Firefox

Hello I am just about to carry out a lot of migrations with this product. I am migrating from a Windows 2003 to a Windows 2008 domain, which are both childs in the same forest. When trying to migrate User or group objects and I have the "Update User Rights" option selected, I always receive this error in the logs ERR2:7228 Error updating user rights for ******, rc=-2147024891 Access is denied. Upon looking at the account post migration, everything looks ok - but I'm a little concerned by the error. The account being used is a full administrator account of both domains

This is what I was hoping :-D

I am about to undertake a task to convert all out Domain Local groups to Universal groups, so that they can then be migrate to another domain. Before the migration I will need to rename the groups. As these are security groups used for folder access, the new name will appear under the folder security permissions. My question is....will this change the flags on each file\folder? as I don't really want to factor full backups into my work if avoidable.

I assume once you applied the GPO you ran a gpupdate /force? did this work? If you run a Gpresult /R does it tell you if the policy is applying? if not does it give a reason as to why?

Create a security group and add the machines you want to target as members Create a security and add the users you want to target as members Under the policy remove, authenticated users from security Filtering, and add the 2 newly created groups This should work if I understand the issue correctly, this is very much how we set our policies

Ok we have an issue with out netbackup install on Windows 2008 R2, after searching the net for the problem, it recommends uninstalling and re-installing Windows Installer. We can happily remove Windows Installer 5, but the trouble is this version doesn't seem to have been released for download as yet. When did try installing an older version to no avail. So as there is no release of 5, and I am expected to uninstall and re-install, where can I obtain a copy? thanks

If they are domain joined you could create a one way trust from the DMZ to the internal domain. This is what we do to allow out KMS server to license our DMZ machines

You could just open up a command prompt and type the following Type netsh dhcp server export C:\dhcp.txt all, press ENTER. Should let you export the info out so it can be re-imported onto a new server

Can't remember if upgrading was an option...but we chose to carry out a clean install. All went seemlessly. Migrating the DHCP scope is a nice simple command line, DNS was easy enough to transfer off. Are you going to be thinking about putting in a KMS server? will make managing the licenses for your new servers a lot easier.

cool, let us know if that fixed it, be interested to know if it was the upgrade that solved it

what's the OS of the device you're trying to run the remote MMC snap-in? I did come across an issue with this when I was on XP, but as we were due to upgrade to Windows 7 at the time it was instantly resolved

Did you manage to install the DNS role without any errors? I would initially re-install this role, in the mean time point your server to the other DNS server to pickup DNS. Once you're happy that is has a full working copy, set it back to itself.

Do you have the PolicyDefinitions folder normally located \\FQDN\SYSVOL\FQDN\policies For some reason on our 2008 box it created a folder at this location called PolicyUpdates.....and we had loads of errors with GPO's under we created the missing definitions folder

Ok this problem isn't 2008 R2 specific, but was unsure of the best fit. Let me try to explain. We have a parent domain (1) 3 Child domains (2), (3), (4) I am trying to organise my DNS suffix search order so that from any domain, when I ping a device it actually responds with it's correct suffix. Now this seems to work for the most part when I put (1) at the bottom of the list, this seems to assume if the device being pinged cannot match any other the other domain suffixes that it must be in the parent. As an example, I put the search order in for the domains as Domain (2) = (2), (3), (4), (1) Domain (3) = (3), (2), (4), (1) Domain (4) = (4), (2), (3), (1) If you put the parent domain (1) any further up the list then everything replies as if it is in the parent domain, assuming because the parent can resolve all child objects. So more then happy for this to stay last in the search list.......however. My issue is with Domain (4). If I put this anywhere in the list except the bottom, then it takes presedence over everything below it...... Take the above example again Domain (2) = (2), (3), (4), (1) In this example when I ping a server in the parent domain (1) it replies as if it is in domain (4). Domain (2) and (3) work correctly at this stage. As soom as I start to move domain (4) further up the list, it then takes presedence over other domains. In this example Domain (4) = (4), (2), (3), (1) All objects in the entire forest reply with domain (4) suffix. If I put (4) at the bottom of the list everything (except domain (4) work fine). To recap (4) is a child domain :-s I hope this makes sense to someone? :-s Here is hoping someone can help Cheers

sorry I think my "in the end" remark was misleading....I meant why did you want to use the same name at all? I believe you're quite correct in being able to rename a 2008 DC....I just wonder what renaming the server holding also the FSMO roles will do

yes will need to run a further forestprep to take your Schema to R2 Is there any reason you want to use the same name for the 2008 server in the end? I personally would avoid this to prevent issues down the line....I'd be interested to know if you can simply rename your box that is holding all 5 FSMO roles

If you've done the Schema update to 2008 already, I believe the R2 update is only 3 versions and takes no time at all :-D

Can't see you having any issues with this, we successfully did exactly the same task, by exporting the database to a file and importing back in on a new 2008 server. After the forwarders had been set it all worked seemlessly

Thanks for the reply. I took a quick look at that article, but it seems to relate to NT4. I have noticed this issue on both a Windows 2003 and Windows 2008 box. Unfortunately it doesn't have the same options at the NT4 suggestions. Our DNS server setup is AD Intergrated, we have 7 DNS servers in our Parent Domain and 150 DNS servers in one of our child domains. The 150 number is historical from our old network, we are going to be significantly reducing this, hence the need to start investigating DNS. We do not currently use routers to manage any of our DNS. I can identify the Unknown servers and they all ping from the DNS server that marks them as Unknown. Then next time I go into DNS some of the Unknown are now known and visa versa. The DNS servers are set to themselves as the primary DNS and to another DNS server in the domain as secondary

Hopefully someone here can help, as my knowledge of DNS is limited and there appears to be very little that is out there in the way of documentation, to help me resolve my particular issue. ok here goes. We have a Parent domain, which contains a stub zone of our child domain. Within this stub zone it obviously holds records all the Name servers from the child domain. Here lies the problem, All the Name servers do have a record, however there is not an A record that relates to all the NS records. This means when I right click on the stub zone and go to properties, under the NameServers tab, a lot of the servers are showing as (Unknown) although they are live. Wait, it gets worse. The missing A records to randomly re-appear and others that were previously there disappear, so my list of Unknowns) is forever changing. Obviously this sounds like replication is coming from more then one source, or that the source keeps having it's records changed. Well the DNS events show the updates always coming from the same master server (in the child domain), and when manually checking that master server, it ALWAYS has total knowledge of all the Name servers. Has anyone come across this issue before? Any help much appreciated

Think just about there with it now *crosses fingers* thanks for all your help

Ok seems I made a slight error, I was using the Enterprise E key to try and change the MAK code on the client, all worked ok when just using the Enterprise key for Windows 7. But on another point our KMS key is VOLUME_KMS_R2_B Channel we are also running this from a Windows 2008 R2 virtual server. all the keys you provided in our link are entered into the VAMT tool on the KMS server, it means we can centrally change keys without having to contact 1 machine at a time. For example I can change 25+ pc's all over to the GVLK key at exactly the same time, meaning I can wait until we have sufficient devices to meet the count.

Hey, Thanks for the reply. Have another issue\question if I may? I have a number of machines that I wish to convert from MAK to KMS, doing so would allow me to get to the 25 count. It is my understanding that if they are MAK activated, I can Install the GVLK key, which in turns would allow them to be KMS activated? sure I have managed to do this once already but when I try to install the GVLK key now I get the following error "The software licensing service reported that the license is not installed" I can confirm that the key is the relevant one from the list on the link you previously provided. I removed this key from the VAMT tool and re-added, but still get the same error :-s I am a little unsure as to what key it thinks is uninstalled

Anyone?

as long as you have a trust relationship setup between the 2 domain it shouldn't be a problem