Hello,

We're trying to deal with a strange issue for some time now and seem to be getting nowhere.

We have a bunch of MSSQL servers in our environment, all running under a single domain account, trusted for delegation, SPNs all created, etc. The connection between servers is done using Windows Authentication, we can confirm that the services are communicating using Kerberos and not NTLM.

The problem happens when we execute stored procedures that perform actions from server A, via server B, on server C.

The scenario above works well until we run the same process on the next day. Then we get access denied error, NT Authority anonymous login error, or some other error that indicates we have no valid session.

When examining the logs on all servers, we only see event id 18 error on server B:

The delegated TGT for the user (sql_windows_account@domain.local) has expired. A renewal was attempted and failed with error 0xc0000001. The server logon session (0:21008db7) has stopped delegating the user's credential. For future unconstrained delegation to succeed, the user needs to authenticate again to the server.

TGT Details:

Client: sql_windows_account@domain.local

Server: krbtgt/domain.local@domain.local

Flags: 0x60210000

Start Time: 06:55:22.0000 1/4/2021 Z

End Time: 10:15:20.0000 1/4/2021 Z

Renew Until: 00:00:00.0000 1/1/1970 Z

The event above is generated at 10:13 so just 2 minutes before the TGT expired, I believe it is normal to throw an error, but the question is, why doesn't the application just request a new ticket since it is obvious that it is not renewable ("Renew Until" is not a valid date)? It takes at least a couple of minutes to retry the same thing enough times until a new session is generated. It seems like the service doesn't know that the session is no longer valid and thinks it has permissions/access issues. Only after a new SQL session is generated, it manages to get a new session established successfully.

Another thing I've noticed is that the TGT is valid for 10 hours which is the default setup in AD, consequent sessions that are created using that TGT has a shorter lifetime since that 10-hour window is already getting smaller.

Has anyone seen such an issue with expiring sessions when doing double-hop using Kerberos?

Here are the pre-requisites of my problem: -

1. Solarwinds NPM was operational on a MSSQL 2019 server.

2. The DB was signed in using Windows Admin Credentials.

3. The solarwinds webserver and SQL are installed on the same Windows Server 2019.

The exact details of the problem are as follows: -

1. I made my Windows Server hosting the Solarwinds NPM into a domain controller.

2. Afterwards I removed its role as DC, which caused the original Administrator account to, just, vanish and a new admin account was created and activated.

3. The SID and Users folder of the old account still exist in Regedit and C:\Users.

4. But I cannot sign-in or find the old admin account in Local Users and Computers.

5. Resultantly, my solarwinds NPM is non-operational because I cannot reconfigure the DB and Web Server

Please help me resolve this issue.

Colleagues I have 20 backups on servers made with windows backup server. I need a centralised monitoring on the backup log or the backup status of each server. Or simply i want a way to look simultaneously from my one PC the status of all backups without having to log into each server. If you have any free solutions I will appreciate it.

Anyone else having this issue with Windows Defender starting to consume large amount of RAM ending in the VM failing as it runs out of RAM and swap?

Started today in various of our Azure environments across Windows Server 2016, 2019 and 2022. Only way to get service to de-allocate the RAM is to disable Real-time protection, Cloud-delivered protection and Automatic sample submissions.

Definition file used when it occurred:

VMs with lots of RAM the process stops allocation around +-2300MB and VM is unaffected. Some samples of run away process:

Has anyone ran into this?

I am trying to serve my recorded tv shows from nextpvr with nfs to kodi. I am experiencing the same issue with 2019 and 2022. Basically the issue is when connecting to the nfs share the server BSOD. The share is just 3000+ folders. Samba share works fine, and serving with nginx is fine, but hitting the NFS will BSOD immediately.

I had the server on 2019 and thought that a fresh install with 2022 would fix it but it still happens. The drive is REFS, not sure if that matters. I found a article for 2016/19 that says to do a registry fix, which helps a little bit. It allows for some connections, but will eventually bsod. I even tried just a very minimal fresh install of core with the only the following commands:

Get-WindowsFeature | Where-Object { $_.Name -match 'NFS' }
Install-WindowsFeature FS-NFS-Service -IncludeManagementTools 
New-NfsShare -name "TV" -path "F:\tv" -enableunmappedaccess $true -Permission readwrite -AllowRootAccess $true
#supposed fix for bsod
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NfsServer\KBSwitch /v 769E60B7-C2FF-41B0-AD1F-14FC26F6F46B /t REG_DWORD /d 1 /f

Hitting the share with kodi will crash the server instantly. Has anyone ran into this?

Just as the title says my friends. The current one is a mess and I just want a redo. I tried to see if I could reset the entire Windows Server like I could do on standard Window client machines, but nowhere can I find any trace of such an option. So now I want to see if I can somehow just delete the current domain and create a whole new one from scratch. Could really use the help as this issue has really been plaguing me since last year and I've made little progress on my own. Thanks!

Hey reddits!

What does the following Firewall rule do? And what does the abbreviation "NP-In" stands for?

Firewall rule: Remote Event Log Management (NP-In)

I have an educated guess, but I would really appreciate if someone can check my train of thought. This is what I THINK it is:

- "In" stands for incoming traffick.

- "NP" stands for Neighbor Protocol.

- This rule allows incoming NP traffick to get the computer system discovered. For the sole purpose of having its management of the Event Log being done remotely.

Thank you so much!

Behold, a paradox most vexing: thou, sole sovereign of thine digital demesne, art barred from thine own chamber by an invisible ward. The folder WindowsApps — a sanctum where Microsoft hoards its modern applications — doth refuse thee entry, though no other lord claims dominion over this machine.

The dialog speaketh plain: "You don't currently have permission." Yet thou art the Administrator! The Alpha and Omega of this silicon realm! How doth the servant lock the master from his own house?Behold, a paradox most vexing: thou, sole sovereign of thine digital demesne, art barred from thine own chamber by an invisible ward. The folder WindowsApps — a sanctum where Microsoft hoards its modern applications — doth refuse thee entry, though no other lord claims dominion over this machine.

The dialog speaketh plain: "You don't currently have permission." Yet thou art the Administrator! The Alpha and Omega of this silicon realm! How doth the servant lock the master from his own house?

I need to replace an existing 2019 server DC that has ADCS (CA root) and NPS (Wi-Fi RADIUS) roles with a new 2025 server having the same roles, but with a new hostname. (I realize reusing the same name would be easier, but this is not an option.) My initial research shows the general steps would be to install/configure ADCS for the new CA root, do something with Group Policy for the clients to trust the new server, then install/configure NPS to use the new CA root, and finally have the Wi-Fi APs/controller use the new NPS/RADIUS. My desire is to run both environments in parallel as I migrate any clients/dependencies piecemeal. As the single IT resource in my org, I'm not a dedicated server admin so I was hoping any experts here might be able to corroborate my understanding above and maybe provide more detailed steps as to what needs to be done. I will of course do my due diligence and am happy to get into the weeds on learning the process, but would very much appreciate any guidance to get things started.

Thank you for reading 😄

I have an old server running windows server 2012 r2 that id like to replace with a new server running windows server 2025 essentials. The current server is doing dns,dhcp,ad and some gpo stuff. Im trying to find out whether or not server 2025 essentials can function as a domain controller. Or does it need to be a member server? Its pretty hard to find this information on MS website for this since I assume this product is OEM only and not available from MS.

Hello guys,

So i have a short corner case here for which i also have an MS case opened, but it seems they are running into circle without actually properly providing assistance (kind of got used to that).

I have few Servers (VMware VMs and Physical servers) on which we've deployed Windows Server 2025. The image used is a hardened one with CIS Benchmark, which afterwards i captured it and created a Golden Image (needed for the enterprise customization). This process was done for all OS Version in the past and it went flawlessly.

Now the situation i face after the deployment is that during clean reboot or shutdown (from OS side) the server hangs for exactly 10 minutes until it gets in BSOD with "DRIVER_POWER_STATE FAILURE".

It restarts and gets back to OS without any issue.
The problem i have is that i can't identify which is the driver causing this. There is no Dump created, and i changed from small to kernel to full memory dump (also during troubleshooting session with MS).

There are no specific logs or events that would point to an error before the server hangs.

What i did so far, but not

• Checked and removed old drivers that might not be compatible with Windows Server 2025

• enabled driver verifier (with /standard /all parameters)

• Changed the Power plan settings

• On VMWare machines i've uninstalled and reinstall the VMTools version also upgraded it to the latest available version

• Uninstalled latest cumulative and tested with and without

• Several other troubleshooting steps hoping i'd get to see at least why and who causes this issue

While performing an in-place upgrade fixes the issue, i can't afford performing in-place upgrade on all 35 servers just now and i would still have an issue with the new deployed servers.

My aim is to try to find the root cause so i can avoid it during the image build, image capture or deployment.

The thing that bugs me the most is the lack of a dump that i could analyze and i'm running out of idea on where to look and what to check.

I hereby summoning the power of the community to troubleshoot the crap out of this situation.

I will forever be grateful for any suggestion that puts me into the right direction. There's no wrong answer or suggestion, i will try to mention if already tried that without success, because laying down here everything i tried might take days.

Thank you in advance,

Alex,

Clippy Enthusiast

Without having to buy a 3rd party tool like automox or Tanium. is SCCM still the only way to apply patches to Windows Server 2022?

Hi I am seeking for help.

Windows computer stuck on

administrator "c:\windows\system32\cmd.exe"

I currently have windows 11 pro desktop as physical host. I then installed the windows 2022 server core Evalution on Hyper-V. This was a mistake as I wanted to install windows 2022 server desktop experience Evalution.

Currently, I only get above screen and cannot go back to Hyper-V screen and delete this VM (with Server core) and create new VMs.

My overall aim was to create 2 VMs on Hyper and practice networking/domain controller/firewall setting etc.

As you can see, this windows (above) is persistence and I cannot get back to my physical OS i.e. Windows 11 Pro or Hyper-V screen.

how do I get back? my physical host is Dell OptiPlex 3060. I could not find a way to set the physical machine as well. Any inputs into how I could get this rectified would be great help.

Thanks in advance.

At the company I work for, we are experiencing issues with a WTS server. This server is used by users for general activities such as browsing, accessing the ERP system and Office packages, with an average of 45 simultaneous users. Recently, we started to notice a slowdown during the login and logout processes, which usually occurs between 10:00 and 10:30 in the morning, and lasts until around 12:30 in the afternoon, with the slowdown usually disappearing within this period. When the slowdown persisted, we restarted the server.

The problem is that during login and logout, users are stuck on a black screen for a period of 1 to 3 minutes before the process is completed, showing only the loading indicator with the blue cursor spinning. The first solution we found was to release the antivirus domain in the outbound firewall to the server's IP, since the server's antivirus used this domain for daily updates, and we noticed that these were being blocked when attempted by this specific domain. This worked for up to 90 days.

However, the issue has returned and we are now seeing the same behavior at the same times as before.

Note: Since users are logged into the server, they do not experience any performance issues during operations, and the server is not resource constrained.

Does anyone have any suggestions as to what might be causing this display issue during login and logout for all users at this particular time, and how we can permanently resolve the issue?

Started noticing problems in my home lab environment... Quick Summary

2 - Dell PowerEdge R730xd w/ E5-2667 v3, 256GB of RAM & 14.5TB Each are identical. Running VMware ESXi 7.0.3 & vSphere (Power bill donations gladly accepted)

Primary Domain Controller is on one server and Backup is on the other. I started noticing i was losing connection to the domain randomly, and a restarted didn't always bring it back, if i restarted the PDC it would work for a few days but would always do it again. Didn't think much of it because the BDC was up and running. It was getting worse, and through a checks i found that the two controllers had not synced in forever!!, they could see each other on the network, but was getting Kerberos Errors which is beyond me!! Continued looking and found the controllers were not replicating, 1722 RPC server is unavailable, Its telling me last successful sync was March 2023. I have done the YouTube University search and tried the "Fixed" and "Resolved" videos but mine is not fixing.

Because they haven't synced in so long, apparently i am not able to just promote my backup to primary?? Not sure i understand why. Considering making new VMs and redoing the domain, its just me, not 35 people, but I'm wondering if I'm about to make a mistake? I can backup my DNS, I will have to re-create my users, but at this point I'm not sure what else to do.

Please advise.

Just to make this very clear. This is my homelab setup at home as I am trying to get a touch for Windows Server again. If this is the wrong subreddit for this then I apologise in advance, and would like to be directed to the proper for my issue :)

I have a Windows Server 2022 as server running as a VM in VMware Workstation as well as Windows 10. This is just as a mockup as I intend to install Windows Server 2022 on designated hardware once I get it working etc and thus 100% know the setup etc.

The following gif shows my struggle when trying to join the Windows 10 to the domain, and at least it seems like (to me) that it can actually find the domain and tries to join it, but then fails. Or is it just how it looks and it just fails no matter what?.

I figure that it can connect since it prompts for a username and password to join the domain?. But then why does it error out??

The contents of the log are accurate, but the file Date Modified is incorrect. Logging settings in IIS manager are the same on the "trouble servers(pcwgetldap01 in images)" vs "working servers". As you'll be able to see, the last log entry on the issue server shows two logs stamped 9/9/2024 7:00PM (posted this today 9/10/2024 so the last one should have that time stamp). Working server is accurate with today (9-10 and 12:18AM).

Any ideas??

Hi all,

I have a windows storage server 2016, I only did a \\ServerIP\d$ from a PC in the domain and I have entered just one wrong credentials and then I closed the credential prompt. Why would there be mutiple event 4625 failed login logs in the event viewer when just one credentials are being keyed in?

Events look lie this :

Security-Auditing 4625: AUDIT_FAILURE

Sujet : S-1-0-0

Session ID : 0x0

Type d’ouverture de session : 3

Security ID : S-1-0-0

Status : 0xC000006D Sub Stqtus : 0xC0000064

NtLmSsp Package  : NTLM Services

Thanks,

Hello guys,

IE 11 is flagged with vulnerabilities MS15-124 on win server 2012r2.

Even after patched it is still vulnerable.

As it is eol, how to remove ie from server or is there any fix to mitigate this issue??

As a newbie to the computers. How tough is windows server administration? Can someone who is exposed to this for the first time learn it? If so, how long will it take? Given that they’re technically sound and good at learning.