Skip to main content

Find the FSMO role holders with DCDiag

By

DCDiag.exe is the Domain Controller diagnostic tool. It is designed to assist you in troubleshooting . You can utilize this tool to discover the current FSMO role holders by executing the command DCdiag /test:Knowsofroleholders /v. The output of this command is below with the role holders highlighted in red.

Directory Server Diagnosis

Performing initial setup:

Trying to find home server...

* Verifying that the local machine MCT-1, is a Directory Server.

Home Server = MCT-1

* Connecting to directory service on server MCT-1.

* Identified AD Forest.

Collecting AD specific global data

* Collecting site info.

Calling ldap_search_init_page(hld,CN=Sites,CN=Configuration,DC=MCTNet,DC=com,

LDAP_SCOPE_SUBTREE,(objectCategory=ntDSSiteSettings),.......

The previous call succeeded

Iterating through the sites

Looking at base site object: CN=NTDS Site Settings,CN=Default-First-Site-Name

,CN=Sites,CN=Configuration,DC=MCTNet,DC=com

Getting ISTG and options for the site

* Identifying all servers.

Calling ldap_search_init_page(hld,CN=Sites,CN=Configuration,DC=MCTNet,DC=com,

LDAP_SCOPE_SUBTREE,(objectClass=ntDSDsa),.......

The previous call succeeded....

The previous call succeeded

Iterating through the list of servers

Getting information for the server CN=NTDS Settings,CN=MCT-1,CN=Servers,CN=De

fault-First-Site-Name,CN=Sites,CN=Configuration,DC=MCTNet,DC=com

objectGuid obtained

InvocationID obtained

dnsHostname obtained

site info obtained

All the info for the server collected

* Identifying all NC cross-refs.

* Found 1 DC(s). Testing 1 of them.

Done gathering initial info.

Doing initial required tests

Testing server: Default-First-Site-Name\MCT-1

Starting test: Connectivity

* Active Directory LDAP Services Check

Determining IP4 connectivity

* Active Directory RPC Services Check

......................... MCT-1 passed test Connectivity

Doing primary tests

Testing server: Default-First-Site-Name\MCT-1

Test omitted by user request: Advertising

Test omitted by user request: CheckSecurityError

Test omitted by user request: CutoffServers

Test omitted by user request: FrsEvent

Test omitted by user request: DFSREvent

Test omitted by user request: SysVolCheck

Test omitted by user request: KccEvent

Starting test: KnowsOfRoleHolders

Role Schema Owner = CN=NTDS Settings,CN=MCT-1,CN=Servers,CN=Default-Fir

st-Site-Name,CN=Sites,CN=Configuration,DC=MCTNet,DC=com

Role Domain Owner = CN=NTDS Settings,CN=MCT-1,CN=Servers,CN=Default-Fir

st-Site-Name,CN=Sites,CN=Configuration,DC=MCTNet,DC=com

Role PDC Owner = CN=NTDS Settings,CN=MCT-1,CN=Servers,CN=Default-First-

Site-Name,CN=Sites,CN=Configuration,DC=MCTNet,DC=com

Role Rid Owner = CN=NTDS Settings,CN=MCT-1,CN=Servers,CN=Default-First-

Site-Name,CN=Sites,CN=Configuration,DC=MCTNet,DC=com

Role Infrastructure Update Owner = CN=NTDS Settings,CN=MCT-1,CN=Servers

,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=MCTNet,DC=com

......................... MCT-1 passed test KnowsOfRoleHolders

Test omitted by user request: MachineAccount

Test omitted by user request: NCSecDesc

Test omitted by user request: NetLogons

Test omitted by user request: ObjectsReplicated

Test omitted by user request: OutboundSecureChannels

Test omitted by user request: Replications

Test omitted by user request: RidManager

Test omitted by user request: Services

Test omitted by user request: SystemLog

Test omitted by user request: Topology

Test omitted by user request: VerifyEnterpriseReferences

Test omitted by user request: VerifyReferences

Test omitted by user request: VerifyReplicas

Test omitted by user request: DNS

Test omitted by user request: DNS

Running partition tests on : ForestDnsZones

Test omitted by user request: CheckSDRefDom

Test omitted by user request: CrossRefValidation

Running partition tests on : DomainDnsZones

Test omitted by user request: CheckSDRefDom

Test omitted by user request: CrossRefValidation

Running partition tests on : Schema

Test omitted by user request: CheckSDRefDom

Test omitted by user request: CrossRefValidation

Running partition tests on : Configuration

Test omitted by user request: CheckSDRefDom

Test omitted by user request: CrossRefValidation

Running partition tests on : MCTNet

Test omitted by user request: CheckSDRefDom

Test omitted by user request: CrossRefValidation

Running enterprise tests on : MCTNet.com

Test omitted by user request: DNS

Test omitted by user request: DNS

Test omitted by user request: LocatorCheck

Test omitted by user request: Intersite
Labels:

Comments

Post a Comment

Popular posts from this blog

Sticky Key problem between Windows Server 2012 and LogMeIn

By
This week I instructed my first class using Windows Server 2012 accessed via LogMeIn and discovered a Sticky Key problem every time you press the Shift key. Here is my solution to resolve this.  First off, in the Preferences of LogMeIn for the connection to the Windows Server, click General . Change the Keyboard and mouse priority to Host side user and click Apply at the bottom. On the Windows 2012 server, open the Control Panel – Ease of Access – Change how your keyboard works . Uncheck Turn on Sticky Keys . Click Set up Sticky Keys . Uncheck Turn on Sticky Keys when SHIFT is pressed five times . Click OK twice. If you are using Windows Server 2012 as a Hyper-V host, you will need to redo the Easy of Use settings on each guest operating system in order to avoid the Sticky Key Problem. Updated Information: March 20, 2013 If you continue to have problems, Uncheck Turn on Filter Keys .
6 comments
Read more

With the AD Recycle Bin Turned on, What Happens when you Create a User Account with a Password that does not meet the Password Policy?

By
This was an interesting observation from one of my Windows Server 2012 classes.  While working with the AD Recycle bin in a lab, one of my students discovered some interesting accounts that were created. When he created user accounts that did not meet password complexity requirements, an account is temporarily made and then deleted.  When a new password is provided that meets the password requirements, then a new account is made. We discovered this in two places.  First off in the Active Directory Administrative Center.  This is what caused the initial confusion.  Take a look.  This is in the Deleted Objects OU. You can see multiple deleted accounts for Test2 and one for Test3.  Test3 is a valid, functioning user account.  Using the PowerShell command Get-ADObject –IncludeDeletedObjects –Filter * –Properties ObjectSID we can see that indeed, two accounts were created, with one of them deleted. Notice the RID portion of the SID is different. ...
Post a Comment
Read more

Where did a User’s Account Get Locked Out?

By
Updated: May 15, 2015 When this article was originally published, two extra carriage returns were add causing the code to malfunction.  The code below is correct.   My client for this week’s PowerShell class had a really interesting question. They needed to know where an account is being locked out at. OK, interesting. Apparently users hop around clients and forget to log off, leading to eventual lock out of their accounts. The accounts can be unlocked, but are then relocked after Active Directory replication. This problem is solved in two parts. The first one is to modify the event auditing on the network. The second part is resolved with PowerShell. The first part involves creating a group policy that will encompass your Domain Controllers. In this GPO, make these changes. Expand Computer Configuration \ Policies \ Windows Settings \ Security Settings \ Advanced Audit Policy Configuration \ Audit Policies \ Account Management Double click User Account Management C...
18 comments
Read more