Month: Apr 2015
![220px-Confucius_Tang_Dynasty[1]](https://lazyadminblog.com/wp-content/uploads/2015/04/220px-confucius_tang_dynasty1.jpg)
AD account lockout issues
Let me give some more idea which will help you to troubleshoot similar steps in future. Here are the most probable reasons which can cause account lockout issues. Exchange ActiveSync mobile devices – 90% of account lockout issues are caused by an “unknown” device trying to sync with your Exchange mailbox.
- Apple MobileMe – contacts sync – Check and ensure the user hasn’t configured MobileMe to sync his contacts from Outlook. If this is configured with AD credentials, it can be a reason for account lockout
- Applications / Web applications/ Tools which sync with Active Directory for authentication – There might be third party applications which are running which may have AD username and password stored within and lot of times the moment the user open applications like Internet explorer / browser, the application or the tools, it will try to authenticate in the background and lock the password.
- Vault for credentials in Windows Control Panel or Credential manager – This is the second most obvious reason the user might get locked out. In my case, the user had an intranet SharePoint web portal and the AD credentials where cached in Credential manager. Make sure Windows Credentials area is empty
Stored usernames and passwords – rundll32.exe keymgr.dll, KRShowKeyMgr – This shouldn’t be a problem in most cases. Open a run windows and type rundll32.exe keymgr.dll, KRShowKeyMgr and delete stored passwords if any.
- Rename AD Profile on the user machine – This is more like trying to fix the issue without knowing what’s causing it. This is under the assumption that account lockout happens when the user is logged into his client machine. If the account lockout is caused from an application or “something” from that machine, rename the AD profile on the client from “Documents and Settings in XP and Users in Win7″, advise the user to login again and monitor the situation.
![lockoutstatus[1]](https://lazyadminblog.com/wp-content/uploads/2015/04/lockoutstatus1.jpg)
Other advanced level tools are LockOutStatus and ADLockouts.
Alan Turing
![225px-Alan_Turing_Aged_16[1]](https://lazyadminblog.com/wp-content/uploads/2015/04/225px-alan_turing_aged_161.jpg)
“Sometimes it is the people no one imagines anything of who do the things no one can imagine.”
![200px-Portrait_Gandhi[1]](https://lazyadminblog.com/wp-content/uploads/2015/04/200px-portrait_gandhi1.jpg)
![220px-Visvesvaraya_in_his_30's[1]](https://lazyadminblog.com/wp-content/uploads/2015/04/220px-visvesvaraya_in_his_30s1.jpg)
Albert Einstein
![220px-Einstein_1921_by_F_Schmutzer_-_restoration[1]](https://lazyadminblog.com/wp-content/uploads/2015/04/220px-einstein_1921_by_f_schmutzer_-_restoration1.jpg)
“Everybody is a genius. But if you judge a fish by its ability to climb a tree, it will live its whole life believing that it is stupid.”
Windows Server 2008 R2 stuck in recovery mode after power failure
If you cannot boot into Safe Mode either, I suggest restarting the computer, keeping pressing F8 and choosing the Last Known Good feature.
If the issue persists, please try methods below:
Method 1:
- Put the Windows Server 2008 R2 installation disc into the disc drive, and then start the computer.
- Press a key when the message indicating “Press any key to boot from CD or DVD …”. appears.
- Select a language, a time, a currency, and a keyboard or another input method, and then click Next.
- Click Repair your computer.
- Click the operating system that you want to repair, and then click Next.
- In the System Recovery Options dialog box, click Command Prompt.
- Type sfc /scannow, and then press ENTER.
Method 2:
- Put the Windows Server 2008 R2 installation disc in the disc drive, and then start the computer.
- Press any key when the message indicating “Press any key to boot from CD or DVD …”. appears.
- Select a language, time, currency, and a keyboard or another input method. Then click Next.
- Click Repair your computer.
- Click the operating system that you want to repair, and then click Next.
- In the System Recovery Options dialog box, click Command Prompt.
- Type Bootrec /RebuildBcd, and then press ENTER.
Method 3:
- Put the Windows Server 2008 R2 installation disc into the disc drive, and then start the computer.
- Press a key when the message indicating “Press any key to boot from CD or DVD …”. appears.
- Select a language, a time, a currency, and a keyboard or another input method, and then click Next.
- Click Repair your computer.
- Click the operating system that you want to repair, and then click Next.
- In the System Recovery Options dialog box, click Command Prompt.
- Type BOOTREC /FIXMBR, and then press ENTER.
- Type BOOTREC /FIXBOOT, and then press ENTER.
- Type Drive:\boot\Bootsect.exe /NT60 All, and then press ENTER.
Note: In this command, Drive is the drive where the Windows Server 2008 R2 installation media is located.
How to use the Replication Monitor to Determine the Operations Master and Global Catalog Roles
Let us see how to use the Active Directory Replication Monitor (ReplMon.exe) tool to determine the servers that hold the operations master roles in a forest as well as the domain controllers and global catalog servers for the forest. The five operations master roles that are defined in Active Directory are:
- Schema master
- Domain naming master
- Relative identifier (RID) master
- Primary domain controller (PDC) emulator
- Infrastructure master
There is a very quick method to determine which servers in the forest hold these roles by using Active Directory Replication Monitor.
The Setup program that installs Active Directory Replication Monitor (and other useful support tools) is available on the Windows 2000 Server CD-ROM under the \Support\Tools\Setup.exe folder. When this tool is installed, you can start it if you click Start, point to Programs, click Support Tools, click Tools, and then click Active Directory Replication Monitor.
Determine the Operations Master Role Holders
- Start the Active Directory Replication Monitor tool.
- Right-click Monitored Servers, and then add one or more servers by using the wizard.
- Right-click the servers, and then click Properties.
- Click the FSMO Roles tab.
- The domain controllers that hold all operations master roles are now displayed under the “Owner” column.
- To test the connectivity to each of the operations master role holders, click Query to the right of each role.
Determine Global Catalog Servers
- Start the Active Directory Replication Monitor tool.
- Right-click Monitored Servers, and then add one or more servers by using the wizard.
- Right-click the servers, and then click Show Global Catalog Servers in Enterprise.
How to user DsQuery
To find all the domain controllers in the forest with DN and RDN:
- DsQuery Server -o rdn -Forest
- DsQuery Server -Forest
To find all the domain controllers in a domain:
- DsQuery Server -domain domain_name.com
To list all the domain controllers in a domain that are also Global Catalog Servers:
- DsQuery Server -domain domain_name.com -isgc
To list the domain controller in the forest that holds the Schema FSMO:
- DsQuery Server -Forest -hasfsmo schema
Note: Use the “>” to store the output to a text file. The below command will store all the domain controller names in AllDCs.txt.
- DsQuery Server -Forest > AllDCs.txt
Lazy Admin Blog 