{"id":10663,"date":"2025-12-19T13:35:10","date_gmt":"2025-12-19T18:35:10","guid":{"rendered":"https:\/\/stevepedwards.today\/DebianAdmin\/?p=10663"},"modified":"2025-12-25T15:38:14","modified_gmt":"2025-12-25T20:38:14","slug":"incoherent-hints-post-for-hyperv-setup-of-server2022-win10-and-win11-subnet","status":"publish","type":"post","link":"https:\/\/stevepedwards.today\/DebianAdmin\/incoherent-hints-post-for-hyperv-setup-of-server2022-win10-and-win11-subnet\/","title":{"rendered":"Notes for HyperV Setup of Server2022, Win10 and Win11 Subnet"},"content":{"rendered":"
<\/div>\n

<\/path><\/svg><\/i> \"Loading\"<\/p>\n

<\/div>\n

Server2022 Hyper V Setup:<\/strong><\/p>\n

You can easily see the IP Addresses of each VM at the screen bottom of Hyper V:<\/p>\n

net start vmms<\/p>\n

You can turn on all VMs from the Host with:<\/p>\n

Get-VM<\/span> | Where-Object<\/span> {$_<\/span>.State -eq<\/span> 'Off'<\/span>} | Start-VM<\/span><\/span><\/p>\n

3 x VMs IP addresses<\/p>\n

<\/p>\n

<\/p>\n

<\/p>\n

Host laptop settings to enable VMs internal LAN and Shared Laptop WiFi for Inet<\/p>\n

<\/p>\n

The Default Switch needs to be auto to get a useless APIPA address, as it cannot be disabled or deleted from the host, or used as it generates a different IP address on reboots of set static due to win internal NAT functions.<\/p>\n

<\/p>\n

The HyperV New Default Switch does not have NAT functions so will retain static Ips on reboot. X.x.x.34 is the server2022 IP for DNS from the server.<\/p>\n

<\/p>\n

The laptop WiFi is gets DHCP from the router and is shared with the Inet Bridge:<\/p>\n

<\/p>\n

This shared adaptor allows the Internal VM LAN to access the Internet.<\/p>\n

<\/p>\n

Each VM has the Default Switch (NAT) replaced with an adaptor renamed Inet Bridge to allow all the VMs to connect.<\/p>\n

<\/p>\n

Server settings:<\/p>\n

<\/p>\n

<\/p>\n

Win10 Ips:<\/p>\n

<\/p>\n

Tips for your \"Gold Master\" Backup<\/strong><\/p>\n

Before you zip up those VHDX files or export them, here is a quick \"pre-flight\" check to ensure your backups are as small and stable as possible:<\/p>\n

    \n
  • Empty the Trash:<\/strong> Empty the Recycle Bin on all three VMs.<\/li>\n
  • Check DNS one last time:<\/strong> Make sure Win10VM and Win11VM still have their Host (A) records in the SBS DNS Manager after the reboot.<\/li>\n
  • The \"Export\" Method:<\/strong> Instead of just copying the .vhdx files, consider using the Export<\/strong> function in Hyper-V. This packages the VM configuration (RAM, CPU, and Virtual Switch settings) along with the disk, making it much easier to \"Import\" if you ever have to move to a new host laptop BUT it can disrupt the VM folders by creating nests of double drives as it doesn\u2019t seem to merge with the folders already there?<\/li>\n
  • Just save the VMs folder in a backup drive. Easier. If the Default Switch is used, with static Ips set, Windows usually resets these back to internal DHCP values to suit the NAT function. If you want to retain static setting you need to add a New Default Switch, which does not use NAT to save settings and leave the Default Switch set auto for DCHP which will give it an APIPA neutral address so be useless.<\/li>\n<\/ul>\n

    PS> shutdown \/s \/t 0<\/p>\n

    Using this command via CMD actually bypasses the Shutdown Tracker window entirely.<\/p>\n

    Server 2022: The L1 \"First Login\" Workflow<\/p>\n

    When you first land on the desktop, Server Manager will launch automatically. Here is your L1 checklist to get the lab \"production-ready\":<\/p>\n

    Local Server Configuration (The L1 Basics)<\/p>\n

    Click Local Server on the left. This is your \"Dashboard\" for the physical (or virtual) box.<\/p>\n

      \n
    • Time Zone: Ensure this is correct. If the server time is more than 5 minutes off from the workstations, Active Directory login will fail due to Kerberos security requirements.<\/li>\n
    • Remote Desktop: By default, it's Disabled. An L1 task is often \"Enable RDP so the admins can get in.\" Click \"Disabled\" and toggle it to \"Allow remote connections.\"<\/li>\n<\/ul>\n

      <\/p>\n

      Note Protocol (not a port! = Any, as it is an App level connection, not OSI 3)<\/p>\n

      <\/p>\n

      I set a Share so it is visible on the network. Noticeable difference in GUI ops speed over Win11 VM! <\/p>\n

      Set a static IP \u2013 server has to have one to have green boxes \u2013 no incorrect configs.<\/p>\n

      ?? L1 Scenario: \"I can't ping the new server!\"<\/p>\n

      This is a classic ticket. By default, Windows Server 2022 has the Advanced Firewall locked down tight. It won't even respond to a PING (ICMP).<\/p>\n

        \n
      • The L1 Fix: 1. Go to Server Manager > Tools > Windows Firewall with Advanced Security.<\/li>\n<\/ul>\n

        2. In Inbound Rules, find File and Printer Sharing (Echo Request - ICMPv4-In).<\/p>\n

        3. Right-click and Enable Rule.<\/p>\n

          \n
        • \n
            \n
          • Now your host machine should be able to \"see\" the VM on the network.<\/em><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n

            <\/p>\n

            Visible in Network, but can\u2019t share yet without Users\/Computers etc added:<\/p>\n

            <\/p>\n

            Server 2022 looks and feels very much like Windows 10\/11, so you won't feel lost. The main difference is that everything is \"Role-Based.\" You don't just \"install an app\"; you \"Add a Role.\"<\/p>\n

            <\/p>\n

            Promotion to a Domain Controller: For the first in a new domain, 3rd<\/sup> option \u2013 Add new forest!<\/p>\n

            <\/p>\n

            <\/p>\n

            <\/p>\n

            <\/p>\n

            <\/p>\n

            <\/p>\n

            <\/p>\n

            ? The \"Nested\" Network Flow<\/p>\n

              \n
            1. The VM Level (172.27.176.x): Both your Server (.34) and Win11 VM (.35) live in this internal \"NAT Bubble\". For this to happen there needs to be 1 HyperV switch set to Internal;<\/li>\n<\/ol>\n

              Explain the NATd LAN for the VMs\u2026it complicated as a Default Switch in HyperV uses NAT, bound to the Host Lan Adaptor, but a New Virtual Switch does not use NAT, apparent later\u2026<\/p>\n

              <\/p>\n

              <\/p>\n

              Each Net adaptor for each VM is also a default switch, set to the same static IP values that the Ghost DHCP gives it at first boot with IP6 unclicked to see IP4 addresses in IPCONFIG, so that it\u00b4s default gateway is the Hyper V 172.x.x.x network, DNS set to the server IP with 8.8.8.8 secondary. It should be able to ping the 192.168.1.1 wifi router due to NAT across the host Win11 net adaptor.<\/p>\n

              BUT this all changes later to get around not being able to change or disable the default switch in the host by adding 2 adaptors to each VM \u2013 one a New Default Switch to enable the internal LAN bubble, the other as a gateway through the host, using metric weighting and unusual IP4 static settings\u2026its complicated!<\/p>\n

              Enhanced session bug in my host needs to be Basic, else cant login. This means no text copy between host and VMs. Duh.<\/p>\n

              <\/p>\n

              <\/p>\n

                \n
              1. The Virtual Gateway (172.27.176.1): This is the internal side of your laptop's Default Switch. It acts as the \"door\" out of the VM world.<\/li>\n
              2. The Virtualized Host NAT: Your laptop takes that 172.x traffic and \"translates\" (NAT) it into your laptop's physical IP address.<\/li>\n
              3. The Physical Level (192.168.1.x): Your laptop sends the request out via its WiFi adapter to your building's router.<\/li>\n
              4. The Gateway (192.168.1.1): The building router sends it to the ISP and out to the Internet.<\/li>\n<\/ol>\n

                Adding win10:<\/p>\n

                <\/p>\n

                Open CMD as Administrator on the Server.<\/p>\n

                Add the New Name as an Alias: Type: netdom computername Server2022.server2022.local \/add:sbs.server2022.local (This tells AD: \"I am still Server2022, but I am also going to be known as sbs.\")<\/em><\/p>\n

                Make the New Name Primary: Type: netdom computername Server2022.server2022.local \/makeprimary:sbs.server2022.local<\/p>\n

                Reboot the Server:<\/p>\n

                Shutdown \/r \/t 0<\/p>\n

                The server will now reboot and swap its identity to sbs without breaking the trust relationship.<\/p>\n

                Remove the Old Name (Optional): Once you log back in as sbs, you can clean up the old name:<\/p>\n

                netdom computername sbs.server2022.local \/remove:Server2022.server2022.local<\/p>\n

                C:\\Users\\Administrator>netdom computername sbs.server2022.local \/remove:Server2022.server2022.local<\/p>\n

                Successfully removed Server2022.server2022.local as an alternate name for the computer.<\/p>\n

                The command completed successfully.<\/p>\n

                C:\\Users\\Administrator>hostname<\/p>\n

                sbs<\/p>\n

                wont that name change affect the win 10 vm login?<\/p>\n

                Yes, it absolutely will. Because you changed the \"Boss\" of the domain's name from\u00a0Server2022\u00a0to\u00a0sbs, your Windows 10 VM is currently holding a \"membership card\" for a server that technically doesn't exist by that name anymore.<\/p>\n

                Here is exactly what will happen and how to fix it for your Sunday project:<\/p>\n

                ?? The Problem: The \"Broken Trust\"<\/p>\n

                The Win10 VM looks for the Domain Controller using\u00a0DNS\u00a0and\u00a0Kerberos.<\/p>\n

                  \n
                • DNS:\u00a0This is likely okay because the DC (sbs) updated its own record.<\/li>\n
                • Kerberos:\u00a0This is the problem. The Win10 VM has a \"Secure Channel\" established with\u00a0Server2022. Now that the server is\u00a0sbs, the Win10 machine might give you an error saying:\u00a0\"The trust relationship between this workstation and the primary domain failed.\"<\/em><\/li>\n<\/ul>\n

                  ?? How to Fix the Win10 VM<\/p>\n

                  You don't need to unjoin and rejoin the domain (which is a hassle). You can usually refresh the trust relationship using PowerShell on the\u00a0Windows 10 VM:<\/p>\n

                    \n
                  1. Log in to the Win10 VM\u00a0(If domain login fails, use the local admin: \u00a0.\\LocalAdminName).<\/li>\n
                  2. Open PowerShell as Administrator.<\/li>\n
                  3. Run this command:\u00a0Test-ComputerSecureChannel -Repair -Credential (Get-Credential)<\/li>\n
                  4. Enter your credentials:\u00a0Type\u00a0LABSERVER2022\\Administrator\u00a0and the password.<\/li>\n
                  5. Restart the Win10 VM.<\/li>\n<\/ol>\n

                    Renaming the Primary Domain Controller from Server2022 to SBS did not disrupt client workstation connectivity, as the Active Directory Forest name (server2022.local) remained constant. Client authentication and trust were maintained via existing DNS resolution within the forest.<\/p>\n

                    server2022.local - does not show up in my Network icon though has a standard share set, but if I type \\\\sbs it connects to netlogin snd sysvol foders, but not with \\\\server2022.local ?<\/p>\n

                    Why it's missing from the \"Network\" Icon<\/p>\n

                    Windows Server 2022 disables Network Discovery by default for security. To make it show up in that \"Network\" folder:<\/p>\n

                      \n
                    1. Open Services.msc (The list of background tools).<\/li>\n
                    2. Find these two services and set them to Automatic (Started):\n
                        \n
                      • Function Discovery Provider Host<\/li>\n
                      • Function Discovery Resource Publication<\/li>\n<\/ul>\n<\/li>\n
                      • Once those are running, the server \"announces\" itself to the network.<\/li>\n<\/ol>\n

                        roaming profile working for Steve, you need to set up the \"landing zone\" on the server first.<\/p>\n

                        Here is the exact order of operations on your sbs server:<\/p>\n

                        ?? Step 1: Create and Share the Folder<\/p>\n

                        You need a central location where the server will store the profile data.<\/p>\n

                          \n
                        1. Create a folder on your data drive (e.g., E:\\Profiles).<\/li>\n
                        2. Share the folder:\n
                            \n
                          • Right-click Profiles > Properties > Sharing > Advanced Sharing.<\/li>\n
                          • Check Share this folder.<\/li>\n
                          • Name the share Profiles$ (Adding the $ makes it hidden from casual browsing, which is a pro move).<\/li>\n<\/ul>\n<\/li>\n
                          • Permissions: Click Permissions and give Everyone - Full Control.\n
                              \n
                            • Note: Don't worry, the security is actually handled in the next step (NTFS).<\/em><\/li>\n<\/ul>\n<\/li>\n<\/ol>\n

                              ? Step 2: Set the NTFS Security (The \"Gotcha\" Step)<\/p>\n

                              This is where most people get the \"Temporary Profile\" error. You must set these specifically so Windows can create Steve's folder for him.<\/p>\n

                                \n
                              1. In the same Properties window, go to the Security tab > Advanced.<\/li>\n
                              2. Disable Inheritance and \"Convert inherited permissions into explicit permissions.\"<\/li>\n
                              3. Ensure the following are set:\n
                                  \n
                                • CREATOR OWNER: Full Control (Subfolders and files only).<\/li>\n
                                • System & Administrators: Full Control (This folder, subfolders, and files).<\/li>\n
                                • Authenticated Users: List folder\/Read data, Create folders\/Append data (This folder only).<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n

                                  ? Step 3: Link the Path to Steve\u2019s User Object<\/p>\n

                                  Now you tell Active Directory to use that folder for Steve.<\/p>\n

                                    \n
                                  1. Open Active Directory Users and Computers.<\/li>\n
                                  2. Find Steve (the domain user, not the local\/Hotmail one).<\/li>\n
                                  3. Right-click Steve > Properties > Profile tab.<\/li>\n
                                  4. In the Profile path field, type: \\\\sbs\\Profiles$\\%username%<\/li>\n
                                  5. Click Apply. (You will see %username% automatically change to steve).<\/li>\n<\/ol>\n

                                    ? What to do next in Win10<\/p>\n

                                    Once the server is ready, the \"magic\" happens when Steve logs in:<\/p>\n

                                      \n
                                    • Go to your Win10 VM.<\/li>\n
                                    • Sign out of your current account.<\/li>\n
                                    • Log in as LABSERVER2022\\steve.<\/li>\n
                                    • Windows will see that path on sbs, create a folder called steve.V6 (for Windows 10), and start syncing.<\/li>\n<\/ul>\n

                                      Account Lockout Policy:<\/p>\n

                                      How to set the \"Trap\" for Steve<\/p>\n

                                      To make the lockout happen on your Win10 VM, you need to change this in the Domain policy, not the local one:<\/p>\n

                                        \n
                                      1. Close that window and open Group Policy Management (gpmc.msc).<\/li>\n
                                      2. Navigate to Domains > server2022.local.<\/li>\n
                                      3. Right-click Default Domain Policy and select Edit.<\/li>\n
                                      4. Go to the same path: Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Account Lockout Policy.<\/li>\n
                                      5. Double-click Account lockout threshold and change it to 5.\n
                                          \n
                                        • Windows will likely pop up a box suggesting you also set the duration and reset timer to 30 minutes. Just click OK to accept those defaults.<\/em><\/li>\n<\/ul>\n<\/li>\n<\/ol>\n

                                          ? The \"Secret Sauce\" for L1<\/p>\n

                                          Policies don't apply instantly. To make the Win10 VM respect the new \"5 attempts\" rule immediately:<\/p>\n

                                            \n
                                          • Go to your Win10 VM.<\/li>\n
                                          • Open Command Prompt and run: gpupdate \/force<\/li>\n<\/ul>\n

                                            Now, when you try those bad passwords again, it won't just keep \"thinking\"\u2014it will slam the door shut after the 5th try.<\/p>\n

                                            <\/p>\n

                                            The L1 Password Reset Procedure<\/p>\n

                                              \n
                                            1. Open Active Directory Users and Computers on the sbs server.<\/li>\n
                                            2. Find Steve Edwards in the Users list.<\/li>\n
                                            3. Right-click Steve and select Reset Password....<\/li>\n
                                            4. Set the Temporary Password: Type something like Spring2025!.<\/li>\n
                                            5. The \"L1 Golden Rule\": Check the box \"User must change password at next logon.\"\n
                                                \n
                                              • Why?<\/em> This ensures that only Steve knows his actual password once he logs in, protecting you from liability.<\/li>\n<\/ul>\n<\/li>\n
                                              • Click OK.<\/li>\n<\/ol>\n

                                                the \"change pword next login box is greyed out\"<\/p>\n

                                                That is a classic \"caught ya\" moment in Active Directory! When that box is greyed out, it\u2019s usually because of a conflicting setting on the\u00a0Account\u00a0tab.<\/p>\n

                                                ?? Why it's Greyed Out<\/p>\n

                                                You cannot force a user to change their password if the account is set so that the password\u00a0never\u00a0changes or\u00a0cannot\u00a0be changed.<\/p>\n

                                                Check these two boxes on Steve's\u00a0Account\u00a0tab:<\/p>\n

                                                  \n
                                                1. \"User cannot change password\": If this is checked, the \"change at next logon\" box will be greyed out because those two rules contradict each other.<\/li>\n
                                                2. \"Password never expires\": Sometimes, depending on the Windows Server version, having this checked will prevent you from enforcing a \"next logon\" change until you uncheck it.<\/li>\n<\/ol>\n

                                                  ? The L1 Fix<\/p>\n

                                                  To get control back:<\/p>\n

                                                    \n
                                                  • Uncheck\u00a0\"User cannot change password\".<\/li>\n
                                                  • Uncheck\u00a0\"Password never expires\" (at least temporarily).<\/li>\n
                                                  • Hit\u00a0Apply.<\/li>\n
                                                  • Now, the\u00a0\"User must change password at next logon\"\u00a0box should be clickable again.<\/li>\n<\/ul>\n

                                                    <\/p>\n

                                                    This network gets broken on reboots as the default switch is tied to the host net card, so the static Ips I set to get the VMs working is fucked by the Default switch getting a new random set of addresses \u2013 MS lunacy!<\/strong><\/p>\n

                                                    THIS IS WHERE you have to create a new virtual switch set as Internal, then set all the VMs to use THAT switch, making the Default Switch, that cannot be removed, redundant on reboots.<\/p>\n

                                                    <\/p>\n

                                                    NOTE you leave the default gateway blank as that is already configured in the Host\u2019s netcard (wifi).<\/p>\n

                                                    The only way to get a working VM subnet domain that has Inet access also is add 2 adaptors to each VM and share the host NIC with the VMs\/Default switches, 1 set to bridged for each VM so each has a gateway out of the internal network via the host nic.<\/p>\n

                                                    <\/p>\n

                                                    This dual switch per VM gives the VM 2 networks on the 172.27.172.34 static for the Internal network and the other from the Host WIFI router on 192.168.1.x:<\/p>\n

                                                    <\/p>\n

                                                    <\/p>\n

                                                    <\/p>\n

                                                    <\/p>\n

                                                    The 172 LAN is static Ips, the 192 LAN is auto. As usual, Win nets next quite work, with the Win11 VM missing from view but available via \\\\Win11VM in Explorer:<\/p>\n

                                                    <\/p>\n

                                                    The default switch had to be made irrelevant on the host, as it cannot be deleted or disabled, so the metrics set for it are 10 to make it a bad option for traffic for the domain LAN VMs. This needs to be done on all 3 VMs, and the New Virtual Switch given metrics of 500 on each VM \u2013 complicated nonsense due to MS randomising the Default switch static settings every reboot, twats!:<\/p>\n

                                                    The host shows a confusing mess, but it works to get the VMs and host connected to each other by Shares and ping and all have Internet paths:<\/p>\n

                                                    <\/p>\n

                                                    <\/p>\n

                                                    <\/p>\n

                                                    Never consistency with MS! PC own address gets shown in IP6 despite being unclicked in all adaptor! FFS\u2026<\/p>\n

                                                    So I have a working VM LAN on 172.27.176.x, and a gateway for the VMs via 192.168.1.1. Via Network icon the VMs can see the host \"laptop\" but cannot login as a password field is required when the login to my host is an online MS account that uses a PIN, not a password.<\/p>\n

                                                    Why this matters for the job<\/strong><\/p>\n

                                                    In an L1 role, you will get calls from users saying: \"I can't get into the shared drive!\"<\/em> 90% of the time, it's because they are trying to use their laptop's PIN instead of their Domain\/Network password. Teaching them that \"A PIN is for the device; a Password is for the network\"<\/strong> is a standard L1 troubleshooting script.<\/p>\n

                                                    Account Lockout Policy:<\/p>\n

                                                    <\/p>\n

                                                    The 1st<\/sup> Net Adaptor Settings for Server2022:<\/p>\n

                                                    <\/p>\n

                                                    <\/p>\n

                                                    The 1st<\/sup> Net Adaptor Settings for Win10:<\/p>\n

                                                    <\/p>\n

                                                    <\/p>\n

                                                    The Inet Bridge adaptor is set to automatic (DCHP, DNS, Gateway etc)<\/p>\n

                                                    <\/p>\n

                                                    The VM host adaptor for the Default Switch (Inet Bridge)<\/p>\n

                                                    <\/p>\n

                                                    <\/p>\n

                                                    Metrics were set so the net data paths between the two adaptors are widely attractive for one and unattractive for the other\u2026metrics 500 (lo priority) for the static adaptor and 10 (hi priority) for the auto.<\/p>\n\n\n\n\n\n\n\n\n
                                                    Device<\/strong><\/th>\nIP Address<\/strong><\/th>\nRole<\/strong><\/th>\n<\/tr>\n<\/thead>\n
                                                    Host Inet Bridge<\/strong><\/td>\n172.27.176.1<\/strong><\/td>\nThe \"Gateway\" for the VMs to talk to your laptop.<\/td>\n<\/tr>\n
                                                    SBS Server<\/strong><\/td>\n172.27.176.34<\/strong><\/td>\nThe Domain Controller \/ DNS Provider.<\/td>\n<\/tr>\n
                                                    Win10VM<\/strong><\/td>\n172.27.176.33<\/strong><\/td>\nStatic Workstation<\/td>\n<\/tr>\n
                                                    Win11VM<\/strong><\/td>\n172.27.176.35<\/strong><\/td>\nThe Static Workstation you just restored.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                    Joining a Windows 11 VM to an older SBS domain (which likely uses a .local extension) is often a \"clash of generations.\" Windows 11 has much stricter security defaults than previous versions.<\/p>\n

                                                    Since your pings to .1 and 8.8.8.8 are working, the \"pipe\" is open, but the Domain Handshake<\/strong> is likely being blocked by one of three things.<\/p>\n

                                                    ?? Step 1: The \"DNS Search\" Test<\/strong><\/p>\n

                                                    Windows 11 is very stubborn\u2014if it can't find the _ldap records for the domain, it won't even try to join.<\/p>\n

                                                    In the Win11 VM, open Command Prompt and run:<\/p>\n

                                                    nslookup yourdomain.local<\/p>\n

                                                      \n
                                                    • If it fails:<\/strong> Your Win11 VM is likely using the Host (.1)<\/strong> or Google (8.8.8.8)<\/strong> as its primary DNS.<\/li>\n
                                                    • The Fix:<\/strong> Go to IPv4 settings and ensure 172.27.176.34<\/strong> (SBS) is the ONLY<\/strong> DNS server listed. Remove the others temporarily.<\/li>\n<\/ul>\n

                                                      ?? Step 2: Disable IPv6<\/strong><\/p>\n

                                                      Windows 11 often tries to find the Domain Controller via IPv6 first. If your SBS server isn't configured for IPv6 (which it probably isn't), the join request will time out.<\/p>\n

                                                        \n
                                                      1. Go to Network Connections<\/strong> in the Win11 VM.<\/li>\n
                                                      2. Right-click your adapter -> Properties<\/strong>.<\/li>\n
                                                      3. Uncheck<\/strong> \"Internet Protocol Version 6 (TCP\/IPv6)\".<\/li>\n
                                                      4. Try the join again.<\/li>\n<\/ol>\n

                                                        ?? Step 3: SMB 1.0 \/ Legacy Compatibility<\/strong><\/p>\n

                                                        SBS (depending on the version) might be trying to communicate using older protocols that Windows 11 has disabled by default for security.<\/p>\n

                                                          \n
                                                        1. Search for \"Turn Windows features on or off\"<\/strong>.<\/li>\n
                                                        2. Look for SMB 1.0\/CIFS File Sharing Support<\/strong>.<\/li>\n
                                                        3. Ensure the SMB 1.0\/CIFS Client<\/strong> is checked.<\/li>\n
                                                        4. Restart the VM.<\/li>\n<\/ol>\n

                                                          ?? The \"NetID\" Shortcut<\/strong><\/p>\n

                                                          If the GUI \"Join Domain\" button is spinning forever, try the old-school way. It often gives a more specific error message:<\/p>\n

                                                            \n
                                                          1. Right-click the Start button -> System<\/strong>.<\/li>\n
                                                          2. Click Advanced system settings<\/strong> -> Computer Name<\/strong> tab.<\/li>\n
                                                          3. Click Network ID...<\/strong> and follow the wizard.<\/li>\n<\/ol>\n

                                                            ? Error Message Decoder<\/strong><\/p>\n

                                                            If it fails again, what is the exact<\/strong> error message?<\/p>\n

                                                              \n
                                                            • \"An Active Directory Domain Controller (AD DC) ... could not be contacted\"<\/strong>: This is 100% a DNS<\/strong> issue.<\/li>\n
                                                            • \"The specified network name is no longer available\"<\/strong>: This is an SMB\/Firewall<\/strong> issue.<\/li>\n
                                                            • \"Access Denied\"<\/strong>: You are communicating, but your Administrator credentials or permissions are being rejected.<\/li>\n<\/ul>\n

                                                              When you ran nslookup, did it return the correct IP address for your SBS server?<\/strong><\/p>\n\n\n\n\n\n\n\n\n\n
                                                              Checkpoint<\/strong><\/th>\nCommand \/ Action<\/strong><\/th>\nWhy?<\/strong><\/th>\n<\/tr>\n<\/thead>\n
                                                              Connectivity<\/strong><\/td>\nping [DC-IP]<\/td>\nConfirms a basic path exists.<\/td>\n<\/tr>\n
                                                              DNS<\/strong><\/td>\nnslookup [DomainName]<\/td>\nConfirms the PC can \"find\" the DC.<\/td>\n<\/tr>\n
                                                              Time<\/strong><\/td>\nw32tm \/query \/status<\/td>\nConfirms Kerberos won't reject the login.<\/td>\n<\/tr>\n
                                                              Edition<\/strong><\/td>\nwinver<\/td>\nConfirms it's not \"Home Edition.\"<\/td>\n<\/tr>\n
                                                              Firewall4<\/sup><\/strong><\/td>\nwf.msc5<\/sup><\/td>\nEnsures RPC\/NetBIOS traffic isn't blocked.6<\/sup><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                              Back to L1 Support theory.<\/strong> Assume you have no knowledge of my current VM domain issues. What are the L1 support expectation possible causes for a Win11 PC not being able to join a Domain?<\/p>\n

                                                              In an L1 Support interview or scenario, the expectation is that you follow a logical, \"bottom-up\" troubleshooting methodology (OSI Model layers 1 through 3<\/strong>).<\/p>\n

                                                              If a Windows 11 machine can't join a domain, an L1 tech is expected to rule out the \"low-hanging fruit\" before escalating to Tier 2 (Server\/Network Admins).<\/p>\n

                                                              1. Physical & Basic Connectivity (Layer 1 & 2)<\/strong><\/p>\n

                                                              The most common mistake is assuming the \"pipe\" is open when it isn't.<\/p>\n

                                                                \n
                                                              • Network Profile:<\/strong>\u00a0Is the connection set to\u00a0\"Public\"<\/strong>? Windows 11 aggressively blocks discovery on Public profiles. It must be\u00a0Private<\/strong>.<\/li>\n
                                                              • Media State:<\/strong>\u00a0Is the cable plugged in \/ is the Virtual Switch connected?<\/li>\n
                                                              • IP Conflicts:<\/strong>\u00a0Does the PC have a valid IP in the same subnet as the Domain Controller (DC), or is it stuck with an APIPA address (169.254.x.x)?<\/li>\n<\/ul>\n

                                                                2. DNS: The \"Universal\" Domain Killer (Layer 3)<\/strong><\/p>\n

                                                                In 90% of domain join failures,\u00a0DNS is the culprit<\/strong>.<\/p>\n

                                                                  \n
                                                                • Wrong DNS Server:<\/strong>\u00a0The client is using the Router (192.168.1.1) or Google (8.8.8.8) instead of the\u00a0DC's internal IP<\/strong>.<\/li>\n
                                                                • The L1 Test:<\/strong>\u00a0Run\u00a0nslookup [domain.local]. If it doesn't return the DC's IP address, the join will always fail.<\/li>\n
                                                                • IPv6 Interference:<\/strong>\u00a0Sometimes Windows 11 tries to resolve the domain via IPv6. L1 techs often disable IPv6 temporarily to force the join over IPv4.<\/li>\n<\/ul>\n

                                                                  3. Time Synchronization (Clock Skew)<\/strong><\/p>\n

                                                                  Active Directory relies on\u00a0Kerberos<\/strong>, which is extremely sensitive to time.<\/p>\n

                                                                    \n
                                                                  • The 5-Minute Rule:<\/strong>\u00a0If the workstation's clock is more than\u00a05 minutes<\/strong>\u00a0off from the Domain Controller's clock, the security handshake will fail.<\/li>\n
                                                                  • The L1 Fix:<\/strong>\u00a0Check the BIOS time or use\u00a0net time \\\\DC-NAME \/set \/y.<\/li>\n<\/ul>\n

                                                                    4. Windows Edition & Credentials<\/strong><\/p>\n

                                                                      \n
                                                                    • Windows Home vs. Pro:<\/strong>\u00a0You\u00a0cannot<\/strong>\u00a0join Windows 11\u00a0Home<\/strong>\u00a0to a domain. L1 must verify the user has Pro, Enterprise, or Education.<\/li>\n
                                                                    • Account Permissions:<\/strong>\u00a0Does the user (or the tech) have the \"Add Workstations to Domain\" right?\u00a0By default, any authenticated user can join 10 machines, but this is often restricted.<\/li>\n
                                                                    • Existing Computer Object:<\/strong>\u00a0If a computer with the same name already exists in Active Directory, and the tech doesn't have \"Reset Password\" rights on that object, the join will fail with \"Access Denied.\"<\/li>\n<\/ul>\n

                                                                      5. Summary Table for L1 Quick-Check<\/strong><\/p>\n\n\n\n\n\n\n\n\n\n
                                                                      Checkpoint<\/th>\nCommand \/ Action<\/th>\nWhy?<\/th>\n<\/tr>\n<\/thead>\n
                                                                      Connectivity<\/strong><\/td>\nping [DC-IP]<\/td>\nConfirms a basic path exists.<\/td>\n<\/tr>\n
                                                                      DNS<\/strong><\/td>\nnslookup [DomainName]<\/td>\nConfirms the PC can \"find\" the DC.<\/td>\n<\/tr>\n
                                                                      Time<\/strong><\/td>\nw32tm \/query \/status<\/td>\nConfirms Kerberos won't reject the login.<\/td>\n<\/tr>\n
                                                                      Edition<\/strong><\/td>\nwinver<\/td>\nConfirms it's not \"Home Edition.\"<\/td>\n<\/tr>\n
                                                                      Firewall<\/strong><\/td>\nwf.msc<\/td>\nEnsures RPC\/NetBIOS traffic isn't blocked.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                                                      ? The \"Golden Answer\" for an Interview<\/strong><\/p>\n

                                                                      If asked this in a test, say:\u00a0\"I would start by verifying the DNS settings, as the machine must be able to resolve the domain's SRV records. Then, I'd check the system time for clock skew and ensure the machine is running a Pro or Enterprise edition of Windows.\"<\/em><\/p>\n

                                                                      Since we know your Win11 VM is having this exact issue, would you like to run the\u00a0<\/strong>nslookup\u00a0and\u00a0<\/strong>winver\u00a0checks to see which of these L1 hurdles is stopping you?<\/strong><\/p>\n

                                                                      PS C:\\WINDOWS\\system32> ping sbs<\/strong><\/p>\n

                                                                      Pinging sbs.local [172.27.176.34] with 32 bytes of data:<\/strong><\/p>\n

                                                                      Reply from 172.27.176.34: bytes=32 time<1ms TTL=128<\/strong><\/p>\n

                                                                      Reply from 172.27.176.34: bytes=32 time=1ms TTL=128<\/strong><\/p>\n

                                                                      Reply from 172.27.176.34: bytes=32 time<1ms TTL=128<\/strong><\/p>\n

                                                                      Reply from 172.27.176.34: bytes=32 time=1ms TTL=128<\/strong><\/p>\n

                                                                      Ping statistics for 172.27.176.34:<\/strong><\/p>\n

                                                                      Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),<\/strong><\/p>\n

                                                                      Approximate round trip times in milli-seconds:<\/strong><\/p>\n

                                                                      Minimum = 0ms, Maximum = 1ms, Average = 0ms<\/strong><\/p>\n

                                                                      PS C:\\WINDOWS\\system32><\/strong><\/p>\n

                                                                      PS C:\\WINDOWS\\system32> nslookup sbs.server2022.local<\/strong><\/p>\n

                                                                      DNS request timed out.<\/strong><\/p>\n

                                                                      timeout was 2 seconds.<\/strong><\/p>\n

                                                                      Server: UnKnown<\/strong><\/p>\n

                                                                      Address: 172.27.176.34<\/strong><\/p>\n

                                                                      Name: sbs.server2022.local<\/strong><\/p>\n

                                                                      Address: 172.27.176.34<\/strong><\/p>\n

                                                                      PS C:\\WINDOWS\\system32> w32tm \/query \/status<\/strong><\/p>\n

                                                                      The following error occurred: The service has not been started. (0x80070426)<\/strong><\/p>\n

                                                                      PS C:\\WINDOWS\\system32> w32tm \/query \/status<\/strong><\/p>\n

                                                                      Leap Indicator: 3(not synchronized)<\/strong><\/p>\n

                                                                      Stratum: 0 (unspecified)<\/strong><\/p>\n

                                                                      Precision: -23 (119.209ns per tick)<\/strong><\/p>\n

                                                                      Root Delay: 0.0000000s<\/strong><\/p>\n

                                                                      Root Dispersion: 0.0000000s<\/strong><\/p>\n

                                                                      ReferenceId: 0x00000000 (unspecified)<\/strong><\/p>\n

                                                                      Last Successful Sync Time: unspecified<\/strong><\/p>\n

                                                                      Source: Local CMOS Clock<\/strong><\/p>\n

                                                                      Poll Interval: 10 (1024s)<\/strong><\/p>\n

                                                                      PS C:\\WINDOWS\\system32> Test-NetConnection -ComputerName 172.27.176.34 -Port 445<\/strong><\/p>\n

                                                                      ComputerName : 172.27.176.34<\/strong><\/p>\n

                                                                      RemoteAddress : 172.27.176.34<\/strong><\/p>\n

                                                                      RemotePort : 445<\/strong><\/p>\n

                                                                      InterfaceAlias : Ethernet 6<\/strong><\/p>\n

                                                                      SourceAddress : 172.27.176.35<\/strong><\/p>\n

                                                                      TcpTestSucceeded : True<\/strong><\/p>\n

                                                                      PS C:\\WINDOWS\\system32> Get-NetFirewallProfile | select Name, Enabled<\/strong><\/p>\n

                                                                      Name Enabled<\/strong><\/p>\n

                                                                      ---- -------<\/strong><\/p>\n

                                                                      Domain True<\/strong><\/p>\n

                                                                      Private True<\/strong><\/p>\n

                                                                      Public True<\/strong><\/p>\n

                                                                      The Next Steps (L1 Troubleshooting Logic)<\/strong><\/p>\n

                                                                      Before we try to join again, we must resolve these two blocks.<\/strong><\/p>\n

                                                                      Step 1: Disable Firewall (Standard L1 \"Rule Out\" Procedure) On the Win11 VM, run: Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled False<\/strong><\/p>\n

                                                                      Step 2: Start\/Sync Time (Ensuring the clock is identical to SBS) On the Win11 VM, run: w32tm \/resync \/force<\/strong><\/p>\n

                                                                      PS C:\\WINDOWS\\system32> Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled False<\/strong><\/p>\n

                                                                      PS C:\\WINDOWS\\system32><\/strong><\/p>\n

                                                                      PS C:\\WINDOWS\\system32> w32tm \/resync \/force<\/strong><\/p>\n

                                                                      >><\/strong><\/p>\n

                                                                      Sending resync command to local computer<\/strong><\/p>\n

                                                                      The command completed successfully.<\/strong><\/p>\n

                                                                      PS C:\\WINDOWS\\system32> nslookup sbs.server2022.local<\/strong><\/p>\n

                                                                      Server: UnKnown<\/strong><\/p>\n

                                                                      Address: 172.27.176.34<\/strong><\/p>\n

                                                                      Name: sbs.server2022.local<\/strong><\/p>\n

                                                                      Address: 172.27.176.34<\/strong><\/p>\n

                                                                      The Server: UnKnown persists because there is no Reverse Lookup Zone or PTR Record for the SBS server. In a professional environment, this is an L1 \"Fix it before proceeding\" item.<\/strong><\/p>\n

                                                                      However, since the name still resolves to the correct IP, we can attempt the join. If it fails, we know exactly what to fix in the SBS DNS Manager.<\/strong><\/p>\n

                                                                      The Join Attempt<\/strong><\/p>\n

                                                                      Run this command in PowerShell:<\/strong><\/p>\n

                                                                      Add-Computer -DomainName \"server2022.local\" -Restart<\/strong><\/p>\n

                                                                      One Final L1 \"Best Practice\"<\/strong><\/p>\n

                                                                      Now that you are in, Turn the Firewall back on but do it the right way.<\/strong><\/p>\n

                                                                      Since the VM now knows it's on a Domain, it will use the \"Domain Profile\" for its firewall. Most of the ports needed for the domain to function are opened automatically once the machine realizes it's \"Home\" on the DC.<\/strong><\/p>\n

                                                                      Run this to bring the walls back up: Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled True<\/strong><\/p>\n

                                                                      ? The Lesson Learned<\/strong><\/p>\n

                                                                      In an interview, if they ask: \"What's the hardest part of a domain join?\" You can now answer from experience: \"Ensuring DNS, Time Sync, and Security Profiles are aligned before even touching the 'Join' button.\"<\/strong><\/p>\n

                                                                      Login Script Example:<\/p>\n

                                                                      _______________________________________________________________<\/p>\n

                                                                      @echo off<\/p>\n

                                                                      net use P: \/delete \/y<\/p>\n

                                                                      net use P: \\\\sbs\\Public<\/p>\n

                                                                      :: This is the line that creates the pop-up box with your original info<\/p>\n

                                                                      msg * \"Welcome %USERNAME%. Today is %DATE% and the time is %TIME%. Your P: drive is now mapped.\"<\/p>\n

                                                                      pause<\/p>\n

                                                                      ________________________________________________________________<\/p>\n

                                                                      <\/strong><\/p>\n

                                                                      The P: drive folder has to be already created and shared on the server c: drive for the script to map it.<\/p>\n

                                                                      <\/p>\n

                                                                      Shutting Down fully before backup; Shut down each vm, server LAST! Then; net stop vmms<\/p>\n","protected":false},"excerpt":{"rendered":"

                                                                      <\/div>\n

                                                                      <\/path><\/svg><\/i> \"Loading\"<\/p>\n

                                                                      <\/div>\n

                                                                      Server2022 Hyper V Setup: You can easily see the IP Addresses of each VM at the screen bottom of Hyper V: net start vmms You can turn on all VMs from the Host with: Get-VM | Where-Object {$_.State -eq 'Off'} | Start-VM 3 x VMs IP addresses Host laptop settings to enable VMs internal LAN ...\u00a0 Notes for HyperV Setup of Server2022, Win10 and Win11 Subnet<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-10663","post","type-post","status-publish","format-standard","hentry","category-post"],"a3_pvc":{"activated":true,"total_views":20,"today_views":0},"_links":{"self":[{"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/posts\/10663","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/comments?post=10663"}],"version-history":[{"count":11,"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/posts\/10663\/revisions"}],"predecessor-version":[{"id":10759,"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/posts\/10663\/revisions\/10759"}],"wp:attachment":[{"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/media?parent=10663"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/categories?post=10663"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/tags?post=10663"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}