HPlum78

How many DC's have you got?

Or talk to MS and you will get some Azure web services for free!

I would guess that you get some Azure web services for free (basically IIS) could you not just use that?

you could also while you are at it do dcdiag /test:replications /s: for each of the DC's in the domain, again post the results.

repadmin /showrepl would be my first call, post the results back.

ICMP Echo in the most part is harmless (ping of death anyone), ping can be used to garner information about your network structure but is not a concern if the server is publicly available (they are public! so visible). You can note how these two well known companies deal with ping on their external www sites google.com will respond where as Microsoft.com wont (what maybe common is not the same as recommend practice). Some of the ICMP packet stuff is used so blocking needs consideration and firewalls are not just about north/ south but east/ west traffic as well, are we still in a time where the only tool in the box is to disable parts of the OS? ok for manage windows clients, but don't help for all those none windows/ none managed devices we now support on our networks (just food for thought).

Had it working when it was called lync but was a little sketchy and at the time I don't think it was supported. This was then release https://technet.microsoft.com/en-us/library/mt740144.aspx

I suppose the question is this, Do MS stand up hardware when you choose to use S4B in their cloud?

https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-topologies - MS Documentation on supported configurations.

New-PSDrive has the -Credential, could you not leverage this to get you the correct permissions

ISESteoids - ISESteroids

A starter for 10 and to be honest checking that the remote reg service like in previous posts could also be done and is probably a good idea. The write-output can be changed to out-file and the horrid write-host that I have put at the end can also go (try not to use write-host in your PS code) again out to a file.... I am sure you see what I am getting at, its just to help get you on your way.

### This script is used to check the registry for a key and value from a list of remote servers. ### Build list of remote servers from AD - the following pulls out all server that are server 2008 R2. Get-ADComputer -filter {operatingSystemVersion -like "*6.1*" -and operatingSystem -like "Windows Server*"} | % { ### Pipe the Server name to test connect before we try to connect to the reg if (Test-Connection -ComputerName $_.Name -Count 1 -Quiet) { ### if the connection can be made connect to the reg and check if the key existis if so get the value of the key $Reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', $_.Name) $RegKey= $Reg.OpenSubKey("SYSTEM\\CurrentControlSet\Control") $RegVal = $RegKey.GetValue("ServicesPipeTimeout") ### write the value of the key and the value to the console Write-Output "The computer $($_.Name) has the following value for ServicePipeTimeout $($RegVal)" } ### if we cannot connect to a server we end up here else{ ### write the name of the server that cannot be connected to to the console Write-Host -fore "Magenta" Unable to connect to $_.Name } }

it can be done, but as mentioned above the only version of exchange that is supported is 2003 no other version is supported. Other things to look out for is your PKI/ CA infrastructure, ADFS SSO and the like, I also seem to think that there are some interesting issues around FIM and SCCM/ SCOM but none of these are insurmountable. Take a look here https://technet.microsoft.com/en-us/library/cc781575(v=ws.10).aspx

Hmm, yes and no leaving a car in gear will stop it. Although @thebatman is technically correct I will say this try pushing your car in first you will not do it and you will struggle to find an incline steep enough to move the entire drive train and compress the pistons! (not impossible just not probable) and you bump a car out of gear by depressing the clutch, when you have forward motion you release the clutch and transfer the energy in to the drive train to make the compression (a bit like the starter motor!) and if you have to bump its 3rd or reverse.

hmmm, I have just looked in 3 domains here and none of them have any deny access setting set!

Yeah they can just go, if they cannot be resolved to an account that still exists then that's a whole different set of issues right there! I had already guessed that you would not have been the perpetrator as you seem to be the one left holding the baby and the questions! good luck @TwistedHelixis

Best practice is to leave the default XXX GPO's alone, MS provide tools to recreate the default GPO's for those who do not take note of the best practice! here is one https://technet.microsoft.com/en-us/library/hh875588(v=ws.11).aspx I think that there are some caveats if you are running Exchange.

Hmmm a switch issue would be an interesting call, only affecting http traffic I am not seeing it. Firewall again if its that random and affecting more than just one workstation then again I can just not get there some kind of protection from say AV or Web filtering I could see but to be cleared after pulling the network cable is saying its a session based thing..... need more info before taking those kind of leaps.

Hmmm I cannot see anywhere that says its supported a quick search shows this from MS https://technet.microsoft.com/en-us/library/ee126170(v=ws.10).aspx Also I would guess and this is just a guess that the server you have is issuing SHA1 certs have you checked that you have no requirements for your SHA1 infrastructure? also if you are going to stand up a new PKI it would not be advisable to start a migration piece of work to SHA2.

is this happening to all the computers on the network at the same time? or is it one or two at a time?

A Quorum is a requirement of clustering not Hyper-V there are now other ways of achieving HA with Hyper-V on server 2012R2 using other methods https://blogs.msdn.microsoft.com/mvpawardprogram/2012/11/05/windows-server-2012-hyper-v-high-availability-without-a-san/ also see here https://blogs.technet.microsoft.com/askpfeplat/2013/03/10/windows-server-2012-hyper-v-best-practices-in-easy-checklist-form/.

I would take a look at this and then make your call from there https://social.technet.microsoft.com/Forums/windows/en-US/f5dea401-5a3b-4ddb-8bb8-8d2b2e2db55b/teamed-network-cards-for-domain-controllers?forum=winserverDS with 5 DC's is there a need for NIC teaming? you need to answer that first, then I would consider the placement and what other roles you require those DC's for (the backup solution may not be best placed on a DC). We have c20,000 user and c9,000 device in the prod environment and have 4 DC's (we only have 4 to comply with the data centre design principals and polices, we could actually run 2 DC's in practice).

oh and just another thought get-wmiobject Win32_NetworkAdapterConfiguration -ComputerName -EA | ? {$_.IPEnabled} do the above and replace the bit with the names of your DC's Harry

5 DC's wow how many users/ devices are you supporting? or is it a site thing you have going on? anyhow like Pete says above need a little more info on the design. That said it is best practise to only have DNS listening on one IP address (if my memory serves) and the fact that there are multiple registrations in DNS is down to DNS registration and having multiple IPs assigned to the DC's is my guess, is this a multiple NIC setup? FSMO Roles what do you mean by its on the backup server? there are 5 such FSMO roles and I am not understanding the backup bit, are you saying that this server is running your backup solution and a/ all FSMO roles? Run the following to get what FSMO roles are where Get-ADDomainController -Filter * | Select-Object Name, Domain, Forest, OperationMasterRoles | Where-Object {$_.OperationMasterRoles} | Format-Table -AutoSize Also a Get-AdForest would also be useful, feel free to redact any sensitive bits in the outputs, and post the outputs. Harry