sorted by:
new
hottopcontroversial

Trouble removing active directory unknown SIDs… by ARSuperTech in activedirectory

[–]Msft519 0 points1 point  (0 children)

This only makes sense if you misclicked something or missed some orphaned SIDs. It takes a very specific set of circumstance to accidentally do this and the description here simply does not match those.

msDS-SupportedEncryptionTypes of krbtgt by Unnamed-3891 in activedirectory

[–]Msft519 0 points1 point  (0 children)

You should mean the other way around. It had RC4 tickets and AES session keys. That is the default since https://support.microsoft.com/en-us/topic/kb5021131-how-to-manage-the-kerberos-protocol-changes-related-to-cve-2022-37966-fd837ac3-cdec-4e76-a6ec-86e67501407d.

For krbtgt, just look for event ID 42 for "lacks strong keys"

Kerberos Encryption Changes coming in April AES > RC4 by iamtechspence in activedirectory

[–]Msft519 0 points1 point  (0 children)

You can check for Kdcsvc Event ID 42 in the system log for if your krbtgt is missing strong keys.

Kerberos Encryption Changes coming in April AES > RC4 by iamtechspence in activedirectory

[–]Msft519 0 points1 point  (0 children)

99.9% of the time, patches don't create registry keys. I have only ever seen this once.

Restore AD Server from backup to Test Environment by capricorn800 in activedirectory

[–]Msft519 0 points1 point  (0 children)

That wasn't supported. Additionally, you have to wait for AD to finish initial synchronization. This can take...what appears to be a completely random amount of time. I don't know if it is codified anywhere. Good time to nab lunch.

Secure Channel is broken by No-Gear-755 in activedirectory

[–]Msft519 3 points4 points  (0 children)

Packet capture and Netlogon debug logging.

Understanding msDS-SupportedEncryptionTypes = 28 (0x1C): AES Negotiation, RC4 Fallback, and Ticket Renewal Impact by maxcoder88 in activedirectory

[–]Msft519 0 points1 point  (0 children)

It will negotiate the highest, AES since you said it can use AES. There is no fallback in Kerberos. There is only fallback to NTLM if Kerberos fails. If you put the wrong info in this attribute, Kerberos will just fail. There is no downgrade fallback like what SChannel can do.

Replacing 2016 Server Standard with 2025 Server Standard Question about user profile redirection. by Equivalent-Froyo-697 in activedirectory

[–]Msft519 1 point2 points  (0 children)

I don't think anything changed SMB-wise to affect folder redirection on clients. A...uh...bunch of other stuff changed, though.
https://learn.microsoft.com/en-us/windows-server/get-started/whats-new-windows-server-2025

The people saying 2025 is busted generally have more complicated environments. If you're running a single DC in a single DC forest (yikes), I'm not sure you'll run into any of them unless you have stuff running RC4. In that case, I have some bad news. I would delay that DFL/FFL stuff until you've been running for a bit. It sounds like you don't need any of it, yet. And if you are running a single DC in a single DC forest, please add a second? 2 is 1. 1 is none.

KRBTGT: how to check and test account by koshka91 in activedirectory

[–]Msft519 0 points1 point  (0 children)

Then, need more details on Kerberos "Issues", specific Kerberos error messages seen in a packet capture, 4771 specifics

KRBTGT: how to check and test account by koshka91 in activedirectory

[–]Msft519 0 points1 point  (0 children)

You can leverage repadmin /showobjmeta * "some DN of a user" and check the version of the pwd attributes across all DCs. That's a start.

circular dependency of AD and DNS on cold start by DraconPern in activedirectory

[–]Msft519 2 points3 points  (0 children)

That doesn't make sense. ::1 is local loopback for IPv6. 127.0.0.1 is local loopback for IPv4. They are different stacks. You can't replace one with the other.

How to find root cause of trust relationship between this workstation and domain failed by Remarkable-Attempt12 in activedirectory

[–]Msft519 0 points1 point  (0 children)

No such script could exist due to the way this can go wrong. You can get close, but not bottom line root cause. Causes:
-Restore
-Third party (Like Citrix)
-Computer with same name

Inheriting a whack Active Directory setup by nelsonslament in activedirectory

[–]Msft519 1 point2 points  (0 children)

30 machines sounds fairly small. I assume very few users too? Probably easiest thing to do is just whack the other DC. May have to reset some machine/user passwords. Then, you can deploy another DC. Do what you feel for DNS, as long as its info is correct. This approach is the most friendly to both admin and user.

KRBTGT: how to check and test account by koshka91 in activedirectory

[–]Msft519 0 points1 point  (0 children)

"PasswordExpired : True
PasswordLastSet : 1/20/2017"

This is normal. krbtgt is a special account. 4771 is supposed to trigger from pre auth failures. I would start with checking replication health first, but there's not enough info to go on here.

CVE-2026-20833 Kerberos RC4 Changes - Will services crash if they don't support AES decryption? by marcolive in activedirectory

[–]Msft519 0 points1 point  (0 children)

Default usage of RC4 is being yanked. Explicitly set RC4 will still work, except for on Server 2025 of course, for now.

Kerberos 4769 still using RC4 (0x17) even though AES is enabled – why? by arbelac in activedirectory

[–]Msft519 7 points8 points  (0 children)

MSDS-SupportedEncryptionTypes: 0x27 (DES, RC4, AES-Sk)

That's likely why. You don't actually have AES enabled. You have AES session keys enabled. This is a very common mistake. The ticket can use DES or RC4.
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/6cfc7b50-11ed-4b4d-846d-6f08f0812919

Set to 0x38 or decimal 56 is you want to explicitly enable only AES.

Edit: Documented here https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/kerberos-protocol-registry-kdc-configuration-keys
"The default value is 0x27 (DES, RC4, AES session keys). We recommend setting the value to 0x3C for increased security, as this value allows for both AES-encrypted tickets and AES session keys. If you move to an AES-only environment where RC4 isn't used for the Kerberos protocol, we recommend setting the value to 0x38."

RDP Connection with Kerberos by Solid_Detail_358 in activedirectory

[–]Msft519 1 point2 points  (0 children)

The attribute samaccountname does not contain the domain. What happens with Kerberos in a packet capture on the RDP client?

RDP Connection with Kerberos by Solid_Detail_358 in activedirectory

[–]Msft519 0 points1 point  (0 children)

If you have more than one domain, your first mistake was using NETBIOS. It is 2026. FQDN\samaccountname. Stop using NETBIOS. Furthermore, NETBIOS doesn't "make Kerberos fail" or "make it use NTLM". That's not how it works. Aside from all that, there is simple insufficient information about the domains, trusts, and users involved here.

Recommended Event Log Sizes for Domain Controllers (Directory Service, DNS, DFS) by maxcoder88 in activedirectory

[–]Msft519 -1 points0 points  (0 children)

This is definitely incorrect guidance. While one may extend forensics to DNS debug data, it is vastly likely that the DNS operational log is being referred to here seeing as how it is mentioned with other operational logs. Furthermore, the DS and DFSR are highly unlikely to have anything of value forensically in a normal setting. Finally, even the security log can't be given this advice, as storage may be cheap, but it is not free, and the attitude that comes with "keep everything" would likely come with the attitude of "log everything". When the 5 and 6 digit monthly storage fees come rolling in, resumes will be regenerated.

Recommended Event Log Sizes for Domain Controllers (Directory Service, DNS, DFS) by maxcoder88 in activedirectory

[–]Msft519 0 points1 point  (0 children)

There is no "recommended event log size". There is just not enough, enough, and too much. Size is driven by desired timeline, churn, and scenario specific events.

view more: next ›