you didn't get signed in. It might be your sign-in adress or logon credentials. so try those again. if that doesn't work, contact your support team

Few days ago I came across an issue in my organization that some lync clients were unable to login. their client prompting for credentials again and again.  I have Lync Server 2010 environment.
If any user Lync client prompting for password and not connecting then first

(1)                Check network connectivity.


If the network connectivity is fine then go to  the following locations, delete the “Communicator” folder and restart the system.


(1)    "C:\Users\user\AppData\Local\Microsoft"

(2)    "C:\Users\user\AppData\Roaming\Microsoft"

(3)    “C:\Users\user\AppData\LocalLow\Temp\Microsoft”
If still the issue not resolved then make sure that the above "communicator" folders or delete and reinstall the lync client on their system.


for further investigation go to cmd and check that from where this client system is authentiacted. go to that DC and check this user lastlogon time, through "net user userid"
also check client and dc time due to time may also this issue occure.

How to apply screen saver through group policy in Active directory 2008 R2 Domain

Applying screen saver is an easy task you only have to apply the following steps.

Please be care full that your screen saver file is not a big one as it may chock your network if it have a big size and users system start to download at the same time.

(1) You have to create your screen saver *.scr file (DomainScreensaver.scr). you need tool to create .scr file.

now place this "DomainScreensaver.scr"  in a folder like "\\servername\foldername" share it. on sharing tab add everyone and give read permission.

on security tab add everyone and give (read and execute, list folder contents, read) permissions.

 

(2) You also have to create your logon script so while a user logging to his/her system the screen saver file (DomainScreensaver.scr) will be downloaded to user system. For which you have to create the .bat file

How? (open notepad file and type

 

md "C:\ScreenSaver"

xcopy \\servername\foldername\DomainScreensaver.scr C:\ScreenSaver

 and save this file as Screensaverphoto.bat

It will download the content(DomainScreen saver.scr) from share location i.e \\servername\foldername to user’s system C:\screensaver.

 (3) share the folder (\\servername\foldername) which contain the screen saver(Screensaverphoto.bat) and give read rights to everyone on this folder.

 

Now you are going to create/configure GPO, So follow these steps

(1) Start à Group Policy Management.

(2) Create a group policy “SS Client”.

(3) Right click on it and select Edit.

(4) Go to user configuration windows settings à Scripts (Logon/logoff)

(5) Double click on logon à show files—go to screensaverphoto.bat file location.

New kept this location/folder ( \\domain.com\sysVol\domain.com\{FD692A-----}\User\Scripts\Logon )   open.

(6)

Go to the location where you have created “screensaverphoto.bat” file and right click on this file and select copy. now close this folder and go above location (mentioned in step 5) and past it there (\\domain.com\sysVol\domain.com\{FD692A-----}\User\Scripts\Logon )

(7) Now go to Logon properties window and click on Add button

And select the “Screensaverphoto.bat” file.

And click OK.

(8) Now go to User configuration à Administrative templates

Control panel à Personalization

(a) Click on Enable Screen Saver and select Enabled.

 

(b) Click on Password protect the screen saver and select Enabled.

(c) Click on Screen saver timeout select Enabled and mention time like seconds 90 etc.

(d) Click Force Specific screen saver C:\screensaver\DomainScreensaver.scr (it will copy screensaver on this location on client system)

Now your GPO is ready, so you need to apply it.
Go to the desired OU in Group policy management and right on that OU.
select link an existing GPO and select "SS Client" GPO and click OK.
you can also enforce etc.

And that's it. Done

Troubleshooting.
you can check on any client screen saver is not applying.
(1) you can use GPresult /r to check that the GPO is applied or not
(2) you can use rsop.msc to check that which settings are applied on your client system.
(3) to check that the screen saver file is downloaded to client system or not go to location (C:\screensaver) that screen saver file is downloaded or not.
(4) you can run the command (xcopy \\servername\foldername\ C:\ScreenSaver) that it is working fine or not.
(5) Command GPresult with different switches will also help to troubleshoot
(6) if you have accessed a system with RDP, then you may be unable to see the Screen saver. So will be better to check on a system on which you have logged in locally. 

How to find NTP server in your Active directory domain

Use the following command from any domain joined server/client. you will receive out put like bellow

C:\Users\user>w32tm /monitor
DC02.domain.local[10.255.5.7:123]:
    ICMP: 9ms delay
    NTP: +0.0466250s offset from DC.domain.local
        RefID: DC.domain.local [10.255.24.10]
        Stratum: 2
ADC01.domain.local[10.192.10.15:123]:
    ICMP: 14ms delay
    NTP: -0.0239011s offset from DC.domain.local
        RefID: DC.domain.local [10.25.2.12]
        Stratum: 2
DC02.domain.local[10.11.20.7:123]:
    ICMP: 17ms delay
    NTP: +0.0111994s offset from DC.domain.local
        RefID: DC.domain.local [10.25.20.12]
        Stratum: 2
DC03.domain.local *** PDC ***[10.20.58.40:123]:
    ICMP: 3ms delay
    NTP: +0.0000000s offset from DC03.domain.local
        RefID: DC03.domain.local [10.255.240.102]
        Stratum: 2

In above out put the red highlighted DC is your NTP server, from which your all DCs getting time.

and DC03 is your PDC, from which all other DCs sync their time, is your main source of time, you should care about DC03 time, if its time got incorrect then all other DCs and client will also get the wrong time. So PDC should be a reliable and will be better if it is a physical machine. per my experience the Virtual machines don't have reliable clock. 

The trust relationship between this workstation and the primary domain failed(resolved)

The "the trust relationship between this workstation and the primary domain failed" occurs

(1) If you are trying to login with any computer that has not connected to your domain since long time

(2) You have multiple domain controllers and have replication issues between them.

(3) one of your domain controllers is down currently which has the password of this computer object.

 If you resolve the replication issue, then you should not face this error anymore.
How to resolve?
First run the following command on effected computer facing above error.
nltest /dsgetdc:domain.local

it will show you that on which domain controller your system is trying to be authenticated at the moment, as you have multiple domain controllers.
 Now go to that Domain controller and check the password reset date of this effected computer

As below:

(Go to AD user and computer and from view select Advance feature and search the effected system object and note its path/location where it is placed and then go on that path/location and right click on the effected computer object and go to its properties and then attribute editor tab and there you will find the pwdLastSet attribute).
it will show you that when the password of this computer object was set.
most probably it will be an old date.

now you have to reset the password of this computer object through the following command, should be run from that effected computer.(if you can not login with domain user then can login with any local users)

netdom resetpwd /s:DomainControler1 /ud:domain\user1 /pd:*

 

The above command will reset the password of the effected computer and will replicate to the domain controller.

Note:- on client OS (Windows 7 etc) you have to install remote server administration tools, otherwise you will receive an error while running the above command.

Now restart this affected computer and try to login with domain user it should login now without any error.

Enable user for Lync through Lync power shell command

Some time you trying to enable an account for lync that have ever admin rights and you receive the following error in lync control panel.

Active directory operation failed on "Domai.controler". you cannot retry this operation: "insufficient access rights to perform the operation 00002098: secErr: DSID-0315bb9. problem 4003 (INSUFF ACCESS RIGHTS). data 0)"

To resolve this issue you have to enable this account through lync power shell using the following command.

C:\users\administrator> Enable-CsUser "user1" -SipAddressType EmailAddress -SipDomain domainname.com -RegistrarPool "lync.com.local"
 

How to show last password reset date of users in an OU in active directory 2008 R2

How to show last password reset date of users in an OU in active directory 2008 R2.

get-aduser -searchbase "OU=ouname,OU=ouname,DC=domainnaem,DC=domainname" -Filter * -Properties passwordlastset | FT passwordlastset,UserPrincipalName >C:\store\MT.csv

How to export the value of specific fieled of user property in active directory 2008 r2

How to export the value of specific field in of a user property in active directory 2008 r2

get-aduser -searchbase "OU=ouname,OU=ouname,DC=domainname,DC=net" -Filter * -Properties thumbnailPhoto | FT thumbnailph

oto,UserPrincipalName >C:\store\abc.csv