Domino

For remote RDP I'm in favour of using an Remote Desktop Gateway rather than allowing the connections directly from the big bad internet. More here: https://turbofuture.com/computers/What-is-Remote-Desktop-Gateway-and-how-to-install

You'd need to have an application that benefited from containerization rather than just scrabbling to move to it - it's not the same relationship for Server to VM as VM to Container Application

Further to this, there's not only hidden devices, but starting device manager with nonpresent devices shown. https://www.vmadmin.co.uk/resources/38-converter/85-converterremovehiddendevices it sounds silly, but it has caused me crazy issues in the past. Aditionally have you removed the VMWare tools?

Are the remaining DCs Global Catalogs? If you run "repadmin /options" on each what are the results?

A couple of things - restoring a DC when you've other working DCs is a monumentally bad idea. Best case scenario the restored DC will be isolated from replication, worst case you do damage to the working DCs. (unless there's a way to do a non-authoritative restore from the backup software. I still would avoid it wherever possible) What state are things currently in now? and can you live without this DC (say if you could get any scripts used in the scheduled tasks from the HD)?

I have one of these and can highly recommend it: https://www.scan.co.uk/products/corsair-gaming-strafe-rgb-silent-mechanical-gaming-keyboard-backlit-multicolor-led-cherry-mx-silent- Equivalent feel to the red switches but less noise. Scan actually have a fair selection of refurbs too.

CPU : Citra Pale 'Un Or even GPU: Graham's Pale 'Un

Just popping into say, I have one of these, and it's very comfy - even for all day use

If I understand correctly, you're using a DFSR group to migrate data from 2008 R2 to 2016? There's actually a few DFSR version upgrades between those OSes Is there a reason to not just robocopy it and then do incremental updates until you're ready to switch over?

Well...

Have you tried disabling hardware acceleration? maybe it means video memory... Another thing that *might* cause issues like that is a Kerberos ticket size being over the configured max - although I would expect that to be worse on Win7 than 10 so can probably discount it for the time being.

Like I say, it's on-premise for us, so it's hardly taxing I fully agree that it's unnecessary, ours came about as an alternative to flat out denying access to users out of hours. That itself came from C-Level execs misinterpreting French labour laws. It may not be what we want, but when the business are dead-set on wanting it what can you do?

An onsite powershell script that enables/disables the rule, run as a scheduled task is likely your only bet. I'm doing the same for our onsite rule that does similar

You've got that bypassing antispam scanning in some way. You can also setup an explicit rule that says "anything from these domains that fails SPF gets blocked" - if you're sure you're setup correctly

I'd definitely try it with 4 vCPUs - it'll be much easier for the host to schedule onto the physical hardware, and faster scheduling = snappier response.

You said each host had 2x e5-2667 v3? That's an 8 core processor. it has 32 cores if you take hyperthreading into account - but you can't really utilize those for full performance VM Cores.

Here's a couple of other threads on the subject (VMware based, but the concept remains the same) http://www.edugeek.net/forums/enterprise-software/185012-want-compare-my-esxi-ram-allocation-others.html http://www.edugeek.net/forums/enterprise-software/198522-vmware-esx-server-cpu-resource-allocations-confused.html

So that single VM is using one whole processors worth of Physical cores? Is it just a DC? I'd at least reduce it to 4, and honestly if it's just a DC consider 2. How are the other VMs specced? It could just be contention. For every VM to be able to occupy CPU slots simultaneously there needs to be enough physical CPU Cores to accommodate each VM. The more they fight over resource the worse it'll be - these VMs are all in an ecosystem so just right-sizing a single VM won't bring you the full picture (and the lower CPU utilization you'll see - they literally can't work enough at the same time to take advantage). As a rule of thumb start low and work up till performance is acceptable. We start at either two or four vCPUs and 4/8 GB of RAM. One of the great thing about VMs is you can adjust their allocation if needed.

Yep, what do the VMs have, and whats available for them to run on with regards to CPU and RAM

How are the VMs sized compared to the underlying hardware?

You're all acting like you don't want to see a Dutch nutcase restore a tank or use Vodka to power a corsa Also Myles Power does great work with debunking everyday qwackery and more people should watch: https://www.youtube.com/channel/UCS_H_4AmsqC705DObesZIIg

Had you just reset people's passwords? when a minimum password age is in place the user will have to be that number of days past when it was last set to issue a new one - unless the "require user to change password on login" flag is set.

"Heartbeat Monitoring" is what you're looking for I think - checks with the vmwaretools application on the guest

Repadmin is your best friend, as well as checking the sysvol is syncing (if you're using FRS this might be your pain point ;-) ) https://www.manageengine.com/products/active-directory-audit/kb/how-to/how-to-check-if-domain-controllers-are-in-sync-with-each-other.html

Also ensure your replication between DCs is working first...