resolutionflow/TS-EXAMPLES.md

# Troubleshooting Scenarios for Decision Tree App

## Scenario 1: FSLogix Profile Not Loading

### Issue Details
**Issue Name:** FSLogix Profile Not Loading
**Category:** Citrix/Virtual Desktop
**Estimated Time:** 10-15 minutes
**Common For:** Warner Robins City, other Citrix environments

### First Thing You Check
Can the user log into the server at all?

### Decision Tree

**Step 1: Can user log into server?**
- **YES** → Step 2: Check FSLogix service status
- **NO** → Different tree (AD account/licensing issue)

**Step 2: Is FSLogix service running on the server?**
- **RUNNING** → Step 3: Check frxtray.exe in user's task manager
- **STOPPED** → Step 4: Start service and check event log for cause
- **STUCK (Starting/Stopping)** → Step 5: Kill service process and restart

**Step 3: Is frxtray.exe running in user's task manager?**
- **YES** → Step 6: Check if profile VHD exists in share
- **NO** → Step 7: Check FSLogix agent installation
- **MULTIPLE INSTANCES** → Step 8: Kill all frxtray.exe, log user off, try again

**Step 4: Service Start Result**
*Action: Start-Service -Name 'frxsvc'*
- **Started successfully** → Step 9: Check Event Viewer for previous failure reason
- **Failed to start** → Step 10: Check service dependencies (NetLogon, RPC)
- **Started but stopped again** → Step 11: Check for file locks or permissions

**Step 5: Service Kill and Restart**
*Action: Stop-Process -Name frxsvc -Force; Start-Service frxsvc*
- **Service now running** → Step 3: Verify frxtray.exe
- **Still stuck** → Step 12: Check for corrupt profile or registry

**Step 6: Does user have a profile VHD in the share?**
*Check: \\server\fslogix\username\Profile_username.vhdx*
- **YES, file exists** → Step 13: Check VHD file permissions
- **NO, file missing** → Step 14: Check FSLogix registry path configuration
- **YES, but 0 bytes** → Step 15: Delete corrupt VHD, recreate profile

**Step 7: Is FSLogix agent installed?**
*Check: C:\Program Files\FSLogix\Apps\frxsvc.exe exists*
- **YES** → Step 16: Repair FSLogix agent
- **NO** → Step 17: Install FSLogix agent

**Step 8: Multiple frxtray instances**
*Action: Get-Process frxtray | Stop-Process -Force*
- **Killed successfully** → Log user off, have them log back in
- **Cannot kill** → Step 18: Check for file/folder locks

**Step 9: Check Event Viewer**
*Action: Check Application log for FSLogix errors*
- **Error 50 (Can't access network path)** → Step 19: Verify network path accessible
- **Error 13 (VHD locked)** → Step 20: Check for locks on VHD from other servers
- **Error 52 (Profile path not found)** → Step 14: Check registry settings

**Step 10: Check Service Dependencies**
*Action: Get-Service NetLogon, RpcSs status*
- **All running** → Step 21: Check antivirus blocking
- **NetLogon stopped** → Start NetLogon, then retry FSLogix
- **RPC stopped** → Critical issue, escalate to senior engineer

**Step 11: Check for File Locks**
*Action: Run Chihlas file lock checker on profile share*
- **No locks** → Step 22: Check disk space on profile server
- **Locked by another server** → Step 20: Release lock or force user logoff from other session

**Step 13: Check VHD Permissions**
*Action: Get-Acl on Profile_username.vhdx*
- **User has Full Control** → Step 23: Try mounting VHD manually
- **User missing permissions** → Step 24: Grant user full control
- **Everyone has permission but still fails** → Step 25: Check parent folder permissions

**Step 14: Check FSLogix Registry Path**
*Check: HKLM\SOFTWARE\FSLogix\Profiles - VHDLocations*
- **Path is correct** → Step 26: Check DNS resolution of server name
- **Path has typo** → Fix registry path, log user off and back on
- **Path uses old server** → Update to correct server path

**Step 15: Delete Corrupt VHD**
*Action: Delete 0-byte VHD file*
- **Deleted successfully** → User will get new profile on next login
- **Cannot delete (in use)** → Step 20: Check locks, force release

**Step 17: Install FSLogix Agent**
*Action: Run FSLogix installer from network share*
- **Installed successfully** → Reboot server, have user try again
- **Installation failed** → Step 27: Check server OS version compatibility

**Step 19: Verify Network Path**
*Action: Test-Path \\server\fslogix from problem server*
- **Accessible** → Step 28: Check firewall between servers
- **Not accessible** → Check DNS, check network connectivity
- **Accessible but slow** → Step 29: Check network performance

**Step 20: Check VHD Locks**
*Action: Use openfiles /query or handle.exe to check locks*
- **Locked by same server** → Kill locking process
- **Locked by different server** → Log user off from that server
- **Lock from crashed session** → Clear stale session, release lock

**Step 21: Check Antivirus**
*Action: Check if AV is scanning/blocking FSLogix folders*
- **FSLogix folders excluded** → Step 30: Check Windows Defender exclusions too
- **Not excluded** → Add exclusions, restart FSLogix service
- **Exclusions present but still blocking** → Temporarily disable AV to test

**Step 23: Try Mounting VHD Manually**
*Action: Mount-VHD -Path \\server\fslogix\...\Profile.vhdx*
- **Mounts successfully** → Profile is good, issue elsewhere (back to Step 2)
- **Fails to mount** → Step 31: Check VHD integrity
- **Mounts but takes forever** → Step 29: Network performance issue

**Step 24: Grant User Permissions**
*Action: icacls add full control for user on VHD*
- **Permissions granted** → Have user log off and back on
- **Cannot modify permissions** → Check if admin has access, check share permissions

**Step 31: Check VHD Integrity**
*Action: Test-VHD -Path ... in PowerShell*
- **VHD is healthy** → Issue is mounting or permissions
- **VHD is corrupt** → Step 15: Delete and recreate
- **Cannot test (access denied)** → Permission issue on share

**RESOLUTION: Profile loads successfully**

### Common Pitfalls
- VHD file locked by another server (user has session on multiple servers)
- Profile path in registry has typo or uses old server name
- Antivirus blocking VHD access or scanning profile folder
- NetLogon service stopped preventing network authentication
- Disk full on profile share
- DNS not resolving profile server name
- Stale sessions from crashed RDP connections

### Resolution Indicators
- User can log in successfully
- Profile loads within 30 seconds
- No FSLogix errors in Event Viewer
- frxtray.exe running in task manager
- User's desktop, documents appear correctly

### Documentation Links
- FSLogix Profile Troubleshooting: https://docs.microsoft.com/en-us/fslogix/troubleshooting-profile-container
- Event Log Error Codes: https://docs.microsoft.com/en-us/fslogix/profile-container-configuration-reference
- VHD Troubleshooting: Internal KB #FSL-001

---

## Scenario 2: Citrix VDA Not Registering

### Issue Details
**Issue Name:** Citrix VDA Not Registering with Delivery Controller
**Category:** Citrix/Virtual Desktop
**Estimated Time:** 10-20 minutes
**Common For:** Warner Robins City, all Citrix environments

### First Thing You Check
Can you ping the VDA from the Delivery Controller?

### Decision Tree

**Step 1: Can you ping VDA from DDC?**
*Action: Test-Connection -ComputerName VDA-HOSTNAME*
- **YES (replies)** → Step 2: Check VDA service status
- **NO (request timed out)** → Step 3: Network connectivity issue

**Step 2: What is VDA service status?**
*Action: Get-Service -Name 'BrokerAgent' on VDA*
- **RUNNING** → Step 4: Check DDC connection from VDA
- **STOPPED** → Step 5: Start VDA service
- **STUCK** → Step 6: Force kill and restart service

**Step 3: Network Connectivity Issue**
*Troubleshooting network layer*
- **VDA powered off** → Power on VDA, wait for boot
- **VDA on different subnet** → Step 7: Check routing/firewall
- **DNS not resolving** → Step 8: Check DNS configuration
- **Network cable unplugged** → Physical layer issue

**Step 4: Can VDA reach DDC on port 80/443?**
*Action: Test-NetConnection -ComputerName DDC-HOSTNAME -Port 80*
- **Port 80 success** → Step 9: Check VDA registration in Studio
- **Port 80 blocked** → Step 10: Check firewall rules
- **DNS fails** → Step 8: Check DNS

**Step 5: Start VDA Service**
*Action: Start-Service -Name 'BrokerAgent'*
- **Started successfully** → Step 11: Wait 60 seconds, check registration
- **Failed to start** → Step 12: Check Event Viewer for error
- **Started then stopped** → Step 13: Check service dependencies

**Step 6: Force Kill VDA Service**
*Action: Stop-Process -Name BrokerAgent -Force*
- **Killed successfully** → Step 5: Start service normally
- **Cannot kill (access denied)** → Restart VDA server
- **Killed but immediately respawns** → Step 14: Check for loops

**Step 7: Check Routing/Firewall**
*Between VDA and DDC*
- **Different VLANs** → Verify inter-VLAN routing configured
- **SonicWall between them** → Step 15: Check SonicWall rules
- **Switches involved** → Check VLAN tagging, trunk ports

**Step 8: Check DNS Configuration**
*Action: Resolve-DnsName DDC-HOSTNAME from VDA*
- **Resolves correctly** → DNS is fine, go back to network troubleshooting
- **Does not resolve** → Step 16: Check VDA DNS server settings
- **Resolves to wrong IP** → Step 17: Check DNS A record

**Step 9: Check VDA in Citrix Studio**
*Action: Open Studio > Machine Catalogs*
- **VDA shows "Registered"** → Issue resolved!
- **VDA shows "Unregistered"** → Step 18: Check ListOfDDCs registry
- **VDA not in catalog** → Step 19: Add VDA to catalog

**Step 10: Check Firewall Rules**
*Between VDA and DDC*
- **Windows Firewall blocking** → Create rule to allow DDC traffic
- **Hardware firewall blocking** → Step 15: Update SonicWall rules
- **NSG rules (if Azure)** → Add allow rule for ports 80, 443, 1494, 2598

**Step 11: Wait and Verify Registration**
*Action: Wait 60 seconds, refresh Studio*
- **Now registered** → Resolution confirmed!
- **Still unregistered** → Step 18: Check ListOfDDCs
- **Shows error in Studio** → Step 20: Check specific error code

**Step 12: Check Event Viewer**
*Action: Application log, filter for Citrix*
- **Error 1001 (cannot contact DDC)** → Step 4: Check connectivity
- **Error 1006 (auth failure)** → Step 21: Check machine account
- **Error 1035 (database connection failed)** → Escalate to DDC troubleshooting

**Step 13: Check Service Dependencies**
*Action: Check dependent services*
- **NetLogon stopped** → Start NetLogon first
- **Remote Registry stopped** → Start Remote Registry
- **Windows Event Log stopped** → Critical, may need reboot

**Step 15: Check SonicWall Rules**
*Between VDA subnet and DDC subnet*
- **No rule exists** → Create LAN→LAN allow rule for Citrix ports
- **Rule exists but wrong ports** → Add ports 80, 443, 1494, 2598
- **Rule exists, looks correct** → Check packet capture on SonicWall

**Step 16: Check VDA DNS Settings**
*Action: Get-DnsClientServerAddress on VDA*
- **Points to wrong DNS** → Set to correct DNS server
- **Points to correct DNS** → Step 17: Check DNS server itself
- **No DNS configured** → Configure DNS, restart VDA

**Step 17: Check DNS A Record**
*On DNS server*
- **A record correct** → Clear DNS cache on VDA
- **A record wrong IP** → Update A record, clear cache
- **A record missing** → Create A record for DDC

**Step 18: Check ListOfDDCs Registry**
*Action: Check HKLM\Software\Citrix\VirtualDesktopAgent - ListOfDDCs*
- **Points to correct DDC** → Step 22: Re-register VDA manually
- **Points to old/wrong DDC** → Update registry to correct DDC name
- **Registry key missing** → Run Citrix VDA installer repair

**Step 19: Add VDA to Catalog**
*In Citrix Studio*
- **Added successfully** → VDA should register within 60 seconds
- **Cannot add (not found)** → Step 1: Network connectivity issue
- **Cannot add (duplicate)** → VDA may be in different catalog, search

**Step 21: Check Machine Account**
*In Active Directory*
- **Account exists, enabled** → Step 23: Check computer trust relationship
- **Account disabled** → Enable account, restart VDA
- **Account missing** → Re-join VDA to domain

**Step 22: Re-register VDA Manually**
*Action: Run "C:\Program Files\Citrix\Virtual Desktop Agent\BrokerAgent.exe" -RegisterWithDDC*
- **Registration successful** → Verify in Studio
- **Registration failed** → Check error message, return to Step 4
- **Command not found** → VDA install corrupted, reinstall

**Step 23: Check Computer Trust Relationship**
*Action: Test-ComputerSecureChannel on VDA*
- **Trust relationship good** → Back to Step 2
- **Trust relationship broken** → Repair: Reset-ComputerMachinePassword
- **Repair failed** → Re-join domain

**RESOLUTION: VDA shows as Registered in Studio**

### Common Pitfalls
- Firewall blocking ports 80/443 between VDA and DDC
- DNS not resolving DDC hostname
- ListOfDDCs registry points to old/decommissioned DDC
- Machine account password expired or trust relationship broken
- VDA service won't stay running due to corrupt installation
- Network routing issue between VDA and DDC subnets
- VDA trying to register to wrong DDC in multi-site setup

### Resolution Indicators
- VDA shows "Registered" in Citrix Studio
- Users can successfully launch sessions to VDA
- No Citrix errors in Event Viewer
- VDA appears in correct delivery group

### Documentation Links
- VDA Registration: https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/manage-deployment/vda-registration
- Troubleshooting: https://support.citrix.com/article/CTX136668
- Event Log Errors: https://support.citrix.com/article/CTX127348

---

## Scenario 3: User Cannot Access File Share

### Issue Details
**Issue Name:** User Cannot Access Network File Share
**Category:** File Services / Permissions
**Estimated Time:** 5-15 minutes
**Common For:** All clients with file servers

### First Thing You Check
Can the user ping the file server?

### Decision Tree

**Step 1: Can user ping file server by name?**
*Action: ping FILE-SERVER-NAME*
- **YES (replies)** → Step 2: Can user access share path
- **NO (timeout/host unreachable)** → Step 3: Network connectivity issue
- **Unknown host** → Step 4: DNS resolution issue

**Step 2: Can user access \\server\share in File Explorer?**
*Action: Navigate to \\SERVER\SHARE*
- **YES, opens** → Step 5: Check specific folder permissions
- **NO, access denied** → Step 6: Check share permissions
- **NO, network path not found** → Step 7: Check SMB service

**Step 3: Network Connectivity Issue**
*Troubleshooting layer 3*
- **User on VPN** → Step 8: Check VPN tunnel status
- **User on different site** → Step 9: Check site-to-site connectivity
- **Server on different VLAN** → Check inter-VLAN routing
- **Cable unplugged** → Physical issue

**Step 4: DNS Resolution Issue**
*Action: nslookup FILE-SERVER-NAME*
- **Resolves to correct IP** → Try accessing by IP: \\192.168.1.10\share
- **Does not resolve** → Step 10: Check DNS configuration
- **Resolves to wrong IP** → Step 11: Update DNS record

**Step 5: Can user access specific folder?**
*Action: Open \\server\share\specific-folder*
- **YES** → Issue resolved!
- **NO, access denied** → Step 12: Check NTFS permissions on folder
- **Folder doesn't exist** → Verify correct path, check if moved

**Step 6: Check Share Permissions**
*Action: Right-click share > Properties > Sharing > Permissions*
- **User has Read or Change** → Step 12: Check NTFS permissions
- **User not in permissions** → Step 13: Add user to share permissions
- **Everyone has Full Control** → Share perms OK, issue is NTFS

**Step 7: Check SMB Service**
*Action: Get-Service -Name LanmanServer on file server*
- **Running** → Step 14: Check SMB signing requirements
- **Stopped** → Start service, verify user can access
- **Disabled** → Enable and start service

**Step 8: Check VPN Tunnel**
*If user is remote*
- **VPN connected** → Step 15: Check VPN routing for file server subnet
- **VPN disconnected** → Reconnect VPN, retry
- **VPN connected but can't reach internal** → Step 16: Check split tunneling

**Step 9: Site-to-Site Connectivity**
*Between user's site and file server site*
- **Ping works between sites** → Not a site link issue
- **Ping fails between sites** → Step 17: Check VPN tunnel between sites
- **Some services work, files don't** → Check port 445 specifically

**Step 10: Check User's DNS Settings**
*Action: ipconfig /all on user's PC*
- **DNS points to DC** → Step 18: Check DNS server health
- **DNS points to wrong server** → Set correct DNS via DHCP or static
- **No DNS configured** → Configure DNS

**Step 12: Check NTFS Permissions**
*Action: Right-click folder > Properties > Security*
- **User has Read & Execute** → User should have access
- **User not listed** → Step 19: Check group memberships
- **User has Deny** → Step 20: Remove explicit Deny

**Step 13: Add User to Share Permissions**
*Action: Add user or user's group with appropriate access*
- **Added successfully** → User should now be able to access
- **Cannot add (grayed out)** → Check if Advanced Sharing is needed
- **Added but still fails** → Step 12: Check NTFS permissions

**Step 14: Check SMB Signing**
*Action: Check SMB server/client signing requirements*
- **Client requires signing, server doesn't** → Enable signing on server
- **Mismatch in SMB versions** → Step 21: Enable SMB 2.0/3.0
- **Settings match** → Not SMB signing issue

**Step 15: Check VPN Routing**
*Verify file server subnet is routed through VPN*
- **Route exists** → Check firewall rules on VPN
- **Route missing** → Add route for file server subnet
- **Route exists but traffic blocked** → Step 22: Check firewall

**Step 17: Check Site-to-Site VPN**
*Between locations*
- **Tunnel up** → Step 23: Check Phase 2 includes port 445
- **Tunnel down** → Troubleshoot VPN (separate tree)
- **Tunnel flapping** → Check for routing loops

**Step 18: Check DNS Server**
*On domain controller/DNS server*
- **DNS service running** → Check if A record exists for file server
- **DNS service stopped** → Start DNS service
- **High CPU/memory** → May need DNS server restart

**Step 19: Check Group Memberships**
*Action: Check what groups user belongs to*
- **User in correct group** → Step 24: Run gpupdate to refresh token
- **User not in group** → Add user to appropriate group
- **User added recently** → User needs to log off and back on

**Step 20: Remove Explicit Deny**
*Deny permissions override all allows*
- **Deny removed** → User should now have access
- **Deny is inherited** → Step 25: Check parent folder permissions
- **Cannot remove (grayed out)** → Disable inheritance, then remove

**Step 21: Enable SMB 2.0/3.0**
*Action: Enable SMB versions on server*
- **Enabled successfully** → User should now connect
- **Already enabled** → Check Windows version compatibility
- **Cannot enable** → OS version too old, may need upgrade

**Step 24: Refresh User Token**
*Action: Have user log off and back on (or run klist purge)*
- **After logoff/logon, works** → Resolution confirmed
- **Still fails after logoff** → Step 26: Check effective permissions

**Step 26: Check Effective Permissions**
*Action: Advanced Security > Effective Access*
- **Shows user should have access** → Step 27: Check for inheritance issues
- **Shows user has no access** → Permission configuration error
- **Tool shows access but user still can't** → Clear SMB cache

**RESOLUTION: User can access share and specific folders**

### Common Pitfalls
- User has NTFS permissions but not share permissions (or vice versa)
- User added to group but hasn't logged off/on to refresh token
- Explicit Deny permission overriding Allow permissions
- DNS not resolving file server name
- Firewall blocking port 445 (SMB)
- DFS namespace issues (different issue, separate tree)
- Offline Files caching causing stale view

### Resolution Indicators
- User can open \\server\share
- User can create/modify files if they should have write access
- File Explorer shows correct folders
- No "Access Denied" or "Network Path Not Found" errors

### Documentation Links
- SMB Troubleshooting: https://docs.microsoft.com/en-us/windows-server/storage/file-server/troubleshoot/
- File Permissions: Internal KB #NTFS-PERMS-001
- DFS Issues: Internal KB #DFS-TROUBLESHOOT

---

## Scenario 4: Active Directory Replication Failure

### Issue Details
**Issue Name:** Active Directory Replication Not Working
**Category:** Active Directory / Infrastructure
**Estimated Time:** 15-30 minutes
**Common For:** Multi-DC environments, especially after DC issues

### First Thing You Check
Can the DCs ping each other?

### Decision Tree

**Step 1: Can DCs ping each other by name?**
*Action: Test-Connection between all DCs*
- **YES, all reply** → Step 2: Check replication status
- **NO, some don't reply** → Step 3: Network connectivity issue
- **Name doesn't resolve** → Step 4: DNS issue

**Step 2: What does replicadmin /showrepl show?**
*Action: repadmin /showrepl on each DC*
- **Last replication: recent (< 1 hour)** → Replication working
- **Last replication: old (> 3 hours)** → Step 5: Check for specific errors
- **Replication failing with error** → Step 6: Identify error code

**Step 3: Network Connectivity Between DCs**
*Layer 3 troubleshooting*
- **Different sites** → Step 7: Check site link configuration
- **Firewall between DCs** → Step 8: Check firewall rules
- **Same site but can't reach** → Check switches, VLANs

**Step 4: DNS Issues Between DCs**
*Action: nslookup DC-NAME from other DC*
- **Resolves correctly** → Not DNS issue, back to Step 1
- **Doesn't resolve** → Step 9: Check DNS zone replication
- **Resolves to wrong IP** → Step 10: Update DNS A record

**Step 5: Check for Specific Replication Errors**
*Review repadmin output*
- **"Last attempt was successful"** → False alarm, replication OK
- **Shows specific error code** → Step 6: Identify error code
- **No errors but time is old** → Step 11: Force replication

**Step 6: Identify Replication Error Code**
*Common error codes*
- **Error 8606 (insufficient attributes)** → Step 12: Metadata cleanup needed
- **Error 8451/8452 (naming context)** → Step 13: Name server not advertising
- **Error 1722 (RPC server unavailable)** → Step 14: RPC/firewall issue
- **Error 1256 (domain trust issue)** → Step 15: Secure channel problem
- **Error 8614 (version mismatch)** → Step 16: Schema version issue

**Step 7: Check Site Link Configuration**
*Action: Check AD Sites and Services*
- **Site link exists** → Step 17: Check site link schedule
- **No site link** → Create site link between sites
- **Link cost too high** → Adjust link cost if needed

**Step 8: Check Firewall Rules Between DCs**
*Required ports for AD replication*
- **Ports 135, 389, 636, 3268, 49152+ open** → Not firewall issue
- **Some ports blocked** → Step 18: Open required AD ports
- **All ports open but still fails** → Back to Step 6 for errors

**Step 9: Check DNS Zone Replication**
*Action: Check _msdcs zone on both DCs*
- **Zone present on both** → Step 19: Check SRV records
- **Zone missing on one DC** → Step 20: Force DNS zone replication
- **Zone present but not replicating** → Check DNS application partition

**Step 11: Force Replication**
*Action: repadmin /syncall /AdeP*
- **Replication succeeded** → Check if ongoing or one-time issue
- **Still failing** → Step 6: Check specific error
- **Partially succeeded** → Identify which DCs failing

**Step 12: Metadata Cleanup for Error 8606**
*Action: ntdsutil metadata cleanup*
- **Phantom DC found** → Remove phantom DC object
- **No phantoms** → Step 21: Check USN rollback
- **Cleanup completed** → Force replication, verify

**Step 13: Name Server Not Advertising (8451/8452)**
*DC not advertising itself properly*
- **netlogon service stopped** → Start netlogon service
- **netlogon running** → Step 22: Re-register netlogon DNS records
- **After reregister, still fails** → Check DNS zone for SRV records

**Step 14: RPC Server Unavailable (1722)**
*RPC connectivity issue*
- **Port 135 blocked** → Step 8: Open port 135
- **Port open but RPC fails** → Step 23: Check RPC service status
- **RPC service running** → Check endpoint mapper

**Step 15: Secure Channel Problem (1256)**
*Computer account trust issue*
- **Password mismatch** → Step 24: Reset computer account
- **Account locked** → Unlock computer account in AD
- **Account missing** → Serious issue, may need DC demotion/promotion

**Step 16: Schema Version Mismatch (8614)**
*Schema versions don't match*
- **One DC has older schema** → Step 25: Update schema on older DC
- **Schema versions match** → May be false positive, check metadata

**Step 17: Check Site Link Schedule**
*Action: Site link properties > Change Schedule*
- **Replication blocked in current time** → Wait or adjust schedule
- **Schedule allows replication** → Step 26: Check site link cost
- **Schedule set to never** → Configure proper schedule

**Step 18: Open Required AD Ports**
*On firewall between DCs*
- **Rules added** → Test replication after 5 minutes
- **Cannot add rules** → Escalate to network team
- **Rules exist but traffic blocked** → Check for other firewalls

**Step 19: Check SRV Records**
*Action: nslookup -type=SRV _ldap._tcp.dc._msdcs.DOMAIN*
- **Both DCs listed** → DNS is good
- **One DC missing** → Step 22: Re-register DNS
- **No DCs listed** → Critical DNS issue, Step 20

**Step 20: Force DNS Zone Replication**
*Action: repadmin /replicate for DNS partitions*
- **DNS replicated** → Verify SRV records now present
- **DNS replication failed** → Check for DNS-specific errors
- **Partial replication** → May need multiple attempts

**Step 22: Re-register Netlogon DNS Records**
*Action: nltest /dsregdns on problem DC*
- **Registration succeeded** → Check DNS for new SRV records
- **Registration failed** → Check DNS service, Event Viewer
- **Succeeded but records still missing** → Manual creation needed

**Step 23: Check RPC Service**
*Action: Get-Service RPCSS*
- **Running** → Step 27: Check RPC port range
- **Stopped** → Start RPCSS service (critical!)
- **Stuck starting** → Reboot DC (after-hours if possible)

**Step 24: Reset Computer Account**
*Action: Reset-ComputerMachinePassword -Server PDC*
- **Reset successful** → Force replication, verify
- **Reset failed** → May need to reset from authoritative DC
- **After reset, still fails** → Deeper trust issue, may need demotion

**Step 27: Check RPC Port Range**
*Action: Check dynamic port range*
- **Default range (49152-65535)** → Range is fine
- **Custom restricted range** → Step 28: Ensure both DCs use same range
- **No dynamic ports available** → Exhaustion issue, investigate

**RESOLUTION: repadmin /showrepl shows recent successful replication on all DCs**

### Common Pitfalls
- Firewall blocking high ports (49152+) needed for RPC
- DNS SRV records missing or incorrect
- Phantom domain controller objects in AD Sites and Services
- Secure channel broken between DCs
- Time skew between DCs (> 5 minutes causes Kerberos failures)
- Antivirus blocking AD replication traffic
- Incorrect site link configuration

### Resolution Indicators
- repadmin /showrepl shows successful replication within last hour
- No replication errors in Directory Services event log
- dcdiag /test:replications passes
- Changes propagate between DCs within expected timeframe
- No Event ID 2042 (too long since last replication)

### Documentation Links
- AD Replication: https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/manage/troubleshoot/
- Repadmin Guide: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc770963(v=ws.11)
- Error Codes: Internal KB #AD-REPL-ERRORS

---

## Scenario 5: Password Reset Request (Simple Example)

### Issue Details
**Issue Name:** User Forgot Password - Needs Reset
**Category:** Account Management
**Estimated Time:** 2-5 minutes
**Common For:** Daily helpdesk task

### First Thing You Check
Verify user's identity

### Decision Tree

**Step 1: Can you verify user's identity?**
*Check against company verification policy*
- **YES (verified via phone/email/manager)** → Step 2: Locate user account
- **NO (cannot verify)** → Deny request, inform user of verification process
- **User is contractor** → Step 3: Check if manager approval required

**Step 2: Can you find user account in AD?**
*Action: Search Active Directory for username*
- **Account found** → Step 4: Check account status
- **Account not found** → Step 5: Check if name spelled correctly
- **Multiple accounts** → Step 6: Identify correct account

**Step 3: Manager Approval for Contractor**
*Per company policy*
- **Manager approves** → Step 2: Proceed with reset
- **Manager denies** → Inform contractor, deny request
- **Cannot reach manager** → Escalate to IT manager

**Step 4: Is account enabled?**
*Check account status*
- **Enabled** → Step 7: Reset password
- **Disabled** → Step 8: Check why disabled
- **Locked out** → Step 9: Unlock and reset

**Step 5: Check Name Spelling**
*Verify with user*
- **Found with correct spelling** → Step 4: Check status
- **Still not found** → Check if account exists, may need creation
- **User doesn't have account** → Route to new user request process

**Step 6: Identify Correct Account**
*Multiple John Smiths, etc.*
- **Identified by employee ID** → Step 4: Proceed
- **Identified by department** → Step 4: Proceed
- **Cannot identify** → Ask user for more info (start date, manager, etc.)

**Step 7: Reset Password**
*Action: Set temporary password in AD*
- **Reset successful** → Step 10: Communicate new password to user
- **Cannot reset (permission denied)** → Escalate to higher-level admin
- **Reset but user still can't login** → Step 11: Check for other issues

**Step 8: Account Disabled - Check Why**
*Look at account notes or ticket history*
- **Disabled for termination** → Do not enable, inform requester
- **Disabled for inactivity** → Step 12: Verify if user still employed
- **Disabled in error** → Enable account and reset password

**Step 9: Unlock Account**
*Action: Unlock account in AD*
- **Unlocked successfully** → Step 7: Reset password
- **Unlock failed** → Wait 15 minutes (lockout duration), try again
- **Immediately locks again** → Step 13: Check for automated login attempts

**Step 10: Communicate New Password**
*Securely provide temp password*
- **Told user over phone** → Instruct user must change at login
- **Sent via secure portal** → Provide portal link
- **User received password** → Step 14: Verify user can login

**Step 11: Reset Success But Login Failed**
*After reset, user still can't login*
- **Wrong username** → Provide correct username
- **Caps Lock on** → Inform user
- **Password not synced yet** → Wait 2-3 minutes, retry
- **MFA issue** → Different troubleshooting path

**Step 12: Verify User Still Employed**
*Check with HR or manager*
- **Still employed** → Enable account, reset password
- **Terminated** → Do not enable, close ticket
- **Unknown status** → Escalate to IT manager

**Step 13: Check for Automated Login Attempts**
*Saved credentials somewhere*
- **Old laptop auto-logging** → Have user change password on laptop
- **Mobile device** → Remove saved password on phone
- **Service account** → Update service account password
- **Can't identify source** → Change password multiple times

**Step 14: Verify User Can Login**
*Confirm with user*
- **Login successful** → Step 15: Set user must change password
- **Still cannot login** → Return to Step 11
- **Login works but can't access email** → Different issue

**Step 15: Force Password Change at Next Login**
*If not already set*
- **User will be prompted** → Document ticket, close
- **User successfully changed** → Resolution confirmed!
- **User locked out again** → May be complexity requirement issue

**RESOLUTION: User successfully logged in with new password**

### Common Pitfalls
- Not verifying user identity properly
- Forgetting to check if account is locked (not just disabled)
- Not telling user to change password at next login
- Multiple accounts for same name, resetting wrong one
- Account syncs slowly to other systems (email, VPN, etc.)
- User typing username incorrectly after reset

### Resolution Indicators
- User confirms successful login
- Account shows last login timestamp updated
- No subsequent lockout or password reset requests
- User able to access all required systems

### Documentation Links
- Password Policy: Internal KB #PWD-POLICY
- Identity Verification: Internal KB #ID-VERIFY
- Account Management: Internal KB #AD-ACCOUNTS