Question 1

One DC or two DCs for an SMB office?

Accepted Answer

1. Two DCs, ideally separate hosts or sites
2. Both run DNS, verify replication
3. Split or consciously keep FSMO roles together
4. System-state backup on both

When to bring us in: 
Growing to multiple offices: configure AD Sites and Services properly for replication traffic.

Question 2

Should I split FSMO roles across two DCs?

Accepted Answer

1. Five FSMO roles: Schema, Domain Naming, RID, PDC, Infrastructure
2. PDC emulator hurts most when down
3. Seize only on a truly lost DC
4. Document which DC holds what

When to bring us in: 
During DC migration always transfer cleanly first, never seize as plan A.

Question 3

How do I know my AD replication is healthy?

Accepted Answer

1. Run a replication report regularly
2. DNS health is a prerequisite for AD
3. Check time sync between DCs
4. Review event logs on both DCs

When to bring us in: 
Long replication outage: avoid the tombstone limit or the DC cannot safely rejoin.

Question 4

Logins are slow at the second office.

Accepted Answer

1. Add each office's subnets to the right site
2. Bind DCs to their site
3. Review site-link cost and schedule
4. Validate site-aware DNS records

When to bring us in: 
Many offices: rethink replication topology and bandwidth budget together.

Question 5

Our GPOs have become a maze.

Accepted Answer

1. Inventory every GPO and its author
2. Remove empty or disabled GPOs
3. Group functionally related settings
4. Consistent naming: purpose-OU-visible

When to bring us in: 
Dozens of GPOs per OU: redesign from scratch in a test OU.

Question 6

GPO does not behave as expected on a specific PC.

Accepted Answer

1. Order: Local, Site, Domain, OU (LSDOU)
2. Security filtering: groups that should apply
3. Loopback mode for kiosk or terminal PCs
4. Run a resulting-set check on the target PC

When to bring us in: 
Unexplained outcome: WMI filters and deny permissions are usually to blame.

Question 7

Accidentally deleted an OU or user in AD.

Accepted Answer

1. Recycle Bin is off by default
2. Enable via AD Administrative Center
3. Default 180-day tombstone window
4. Test by recovering a dummy object first

When to bring us in: 
Bin off and object older than tombstone: only authoritative restore from backup.

Question 8

Which sync method between on-prem AD and Entra ID?

Accepted Answer

1. PHS: hash via cloud, simple and robust
2. PTA: validation stays on-prem, needs agent
3. ADFS: legacy, new deployments discouraged
4. Seamless SSO as add-on to PHS or PTA

When to bring us in: 
Compliance forbids passwords reaching cloud: PTA with seamless SSO and redundant agents.

Question 9

Entra Connect reports sync errors on specific users.

Accepted Answer

1. Inspect the sync error in the health portal
2. Check duplicate proxyAddresses and UPN
3. Manually clear connector quarantine
4. Force a delta sync after fixing

When to bring us in: 
Object stuck in metaverse: clean up via support or planned rebuild, never edit the DB by hand.

Question 10

What is hybrid join and when do I want it?

Accepted Answer

1. Hybrid join via Entra Connect config
2. Service Connection Point required in AD
3. GPO to trigger automatic registration
4. Verify on the client with dsregcmd

When to bring us in: 
End goal is Entra-only: Entra-join new devices and use hybrid only for legacy.

Question 11

Should SMBv1 still be enabled anywhere?

Accepted Answer

1. Disable SMBv1 on all servers and clients
2. Inventory devices still requesting SMBv1 (old scanners)
3. Enforce SMBv2/v3 on file shares
4. Enable audit logging for outliers

When to bring us in: 
A legacy device truly needs SMBv1: isolate it on a dedicated VLAN, never the main network.

Question 12

Every department has its own mapped drives. It is chaos.

Accepted Answer

1. One logical path for all shares (\company\data)
2. Servers behind the namespace are replaceable
3. Per-site namespace targets possible
4. Document which share lives where

When to bring us in: 
Migration to SharePoint/OneDrive is coming: don't grow DFS, plan the destination.

Question 13

DFS-R is stuck or producing conflicts.

Accepted Answer

1. Run the replication health report per server
2. Check disk space and USN journal
3. Query backlog between partners
4. Clean the Conflict-and-Deleted folder periodically

When to bring us in: 
Large backlog or journal corruption: pre-seed and rebuild the replication group, not brute force.

Question 14

File server fills up with personal video and photos.

Accepted Answer

1. Quotas per share or per user
2. File screens block specific extensions
3. Soft quota for warnings, hard quota for cap
4. Email reports to admins

When to bring us in: 
Many false positives: pair screening with policy, not technology alone.

Question 15

Users see folders they cannot open and ask why.

Accepted Answer

1. Enable ABE per share, not domain-wide
2. Tidy permissions first
3. Test with a regular user account
4. Measure browse performance impact

When to bring us in: 
Very deep trees: ABE costs performance, consider restructuring.

Question 16

Share permissions and NTFS permissions tangle.

Accepted Answer

1. Share: Everyone Full or Authenticated Users
2. Drive granularity through NTFS
3. Document only the NTFS layer
4. Avoid Deny rules except very deliberately

When to bring us in: 
Unexplained access-denied: use the effective-access tool, don't reason by hand.

Question 17

A leaver's personal folder is inaccessible.

Accepted Answer

1. Work from an admin account, not the user
2. Backup or snapshot first
3. Take ownership recursively
4. Apply new perms and hand ownership to a group

When to bring us in: 
Folder with legal or audit data: log the action and the actor explicitly.

Question 18

The classic print server is hard to maintain.

Accepted Answer

1. Inventory current queues and drivers
2. Direct-IP for small offices
3. Universal Print or vendor cloud at scale
4. Bundle drivers via Intune or GPO

When to bring us in: 
Many brands and old drivers: the vendor mix is the real problem, standardise first.

Question 19

When the DHCP server is down, nobody gets an address.

Accepted Answer

1. Two Windows DHCP servers, same scope
2. Create a failover relationship
3. Pick mode: load-balance or hot-standby
4. Test by powering one off

When to bring us in: 
Large office with VoIP: DHCP outage also takes down phones; redundancy is not optional.

Question 20

External names resolve slowly from the office.

Accepted Answer

1. Forwarders to two external resolvers
2. Create reverse zone for the LAN subnet
3. Enable scavenging against stale records
4. Conditional forwarders for trusted zones

When to bring us in: 
DNS leakage or split-horizon needs: discuss design, don't just bolt on forwarders.

Question 21

VMware licensing got much more expensive, now what?

Accepted Answer

1. Inventory current VM load and features
2. Hyper-V if Microsoft stack dominates
3. Proxmox VE for open-source and low license cost
4. Migration path: P2V/V2V tools per platform

When to bring us in: 
Cluster with vSAN or NSX dependency: migration is a project, not a weekend job.

Question 22

Is a VM snapshot enough as a backup?

Accepted Answer

1. Snapshot = point-in-time on same disk
2. Backup = copy to a separate location
3. Don't keep snapshots longer than a few hours
4. Test restores regularly

When to bring us in: 
Long-running snapshots on production: snapshot bloat can crash the VM or fill the disk.

Question 23

An old physical server finally needs to become a VM.

Accepted Answer

1. Inventory dependencies and licenses
2. Test P2V on a copy, not the source
3. Remove old vendor drivers post-conversion
4. Plan enough cutover downtime

When to bring us in: 
Servers with dongles, USB licenses or special hardware: virtualisation isn't always feasible.

Question 24

Which Synology fits an SMB office?

Accepted Answer

1. Plus series for BTRFS and snapshots
2. At least 4 bays for SHR with redundancy
3. Plenty of RAM, ECC where possible
4. Plan two-disk redundancy on larger arrays

When to bring us in: 
Above 50 users and heavy media: look at XS+ or a true SAN alternative.

Question 25

Disk failed in the NAS, how long does the rebuild take?

Accepted Answer

1. Cut non-essential traffic to the NAS
2. Replace with identical or larger disk
3. Track rebuild progress in the interface
4. Take an extra backup before and after

When to bring us in: 
Second disk struggling mid-rebuild: stop, don't push through, restore from backup.

Question 26

Does a NAS really need ECC RAM?

Accepted Answer

1. Plus/XS series often offer ECC
2. Run a memory test on first install
3. Schedule BTRFS/ZFS scrubs weekly or monthly
4. Don't sneak in cheap DIMMs

When to bring us in: 
Production data or compliance: pick ECC, no debate.

Question 27

BTRFS, ZFS or ext4 for my NAS?

Accepted Answer

1. BTRFS: snapshots, checksums, common on Synology
2. ZFS: heavier but very robust, TrueNAS stack
3. ext4: simple but no integrity check
4. Mind the RAM budget, ZFS is hungry

When to bring us in: 
Migrating an existing ext4 volume: usually means recreate and copy data back.

Question 28

How do I make a second NAS site as off-site copy?

Accepted Answer

1. Second unit at another site or fire zone
2. Schedule replication outside office hours
3. Enable encryption on the replication link
4. Test restore from off-site, not just primary

When to bring us in: 
Fibre often fails on one route: ensure replication errors are monitored.

Question 29

Do I need dual-PSU servers, or is single fine?

Accepted Answer

1. Two PSUs on separate UPS or power feeds
2. Single PSU fine for edge or lab
3. Test by pulling one PSU
4. Plan PSU swaps into maintenance

When to bring us in: 
Whole rack on one feed: dual PSU helps less, split the feeds first.

Question 30

What is IPMI/iDRAC/iLO and should I set it up?

Accepted Answer

1. Dedicated management port on its own VLAN
2. Strong passwords, never the defaults
3. Update firmware regularly
4. Never expose on the internet

When to bring us in: 
Known BMC firmware CVEs: block the management VLAN externally and patch first.

Question 31

Our server room gets too warm in summer.

Accepted Answer

1. Log temperature and humidity
2. Alarm by email or SMS over thresholds
3. Hot/cold aisle even in a small room
4. Spare AC or backup cooling for summer

When to bring us in: 
No second cooling and a critical room: that's a business risk, escalate to leadership.

Question 32

UPS has been in the rack for years, still working?

Accepted Answer

1. Note UPS battery age
2. Schedule a controlled load test out of hours
3. Swap batteries every 3-5 years
4. Verify runtime under current load, not specs

When to bring us in: 
Server reboots during a short power glitch: UPS is dead, replace, don't hope.

Question 33

Windows Server 2019, 2022 or 2025?

Accepted Answer

1. 2025 for the longest support window
2. 2022 fine for stable SMB roles
3. Check vendor compatibility
4. Consider Server Core for smaller footprint

When to bring us in: 
Vendor supports only 2019: that's a risk, ask the roadmap, no wishful thinking.

Question 34

RDS server complains about licensing after 120 days.

Accepted Answer

1. Install the RDS Licensing role
2. Pick Per-User or Per-Device CALs
3. Activate the licensing server with Microsoft
4. Check availability in event log

When to bring us in: 
Wrong CAL type purchased: not solvable on the fly, back to reseller.

Question 35

WSUS is slow and painful to maintain.

Accepted Answer

1. Inventory what WSUS does now
2. Migration path to Intune update rings
3. Manage servers via Azure Update Manager
4. Decommission WSUS, don't just keep it parallel

When to bring us in: 
Many offline or isolated clients: WSUS still has a role, but plan a migration.

Question 36

Which Linux distro for a simple on-prem server?

Accepted Answer

1. Ubuntu LTS: easy on-ramp, big community
2. Debian: stable, less hand-holding
3. Rocky/Alma: for those with RHEL background
4. Avoid non-LTS releases in production

When to bring us in: 
Vendor software supports only one distro: follow the vendor, not your preference.

Question 37

How do I harden SSH on a Linux server?

Accepted Answer

1. Disable password login, keys only
2. Disable root login, sudo via regular user
3. Fail2ban against brute force
4. Port 22 only behind VPN or trusted subnet

When to bring us in: 
Server must expose SSH publicly: add MFA and strict audit logging.

Question 38

SELinux or AppArmor blocks my app, can I disable it?

Accepted Answer

1. Check audit logs for the blocking rule
2. Tweak specific booleans or profile
3. Permissive mode temporarily to diagnose
4. Return to enforcing afterwards

When to bring us in: 
Vendor tells you to disable it: ask why, escalate to vendor support first.

Question 39

We want to move our file server to SharePoint/OneDrive.

Accepted Answer

1. Inventory the current share structure
2. Tools: SharePoint Migration Tool or third party
3. Pilot with one department first
4. Train users on OneDrive sync, not as a new drive

When to bring us in: 
Many apps still write to UNC paths: keep a small file server or move to Azure Files.

Question 40

Last Exchange server is only there for attribute management.

Accepted Answer

1. Inventory locally managed attributes
2. Microsoft-recommended tooling for attribute edits
3. Mailboxes have been in M365 for years
4. Phase out, don't hard kill

When to bring us in: 
Hybrid with multiple tenants or complex routing: don't go alone, plan with support.

Question 41

Only DC is down, nobody can log in.

Accepted Answer

1. Confirm DC vs network failure
2. Cached logon still works on laptops
3. Try a clean start, no forced recovery
4. Consider rolling back the last update

When to bring us in: 
DC refuses to start: bring up a second DC or restore from backup; don't tinker for hours.

Question 42

File server is suddenly 100% full.

Accepted Answer

1. Identify largest folders quickly
2. Temporarily clean where safe
3. Inspect log folders and old backups
4. Set quota or file screen to prevent repeats

When to bring us in: 
Volume keeps filling despite cleanup: an app writes stubbornly, bring in the vendor.

Question 43

RAID reports a degraded disk, what's the right order?

Accepted Answer

1. Identify the right physical slot via management tool
2. Verify backup status first
3. Hot-swap per vendor procedure
4. Monitor rebuild until fully green

When to bring us in: 
Multiple disks degraded simultaneously: stop, don't keep swapping; could be backplane or controller.

Question 44

After a Windows update a Hyper-V VM lost networking.

Accepted Answer

1. Check the host virtual switch
2. Re-attach the VM NIC to the switch
3. Verify physical NIC driver
4. Rollback the update as last resort

When to bring us in: 
Cluster host with multiple VMs offline: activate failover role, don't start with single-host triage.

Question 45

Windows Server 2012 or 2012 R2 still in production and out of support

Accepted Answer

1. Inventory what runs on it: role, app version, users, integrations
2. File server: migrate to SharePoint, OneDrive, or a fresh Windows Server
3. Legacy LOB app: ask the vendor whether it runs on Server 2022 or 2025, or plan replacement
4. AD: do not just demote a DC, plan FSMO move, replica build, decommissioning, in order

When to bring us in: 
For apps from vendors that no longer exist, while you stay on 2012, segment the server network-wise and pull it off the internet. Accept it as temporary and log it.

Question 46

Migrating on-prem Hyper-V to Azure, where to start

Accepted Answer

1. Run an Azure Migrate assessment to see VMs with SKU recommendations and cost
2. Build VNet, subnets, VPN or ExpressRoute before migrating, not after
3. Test a non-critical VM first, validate DNS, app sign-in, backup
4. Cut over one by one in maintenance windows, not everything at once

When to bring us in: 
On Windows licensing, Azure Hybrid Benefit saves a lot, but only with SA licenses. Check that before migrating, otherwise you pay double.

Question 47

Synology or QNAP for an SMB NAS choice

Accepted Answer

1. Synology: steadier updates, strong Active Backup for Business, restricted to own disks
2. QNAP: more hardware per euro, more apps, historically more ransomware on internet-exposed units
3. Do not put a NAS directly on the internet, regardless of brand, use VPN or a reverse proxy with MFA
4. Plan two-disk redundancy and an off-site backup, not single-disk in a Plus unit

When to bring us in: 
Above 30 users with heavy use (video, photo), pick XS+ (Synology) or TS-h Enterprise (QNAP), or move to a real file server.

Question 48

NAS disks have been spinning for years, no idea when to replace

Accepted Answer

1. Read power-on hours and SMART attributes via the NAS UI or smartctl
2. Plan proactive replacement from four to five years of power-on, not at failure
3. Replace in batches, and intentionally vary suppliers or batches on the new ones
4. Keep a hot spare on the shelf, a Sunday-evening rebuild with nothing to swap in is not a plan

When to bring us in: 
Multiple disks throwing SMART warnings at once: stop writing and restore from backup onto a fresh array. Pushing through a rebuild on a wobbly array is how you lose everything at once.

Question 49

Server lives in the utility cupboard, gets weird in summer

Accepted Answer

1. Measure temperature over a week with a cheap datalogger, not once with a thermometer
2. Keep the room below the vendor ceiling (often around 27 C), with margin in summer
3. Put a UPS in front, with monitoring that mails or Slacks when the battery ages out
4. Move the server to a lockable, ventilated room, or replace it with a cloud equivalent

When to bring us in: 
No ventilation option and no cooling budget: that is usually the signal to move toward Microsoft 365 plus Azure Files or a hosted server, not to bolt an AC into the meter cupboard.

Question 50

File server is out of warranty, replace or move to cloud

Accepted Answer

1. Calculate true cost per year: hardware depreciation, licences, backup, admin
2. Compare to SharePoint plus OneDrive or an Azure Files share, including one-off migration work
3. Add the extras: 24/7 failover, off-site backup, and what an outage now costs in productivity
4. Make a plan with cutover date, parallel period, and a date when the old box goes off

When to bring us in: 
For apps that lean on SMB paths or NetBIOS names, refactoring those is often more work than the server itself. Plan it as a separate project.

Question 51

ESXi licence expiring or upgrade path unclear after the Broadcom acquisition.

Accepted Answer

1. Inventory current edition and socket or core count
2. Ask your reseller in writing for upgrade path and final price
3. Compare against Hyper-V or Proxmox as a migration option
4. Plan renewal at least a quarter ahead

When to bring us in: 
Quote balloons beyond your scale: work out a Hyper-V or Proxmox migration seriously, not at the renewal deadline.

Question 52

What do we do with Windows Server 2019 heading to 2029?

Accepted Answer

1. List every 2019 server and its role
2. Per role decide: replace with 2022 or 2025, or move to cloud
3. AD, file and print last, easy roles first
4. Budget replacements spread over multiple years

When to bring us in: 
Anything older than 2019 still running (2012 R2, 2016 out of support): set a hard cutoff instead of endless delay.

Question 53

After a power outage the server boots but a VM or database is corrupt.

Accepted Answer

1. Verify the UPS agent talks to the hypervisor or host
2. Test scheduled shutdown by simulating power loss
3. Battery runtime must cover shutdown time with margin
4. Check RAID controller cache battery yearly

When to bring us in: 
Storage corrupt after every dip: write-cache without a battery-backed unit (BBU), do not rely on the UPS alone.

Question 54

I want tougher password rules for admins than for normal users.

Accepted Answer

1. Open Active Directory Administrative Center, browse to your domain, System, Password Settings Container.
2. Create a new Password Settings object, set precedence (lower wins) and link it to a group such as Tier-0 Admins or Service Accounts.
3. Pick sensible values: 14 to 16 character minimum for admins, drop complexity rules that push users toward Pa$$w0rd1, lockout threshold that stops brute force without flooding the helpdesk.
4. Test with a sample account in the target group: open a fresh session, try a too-short password, and confirm with dsget user -effectivepso that the PSO actually wins.
5. Document which group has which PSO, otherwise nobody remembers why one account follows different rules.

When to bring us in: 
Pair this with a ban on known leaked passwords. Microsoft Entra Password Protection can enforce that on-prem too, via a proxy and agent on your DCs.

Question 55

A setting on a workstation is wrong and I cannot tell which GPO wins.

Accepted Answer

1. On the affected PC run gpresult /h c:	empsop.html /scope both and open the report.
2. Find the setting, see which GPO is 'Winning GPO' and which other GPOs attempted to set it.
3. In Group Policy Management verify the scope: linked at the right OU, security filtering correct, WMI filter not unintentionally blocking.
4. If user settings fail to land on a terminal server, check loopback processing mode (Replace or Merge) on the computer object's OU.
5. Change one variable at a time, run gpupdate /force, reboot if the setting only applies at logon, and retest.

When to bring us in: 
If the Winning GPO is correct but the effect is missing on the PC, suspect client-side extensions not running, a stopped Group Policy Client service, or a corrupt registry.pol.

Question 56

Everyone has access to everything on the file server and no-one knows why anymore.

Accepted Answer

1. Run a report with AccessChk or a tool like FileAuditor: which shares have Domain Users, Authenticated Users or Everyone in their ACL?
2. Define a role-based model: a security group per department or project, no more loose user permissions on folders.
3. Work top-down: parent folders get only the department group, sub-folders only where it must differ. Avoid deep ACL pyramids.
4. Plan an audit window per department with the team lead: who belongs here, who left, and what the exceptions are.
5. Enable Access-Based Enumeration so users no longer see folders they cannot enter, which kills support questions.

When to bring us in: 
With hundreds of thousands of files or complex history a tool like Varonis or Netwrix pays off. That gets expensive fast, so first see if hygiene can be repaired with Microsoft-native means.

Question 57

We want to switch between Hyper-V and VMware, how do I approach this?

Accepted Answer

1. Inventory per VM: OS, disk size, generation (Gen1/Gen2 on Hyper-V), UEFI or BIOS, integration services and hypervisor-specific drivers.
2. Remove hypervisor tools before migrating: uninstall VMware Tools when leaving VMware, uninstall Hyper-V Integration Services when leaving Hyper-V. Otherwise expect BSODs or missing network.
3. Pick a method: a Veeam restore to the other hypervisor is cleanest for most SMB environments, Starwind V2V is free for small batches, VMware vCenter Converter still works towards VMware.
4. Test with an unimportant VM first, fix driver and boot issues (UEFI vs BIOS, disk controller driver) and document the recipe.
5. Schedule production VMs in maintenance windows with a rollback path: keep the source VM powered off but preserved until the target runs cleanly for at least a week.

When to bring us in: 
For domain controllers, clusters or Exchange/SQL with strict downtime needs, review the architecture before converting. Sometimes building a new VM and migrating data is faster and safer.

Question 58

A VM has had a snapshot for months and is now slow or corrupt.

Accepted Answer

1. Before anything else, take a Veeam or equivalent backup of the VM in its current state. Merging a snapshot can fail.
2. Inventory the chain: in VMware via Snapshot Manager or the folder with -delta files, in Hyper-V via Get-VMSnapshot and the .avhdx files.
3. Plan a maintenance window, gracefully stop applications if the VM runs a database, then start the consolidation or snapshot delete.
4. Watch the merge: in VMware it can take hours with large deltas, in Hyper-V it merges automatically on delete. Do not reboot halfway.
5. After consolidation: re-check the VM (chkdsk on Windows, fsck on Linux), test the application, and keep the backup until you are certain everything is good.

When to bring us in: 
If the merge fails due to disk corruption or a full datastore, restore from the pre-merge backup to a new VM and pick up from there. Do not keep retrying on a shaky chain.

Question 59

My Veeam job has been failing for a few nights and I keep postponing the investigation.

Accepted Answer

1. Open Veeam, click the failed job, read the Sessions log: note where it breaks (VSS, snapshot, transport, target).
2. Check the basics: Veeam Service running, repository >15% free, guest credentials still valid (no expired password).
3. VSS errors on the guest: inside the VM run Get-VssWriter, restart the problematic writer (Volume Shadow Copy, COM+, sometimes SQL writer). On Linux: check fsfreeze or the application-aware snapshot config.
4. Repository issues: verify the service account rights on the share or local path, check antivirus exclusions for .vbk/.vib files.
5. Run an Active Full if the incremental chain is corrupt. Do not hope it fixes itself tomorrow.

When to bring us in: 
If you see repeated 'Storage failure' or bitrot symptoms in Veeam, run a SureBackup or a manual restore test to a sandbox. Trusting a green tick is not a backup.

Question 60

We have been hit by ransomware and need to restore from immutable backup.

Accepted Answer

1. Disconnect the infected environment from the network, including backup paths. The backup server is a primary target, so verify it is clean before restoring anything.
2. Build a clean restore bubble: new VLAN or isolated host with fresh hypervisor and OS, no connection to production AD or the internet.
3. Identify the last clean backup: check the modify times on .vbk/.vib, compare with the encryption moment, take a week's margin.
4. Restore the domain controller and core infrastructure first, scan restored VMs with an EDR before exposing them, reset all passwords and rotate KRBTGT twice with an interval.
5. Only then bring back user VMs and data step by step, prioritised by the business: what must run tomorrow, what can wait a week.

When to bring us in: 
With ransomware always notify the Dutch DPA (data breach) and the police. A specialised DFIR firm prevents mistakes, even at cost. Do not negotiate with attackers yourself.

Question 61

An AD trust between two domains stopped working and users cannot access resources.

Accepted Answer

1. On a DC on each side run nltest /sc_query:OTHERDOMAIN and netdom verify /domain:OTHERDOMAIN. Read the exact error code.
2. Check DNS: forward and conditional forwarders must work both ways, plus reverse zones. Test with nslookup -type=SRV _ldap._tcp.dc._msdcs.OTHERDOMAIN.
3. Firewall check: ports 88 (Kerberos), 389 and 636 (LDAP), 445 (SMB), 3268 (Global Catalog) and the RPC range must be open between DCs.
4. Reset the trust password if everything else looks fine but Kerberos complains: netdom trust /domain:OTHERDOMAIN /resetonewaytrustpassword (both directions, a few minutes apart).
5. Test with a test account from the other domain against a share or PC, and check Event Viewer (System and Security) on both DCs for Kerberos and NTLM events.

When to bring us in: 
In a merger or acquisition where the other side is not under your control, gather logs and involve both AD teams. Trust troubleshooting without access to the other side is almost always a dead end.

Question 62

Our WiFi auth via NPS/RADIUS is dead and nobody can get on the network.

Accepted Answer

1. On the NPS server: confirm Network Policy Server service is running, open Event Viewer custom view 'Network Policy and Access Services', read recent events.
2. Common causes: NPS certificate expired (PEAP/EAP-TLS rely on it), shared secret mismatch between AP and NPS, lost AD connectivity or LDAP rights.
3. Test directly with a test account: ntradping or a similar tool against NPS, do not keep guessing over WiFi. At AP level: test page or debug logs.
4. Are RADIUS clients (the APs) still registered correctly? Open NPS console, RADIUS Clients, check IP and shared secret per AP.
5. After recovery, deploy a second NPS on a separate server, configure it as secondary in the AP setup, and schedule certificate rotation well before expiry.

When to bring us in: 
For larger environments or multiple SSIDs with different policies, consider ClearPass, FortiAuthenticator or a cloud RADIUS. Redundant by design with audit logs.

Question 63

What are the basics for DNS on a Domain Controller?

Accepted Answer

1. A DC never points only to itself for DNS. Prefer: primary = another DC, secondary = self, or in a single-DC setup primary = self but plan the second.
2. Clients and servers point only to internal DCs for DNS, never to 8.8.8.8 or ISP DNS. External resolution goes through forwarders on the DCs.
3. Use Active Directory Integrated zones so replication runs automatically, avoid leaving static zones on a single server.
4. Create reverse zones for the subnets in use, otherwise many security tools and logs fail on name resolution.
5. Enable aging and scavenging so stale records (laptops that no longer exist) get cleaned up, otherwise duplicate and wrong A records pile up.

When to bring us in: 
With split DNS (same domain name internal and external): document which records are overridden internally, otherwise two years later a mail route mysteriously disappears.

Question 64

Kerberos errors or clock skew, time is no longer in sync on the DC.

Accepted Answer

1. Identify the PDC emulator: netdom query fsmo. On that DC, w32tm /query /status must show an external NTP source, not 'Local CMOS Clock'.
2. Configure correctly on the PDC: w32tm /config /manualpeerlist:'pool.ntp.org 0x9' /syncfromflags:manual /reliable:yes /update, then w32tm /resync.
3. Other DCs and members sync automatically with the PDC. Verify with w32tm /monitor or w32tm /query /source: should never be 'CMOS Clock' on a member.
4. On virtual DCs disable Hyper-V/VMware tools time sync, otherwise it fights Windows Time. Only Windows Time should set the clock.
5. Re-test after a few hours and after the next reboot. Time issues sometimes return after a restart.

When to bring us in: 
With persistent host time drift (dead CMOS battery, old hardware) replacing or upgrading the host is unavoidable. Software cannot fix dying hardware.

Servers and on-premise