Active Directory Rights Management Services - Parallels Upgrade

Description:
You have an Active Directory Rights Management Services (ADRMS) being deployed in your IT Environment. You need to upgrade the version of ADRMS, the Windows OS, and also the Database with minimal downtime and minimal risk to new Windows 2019 and SQL 2019 machines.
You decided to do a Parallel Upgrade.

Resolution:

You would need to perform the following:

1. Prepare the new Windows 2019 OS and SQL 2019 Databases on different machines. Install all the necessary patches.
2. Back up the existing AD RMS database.
3. Restore the AD RMS databases to a new location (new instance, new SQL server, etc.).
4. The following SQL changes must be made on the restored databases.
• Database: DRMS_Config
• Table: DRMS_ClusterPolicies
• PolicyName entries in which the PolicyData value needs to reflect the new SQL connection string information.
• LoggingDatabaseServer
• CertificationUserKeyStorageConnectionString
• DirectoryServicesCacheDatabase
5. Built a new Windows Server of the desired version for the AD RMS cluster upgrade.
6. Add the AD RMS role.
7. When it gets to the role configuration choose the “join an existing cluster” option.
8. At the SQL database dialog enter the NEWLY RESTORED SQL database location, not the actual production database currently in use.
9. Complete the role configuration using all the same settings, service accounts, etc.
10. Edit the NTFS permissions on new AD RMS server's "C:\inetpub\wwwroot\_wmcs\certification\ServerCertification.asmx" file. Configure the same permissions as on the existing AD RMS server.

PowerShell Command to Identify Local Admin Account

Description:

You have several local account on your computer. One day, you need to find out which one is the real local Admin Account.

Resolution:

You can run the following PowerShell command on the local computer:

Get-CimInstance -ClassName Win32_UserAccount -Filter "LocalAccount = TRUE and SID like 'S-1-5-%-500'"

Cannot Publish or Missing Certificates Template

Description:

You created a certificate template in your Windows Enterprise CA. However when you want to publish it, you cannot saw the templates inside the "Enable Certificate Templates" wizard. All other Certification Authority function works normally and you've used the account which has proper permission.

Resolution:

Try to use the following command:
Certutil -setcatemplates +templatename

Note: The plus (+) sign is mandatory. Otherwise it will replace all of the other published template.

Error while creating Windows 2016 Cluster at "Find a suitable Domain Controller"

Description:

You want to create Windows 2016 cluster on Windows 2012 R2 Domain. You run the Wizard, however encountered error and the cluster cannot be created. 

During investigation, you saw several error message such as:
"Check whether the computer object "clustername" for node "hostnameFQDN" exists in the domain. More data is available".

At event viewer (after enabling Debug Log) you could see:
"Failed to find suitable DC. Error 234"
"Searching for object "clustername" on first choice DC failed. Error 234"
"Couldn't resolve RPC binding to cluster, Status = 1753"

You then try to run the Cluster Validation wizard but everything seems to pass. You validated that the required AD permission for the User Account creating the Cluster are already meet. You also verify the Group Policy setting for "Deny Access to this computer from the Network" is correct. You check the network port requirement and verify all the necessary port are open.

Resolution:

First, verified the DNS record in your DNS Server. Especially the record for all of your Domain Controllers. Make sure the Active Directory required Zones has the correct NS records, CNAME records, A Records, and also SRV DNS records. Remove the stale records for old or unknown broken Domain Controllers.

Second, check the Application partition (DomainDnsZone and ForestDnsZone) in your Active Directory. Use ADSIedit to connect to the application partition and try to browse the content. If you encountered error, you may need to delete the application partition using NTDSUtil.

You should be able to create the Windows Cluster afterwards.

Error Event ID 345 on ADFS Server

Description:

You recently just upgraded your ADFS to newer OS version. After a while you notice Event ID 345 on one of the secondary ADFS server. It said "There was a communication error during AD FS configuration database synchronization. Synchronization of the data from primary federation server to a secondary federation server did not occur". You are sure that all of the network port requirement are met.

Resolution:

The previous ADFS upgrade process is somehow causing the farm behavior level (FBL) on the secondary server doesn't match with the FBL on the primary server.

We need to remove the ADFS role and WID database feature on the problematic secondary ADFS server. After that try to re-install the ADFS role and finish the post configuration. 

The secondary server will then use the correct version of ADFS configuration database and synchronization will works as expected.