Replications problems between two DCs caused by faulty Schannel and wrong Kerberos ticket of the affected DCs Computer object

Problem:
•    Automatic and manual replication gives error:
Error Message "Target Principal Name is Incorrect"

•    AD Replication error 8452 remains:
"The naming context is in the process of being removed or is not replicated from the specified server."

•    KCC builds wrong NTDS partners

Directory Services Events:
•    EventID 36871  Schannel
A fatal error occurred while creating an SSL client credential. The internal error state is 10013.

•    Event  ID 36886 Schannel
No suitable default server credential exists on this system. This will prevent server applications that expect to make use of the system default credentials from accepting SSL connections. An example of such an application is the directory server. Applications that manage their own credentials, such as the internet information server, are not affected by this.




Solution:
•    Affected DC cannot communicate with the PDC
•    Renewal of the Schannel on the affected DC is required
•    New Kerberos ticket has to be requested from PDC
•    KCC has to be restarted to rebuild the replications partner(s)


Actions needed:
1.    Stop the KDC service:
C:\>net stop KDC
2.    Purge kerberos tickets using KLIST:
C:\>klist purge
3.    Find PDC Domain Controller in the domain of the affected DC
4.    Reset secure channel from Problem DC's to PDC:
C:\>netdom resetpwd /server:<PDC> /userd:<DOMAIN>\<Admin_account>
/passwordd:*
5. Access the PDC by FQDN to force the Problem DC's to request new kerberos
tickets:
C:\>net use \\<PDC FQDN>\IPC$
6. Force the DC to replicate from PDC: (from active directory sites and services)
7. Start the KDC service:
C:\>net start KDC

Delete existing NTDS connections and check replication topology.

Change AD Group membership for multiple Users using Powershell

You can download my script from technet.

- Requirements:

You have to create c:\ADUser.csv looking like this:


Also edit the marked groups in the script matching to your environment. You can extend this as needed.
# Add the specified users to the groups "Petun" and "Petun2" in AD
Add-ADGroupMember -Identity Petun -Member $User.username
Add-ADGroupMember -Identity Petun2 -Member $User.username

Windows Server 2012: The remote session was disconnected because there are no Terminal Server client access licenses available for this computer

If you try a RDP connection you get the following Error message.
 

It could be the case, that no license is available:
So you have to add the needed license to you RD Licensing Server!

If this server isn´t a terminal server you have to run the RDP console with the following parameter:
mstsc /admin

OR->

You can also disable "User Account Control: Run all administrators in Admin Approval Mode" by doing the following steps:

- Open "Search" and type in "secpol" and click on "Local Security Policy"
 

- In the "Local Security Policy" browse to "Local Policies/Security" options and set "User Account Control: Run all administrators in Admin Approval Mode" to "Disabled".



After this change restart the server.

Backup All GPOs using Powershell

I uploaded a new script to backup all GPOs and the Scripts folder located in th sysvol share.
It will be saved to a server in a folder named as the current date.

- Run this script using a schedule task

Open the Task Scheduler on your server.

Right-Click on "Task Scheduler Library" and select "Create a Basic Task".

Define a Name/Description, Trigger...

On the "Action" section you have to select Start a Program and enter the following options.

Program/script: powershell
Add arguments (optional): -file "C:\admin\Scripts\GPOBackup\GPOBackupV2.ps1"

On the "Finish" section checking "Open the Properties dialog for this task when I click Finish" and click "Finish".

To run whether user is logged on or not, select the option in the General tab, click ok and enter credentials.

- Import GPO Backups

To import the backed up GPOs you can use the GPMC:

Right-click "Group Policy Objects" and click on "Manage Backups..."

or using the Powershell command import-gpo:

https://technet.microsoft.com/de-de/library/ee461044.aspx

Windows Server Service Monitroing via E-Mail notification

Save the following powershell script to your server. Edit the underlined values matching to your environment.


 function sendMail{

     Write-Host "Sending Email"

     #SMTP server name
     $smtpServer = "smtp01.domain.com"

     #Creating a Mail object
     $msg = new-object Net.Mail.MailMessage

     #Creating SMTP server object
     $smtp = new-object Net.Mail.SmtpClient($smtpServer)

     #Email structure
     $msg.From = "server01.edomain.com@domain.com"
     $msg.To.Add("serveradmin@domain.com")
     $msg.subject = "server01 - ServiceX stopped"
     $msg.body = "ServiceX stopped on server01. Please check the server state."

     #Sending email
     $smtp.Send($msg)

}

#Calling function
sendMail


After that open the services.msc and browse to the service you want to monitor. Right-click the service, select "Properties" and click on the "Recovery" tab. On the third drop-down menu select "Run a Program" and select the saved powershell script.