HPlum78

The issue is here (and I am not sat in front of your domain) is that you will not have replication between the two DC's and by seizing the role you are essentially writing off the server you seize the role from. What happens when forcibly seizing a FSMO role I think varies based on underlying OS and functional levels. I think that in your current state even trying to seize the role will do one of two things 1. Fail out right as the underlying moving parts of Active Directory are just not in a state that will allow this to happen 2. Corrupt the AD dit / underlying files.

riDPreviousAllocationPool need to do something with this attrib in the schema from memory, you guys could look into that. Also could do with digging out the Powershell to find the highest RID allocated to an AD object. I will pick this back up when I get home unless you guys fix in the meantime.

Its not as simple as just transferring the RID FSMO role now, when you restore AD you have some options around if its an Authoritative restore or a none Authoritative restore. The issue with using a system state restore is you do not get the option of specifying what type of restore you are doing. The second DC (server 2) is now irrelevant (if I am reading what you have done right) as you cannot restore 2 DC's from any backup like this. So back to the issue in hand your RID and this will be one of a few issues that are going to be needing fixing (so strap yourself in here) the DC that holds the RID FSMO role gets blocks of RID's assigned to it at various points in its life. What you have done by restoring the DC the way you have had to is thrown this out of sync, when a DC attempts to start Active Directory one of the checks is around the RID allocation and what will be happening at the min is that the pool will be conflicting with what is the last known RID allocated to an AD object and the RID's that the DC is allocating itself from what it thinks is a valid range of RID's for your Domain. This is a simplistic overview of how this works - I am not about to drill into the depths of how a DC ends up being a valid domain controller in the limited space I have here.... :-P

Hence why I am just sending you stuff so I can build a picture of where you are.

The issue here is the DC's will know that they have issued RID's beyond what they now know about due to being restored. Need to kill the RID pool and then start it beyond the point of the last known issued RID.....

Need to think about this.... I have a niggle that in this instance grabbing the RID FSMO role will end up in corrupting the directory.

Just a side note before trying to stand up a new DC, As you have no RID at the min you are going to find it hard to add a DC and all the relevant AD information due to not having a RID. The first thing you are going to need is a RID for the new computer account in AD..... you get the picture.

Get-ADForest | select ForestMode,SchemaMaster | FL Get-ADDomain | select DomainMode,InfrastructureMaster,PDCEmulator,RIDMaster | FL Get-ADObject (Get-ADRootDSE).schemaNamingContext -Property objectVersion from one of the DC's if possible.

https://www.microsoft.com/en-gb/download/details.aspx?id=30005 - This maybe useful. https://technet.microsoft.com/en-us/library/cc535164.aspx - added this just for info. hmmmm.....

I have posted about this in the past, have a mailbox (Password_Rest@.......) make it so teachers (Staff) are the only ones who can send mail to it. Monitor it (the mailbox) with a PowerShell script get your teachers to send a mail to that account and CC the student (this is the student who has forgot their password) scope the account that runs the script permissions only to be able to change student passwords (OU Level/ or if you have not split out your users then you need to do this by using a AD attribute). Have the script generate a random password set it in AD and mail it back to the teacher who requested the password reset. You can also automatically raise the ticket in your ticketing system or whatever else you want to do to monitor what's going on. To be honest I would be looking at using Flow for this now and when I get some time I may well just do that.

Modern Groups underpin a number of apps, so by stopping users creating groups you also stop them being able to use the apps that are built on modern groups, although the link below shows you how to get around the need for a modern group by using 'shared inbox mode'. I would suggest that you set up some automation around creating these groups (flow can be your friend here) to help streamline the process. https://support.office.com/en-us/article/Learn-about-Office-365-groups-b565caa1-5c40-40ef-9915-60fdb2d97fa2#ID0EAADAAA=Create

https://support.microsoft.com/en-us/help/2751452/dns-zones-do-not-load--event-4000--4007

Is the DNS AD integrated?

Ah that's the answer right there, mystery solved Scooby.

I have attached the std out from the get-localuser cmdlet, I cannot see in that list where I can select Enabled or accountExpires. is this a version thing? Even when I do a select * those props are not returned..... Have attached my $PsVersionTable for comparison

Function Cleanup-UserProfiles <# .Parameter ComputerName The computer on which to clean profiles. .Parameter AgeLimit All profiles older than this number of days will be removed .Parameter Exclude Comma separt #> { [CmdletBinding( SupportsShouldProcess=$true, ConfirmImpact="High" )]param ($computerName= '.',$AgeLimit='60', $Exclude) $dateLimit = (get-date).adddays(-1 * $agelimit) $userprofiles = Get-WmiObject -Class Win32_UserProfile -ComputerName $computerName #the default exclusion list will prevent deletion of Administrator acount, Default accounts, System and Network Service $exclusionlist = @('S-1-5-19','S-1-5-18','S-1-5-20','-500$') + $Exclude | where-object {$_} foreach ($profile in $userprofiles) { #Check if profile is in date range $dateLastUsed = [datetime]::ParseExact(($profile.lastusetime -replace '\..+$',''),'yyyyMMddHHmmss',$null ) if ( $dateLastused -ge $dateLimit){ write-verbose "Skipping $($profile.sid) because it was last used $dateLastUsed" continue; } #Check if profile matches an exclusion $MatchesExclusion = $false foreach ($comparison in $exclusionlist){ if ($profile.sid -match $comparison -or $profile.localpath -match $comparison) { $MatchesExclusion = $true write-verbose "Skipping $($profile.sid) because it matches exclusion '$comparison'" break; } } if ($MatchesExclusion) {continue;} #Use ShouldProcess to prevent accidental removal of profiles $activity = "Remove profile for user $($profile.SID) from computer $Computername with local path $($profile.localpath)" if ($pscmdlet.ShouldProcess($activity)) { Write-Verbose "Attempting to $activity" $profile.Delete() } } } more info here https://gallery.technet.microsoft.com/scriptcenter/Cleanup-UserProfiles-277a8084 I can think of a whole load of extra automation you could add to this script, like building a computer list from AD and some making sure that its accessible before trying to clean up the profiles.......

No don't seem to be part of the get-localuser cmdlet. Get-WmiObject -Class Win32_UserAccount -Namespace "root\cimv2" -Filter "LocalAccount='$True'" The above may get somewhere close, I cannot be any more use as I do not have a Windows device to hand.

https://blogs.technet.microsoft.com/skypehybridguy/2017/11/07/microsoft-teams-powershell-support/ Powershell can be used to this, the above link is a start. May find yourself using the graph api as well mind.

CalSync http://www.s2unified.com/calsync/ May do what you want.

If you have access to OMS that can do this sort of thing. https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-change-tracking

@rich_tech I would say step back before you virtualise any more servers in the cloud as I said above IaaS is not the way to leverage the cloud, you are paying a lot of money to have someone host your servers that's almost c£1300 per VM per year! c13K a year all in! (it not such a simplistic calculation I know, but you see the point). In one year that's a bill that would get a good VM infrastructure that would probably have a 5 year write down and could be capitalised (unlike taking a service). Now don't get me wrong I think cloud solutions have a place and am not saying don't use the cloud but that sort of money surly is unsustainable....

I have said this before about cloud based solutions, so here goes again. If you are replacing existing servicable infrastructure for IaaS then you will pay more period, if however your hardware is end of life then you should be thinking about how it would look in a cloud Enviroment. If you are able to take up PaaS (cheaper) or SaaS (cheaper still) offerings then the cost starts to fall. No one is saying lift and shift infrastructure in to any cloudy provider (MS included), what you should be thinking about is transformational/ new services. If you are standing up IIS on a server for a web app then I guarantee that a cloudy provider is going to be cheaper with a SaaS solution. Office 365 is a SaaS solution and as such is cheap and for education it's just there, if you have the thick wedge of 20k (plus supporting infrastructure) worth of Exchange deployment needing replacing then Exchange online is cheaper (I know first hand!) but there is a tipping point, and the scales of economy are not there if you are running Exchange on a single server. The cloud is not a replacement it's an option and when you are going to scope out a new service or its time to review existing services a cloudy deployment should be considered and a true costing of an on prem deployment should inform any decision. Any how it's late and I zzzzzzz

$UserNames = get-aduser -SearchBase "OU=Users,OU=StaffAccounts,DC=SCHOOL,DC=COM" -Filter * | Select samAccountName $UserNames | %{ $FldrPath = "D:\User Folders\Students\Admitted 2016\$($_)\Downloads" Set-Location $FldrPath | Remove-Item * -Recurse } The above is one approach that you could use.... I would throw in a test-path and again some logging.

You should add a filter to stop .tmp files from being replicated. https://msdn.microsoft.com/en-us/library/cc753409(v=ws.11).aspx

Some of the use of these products has to be organic, with a degree of eating your own dog food.... by that I mean we start by using the tools within IT Services then get the rest of the support services to start using the tools then getting the IT department involved. I would reiterate what @Katy and @TechMonkey have said its a hard to throw a beast like Microsoft 365! (Office 365) over the wall in one go, start by using Yammer for instance then expand it out and in no time the organic use of it will snowball and with the drop in session you will see that the uptake will be just happen. This will need support from above and where possible should not be mandated or forced on to people as this never goes down well! the idea behind offering services is that we give our users the tools that they need not what we dictate try not to rip the rug out from under your users as this makes the task of getting them to adopt new/ different services much harder than it needs to be. Its a journey.....