get-aduser with filter - missing attributes

A forest, 40 domains, one attribute, let's assume 'attribute-N'. Attribute was deprecated (isDefunct=True), now is visible again. near 40k user objects have this value set - boolean type, not system, in global catalog (SearchFlags=1). When I was looking for I got 40k objects. After clear no instances. 

After that I undeleted user object with this attribute and again looking for objects with attribute-N in a domain and in the forest (global catalog) - I received no answers. Get-ADUser for this single objects returns attribute value. Looking for with Get-ADObject - also no return. 

Finally, when I added value to my user object - I can find by searching in the domain and in the forest. Is there a limit of 1 instance per domain or the forest when I can find objects? 

Yes, I must have minimum 2 instances to look for objects. 

password rotation in ADFS

 ADFS farm, configuration in dedicated SQL database, standard service accounts in Active Directory, how to rotate passwords? Nothing unexpected:

• change password on account in Active Directory
• change on every node of the farm - in service configuration (through services.msc)
• restart
• low risk of account lockout - my personal preference - do it on Wednesday or Thursday evening - when most of customers do not use it actively

LSASS Schema Cache

 Interesting - every time, when I'm modifying schema there is a gap when I can't see changes from perspective of tools. For example - I'm adding new attribute and this attribute will be available after a small gap - 5-15 minutes before it will be available. Is it Schema Cache? 

Or maybe Schema Management Thread (ntdsai.dll)?

After hide of one of attributes in Powershell I can still query for this attribute and magically - after 5-15 minutes it just disappears...

schema isDefunct - hide attribute

 First test deactivation of attribute:

• created custom attribute - emptyAttribute1 (ldap emptyAttr1), some oid, OMx 64
• custom attribute added to class User (I know, it should be auxiliary class)
• few user objects created - few of them with this attribute populated
• all test accounts deleted - moved to trash - recycle bin
• all restored - without issue
• all test accounts deleted again - in recycle bin 
• isDefunct = True set on attribute 
• I can't restore them

Second test undelete:

• try to add mayContain in user class - error 0x57 - error in attribute conversion
• 00000057: LdapErr: DSID‑0C090EBF, comment: Error in attribute conversion operation
• isDefunct cleared (means False)
• few errors - but finally success - maybe I must close dialog boxes - they have their own cache - cache of threads connected with dialog boxes
• now attribute is in class... lets try to recover objects - still error with user objects with attribute unhidden
• attribute is not reachable from ADUC, but from Powershell is visible, can be set
• ok - finally I can restore object 
• can I defunct attribute now? no, I have 2 objects with this value...
• 0x20C2 (WILL_NOT_PERFORM) + data 8386 → „attribute is used in may‑contain”
• - let's try to clear the value... cleared - still can't defunct, let's populate it again and try to remove from may contain
• removed from maycontain - it is possible with objects with this value
• now isDefunct=TRUE is possible - objects still have this value
• I can change value of attribute that is already set
• ok, now I have error in Powershell - parameter is incorrec - so I should wait - even in lab with the single server
• objects have been deleted, isDefunct=TRUE, in theory they don't have attributes set - before removal - no attributes visible, even from Powershell
• isDefunct cleared  - can I restore object? no, I must add to mayContain
• I can't add to mayContain - error in attribute conversion... why? dialog boxes or Search Flags? 
• Bingo! searchFlags must be cleared - now I can add to mayContain, can I recover accounts?
• yes - 5 minutes waiting - accounts undeleted

Summary:

• to recover objects with isDefunct attributes
• clear isDefunct in attribute
• clear SearchFlags in attribute
• add attribte to mayContain in class
• wait 5 minutes (in lab)
• recover

Observation - important:

• objects can have values in attributes not active anymore - attributes in state inDecfunct=TRUE, class mayContain - cleared with these attributes

TaskScheduler error 0xFFFD0000

0xFFFD0000 - source of this error:

• wrong path - missing script

Exchange Online versus on-premise environment

Let's assume there are:

• (MF) main forest - source of the indentities - single user = single account
• (RF) resource forest - linked mailboxes - Exchange attributes
• (AT) tenant - with migrated mailboxes

Sometime I can see object in AADC/EIDC:

• AT connector
• MF connector

Sometime it's build of:

• AT connector
• RF connector

In this particular hybrid configuration part of attributes are managed by IAM in MF, rest of attributes come from RF. To properly build object MV (metaverse) must be build with the three connectors - MF - main account, RF - resource account - linked mailbox and finally AT - object in Azure.

I'm not sure who is responsible for two strange cases. I don't know - maybe IAM team, maybe EXO team, finally - me - guy responsible for Active Directory, AADC/EIDC and partially for Azure I should repair it. So how to enforce AADC/EIDC in this case to properly connect them:

• ms-DS-ConsistencyGuid - present on MF account usually is equal to Base64 objectGuid of the MF account itself
• ms-DS-ConsistencyGuid - in Base64 format should be on AT account as immutableId
• ms-DS-ConsistencyGuid - can't be present on RF account or... this account will be a placeholder - so on RF account this attribute must be empty - null
• msExchMasterAccountSid - on RF account must be equal SID's of MF account.

TaskScheduler error 0x800710e0

0x800710e0 - meaning - task not launched do to missed start time - reason? Server restarted - by updating team.

ADSIEdit 0x8000500d property not found

Some LDAP instance - connection through AdsiEdit - it is not a problem with authentication - my ldap account allowing me to connect. Problem with encryption? I don't think so, so what the hell it is?

Error replication - tombstone lifetime exceeded

I've got small lab - domain controllers and the whole lab was run at 2018, so I've received error, that tombstone lifetime is exceeded.

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" /v "Allow Replication With Divergent and Corrupt Partner" /t REG_DWORD /d 1 /f

RC4 depreciation in 2026

According to Microsoft document related to CVE-2026-20833 in July by default kerberos tickets by default will be created with AES tokens.

double dots name prevent synchronization group to Azure

case: on-premise user or group with two consecutive dots in name like "Group..1"; AADC synchronization rule with simply flow mailnickname (direct) alias

error: wrong mailnickname (but mailnickname is empty in the source directory)

TLS SSL SNI

SNI - server name indicator - part of TLS standard - similar to host header

inter-domain object move

Until yesterday, I was convinced, that inter-domain (in the same forest) is strictly impossible. I did huge migrations, hudreds thousands of objects and I thought that inter-domain migration is impossible. Yesterday I found document or notice regarding movetree.exe but:

• new object in destination domain retains the same object guid, but of course - sid is different - most of migrations requires the same sid and the same guid or to properly process new object and treat as the new as the old one (to mimic)
• new object has the old sid in sidHistory - ok
• the old object is deleted and can't be simply refurbished

In our huge migrations every time we created a new bunch of objects - in the same forest or in different forest, every time we used sidHistory, the old objects remains intact - just to have flexibility in operations. Every user profile with exchange mailbox/outlook profile was also migrated before the final switch, so... if userA in domain1 (domain1\userA) was prepared for switch, so his user profile with outloook profile was prepared for this operation and in M-Day (migration-day) he could just login on userA account in domain2 (domain2\userA) so he could still work with the same environment.

MoveTree scenario is possible only in a small environments, in small migrations.

what's wrong - domain controller or different source?

what's wrong	possible source	solution
time unsynchronized	pdc role domain controller	verify if pdc is synchronized with external time source verify if dc are synchronized with pdc
users can't login	time synchronization (Kerbers) 802.1x issue	check domain controllers if they are synchronized are certificates ok for 802.1x? crl are available?
users change password issues	pdc role availability	maybe something wrong is with pdc role dc?
can't join a new computer to domain	limit per user account of new computers availability of RID master	increase limit check if RID master is available - dc don't have rid pool to assing
can't create new objects - uses, groups, computers	availability of RID master	check if RID master is available
universal group membership failure	infrastructure master global catalog availability	infrastructure master is not updating links between domains because is on global catalog check if global catalog is available

to-do november 2025

What subjects I must focus:
- TGT on a trust - reset -

SPN with IPv4 or IPv6 addresses

Starting with Windows 10 version 1507 and Windows Server 2016, you can configure Kerberos clients to support IPv4 and IPv6 host names in SPNs. Yes, it is again possible - as I can remember - it was disabled on Windows 2008 r2 or maybe Windows 2008, up to these versions it was possible.





Entry in registry:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters

DWORD:TryIPSPN, value = 1



SPN value must be registered in Active Directory or course.

Windows 11 - customize taskbar

It's impossible to have taskbar on the top, on the right or on the left - the only position and the best position according to Microsft is the bottom. Next stupid choice like "only one button" in IOS devices. Users don't know what is the best for Them, but of course - one guy - Satya, Bill or Steve knows. What an idiotic choice.
Is there a sollution? Of course, please praise the lords and ask them of one stupid option.
Registry customization is not working. What audacity to think that change could be so simple by using only registry. It's must be hardened in binaries to prevent such brave steps.

DNS CAA proper internal configuration

What is a valid configuration of internal CAA records (internal - not visible in Internet) on Windows DNS servers:

• You should point to valid source of certificates - "issue" prefix for DNS record, for example if Your internal PKI is from pki.internal.contoso.com you should place record issueinternal.contoso.com or issuecontoso.com; this will cover also wildcard certificates;
• If You don't want to allow wildcards You should place another DNS record with empty source record like "issuewild;" - allowed entries is empty; 
• binary representation  of DNS record contains first byte equal zero (the higest bit has critical meaning, rest is not used now), next byte value 5, rest of record is a string data, e.g. "<00><05>issuewild;"
• binary representation must be located in DNS record of Type257

ADFS certificate renew with Azure, Entra ID and M365

We have ADFS 4.0 farm without WAP (security reasons) so we don't have strict accessibility from Internet - only communication between on-premise and Azure from selected networks and addresses. Why it is important? Probably we've been had some issue with renewal process.
According to Renew federation certificates for Microsoft 365 and Microsoft Entra ID we should enable rollover on certificates and after controlled switch between primary and secondary certificates our federation between Azure and ADFS should be updated, but:

• the next signing certificate on Azure was from two periods ago (one period is 2 years, so it was 4 years old, now we have certs from 2025 to 2027, previous period it was 2023 to 2025, but two periods ago it was 2021 to 2023)
• so the next signing certificate wasn't updated till 4 years
• on daily basis we have AutoCertificateRollover disabled
• when it should be enabled? just before enforced generation of the new certificates? it wasn't
• so we changed it manually - after replacement of certificates (flip between secondary and primary) they've been exported to base64, imported in powershell (copy paste from .cer file to variable)
• connection to Entra - Connect-Entra -Scopes 'Domain.ReadWrite.All' (different possible values are like User.ReadWrite.All, Directory.ReadWrite.All, Group.ReadWrite.All - not suitable in our case)
• and update using Update-MgDomainFederationConfiguration -DomainId 'our.federated.domain.com' (like contoso.com) -InternalDomainFederationId 'our-federation-id' -signingcertificate $variableWithCert
• at first we've tested on -nextsigningcertificate, later on -signingcertificate
• confirmation on Get-MgDomainFederationConfiguration -DomainId 'our.federated.domain.com' -InternalDomainFederatoinId 'our-federation-id' (pipe) Format-list - there we could confirmed that certificates were replaced
• additional confirmation was on Teams on mobile devices - after logout and logon it was obious that it is working

Pay Attention!!! You must have BGA account without MFA (if you have enabled MFA) - probably You will have issues connecting to Azure after certificate replacement. Maybe You should open connection (powershell session) before any steps - just in case.

huge netbios traffic - after print server removal, next part

After print server removal (guys responsible of print servers) every workstation is trying to find print server which is unavailable. We have still wins servers but addresses are removed from wins and dns servers. So every 30 seconds every of 20k workstations is trying to find names at first by querrying wins, later by broadcasts. Finally network traffic from this source is huge. I must try to remove registry entries for missing print servers.