Jaan

what's odd, is that it seems gmail does work!.... i think the "disabled" next to the account should ideally read "some services disabled" to stop confusion.

Yeah there has they have enforced age restrictions on some apps..... but Gmail (in this instance) isn't affected by that change.

All already allowed and confirmed.

Hey all. We've got a sudden surge of reports that our students' Google accounts are appearing as "Disabled" on their phones. (Android and iphones) I've tested it with a demo account, and confirmed it on my personal phone. In Android, the student account is clearly marked "disabled." Tapping on this disabled account gives the error: "...service unavailable... you tried to access a service that isn't available for your account." upon clicking 'learn more' I get "Can't access this service, this service is unavailable for Google workspace for education users who are under 18 and children under 13 (or the age of consent in your country)." What makes this odd is The account is active in the Google Admin Console and the student can successfully log into and use Gmail via the web browser on the same phone. I've confirmed all student Organizational Units (OUs) have the correct age ranges. However gmail isn't age restricted anyway as i understand it. It seems to be a sudden, app-level restriction/misinterpretation of the account's status or age setting. Has anyone else encountered this strange discrepancy recently? Same issue on iphones. I've opened a support request with Google also. Cheers

Just punched it into AI and got this: While you state DNS is set correctly, the configuration you described ("primary is as backup one and second as localhost on the both servers") is a common point of contention, especially for a new DC. Main DC (WS2019): Primary DNS: IP of the WS2025 DC. Secondary DNS: 127.0.0.1 (Loopback) or another DC (if you had one). Using the loopback is generally acceptable. Backup DC (WS2025): Primary DNS: IP of the WS2019 DC (FSMO holder). Secondary DNS: 127.0.0.1 (Loopback). If the WS2025 DC is setting its Primary DNS to its own IP (the loopback or static IP) and its Secondary to the WS2019 DC's IP, that's often an issue because it may try to register its SRV records before its own DNS service is fully operational, leading to the 1908 error from the other DC. Actionable Step: On the WS2025 DC, ensure the Primary DNS Server is set to the IP address of the WS2019 DC. Service Startup Dependency The intermittent nature of the error (sometimes taking 30 minutes to resolve) points directly to services starting after the initial replication check fails. Active Directory Domain Services (NTDS) relies heavily on the Netlogon service for locating other DCs and registering its own SRV records. Actionable Step: After a reboot of the WS2025 server, check the status of the Netlogon service. If it's not running or just starting, that's likely the cause. Wait for it to start, and then immediately check repadmin /replsummary. 2. DHCP Authorization Error (1059) The error 1059 (The DHCP service failed to see a directory server for authorization) occurs because the DHCP Server service attempts to start and authorize itself in Active Directory before the Active Directory Domain Services (NTDS) or the Netlogon service is fully operational. The Registry Fix Explained and Validated Your fix using the DependOnService registry value is the correct and recommended solution for this specific timing issue. Location: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCPServer Value Name: DependOnService Value Data: NTDS (and possibly Netlogon) By adding NTDS (Active Directory Domain Services) to the list, you instruct the Service Control Manager to delay the start of the DHCP service until the AD DS service has successfully started. This ensures that a Directory Server is available for the DHCP service to check authorization against, eliminating the 1059 error. Tip: While your fix is good, you could also consider adding Netlogon to the DependOnService value alongside NTDS, as Netlogon is crucial for DC functionality, too. The value would be NTDS and Netlogon on separate lines (if editing via the GUI) or separated by spaces/nulls (if editing via command line/script). 3. Potential Crossover Solution Since both your issues (Replication 1908 and DHCP 1059) are likely boot-time dependency issues on the WS2025 DC: Focus on Netlogon and DNS: If the Netlogon service starts slowly, it prevents the DC from advertising itself correctly (causing 1908) and prevents other services (like DHCP) from finding a directory server. Review Event Logs: After a reboot, check the System and Directory Service logs on the WS2025 server, paying attention to the timestamps immediately preceding and following the 1908 error time. Look for errors related to Netlogon, DNS Client, or DNS Server. Summary of Recommended Actions Correct DNS Forwarding: On the WS2025 DC, set the Primary DNS to the IP address of the WS2019 DC (the FSMO holder). Confirm DHCP Fix: The DependOnService fix for the DHCP service is valid and should prevent the 1059 error. Investigate Service Startup: If the 1908 error persists, it is a race condition. Ensure Netlogon and DNS Server services are set to Automatic startup. If the issue is persistent, you could explore setting the DNS Server service to also depend on NTDS using the DependOnService registry key, though this is a more advanced troubleshooting step. The combination of slow service startup (particularly Netlogon/DNS Server) and the new server's need to register in the forest is the most probable cause of both errors. Resolving the service dependency for DHCP is complete, now focus on the Netlogon/DNS dependencies for replication.

That's a hard no then isn't it! 😄 thanks for that.

So point the XGS to an a new routing only svi on the core? Not just any existing svi owned by the stack?

I can't currently ping to core from the XGS. the XGS does allow me to select a source interface and IP to ping. I think the issue deepens here. I can't create a static route on the XGS as the Management IP of the core isn't on the same subnet. I can change that, however creating a static route from the xgs to the core would create a single point of failure. VRRP or HSRP on the cores would help to protect against this, but i'll need to research it. The "core" is in fact two stacked switches with management IPs of 192.168.1.50 & .51 .... i think the core switches will need new management interface IPs on the same subnet as the XGS LAN interface with the cores ideally having VRRP or HSRP ......... well this just snowballed 🙃

So i need a static route on both my xgs and the core switch? doing a tracert from my test pc i get; 1 - 10.10.15.254 - reports: Destination unreachable. The XGS is connected to the LAN via 10.15.20.2/255.255.252.0 I have not done anything to the xgs yet with regards to any VLANS I can't ping from the XGS to the core SVI of 10.10.15.254 thanks for looking

And i need this even tho i'm using my L3 for intervlan routing? (sorry i'm new to vlans) I even had this written down (step7) but have one static rule covering the whole 10.10.0.0 /16. I assume that's ok and i don't need one for each svi?

Hey all, Google photos isn't part of the core system and its being abused by some users. We plan on disabling google photos but not before allowing users the opportunity to download their pics. We have asked them to delete their pics after they have done this..... but they won't (endusers), so i'm looking for a way to do this centrally after a sent deadline. I can't use the google admin panel as it isn't acore app and doesn't seem to have the options i need. Does anybody know of a 3rd part way of doing this? i seem to recall a saas the had a little red cross in its logo that might be able to do this..... but can't find it to save my life! Anybody been down this route before? cheers

Thanks, i'll check it out.... just got called out for something else 🙃 i assumed i only needed one static route on the xgs for internet traffic..... have i misunderstood that?

Routing seems to be enabled. Looking at the documentation, as soon as a svi is created its enabled.... and not control by the ubiquitous "ip routing" cli command. entering "show ip route" into the web cli displays; FS#show ip route Codes: C - Connected, L - Local, S - Static R - RIP, O - OSPF, B - BGP, I - IS-IS, V - Overflow route N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 SU - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 IA - Inter area, EV - BGP EVPN, A - Arp to host * - candidate default Gateway of last resort is no set C 10.10.12.0/22 is directly connected, VLAN 30 C 10.10.15.254/32 is local host. FS#

after setting a static ip on my test PC i can ping the core svi but not the dhcp server. the dhcp server normally response to ping requests from the flat network PC also not appearing in DNS reverse lookup zone.

no my dhcp server's gw is 10.15.20.2 which is the Sophos XGS

Thanks all, Couple of typos in there welldone for spotting that! errors updated I have a dhcp relay (ip helper) on my core switch that points to my 10.15.20.111 dhcp server i'll try settings a static ip and pinging the dhcp.... i'll look into checking if routing is enabled on the switch... i just assumed it was.

Thanks all, here's my not getting a IP address on VLAN30 issue. Probably too much info here, but just trying to post a clear picture of where i'm at. I have multiple vlans to create but thought i'd start with 1 first (vlan30) and see if i can get it working and getting an IP address from the correct scope..... here goes.... I have a core L3 switch that will be doing the inter vlan routes, i'm not using the FW to do this. My edge switches are L2+ and both core and edges are FS switches. The firewall is a Sophos XGS but i've not done anything to that yet, from what i understand i need to set a static route on it for the vlan scope once i'm ready to allow internet access..... but i need an IP address first, so i'm worry about the FW later..... unless that is my issue! I also have a windows DHCP servers that will be doing DHCP for these VLANs. I'm not using dhcp on any of the switches. I have created vlan 30 on both my core and edge switches. Created a SVI on the core switch; SVI: 10.10.15.254 /22 (255.255.252.0) on vlan 30 and enabled dhcp relay to my windows dhcp server 10.15.20.111. The DHCP scopes on the win server are as follows: 10.10.12.0 /22 dhcp range: 10.10.12.2 - 10.10.15.253 10.10.12.1, 10.10.15.254 & .255 not in dhcp scope 003 router = 10.10.15.254 (svi ip on L3 switch???) 006 DNS = 10.15.20.111 trunk ports on switch uplinks are aware of vlan 30 and the port my test pc is connected to on the edge has a default pvid of 30 but "allows 1-4094" and is a access port. I think that's it... i was expect to get a IP address from the new scope, but just get a 169.x.x.x. Any thoughts? EDIT: IP errors removed

Hey all, i've finally got some time to put my research into practice and move away from a flat network! I'm a total VLAN noob, but have done lots of research, watched loads of videos and was feeling confident..... but i seem to have failed at the first hurdle! I'm not getting an IP address on my newly created VLAN30 and now i think i'm overlooking things. First thing i'm confused myself over is access vs trunk ports and how they handle VLANs From what i understand, an access port can only support 1 VLAN, anything more than 1 and it has to be a trunk port? is this right....... what about Voice vlan? is this an exception to the rule? my switches seem to allow me to have a access port set with a default vlan of 30 but also says allowed 1-4094... this seems to contradicted what a access port is? I know i can Google and AI search this, but wanted to ask from a real world point of view as some info contradicts. More details on my lack of a DHCP IP in my next post.... just need to check a few things first. Fanks

From what i understand, the xbox compatibility is a licensing thing..... i'm sure the v1 had a fw update to allow it....to work on the xbox

Well i hope mines the v2! that's what i paid for...... how you checking v1 vs v2? firmware or any physical differences?

Funny... i ordered one on the weekend also! the black version! 😄

You'd have to follow the official process and confirm you own the domain: https://support.google.com/a/answer/33561?hl=en&src=supportwidget0&authuser=0

i like the look of this: https://www.manba.cc/products/manba-one-black?srsltid=AfmBOopZ5KvgI5WGbMUP5DckezD4Ltz1UQFu4tThNQzp2TWPMbSLAjjJ

Sounds about right to me, that would be my approach. Although i'm sure you'll need to triple check the hardware is s2d 2025 compliant. Also, back up back up back up! i'd also back up each s2d hosts as part for the update process incase a speedy roll back is needed.

Alfa Giulia has that box also doesn't it? You could always just rent one. if you're not sure which path to take. (As in from a car rental place rather than pcp etc)