Tag: Mircosoft

[Solved] – Dcdiag fails for NCSecDesc test and adprep /rodcprep fails to fix it.

This was a real pain and we ended up having to call Microsoft and spend several hours to resolve what seem to be a simple issue.  When running dcdiag you get an error that the NCSecDesc test failed with:

 Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn’t have     Replicating Directory Changes In Filtered Set  access rights for the naming context:  DC=cosgro,DC=com

Normally running adprep /rodcprep at the command line would correct the issues but in this case we kept getting the same response when running adprep.

Adprep detected the operation on partition DC=ForestDnsZones,DC=cosgro,DC=com  has been performed. Skipping to next partition. ============================================================================== Adprep detected the operation on partition DC=DomainDnsZones,DC=cosgro,DC=com  has been performed. Skipping to next partition. ============================================================================== Adprep detected the operation on partition DC=cosgro,DC=com has been performe d. Skipping to next partition. ============================================================================== Adprep completed without errors. All partitions are updated. See the ADPrep.log in directory C:\Windows\debug\adprep\logs\20130213141646 for more information.

And when we re ran DCDiag we would still get the same error. All the online documents say this should of resolved the issues but it had not.

 

The problem was not the ADPrep /rodcprep but the permissions were seen  to be to “open” for the Enterprise Domain Controllers Group. The security permissions for this group was set to “full” on the main domain partition.  This set of permissions needed to be more restrictive for the group.  To fix we needed to open ADSI Edit and reset the permissions on the domain partition.

The picture below shows you where the domain partition resides, right click the partition and select properties.

Then on the pop up windows select the security tab. In the Groups and Users box find the “Enterprise Domain Controllers” group and then uncheck all permissions.

Now  re-add only the list below to the allow column.

 

 

reset permissions on Domain Partition

  1. Manage replication topology
  2. Replicating Directory Changes
  3. Replicating Directory Changes All
  4. Replicating Directory Changes In Filtered Set
  5. Replication Synchronization

 

Apply the changes and rerun DCDiag to verify that the changes are working.

 

Thats it.

 

Enjoy  Cubert  😎

 

How-to: Exchange 2010 Using GoDaddy UCC Certificates For Multiple Sub Domains

When using GoDaddy UCC certificate with Exchange 2010 there are some termoil on how best to do it. Here is my quick how to on using the UCC Certificates with Exchange 2010.

You shoul edit the powershell command below to reflect your domain name and sub names. Remove all Squidworks.net from the command and insert your domain and sub domain names.

Set-Content -path “c:\temp\squidworks_net.csr” -Value (New-ExchangeCertificate -GenerateRequest -KeySize 2048 -SubjectName “c=us, s=Florida, l=Melbourne, o=Squidworks, ou=IT, cn=squidworks.net” -DomainName mail.squidworks.net, autodiscover.squidworks.net, mail -PrivateKeyExportable $True)

Now we need to run the command in the Exchange Management Shell:

  1. Login to your Exchange 2010 server
  2. Click Start > Programs > Microsoft Exchange Server 2010 > Exchange Management Shell
  3. Paste the New-ExchangeCertificate command into the Exchange Management Shell and press Enter
  4. Your CSR file will appear in c:\temp.

    You can copy that text by opening this file with notepad, and then highlighting the entire body of text, including the Begin and End Certificate Request tags then pasting the text in the CSR area inside of GoDaddy’s Cert request process.

Once Godaddy issues the new cert we will need to import that back in to Exchange.  To Import the file you will need to copy the crt file from GoDaddy to your Exchange server then run the following command in the Exchange Power Shell.

Import-ExchangeCertificate -FileData ([Byte[]]$(Get-Content -Path c:\temp\squidworks.net.crt -Encoding byte -ReadCount 0)) | Enable-ExchangeCertificate -Services “IIS”

In this command we are registering it for the IIS services, afterwards we will go in and modify it replacing the current cert with this one. To do this we open the Exchange Console selecting Server Configuration. In this view we should see the new certification in the “Exchange Certification Tab”. Select this new cert and in the far right panel select “Assign Services to Certificate” Then follow the wizard and select the IMAP,POP and SMTP services. I should ask you once you select finish if you want to replace cert 1 with cert 2. Look at the dates and make sure it is the correct expire date.

Afterwards pull up your exchange server using SSL (https://) and see if your new GoDaddy Cert is being used.

Your all done..

Enjoy

Cubert