Trace KFSO doesn't work in external trust across Active Directory and Windows DNS
Microsoft states: “This article discusses a situation where Kerberos Forest Search Order (KFSO) doesn’t work in an external trust.”
Read the guideDSE security knowledge hubNetworks & Infrastructure
Networks & Infrastructure
Knowledge
Page 118 of the DSE Networks & Infrastructure knowledge center, with source-backed guidance and practical next steps.
DSE-authoredOfficial sourcesReviewed guidance
Search the library Explore this topic
Start with the cornerstone guide Networks & Infrastructure knowledge center
Guidance for resilient networks, Wi-Fi, firewalls, cabling, power, exposure reduction, and connected-device planning.
DSE post stream
1,594 articlesNetworks & Infrastructure
Review LDAPS connection fails with event ID 36884 before AD/DNS changes
Microsoft states: “This article introduces how to troubleshoot the event ID 36884 issue that occurs when you try to build a Lightweight Directory Access Protocol (LDAP) connection.”
Read the playbook
Scope AuditPol and Local Security Policy results may differ in observed AD/DNS state
Microsoft states: “This article helps fix an issue where audit policy settings with AuditPol and the Local Security Policy (SECPOL.msc) show different results.”
Read the briefing
Validate Configure an authoritative time with AD/DNS evidence
Microsoft states: “This article describes how to configure the Windows Time service and troubleshoot when the Windows Time service doesn’t work correctly.”
Read the checklist
Stage A newly promoted domain controller may fail to advertise after completion of DCpromo with AD/DNS rollback checks
Microsoft states: “This article describes an issue where a newly promoted domain controller fails to advertise after completion of DCpromo.”
Read the explainer
Trace This page can't be displayed across Active Directory and Windows DNS
Microsoft states: “This article provides a solution to an error when you try to access an application on a website that uses AD FS 2.0.”
Read the guide
Review Find servers that hold FSMO roles before AD/DNS changes
Microsoft states: “This article describes how to find the servers that hold the Flexible Single Master Operation (FSMO) roles in a forest.”
Read the playbook
Scope w32tm /resync command fails with "The computer didn't resync because no time data was available." in observed AD/DNS state
Microsoft states: “This article provides several possible solutions to an error that you may get when you run the w32tm /resync command to synchronize time with a time source.”
Read the briefing
Validate LDAP to Active Directory is disabled with AD/DNS evidence
Microsoft states: “This article provides some information about the issue that anonymous LDAP operations to Active Directory are disabled on domain controllers.”
Read the checklist
Stage How to Turn on Debug Logging of the LDAP Client (Wldap32.dll) with AD/DNS rollback checks
Microsoft states: “This article describes how to turn on debug logging of the LDAP client (Wldap32.dll).”
Read the explainer