Hybrid Join Troubleshooting in Microsoft Entra ID
You followed the Hybrid Join guide. Entra Connect is happily syncing. The SCP is in AD. The four URLs are reachable. The device is domain-joined. Yet dsregcmd /status on the…
Tag: Troubleshooting
Find Microsoft Entra Connect Service Accounts: Three Identities, Three Locations
Microsoft Entra Connect uses three different service accounts, each in a different place. When troubleshooting permission errors or stuck syncs, knowing which account does what — and where to look…
Find Your Entra Connect Server: Ask the Cloud (No RDP Required)
You inherited an Entra Connect deployment with no documentation. Or you suspect there’s a rogue EC install somewhere on your network. Or you’re auditing for compliance and need to know…
Find Your Entra Connect Version: 4 Ways (Cloud, GUI, Sync App, PowerShell)
The first thing any Entra Connect troubleshooting call asks: which version are you running. Microsoft’s release cadence is brisk; minor sync issues often turn out to be known bugs in…
Fixed: Trust Relationship Between Workstation and Domain Failed
Every domain-joined Windows machine shares a machine-account password with the domain controller; the password rotates every 30 days, and when the local and DC copies drift apart the secure channel collapses and logon dies with: The trust relationship between this workstation and the primary domain failed. Four working fixes, ordered heaviest to lightest. Solution 1 - drop the machine to a workgroup and rejoin the domain (always works, two reboots). Solution 2 - Reset-ComputerMachinePassword -Credential from PowerShell (one command, no reboot, the cleanest fix). Solution 3 - cache a domain credential in Credential Manager (a workaround, not a fix - the underlying drift is still there). Solution 4 - right-click the computer object in dsa.msc and pick Reset Account, then reboot the client (the right answer when the desktop is unreachable). Includes the four root causes (long offline gap, snapshot restore, cloning without sysprep, replication lag) and which solution best matches each.
Troubleshoot AD Promotion Stuck at “Creating the NTDS Settings Object”
The Active Directory promotion wizard reaches Creating the NTDS Settings object and never advances. The Directory Service log on the candidate fills with events 1963 / 1962 / 1125. The cause is almost always one of two things: a credential mismatch (local Administrator password matches the domain Administrator password, or the wizard credential was supplied without a domain qualifier) or stale residue from a prior failed promotion. This article walks the five-step path: prerequisite check, fix the two credential mistakes, four-step residue cleanup (reboot, delete computer object, force-leave domain, uninstall AD DS role), retry the promotion, and only then chase the deeper network and DNS causes. Includes the LDAP port 389 sweep, SRV-record verification, and replication health check on the existing DC.
Troubleshoot Active Directory Domain Join Error 0x232A (DNS / NetBIOS)
Domain join error 0x232A (An Active Directory Domain Controller for the domain could not be contacted) is a name-resolution failure, not a network outage. The fix is almost always one of three things: type the DNS FQDN instead of the NetBIOS short name, point the workstation's DNS at servers that host the AD zones, or disable NetBIOS over TCP/IP entirely. This article walks the seven-step diagnostic path: confirm the name typed, fix client DNS, kill NetBIOS, verify SRV record resolution with nslookup, prove TCP 53 / 389 connectivity, check both host firewalls, and read NetSetup.log for the exact failure point. Includes the difference between 0x232A and 0x3a and the common pitfalls (public DNS in the DHCP scope, split-tunnel VPN DNS, unreplicated SRV records on a newly promoted DC).
Troubleshoot “The Specified Server Cannot Perform the Requested Operation” Error (0x3a)
Domain join error 0x3a (The specified server cannot perform the requested operation) is almost always a TCP 389 LDAP connectivity problem dressed up in directory-layer language. This article walks the diagnostic path: confirm DNS and basic reachability, prove TCP 389 with Test-NetConnection, then narrow the block to the workstation host firewall, the DC host firewall, or the network ACL between them. Includes the multi-port sweep (53/88/135/389/445/464/3268), the residual-causes list when port 389 is open (AD DS service, time skew, stale computer object), and the common pitfalls (disabled firewall left off, public DNS resolver, 389-vs-636 confusion).
Troubleshoot “Your Computer Could Not Be Joined to the Domain” Error
The 'maximum number of computer accounts' error comes from ms-DS-MachineAccountQuota, the domain-wide AD attribute that limits how many machine accounts any single authenticated user can create (default: 10). This article walks the four ways to fix it: delegate Create Computer Objects on the OU (recommended), raise the global quota in ADSI Edit (with caution), use a domain admin account (lazy), or reset/delete a stale computer object that is in the way. Includes the post-change replication step and the common pitfalls (setting the quota to 0, delegating to Authenticated Users, forgetting orphan objects, wrong default OU).
Troubleshoot On-Premise Active Directory (DNS Edition)
The three most common AD-DNS failure modes and how to fix each: clients pointing at the wrong DNS server (point at a peer DC + loopback, never the DC's own external IP); the AD-integrated zone gone missing (recreate as Primary AD-integrated, restart Netlogon to re-register SRV records, verify with dcdiag /test:dns); and inter-DC replication broken (repadmin /replsummary, /showrepl, /syncall /A /e /P, plus time skew and firewall checks). Includes the four-tool diagnostic kit (nslookup SRV / dcdiag / repadmin / Event Viewer Directory Service) and 7 common pitfalls.
Disable Windows Firewall with PowerShell
When you legitimately need to turn the host firewall off (debugging, lab, migration window) and how to do it cleanly with PowerShell. Get-NetFirewallProfile reads the per-profile state; Set-NetFirewallProfile -Enabled False flips them off; the same cmdlet with True flips them back. Includes the targeted-single-rule alternative (Disable-NetFirewallRule), a try/finally cleanup pattern, the schedule-a-forcing-function-to-re-enable pattern, and the common pitfalls (forgot to re-enable, wrong profile, GPO override, trusted-the-wrong-tool).
Back Up and Restore the Windows Registry
Step-by-step guide to backing up and restoring the Windows registry: open Registry Editor, choose File > Export, pick All or a single branch, save the .reg file, and restore later via File > Import or by right-clicking the .reg file and choosing Merge - including the Safe Mode workflow when Windows will not boot.