r/activedirectory

Hello Sir,

We have cloud kerberos trust and using entra joined machines.

Some users report they are unable to connect share drive in the morning when they login.

We also noticed that they unable to acquire kerberos token.

But after few minutes to half an hour they get token and issue resolved itself..

During the day tone also some user reporting this issue.

When we check klist they don't have token.

Seems like kerberos authentication request not reaching to dc or not getting properly generated from entra joined machine.

Any troubleshooting which you can recommend or any log capture which will help to trave the issue.

Hello,
I am facing an issue with disabling the default RC4 fallback in an Active Directory domain following the July update.
The client I work for still has a few Windows XP and Windows Server 2003 machines in the environment that I can neither upgrade nor remove from the domain. The July update has not been deployed due to concerns about potential side effects.
When reviewing Event ID 201 on the different domain controllers, I mostly find machine accounts corresponding to these operating systems. Naturally, they do not support AES.
Following Microsoft’s recommendations, I modified the msDS-SupportedEncryptionTypes attribute to 0x1C on these objects in order to explicitly allow RC4.
However, despite this change, Event ID 201 events are still being generated, and in these events I can see that the attribute value is 0x27 (the same value as DefaultDomainSupportedEncryptionType).
It appears that this attribute is only taken into account starting with Windows Server 2008.
My question is therefore: How can these old servers/workstations be handled in this situation?

Hi everyone,

We have a new requirement to enable DNSSEC on our AD-integrated DNS which we never had or worked before. We already tried pushing back, explaining that it’s not really recommended for an internal environment that isn't internet facing, and that the operational overhead completely outweighs the minimal security benefits.

But management insisted, so here we are preparing the deployment. We have 4 dcs total.

I’d love to get some real-world suggestions and feedback from anyone who has done this:

Have you seen any weird side effects or negative impacts on the environment after turning it on?

What specific areas should we audit or assess before we flip the switch?

Do any common applications tend to break or get impacted by this?

We know the zone file size and packet sizes will increase, but is there a reliable way to benchmark/evaluate that overhead beforehand?

Our environment actually has more Linux machines than Windows. Any specifics we should look out for with Linux clients?

Is it possible to completely skip signing the _msdcs folder where the AD service locators live, or does the whole zone have to be signed together?

Any best and safest plan to deploy it.

These are a lot of questions, but please bear with me as this is all very new to me. My main concern is that since this is AD-integrated DNS, it is the critical foundation that clients hit first for all AD authentication and services 🙂