Windows Server
A running AD service does not guarantee the controller advertises the functions clients need. Inspect the controller's advertising test and related logs.
Active Directory & Group Policy1 min read
Read article : Investigate a domain controller that is not advertising correctly
Windows Server
Some directory operations depend on a particular role owner. Identify ownership before assuming every controller can perform the same operation.
Active Directory & Group Policy1 min read
Read article : Locate FSMO role owners during a role-specific AD incident
Windows Server
Incorrect subnet-to-site mapping can send a server to distant controllers and increase authentication or policy latency.
Active Directory & Group Policy1 min read
Read article : Investigate a server authenticating against the wrong AD site
Windows Server
A domain trust symptom can come from DNS, time or a machine-account mismatch. A non-repairing secure-channel test provides a focused first check.
Active Directory & Group Policy1 min read
Read article : Test a member server's secure channel before repairing it
Windows Server
A member server can resolve domain services yet fail authentication when its clock diverges. Inspect source and synchronization state first.
Active Directory & Group Policy1 min read
Read article : Check a domain member's time source during Kerberos failures
Windows Server
Unlocking an account does not stop an old service or scheduled task from retrying the wrong secret. Collect the recorded lockout source and time.
Active Directory & Group Policy1 min read
Read article : Locate account lockout evidence on the relevant domain controller
Windows Server
A service may fail Kerberos when its SPN is absent, duplicated or assigned to the wrong identity. Start with a precise query.
Active Directory & Group Policy1 min read
Read article : Find an SPN registration before changing Kerberos configuration
Windows Server
A user terminal and a Windows service can hold different tickets and identities. Inspect the relevant context before concluding an SPN change failed.
Active Directory & Group Policy1 min read
Read article : Inspect Kerberos tickets in the actual service context
Windows Server
A local change can be reverted by policy and create a recurring incident. Inspect applied computer and user policy before editing the setting again.
Active Directory & Group Policy1 min read
Read article : Investigate a server setting managed by Group Policy
Windows Server
Policy processing can fail when DNS, authentication or SYSVOL access is broken. Separate file retrieval from the policy's own settings.
Active Directory & Group Policy1 min read
Read article : Diagnose Group Policy retrieval failures through SYSVOL access
Windows Server
A controller can have an older policy copy when DFS Replication does not keep up. Inspect backlog in the correct direction between known partners.
Active Directory & Group Policy1 min read
Read article : Check SYSVOL replication backlog between known partners
Windows Server
Recreating an object with the same name does not preserve its original identity or permissions. Search approved deleted-object metadata first.
Active Directory & Group Policy1 min read
Read article : Check whether an AD object is deleted before recreating its name