify the trust.

netdom trust <trusting_domain_name> /domain:<trusted_domain_name> /userd:<administrator> /password:<password> /verify /kerberos

6. If replication is failing between domain controllers in different domains, follow these steps:

Add the following registry value to the upstream replication partner:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters

Value name:  Replicator Allow SPN Fallback
Value type:  REG_DWORD
Value data:  1

Run the following command from the upstream partner:
repadmin /add CN=Configuration,DC=<domain controller>,DC=<com> <root DC name> <fully qualified name of child domain controller>

Remove the Replicator Allow SPN Fallback registry value after testing replication.

7. Attempt to reset the computer account password and force a refresh of Kerberos tickets of the downstream partner.

netdom resetpwd /server:<DC> /userd:<domain>\administrator /passwordd:<password>

Note Run the command on the problem domain controller. <DC> is any domain controller other than the domain controller with an invalid password. Set the Kerberos Key Distribution Center (KDC) service to manual on the problem domain controller and reboot. Restart the KDC service and switch it back to automatic after the reboot is completed.

8. Make sure the Service Principal Name (SPN) is registered for each domain controller object on each partner domain controller. For more information see KB article 308111.

Review the Registered Service Principal Names section of the Netdiag output on partner domain controllers to ensure that the test passes. Export the SPNs of each domain controller object involved in the replication failure from each partner using the following command:

ldifde -f spndump.txt -p base -l servicePrincipalName -d <DN of DC>

Either visually compare the SPNs or use the Windiff tool from the Windows 2000 Support Tools to compare the files for differences. Under the Options menu in Windiff, uncheck everything except Show different files, Show left-only lines, and Show right-only lines. After identifying the missing SPNs, edit the good SPN file as follows:

• Change changetype:  add to changetype:  modify.
• Add replace:  servicePrincipalName after the changetype line.
• Add "-" to the last line of the file.

Import the correctly registered SPNs on the partner domain controllers that do not have proper SPNs registered for its replication partner domain controllers.

ldifde -I -f goodSPNs.txt

9. If the problem domain controllers exist in only one domain with more than two domain controllers, force all computer accounts to be replicated throughout the enterprise. That means all domain controllers must be synchronized with all other copies of their domain. For each computer that is reporting a replication error, use the following command to force that computer to become synchronized. The domain to synchronize must be specified. For more information see KB article 296993.

repadmin /syncall /d /e <problem domain controller> <DN of domain>

Note For large environments, remove the /e switch to replicate domain controllers with the same site, or use /sync to target specific domain controllers in remote sites.

10. If the failing domain controllers reside in different domains, then specify the configuration partition. For more information see KB article 296993.

repadmin /syncall /d /e <problem domain controller> <DN of config>

Note For large environments, remove the /e switch to replicate domain controllers with the same site or use /sync to target specific domain controllers in remote sites.

11. Make sure the Enterprise Domain Controllers group has the required permissions on the directory partition’s access control list (ACL):

• Start Active Directory Users and Computers.
• On the View menu, select Advanced Features.
• Right-click the root domain object, and then select Properties.
• Select the Security tab, click Enterprise Domain Controllers in the name list, and then make sure the following permissions are selected under Allow:
  • Manage Replication Topology.
  • Replicating Directory Changes.
  • Replication Synchronization.

12.  Use Active Directory Sites and Services to make sure the server object and its corresponding NTDS Settings child object exist in the correct site.

13. Verify the following Group Policy security options under Security Settings match on all partner domain controllers.

• Additional Restrictions for Anonymous Connections.
• Digitally Sign Client Communication (Always).
• Digitally Sign Client Communication (When Possible).
• Digitally Sign Server Communication (Always).
• Digitally Sign Server Communication (When Possible).
• LAN Manager Authentication Level.

14. Check for Kerberos fragmentation by typing ping <destination computer> -f -l 1500. Start with 1500 first, and then work up to 2000. If it fails before 2000, then packets are likely being fragmented. For more information see KB article 244474.

Monitor NTDS Performance

Uses cooked performance counters to monitor NTDS performance on a domain controller.

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
set objRefresher = CreateObject("WbemScripting.SWbemRefresher")
Set colItems = objRefresher.AddEnum _
    (objWMIService, "Win32_PerfFormattedData_NTDS_NTDS").objectSet
objRefresher.Refresh
For i = 1 to 5
    For Each objItem in colItems
    Wscript.Echo "Directory service threads in use: " & _
        objItem.DSThreadsInUse
    Wscript.Sleep 2000
    objRefresher.Refresh
    Next
Next

This is a VB Script, this can be used by saving the file in .vbs file

Monitor Active Directory Replication

Returns a list of pending replication jobs on a domain controller

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & _
        strComputer & "\root\MicrosoftActiveDirectory")
Set colReplicationOperations = objWMIService.ExecQuery _
        ("Select * from MSAD_ReplPendingOp")
If colReplicationOperations.Count = 0 Then
    Wscript.Echo "There are no replication jobs pending."
    Wscript.Quit
Else
    For each objReplicationJob in colReplicationOperations 
        Wscript.Echo "Serial number: " & objReplicationJob.SerialNumber
        Wscript.Echo "Time in queue: " & objReplicationJob.TimeEnqueued
        Wscript.Echo "DSA DN: " & objReplicationJob.DsaDN
        Wscript.Echo "DSA address: " & objReplicationJob.DsaAddress
        Wscript.Echo "Naming context DN: " & objReplicationJob.NamingContextDn
    Next
End If

This is a VB Script, this can be used by saving the file in .vbs file

Monitor Active Directory Database Performance

Uses cooked performance counters to monitor the performance of the Active Directory database on a domain controller

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colDatabases = objWMIService.ExecQuery _
    ("Select * from Win32_PerfFormattedData_Esent_Database " _
        & "Where Name = 'NT Directory'")
For Each objADDatabase in colDatabases
    Wscript.Echo "Database cache hit percent: " & _
        objADDatabase.DatabaseCachePercentHit
Next

This is a VB Script, this can be used by saving the file in .vbs file

List Active Directory Database Replication Partners

Configures trust relationship refresh and validation properties.

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & _
        strComputer & "\root\MicrosoftActiveDirectory")
Set colReplicationOperations = objWMIService.ExecQuery _
    ("Select * from MSAD_ReplNeighbor")
For each objReplicationJob in colReplicationOperations 
    Wscript.Echo "Domain: " & objReplicationJob.Domain
    Wscript.Echo "Naming context DN: " & objReplicationJob.NamingContextDN
    Wscript.Echo "Source DSA DN: " & objReplicationJob.SourceDsaDN
    Wscript.Echo "Last synch result: " & objReplicationJob.LastSyncResult
    Wscript.Echo "Number of consecutive synchronization failures: " & _
        objReplicationJob.NumConsecutiveSyncFailures
Next

This is a VB Script, this can be used by saving the file in .vbs file

Install Active Directory Database Performance Counters

Installs the Active Database performance counters on a domain controller

Set WshShell = WScript.CreateObject("WScript.Shell")
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objShell = CreateObject("Shell.Application")
objFSO.CreateFolder ("C:\Performance")
Set objCopyFile = objFSO.GetFile("C:\windows\system32\esentprf.dll ")
objCopyFile.Copy ("C:\performance\esentprf.dll ") 
WshShell.RegWrite _
    "HKLM\System\CurrentControlSet\Services\Esent\Performance\Open", _
        "OpenPerformanceData", "REG_SZ"
WshShell.RegWrite _
    "HKLM\System\CurrentControlSet\Services\Esent\Performance\Collect", _
        "CollectPerformanceData", "REG_SZ"
WshShell.RegWrite _
    "HKLM\System\CurrentControlSet\Services\Esent\Performance\Close", _
        "ClosePerformanceData", "REG_SZ"
WshShell.RegWrite _
    "HKLM\System\CurrentControlSet\Services\Esent\Performance\Library", _
        "C:\Performance\Esentprf.dll", "REG_SZ"
strCommandText = "%comspec% /c lodctr.exe c:\windows\system32\esentprf.ini" 
WshShell.Run strCommandText

Replication topology and connectivity errors

The common causes of Event ID 1311 messages fall into two categories:  Improper logical configuration and Infrastructure failure. These events are logged when an improper logical configuration or a replication error occurs. For more information see KB article 307593.

1. Improper logical configuration.
   A logical configuration is improperly configured when information in the Configuration Naming Context (NC) does not match the physical topology of the network that hosts the Active Directory forest. For example, a site may not be properly defined, sites that are missing from site links may be included, site links may not be interconnected, or incorrect bridgeheads may have been configured.
   
2. Infrastructure failure.
   An infrastructure failure occurs as a result of one of more of the following events:
1. A wide area network (WAN) link fails.
2. A domain controller that hosts a necessary naming context is offline.
3. A replication failure occurs for one or more naming contexts.

For more information see KB article 307593.

LDAP bind error 31 errors

I. Attempt to reset the computer account password and force a refresh of Kerberos tickets:

• Use the Netdom tool from the Windows Support Tools to reset the machine account password.
  
  netdom resetpwd /server:<computername> /userd:<domain>\administrator /passwordd:<password>
  
  Note Run the command on the problem domain controller. <computername> is any domain controller other than the domain controller with the invalid password.
  
• Set the Kerberos Key Distribution Center (KDC) service to manual on the problem domain controller and reboot.
  
• After the reboot, start the KDC service and change it back to Automatic.
  
• If the problem persists even after the above steps, try the following:
1. Sometimes the HKEY_LOCAL_MACHINE\Security\Policy\PolAcDmN registry key is set to the computer name instead of the NetBIOS domain name. Use Regedt32 to view this value as Regedit does not display REG_BINARY values properly.
   
2. In Regedt32, highlight the No Name value and choose Display binary data from the View menu.
   
3. Confirm that the value in HKEY_LOCAL_MACHINE\Security\Policies\PolPrDmN is set to the NetBIOS domain name.
   
4. Copy that value and paste it into HKEY_LOCAL_MACHINE \Security\Policies\PolAcDmN.

II. Missing trustedDomain object.

If the trustedDomain object is missing, there will usually be an Event ID 1265 logged in the directory service event log referencing a "Target account name is incorrect" error. If the error is being reported for replication between two domain controllers of different domains which have a parent/child or tree root trust relationship, this error may be the result of a missing object that represents the trust relationship between the two domains. This object is known as a trustedDomain object and is found in the System container in Active Directory Users and Computers. If this object is not present, cross-domain authentication will fail. For more information see KB article 257844.

To resolve this issue perform the following steps:

Note This procedure should only be performed if the trustedDomain object for the remote domain is not present in the System container.

1. From the domain that is generating the Event ID 1265 or “LDAP Bind error 31” error messages, open Active Directory Domains and Trusts on the domain controller that holds the PDC Emulator operations master role for the domain. Right-click the object that represents the domain, and then select Properties.
   
2. Click the Trusts tab, and click Add to create both sides of the trust relationship to the remote domain. Because this would normally be a Kerberos trust, creating both sides of the trust is required. Creating the trusted side first generates the error message "Active Directory cannot verify the trust. Access is denied."
   
3. Click OK. Note that Active Directory Domains and Trusts displays the trust as a transitive, shortcut trust. Adding the trusting side generates the message "To verify the new trust, you must have permissions to administer trusts for the domain <domain name>. Do you want to verify the new trust?”
   
4. Click Yes, and supply the administrator credentials for the remote domain. When prompted for credentials, specify the NetBIOS domain name as well as the user name, i.e., CONTOSO\Administrator. The following error message is generated:  "Active Directory cannot verify the trust. Access is denied."
   
5. Click OK. Again, note that Active Directory Domains and Trusts displays the trust as a transitive, shortcut trust.
   
6. After both sides of the trust are created, run the Netdom command below (Netdom is included in the Windows 2000 Support Tools):
   
   netdom trust <local_domain> /domain:<remote_domain> /userd:administrator /passwordd:* /usero:administrator /passwordo:* /reset /twoway
   
   Where <local_domain> is the domain on which the trust is being created and <remote_domain> is the parent, child, or root domain being trusted. In either case, the fully qualified domain name (FQDN) should be used, i.e. "Contoso.com". This should result in the following message:
   
   Type the password associated with the domain user:  (This is UserD)
   
   Type the password associated with the object user:  (This is UserO)
   
   Resetting the trust passwords between <local_domain> and <remote_domain>. The trust between <local_domain> and <remote_domain> has been successfully reset and verified.
   
   The command completed successfully.
   
   
7. Reboot the domain controller where these changes were made.
   
8. After rebooting, wait several minutes for Active Directory to establish a secure channel and the Knowledge Consistency Checker (KCC) to attempt to re-establish replication links to the domain controllers in the remote domain. During this period, test that logons across the trust relationship are successful and that no errors are logged in the directory service event log.

Target account name is incorrect errors

Determine if replication is failing between domain controllers in different domains or the same domain. Review the directory service event logs very closely to identify what the source of the error is, such as a conflicting object.

I. If replication is failing between domain controllers in different domains:

1. Add the registry value below to the upstream replication partner.
   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters
   Value name:  Replicator Allow SPN Fallback
   Value type:  REG_DWORD
   Value data:  1
   
2. Run the following command from the upstream partner: 
   repadmin /add CN=Configuration,DC=<Contoso>,DC=<com> <root DC name> <fully qualified name of child DC>
   
3. Remove the Replicator Allow SPN Fallback registry value after testing replication.

II. Search for duplicate computer or user accounts in the domain of the failing domain controller and its upstream replication partner. For more information see KB article 310340.

III. Review the server objects of the problematic domain controllers in Active Directory Sites and Services to make sure there are no duplicates or conflicting objects present.

IV. Verify that multiple server names with the same IP address are not registered in DNS, which can happen if a domain controller is renamed and old DNS records are not scavenged. Use Adsiedit or Ldp (both are included in the Windows 2000 Support Tools) to verify that the dNSHostName attribute on each domain controller is populated with the correct value. To do this, perform the following steps.

1. Type adsiedit.msc from Start, Run.
2. Expand the Domain NC container.
3. Expand the object below, i.e. DC=Contoso, DC=COM.
4. Expand OU=Domain Controllers.
5. Right-click CN=<domain_controller>, and select Properties.
6. Under Select a property to view, select dNSHostName and verify the value contains the fully qualified name of the server, i.e. dc1.contoso.com.

V. If the problem domain controllers exist in only one domain with more than two domain controllers, then force all computer accounts to be replicated throughout the enterprise. That means all domain controllers must be synchronized with all other copies of their domain. For each computer that is reporting a replication error, use the following command to force that computer to become synchronized. The domain to synchronize must be specified. For more information see KB article 296993.

repadmin /syncall /d /e <problem domain controller> <DN of domain>

Note For large environments, remove the /e switch to replicate domain controllers with the same site or use /sync to target specific domain controllers in remote sites.

VI. If the failing domain controllers reside in different domains, then specify the configuration partition. For more information see KB article 296993.

repadmin /syncall /d /e <problem domain controller> <DN of config>

Note For large environments remove the /e switch to replicate domain controllers with the same site or use /sync to target specific domain controllers in remote sites.

VII. If the problem exists between domain controllers from different domains, check the trust relationship by doing the following:

1. Open Active Directory Domains and Trusts.
2. Right-click the desired domain and select Properties.
3. Click the Trusts tab.
4. Highlight the domain to verify and click Edit.
5. Click Verify.

The Netdom tool, included in the Windows 2000 Support Tools, can also be used to verify the trust.

netdom trust <trusting_domain_name> /domain:<trusted_domain_name> /userd:<administrator> /password:<password> /verify /kerberos

VIII. If the error happens when attempting replication between two domain controllers in different domains that have a parent/child or tree root trust relationship, it may be the result of a missing object that represents the trust relationship between the two domains. This object is known as a trustedDomain object and is found in the System container in the Active Directory Users and Computers tool. This type of object directly relates to the trust relationships displayed in Active Directory Domains and Trusts. If this object is not present Active Directory, cross-domain authentication will fail. If you discover that the trustedDomain object is missing, refer to the “Missing trustedDomain object” section of the troubleshooter.

IX. Make sure the Service Principal Name (SPN) is registered for each domain controller object on each partner domain controller. For more information see KB article 308111.

Review the Registered Service Principal Names section of the Netdiag output on partner domain controllers to ensure that the test passes. Export the SPNs of each domain controller object involved in the replication failure from each partner using the following command:

ldifde -f spndump.txt -p base -l servicePrincipalName -d <DN of DC>

Either visually compare the SPNs or use the Windiff tool from the Windows 2000 Support Tools to compare the files for differences. Under the Options menu in Windiff, uncheck everything except Show different files, Show left-only lines, and Show right-only lines. Once you have identified the missing SPNs, edit the good SPN file with the following steps:

1. Change changetype:  add to changetype:  modify.
2. Add replace:  servicePrincipalName after the changetype line.
3. Add "-" to the last line of the file.

Import the correctly registered SPNs on the partner domain controllers that do not have proper SPNs registered for its replication partner domain controllers.

ldifde -I -f goodSPNs.txt

Troubleshooting 'RPC Server is too busy errors'

This error is usually the result of a time synchronization problem between domain controllers. For more information see KB article 257187.

One method of synchronizing time amongst domain controllers is to use the net time command to synchronize the time with the computer that holds the primary domain controller (PDC) emulator operations master role. To do this, use the following command:
net time \\<PDC emulator> /set /y

This command instructs the local computer to synchronize its time with the PDC emulator. The /set option specifies that the time not only be queried, but synchronized with the specified server. The /y switch skips the confirmation for changing the time on the local computer.

Another method is to use the W32tm tool to determine if a time server is explicitly configured for the local computer and if synchronizations against that host are not working. At a command prompt on the server displaying the error messages, type the following:
w32tm –v

In the sample output below, a time server named DC01 has been configured, but it is unreachable by the local computer:
W32Time:  BEGIN:GetSocketForSynch
W32Time:  NTP:  ntpptrs[0] - DC01
W32Time:  rgbNTPServer DC01
W32Time:  NTP:  gethostbyname failed
W32Time:  Port Pinging to - 123
W32Time:  NTP:  connect failed
W32Time:  END:Line 1147

For more information on the Windows Time service and how clients synchronize their time, see KB article 224799.

Troubleshooting 'RPC Server is unavailable errors'

It is important to understand the internal name resolution configuration of the environment. Verify which servers are authoritative for the zone and how the client is configured to retrieve the DNS records. In most cases, the client should only point to DNS servers that can resolve the internal domain name.

1. Verifying proper client configuration

• Check local DNS settings under the TCP/IP settings of the network adapter. For more information on verifying TCP/IP settings, see Knowledge Base (KB) article 308199.
• In most cases, the client should not be pointing to an Internet service provider (ISP) for either their Preferred or Alternate DNS server. ISPs commonly do not register the service resource records (SRV) records that are required to locate a domain controller. For more information see KB article 261968.
• Clients should only point to internal DNS servers that can resolve the internal domain, and the internal DNS server should resolve names on the Internet for the clients, which is often done by configuring forwarders on the internal DNS server.

2. Verifying proper DNS server configuration

• In an Active Directory domain, typically a DNS server in a child domain should forward to a DNS server in the parent or root domain. For more information, see KB article 300202.
• As an alternative to forwarding from child to parent, the child DNS server may be configured with a secondary zone for the parent domain. For more information see KB article 313563.
• Microsoft® Windows Server™ 2003 can be configured to forward queries for a specific domain to specific DNS servers (conditional forwarding), and allow normal name resolution for all other domains if desired. In the DNS management tool, right-click the name of the DNS server in the left pane, select Properties, select the Forwarders tab, and then add the domain name under DNS domain, typing the IP addresses of the servers under Selected domain’s forwarder IP list. For more information see article 304491.
• Check for improperly configured forwarders.

1. If a forwarder that the domain name system (DNS) server is using is unable to resolve records for the zone, query it directly using a tool such as Nslookup to verify that the forwarder itself is the problem. For more information see KB article 200525.
2. Verify the DNS server is not configured to forward to non-recursive DNS server. This can be verified by viewing the response from the forwarder in a network trace and checking the DNS Flags field.

3. Verifying proper zone delegation

• Ensure the child zone is properly delegated from the parent. There should be a name server (NS) record in the parent domain for the child domain. The exception is if both child and parent domains are part of the same zone on the same DNS server. For more information see KB article 255248.
• Make sure the zone has not been delegated to a DNS server that is not authoritative for that zone. For more information see the section on delegation in KB article 255248.

4. Verifying configuration of internal root servers

• Windows 2000 has some definite steps that need to be followed besides just modifying the Cache.dns file on the DNS server. For more information see KB article 249868.

5. Verifying proper registration of DNS records

• After verifying settings in client and zone configuration sections, delete the Netlogon.dns and Netlogon.dnb files on the domain controller and restart the Net Logon service. For more information see KB article 259277.
• Verify that the domain controller does not have a disjointed namespace. For more information see KB article 257623.
• Verify Net Logon dynamic updates are not disabled in the registry by checking that the UseDynamicDNS value in the registry key below is not set to 0.
  HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters
• If SRV records are properly registering, and Net Logon A records are not, verify the RegisterDnsARecords value in the registry key below is not set to 0.
  HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters
• If a domain controller is not registering a globally unique identifier (GUID),  Net Logon event 5774 referencing the SRV record. Check for an MX (Mail Exchange) wildcard entry. For more information see KB article 325208. Also see KB article 259277 for additional information on Event ID 5774, 5775 and 5781.
• Verify domain controllers that are replication partners in the domain have their GUID registered in the forest root zone.
  Example of domain GUID record:
  Name: e99e82d5-deed-11d2-b15c-00c04f5cb503._msdcs.contoso.com
  Type:  CNAME
  Data:  dc01.contoso.com
  Records for global catalog servers are registered in the forest root domain, regardless of whether the domain controller is in a child domain or a different tree of the forest. The forest root domain is the first domain created in the forest.
  Domain controllers attempting to replicate will initiate a query to Active Directory for their configured replication partner and GUID. They then initiate a DNS query for the CNAME record for the GUID, similar to the record in the example above. If the GUID is not present in the DNS zone, the domain controller will not replicate with that partner.
• Each domain controller must also have a host record registered for their name (CNAME) in the DNS zone.
• Verify that both domain controllers involved in the replication can resolve the above DNS records for each other.
• If there are replication problems in the forest root zone, verify that domain controllers are not pointing to themselves for DNS. As a rule, only one domain controller in the forest root domain should be pointed to itself for either Preferred or Alternate DNS server in their TCP/IP properties setting. All other domain controllers should be pointed to DNS servers other than themselves. For more information see KB article 275278.

How to Enable Secure Channel Logging

When you enable Schannel event logging on a computer that is running Microsoft Windows NT Server 4.0, Microsoft Windows 2000 Server, or Microsoft Windows XP Professional, detailed information from Schannel events can be written to the Event Viewer logs, in particular the System event log.

Value Path: HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel
Value Name: EventLogging
Value Type: REG_DWORD
Value Data: 7
Output: System Event Log

How to Enable Kerberos Event Logging

Microsoft Windows 2000 and Microsoft Windows Server 2003 offer the capability of tracing detailed Kerberos events through the event log mechanism. You can use this information when you troubleshoot Kerberos.

Public URL:
262177 How to enable Kerberos event logging
http://support.microsoft.com/?id=262177

Value Path: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters
Value Name: LogLevel
Value Type: REG_DWORD
Value Data: 1 (hex)
Output: System event log
Note: If the Parameters subkey does not exist, create it.
Note: Remove this registry value when it is no longer needed so that performance is not degraded on the computer. Also, you can remove this registry value to disable Kerberos event logging on a specific computer.

How to Enable DCpromoUI Logs

The Dcpromoui.log file captures status information on the promotion or demotion of an Active Directory computer from start to finish, including the capture of user input for the role the server will play in the forest.

221254 Registry Settings for Event Detail in the Dcpromoui.log File
http://support.microsoft.com/?id=221254

Value Path: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AdminDebug
Value Name: DCPromoUI
Value Type: REG_DWORD
Value Data: FF0003 (hex)
Output: %systemroot%\debug\dcpromoui*.log

How to configure Active Directory diagnostic event logging in Windows

Active Directory records events to the Directory Services log of Event Viewer. You can use the information that is collected in the log to help you diagnose and resolve possible problems or monitor the activity of Active Directory-related events on your server. By default, Active Directory records only critical events and error events in the Directory Service log. To configure Active Directory to record other events, you must increase the logging level by editing the registry.

314980 How to configure Active Directory diagnostic event logging in Windows
http://support.microsoft.com/?id=314980

Value Path: HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics
Each of the following REG_DWORD values under the Diagnostics subkey represent a type of event that can be written to the event log:
Value Names: 
1 Knowledge Consistency Checker
2 Security Events
3 ExDS Interface Events
4 MAPI Interface Events
5 Replication Events
6 Garbage Collection
7 Internal Configuration
8 Directory Access
9 Internal Processing
10 Performance Counters
11 Initialization/Termination
12 Service Control
13 Name Resolution
14 Backup
15 Field Engineering
16 LDAP Interface Events
17 Setup
18 Global Catalog
19 Inter-site Messaging
The following values are valid only on Windows Server 2003:
20 Group Caching
21 Linked-Value Replication
22 DS RPC Client
23 DS RPC Server
24 DS Schema
Value Type: REG_DWORD
Value Data: <0-5>
Output: Directory Services Event Log

Reading userAccountControl Values for an Active Directory User Account

Reads values from the userAccountControl of the MyerKen Active Directory user account.

Set objHash = CreateObject("Scripting.Dictionary")
 
objHash.Add "ADS_UF_SMARTCARD_REQUIRED", &h40000 
objHash.Add "ADS_UF_TRUSTED_FOR_DELEGATION", &h80000 
objHash.Add "ADS_UF_NOT_DELEGATED", &h100000 
objHash.Add "ADS_UF_USE_DES_KEY_ONLY", &h200000 
objHash.Add "ADS_UF_DONT_REQUIRE_PREAUTH", &h400000 
 
Set objUser = GetObject _
    ("LDAP://cn=MyerKen,ou=Management,dc=NA,dc=fabrikam,dc=com")
intUAC = objUser.Get("userAccountControl")
 
If objUser.IsAccountLocked = True Then
    WScript.echo "ADS_UF_LOCKOUT is enabled"
Else
    WScript.echo "ADS_UF_LOCKOUT is disabled"
End If
wscript.echo VBCRLF
 
For Each Key In objHash.Keys
    If objHash(Key) And intUAC Then 
        WScript.echo Key & " is enabled"
    Else
        WScript.echo Key & " is disabled"
  End If
Next

This is a VB Script, this can be used by saving the file in .vbs file

Configuring the UPN Suffixes Defined in the Forest

Configures the upnSuffixes attribute of the Partitions container and displays the new values to the operator.

Const ADS_PROPERTY_APPEND = 3 
Set objPartitions = GetObject _
    ("LDAP://cn=Partitions,cn=Configuration,dc=fabrikam,dc=com")
 
objPartitions.PutEx ADS_PROPERTY_APPEND, _
    "upnSuffixes", Array("sa.fabrikam.com","corp.fabrikam.com")
objPartitions.SetInfo
 
For Each Suffix in objPartitions.GetEx("upnSuffixes")
    WScript.Echo Suffix
Next

This is a VB Script, this can be used by saving the file in .vbs file