Remko Weijnen's Blog (Remko's Blog)

About Virtualization, VDI, SBC, Application Compatibility and anything else I feel like

Archive for the ‘Active Directory’ Category

After joining a new Windows 2008 R2 Server to the domain I could not login to the domain.

I would get the following error message:

The security database on the server does not have a computer acocunt for this workstation trust relationship.

Additionally the following error was logged in the Eventlog:

Event ID 3 | Error 1787 | Error Code 0x7 | KDC_ERR_S_PRINCIPAL_UNKNOWN | A Kerberos Message was received



Create Active Directory Group with PowerShell

If you want to Create an Active Directory group with PowerShell there are a few things you need to be aware of:

First of all there is no direct way to create new objects in Active Directory. You always need to bind to the Domain or an Organizational Unit and call the Create method.


However the group is not yet complete:

Group name (pre-Windows 2000)


Script to Get Computer OU

Just some quick code to get the OU Name of the computer we run the script on.



Read Maximum Password Age with PowerShell

imageI needed to read out the Maximum Password age with a PowerShell script in a Windows 2003 domain.

Reading out the maxPwdAge attribute is a trivial task  in PowerShell (I am re-using the function AdsLargeIntegerToInt64):

In my case this returns the value -78624000000000 but how do we interpret this?


Some Active Directory attributes return an 8 byte integer in the form of an IADsLargeInteger interface. An example is the pwdLastSet attribute from a user object.

Because the IADsLargeInteger object doesn’t provide type information PowerShell cannot read the HighPart and LowPart properties.

So I wrote the function below to get the Int64 value of an IADsLargeInteger:


I am currently creating a PowerShell script that creates a user with all needed Active Directory attributes, Exchange mailbox, (TS) Home- and Profile directories and so on.

In such a script you can easily get failures because of Active Directory replication.


Function below can be used to check if a given Username exists in Active Directory:

AD Internals: Display RID Allocation Pools

In my previous post I wrote about a problem I had with duplicate RID Allocation pools.

But how do we get more insight into these RID Allocation pools?

The DCDIAG tool can display this information per domain controleler using the following syntax

Example output:

DCDiag Ridmanager Test

But where in Active Directory is this information stored and can we display it for all Domain Controllers at once for larger environments?


The case of the duplicate SID’s


I encountered another interesting error during Exchange 2010 installation today. During the Organization Preparation I got the following error:

The requested object has a non-unique identifier and cannot be retrieved.Active directory response: 0000219D: SvcErr: DSID-031A0FC0, problem 5003 (WILL_NOT_PERFORM), data 0

The setup.log doesn’t give us much more detailed info:

I remembered from a Tweet by Helge Klein recently that the Active Directory schema has no mechanism for enforcing uniqueness of an attribute.


SNAGHTML1ca684cToday I was testing the installation of Exchange 2010 in a VMWare sandbox environment. We created the sandbox to test migration from a 2003 AD and Exchange environment to 2008 R2 with Exchange 2010.

We used a P2V to get real copies of the Active Directory and the AD upgrade to 2008 R2 was already tested.

But during the Exchange installation in the sandbox I got the following error:

The well-known object entry on the otherWellKnownObjects attribute in the container object CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=zorg,DC=local points to an invalid DN or a deleted object.  Remove the entry, and then rerun the task.