Windows Server: AD, DNS & Group Policy
Active Directory replication, trusts, DNS, SYSVOL and Group Policy processing.
55 articles
Event ID 4771
Event ID 4771 Kerberos pre-authentication failed: tracing account lockouts
Event ID 4771 records every failed Kerberos pre-auth on the DC. Read the failure code and caller IP to find…
Event ID 4001
NTLM authentication blocked by policy: reading the NTLM operational log
Restrict NTLM policy denied the logon, not a bad password. Audit first, add a server exception, or move the app…
Event ID 12
Event ID 12: the PDC emulator has no external time source configured
Event ID 12 means the forest root PDC is trusting its own clock. Point W32Time at reliable NTP peers and…
Event ID 129
Event ID 129: NtpClient cannot resolve a domain peer to use as a time source
Event ID 129 means W32Time could not find a domain time peer through DNS. Repair the DC locator records and…
Event ID 4521
Event ID 4521: DNS cannot load an Active Directory integrated zone
Event ID 4521 means DNS could not read a zone from its directory partition. Check partition membership, replication scope and…
Event ID 50
Event ID 50: the time service found a difference too large to accept
The time service found a difference it will not correct, and stopped serving time. Fix the hierarchy, disable host time…
Event ID 5002
DFSR Event ID 5002: SYSVOL partners cannot hold an RPC session open
Event ID 5002 means DFSR lost its RPC session to a partner DC. Repair name resolution, firewall rules and the…
Event ID 13508
FRS Event ID 13508: SYSVOL still on File Replication Service and unsupported
Event ID 13508 flags an FRS SYSVOL that never converged. FRS is gone from current Windows Server, so migrate SYSVOL…
0x54B
Error 0x54B on domain join: the specified domain could not be contacted
Error 0x54B means the client cannot locate a DC for the domain. Point the NIC at internal DNS, clear stale…
0x6BA
Error 0x6BA during domain join: RPC and the endpoint mapper are blocked
Error 0x6BA means the joining client cannot reach RPC on the DC. Open TCP 135, the dynamic range and 445,…
0x52E
Error 0x52E joining a domain: credentials rejected or missing OU rights
Error 0x52E means the join account failed to authenticate or lacks rights on the target OU. Delegate Create Computer Objects…
8557
Error 8557 machine account quota exceeded: no more computers may join
Error 8557 blocks the join once ms-DS-MachineAccountQuota is used up. Pre-stage the object or delegate the OU, and license every…