Blog - Page 17 of 26 - InfoTech Ninja

Systems Admin

Convert MBR to GPT without Data Loss

MBR caps at 2 TB per disk and four primary partitions; GPT lifts both ceilings (9.4 ZB, 128 primary partitions). For data disks on a running Windows Server, the right tool is DiskGenius - free, online, three clicks per disk, no data movement, no reboot. This article walks the workflow: identify MBR disks with Get-Disk, convert with DiskGenius (right-click - Convert To GUID Partition Table - Save All - Yes), repeat for each disk, verify with Get-Disk, restart the server when the maintenance window allows. Includes why mbr2gpt.exe is the wrong tool for data disks (it is system-disk-only and requires WinPE), the gotchas (skipping Save All, converting from the wrong DAG node, BIOS-only servers and the system-disk constraint), and the difference between the in-place metadata-only conversion DiskGenius does and the copy-everything-over fresh-GPT-disk migration Microsoft suggests.

Systems Admin

Remove Orphaned SIDs with PowerShell

An orphaned SID is an ACL entry whose underlying user, group, or computer was deleted but the access control entry was left behind. They show up as raw S-1-5-21-... numbers on the Security tab of AD objects and clutter audit reports without breaking access control. This article ships a complete RemoveOrphanedSID-AD.ps1 PowerShell script that recursively walks AD objects, identifies ACEs whose IdentityReference is a domain-prefixed SID that no longer resolves, and either lists or removes them. Includes the two-pass workflow (list, then remove), the -WhatIf dry-run mode, the AD: PowerShell drive provider details, why RemoveAccessRuleSpecific is the right method, and the common pitfalls (running -Remove first, scoping to forest before testing on one OU, confusing this with file-system ACL cleanup).

Systems Admin

Troubleshoot AD Promotion Stuck at “Creating the NTDS Settings Object”

The Active Directory promotion wizard reaches Creating the NTDS Settings object and never advances. The Directory Service log on the candidate fills with events 1963 / 1962 / 1125. The cause is almost always one of two things: a credential mismatch (local Administrator password matches the domain Administrator password, or the wizard credential was supplied without a domain qualifier) or stale residue from a prior failed promotion. This article walks the five-step path: prerequisite check, fix the two credential mistakes, four-step residue cleanup (reboot, delete computer object, force-leave domain, uninstall AD DS role), retry the promotion, and only then chase the deeper network and DNS causes. Includes the LDAP port 389 sweep, SRV-record verification, and replication health check on the existing DC.

Systems Admin

Troubleshoot Active Directory Domain Join Error 0x232A (DNS / NetBIOS)

Domain join error 0x232A (An Active Directory Domain Controller for the domain could not be contacted) is a name-resolution failure, not a network outage. The fix is almost always one of three things: type the DNS FQDN instead of the NetBIOS short name, point the workstation's DNS at servers that host the AD zones, or disable NetBIOS over TCP/IP entirely. This article walks the seven-step diagnostic path: confirm the name typed, fix client DNS, kill NetBIOS, verify SRV record resolution with nslookup, prove TCP 53 / 389 connectivity, check both host firewalls, and read NetSetup.log for the exact failure point. Includes the difference between 0x232A and 0x3a and the common pitfalls (public DNS in the DHCP scope, split-tunnel VPN DNS, unreplicated SRV records on a newly promoted DC).

Systems Admin

Troubleshoot “The Specified Server Cannot Perform the Requested Operation” Error (0x3a)

Domain join error 0x3a (The specified server cannot perform the requested operation) is almost always a TCP 389 LDAP connectivity problem dressed up in directory-layer language. This article walks the diagnostic path: confirm DNS and basic reachability, prove TCP 389 with Test-NetConnection, then narrow the block to the workstation host firewall, the DC host firewall, or the network ACL between them. Includes the multi-port sweep (53/88/135/389/445/464/3268), the residual-causes list when port 389 is open (AD DS service, time skew, stale computer object), and the common pitfalls (disabled firewall left off, public DNS resolver, 389-vs-636 confusion).

Systems Admin

Troubleshoot “Your Computer Could Not Be Joined to the Domain” Error

The 'maximum number of computer accounts' error comes from ms-DS-MachineAccountQuota, the domain-wide AD attribute that limits how many machine accounts any single authenticated user can create (default: 10). This article walks the four ways to fix it: delegate Create Computer Objects on the OU (recommended), raise the global quota in ADSI Edit (with caution), use a domain admin account (lazy), or reset/delete a stale computer object that is in the way. Includes the post-change replication step and the common pitfalls (setting the quota to 0, delegating to Authenticated Users, forgetting orphan objects, wrong default OU).

Systems Admin

Troubleshoot On-Premise Active Directory (DNS Edition)

The three most common AD-DNS failure modes and how to fix each: clients pointing at the wrong DNS server (point at a peer DC + loopback, never the DC's own external IP); the AD-integrated zone gone missing (recreate as Primary AD-integrated, restart Netlogon to re-register SRV records, verify with dcdiag /test:dns); and inter-DC replication broken (repadmin /replsummary, /showrepl, /syncall /A /e /P, plus time skew and firewall checks). Includes the four-tool diagnostic kit (nslookup SRV / dcdiag / repadmin / Event Viewer Directory Service) and 7 common pitfalls.

Systems Admin

Manage Hyper-V VM Checkpoints

How Hyper-V checkpoints actually work (differencing-disk chain), when to use them (lab rollback, patch dry-run, demo reset, short-term oh-no insurance), why they aren't a backup, the Production vs Standard distinction (default Production - app-consistent via VSS - safe for most workloads except DC/SQL/Exchange replicas), the GUI flow for create / revert / apply / merge, the Edit Disk wizard for manual merge of orphaned chains, the PowerShell equivalents (Checkpoint-VM, Restore-VMSnapshot, Remove-VMSnapshot), and 7 common pitfalls (don't snapshot a DC, USN rollback, long-lived checkpoints, disk-space crunch, revert vs running VM).

Systems Admin

Configure Disk and Volumes in Windows Server

How to add a new disk to a Windows Server, bring it online, initialize it as GPT, create one or more volumes (NTFS / ReFS), and the design choices that decide whether the storage stays predictable or gets weird six months later. Walks the Hyper-V add-disk flow, the Server Manager bring-online + initialize + New Volume Wizard procedure, the NTFS vs ReFS trade-off (general purpose vs resilient / VM-host / backup), the PowerShell equivalent (Get-Disk / Initialize-Disk / New-Partition / Format-Volume), and 7 common pitfalls (MBR by accident, Disk Management on Storage Spaces, wrong file system, forgot Bring Online after reboot, drive-letter collision).

Systems Admin

Clean Up Stale DNS Records with PowerShell

One PowerShell script that walks every Primary forward zone on a DNS server and removes every record (A, NS, SRV, CNAME, PTR) that names or points at a demoted host - in one pass. Covers why scavenging alone doesn't catch them, the manual DNS Manager review (zone Properties Name Servers, DomainDnsZones host records, _msdcs SRV records under sites), the full Remove-DNSRecords.ps1 with -WhatIf-first usage, the trailing-dot trap on SRV/NS data, verification with Resolve-DnsName + dcdiag /test:dns, and 7 common pitfalls (skipped -WhatIf, missed trailing dot, non-Primary zones, reverse zones, scavenging assumptions, downstream-DNS confusion, client caches).

Systems Admin

Change the IP Address of a Domain Controller

Three GUI clicks to set a new IP, four CLI commands (ipconfig /flushdns, /registerdns, nltest /dsregdns, dcdiag /fix) to re-register with DNS, and one downstream-consumer audit afterwards. Walks the pre-flight (second DC, console access not RDP, replication health, downstream-consumers list), the GUI procedure with screenshots, the PowerShell-only equivalent (Remove-NetIPAddress / New-NetIPAddress / Set-DnsClientServerAddress), DNS-pointer trap (don't point at the DC's old IP), the SRV-records-need-nltest /dsregdns trap, and 7 common pitfalls (RDP'd into it, peer DCs caching old IP, stale scavenger window, FSMO concerns).

Systems Admin

Disable Windows Firewall with PowerShell

When you legitimately need to turn the host firewall off (debugging, lab, migration window) and how to do it cleanly with PowerShell. Get-NetFirewallProfile reads the per-profile state; Set-NetFirewallProfile -Enabled False flips them off; the same cmdlet with True flips them back. Includes the targeted-single-rule alternative (Disable-NetFirewallRule), a try/finally cleanup pattern, the schedule-a-forcing-function-to-re-enable pattern, and the common pitfalls (forgot to re-enable, wrong profile, GPO override, trusted-the-wrong-tool).

The Dojo