Windows Server: AD, DNS & Group Policy
Active Directory replication, trusts, DNS, SYSVOL and Group Policy processing.
55 articles
8340
Error 8340: metadata cleanup after a domain controller that never came back
Error 8340 appears when removing a dead DC's metadata. Clean up with ntdsutil, delete the NTDS Settings object and tidy…
8610
Error 8610: FSMO role ownership cannot be verified until the partition replicates
Error 8610 blocks FSMO work until the partition replicates. Repair replication first, and only seize the role with ntdsutil once…
8531
Error 8531 Directory Service cannot start: NTDS database and disk failures
Error 8531 is ERROR_DS_CANT_START: AD DS could not start against its database. Read the codes logged with it, then rebuild…
8565
Error 8565: raise the forest functional level before adding this controller
Error 8565 blocks promotion when the forest level predates the new OS. Retire the legacy DCs, raise the level, then…
8568
Error 8568: the functional level will not rise while legacy DCs remain
Error 8568 means a domain controller still runs an older operating system. Locate it, demote or upgrade it to a…
Event ID 4771
Event ID 4771 Kerberos pre-authentication failed: tracing account lockouts
Event ID 4771 records every failed Kerberos pre-auth on the DC. Read the failure code and caller IP to find…
Event ID 4001
NTLM authentication blocked by policy: reading the NTLM operational log
Restrict NTLM policy denied the logon, not a bad password. Audit first, add a server exception, or move the app…
Event ID 12
Event ID 12: the PDC emulator has no external time source configured
Event ID 12 means the forest root PDC is trusting its own clock. Point W32Time at reliable NTP peers and…
Event ID 129
Event ID 129: NtpClient cannot resolve a domain peer to use as a time source
Event ID 129 means W32Time could not find a domain time peer through DNS. Repair the DC locator records and…
Event ID 4521
Event ID 4521: DNS cannot load an Active Directory integrated zone
Event ID 4521 means DNS could not read a zone from its directory partition. Check partition membership, replication scope and…
Event ID 50
Event ID 50: the time service found a difference too large to accept
The time service found a difference it will not correct, and stopped serving time. Fix the hierarchy, disable host time…
Event ID 408
Event ID 408: the DNS server could not open a socket on its listen address
Event ID 408 means another process holds port 53 or the listen address vanished. Free UDP and TCP 53, correct…