ITGURU Posted January 20, 2017 Posted January 20, 2017 (edited) I'm looking to move away from shared folders and go to DFS for file access. I had been testing with a test account which was fine, until I enabled an old unused student account for testing. Once an Account is enabled in AD I can immediately log on to a computer and it will map other drives from GPO that are still set as server shares pointing direct to the server name and share However for the home directory it didn't appear, so being puzzled I opened office and tried to access the \\domain path. I got the error: This user cannot sign in because this account is currently disabled. However if I went to \\servername\share that the original home directory is on, I can immediately access the share. Well the user obviously isn't disabled because I have just logged on as the user! There seems to be a delay with DFS authentication if an account is re-enabled. How can this delay be speeded up, as if I have to disable a user, then re-enable later it means that even though they can login, they wont be able to access files for upto the 15 minute replication interval? After about 10 minutes I logged off and back on and home drive was being mapped again. Anyone else ever noticed this and have a solution? If not then i'll be sticking to using the \\servername\share route. Edited January 20, 2017 by ITGURU
ITGURU Posted January 23, 2017 Author Posted January 23, 2017 Can anyone else test this and see if its by design? thanks.
Willott Posted January 23, 2017 Posted January 23, 2017 Do you have multiple DCs and are they the namespace servers? Are they replicating happily?
ITGURU Posted January 23, 2017 Author Posted January 23, 2017 Do you have multiple DCs and are they the namespace servers? Are they replicating happily? I have 3 DC's all replicating happily. 1 is in a different Site though, would that be causing the issue even if the computer accessing is not on the second SITE? Seems odd that when the account is enabled it is immediately replicated to the other DCs and can login
Willott Posted January 23, 2017 Posted January 23, 2017 Egg sucking, but sites and services in use? Just wondering whether there's a delay in replicating to second site, but it's trying to use second site server when referencing DFS root. Other thing to do to test, in your DFS namespace, remove all but one server, see if issue persists, then add your other servers back.
ITGURU Posted January 23, 2017 Author Posted January 23, 2017 Egg sucking, but sites and services in use? Just wondering whether there's a delay in replicating to second site, but it's trying to use second site server when referencing DFS root. Other thing to do to test, in your DFS namespace, remove all but one server, see if issue persists, then add your other servers back. it is - 2 DCs in main site, 1 in remote site.Only the 2 servers in main site are hosting the DFS namespace.
Willott Posted January 23, 2017 Posted January 23, 2017 I'll see if I can find a disabled account or disable an account, leave it half an hour and then enable it to test for you. I don't recall having seen an issue in the past, but haven't specifically tested that case.
Willott Posted January 23, 2017 Posted January 23, 2017 Just enabled one of our exam logins, and as soon as I was able to logon I was able to get the DFS share available. So doesn't look like by design. Security logs on servers show which DC handles the logon and which handles the DFS request and which denies and which allows?
ITGURU Posted January 23, 2017 Author Posted January 23, 2017 Think I've sorted it. I found an adsi edit which allows immediate replication across AD sites, and a tickbox to disable replication schedule. When I enable/disable the account on a DC on either site , it now immediately replicates this to the other sites DC's rather than the 15 minute wait, and I can then login still and the DFS is active immediately.
Willott Posted January 23, 2017 Posted January 23, 2017 That's interesting - MS blog posts suggest that DFS should follow sites and services. Useful to know for future expansions!
Willott Posted January 23, 2017 Posted January 23, 2017 Just one other check - your DFS namespace, it's in domain mode, is it 2008 or higher - if you click on it in DFS management it should show above the namespace list in a grey bar. Or maybe some of the bits vaguely mentioned in https://msdn.microsoft.com/en-us/library/cc732414(v=ws.11).aspx - maybe a get-dfsnroot may show up some setting that's getting out of site referrals
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now