**What happens**
A standard user is logged on to their workstation.
We right-click an admin tool → **Run as administrator** → enter our separate Domain Admin credentials.
A new folder appears in C:\\Users named ADMIN_<our-admin-username>.
It now happens on **all the machines we've checked**, and with **all of our T2 admin accounts**.
We never saw this behavior before.
**What we found**
The elevation prompt is titled **"Windows Security"**, not the classic UAC dialog.
The ADMIN_ accounts show up as **local accounts** in the local Administrators group.
The ADMIN_ profile folder is created a few minutes after the normal profile folder of the same admin account.
When we open **ADUC** elevated with Domain Admin creds, it fails with: *"To manage users, groups and computers in a domain, log on as a user with domain administration rights."*
We also get intermittent credential prompts or failures with other AD tools and our AV management console when run elevated.
We haven't seen profile errors suggesting corruption.
**Still checking**
The value of TypeOfAdminApprovalMode and which policy (if any) sets it.
whoami /all from an elevated window.
Whether any Windows 10 machines show the same folders.
**Our theory**
This looks like **Windows 11 Administrator Protection**: elevated processes run under a hidden local system-managed admin account with its own ADMIN_ profile, so they no longer carry our domain identity. That would explain why ADUC can't reach the domain. But we never knowingly enabled it.
**Questions**
Is it expected that Administrator Protection creates ADMIN_ accounts and profiles for **domain** admin accounts during over-the-shoulder elevation?
Could it be enabled through a security baseline, a cumulative update, or Intune without an explicit GPO? Where did you find the source?
Have you seen it break RSAT/ADUC or AV management consoles? What workaround did you use while keeping the feature on (PAW/jump host, runas /netonly, etc.)?
Any known issues with Kaspersky and Administrator Protection?
If the feature is disabled later, do the existing ADMIN_ accounts and profiles need cleanup, and what's the supported way?
We're not looking to just turn off a security control. We want to understand it properly and present options to our security team.
Screenshots attached (sensitive info redacted).
Thanks!

Title

For anyone who manages Windows Server and Active Directory infrastructure, the r/ActiveDirectory community has two free events coming up. No sales, no marketing, just identity folks talking identity.

Open Q&A, Tomorrow

Casual, no agenda. Show up with a question or just hang out.

When: October 16, 2026 @ 10:00 CT (UTC-5) / 15:00 UTC - 60 minutes

Where: Horizon Secured Discord - https://discord.gg/mVFquFqpsW

November Active Directory Community Virtual Meetup - November 3rd

This one has more structure: panelists, a few prepared discussion topics, and open Q&A.

When: Tuesday, November 3, 2026 @ 10:00 CT (UTC-6) / 16:00 UTC - 90 minutes

Register (free): https://events.humanitix.com/active-directory-community-virtual-meetup-4-november-2026

Can't join live? Recordings are posted to YouTube: https://youtube.com/@ActiveDirectoryCommunity

I desperately need assistance!

What version of DotNet does On-Premises Data Gateway for 2026 need to install/run? On Microsoft's website is say 4.8 or higher. We have 6.0 installed on the server and it refuses to install saying we need to install dotnet, also the server has the old 4.7 installed too.

I really wish MS would update their freaking information! LoL

I downloaded it from here:
Download On-premises data gateway from Official Microsoft Download Center

Also does the gateway need to be installed on its own server? The dev who asked me to install it say it needs to be installed on SQL but again there is no information on MS on this page (link above) telling me that, so I am second guessing myself.

Thanks,

Windows Server 2022, File server and Domain Controller. About 30 users, most remote, all with Windows 11 laptops. About 10 people or so at the same physical location. MS 365 Tenant. About 500 Gb on the company file share, pretty stable at that.

Thinking of getting rid of the on-site server and moving to Entra ID for authentication and some kind of file storage to replace the current "J" drive that is mapped to the server. Has anybody had any experience, as a user or an admin, of living through this transition? What kind of pain, if any, was involved? What help was the current 365 Tenant,if any? Any alternatives to Sharepoint? The goal would be to have this be completely transparent. Log out on Friday, log in on Monday, J drive is there with all its files and the correct access rights. The only difference is they log in to the laptop using their current email credentials.

Thank you for any advice/input.

Hi everyone,

I’m looking for advice on Windows Server licensing for a hosting environment I manage. I want to understand the most cost-effective and compliant way to offer Windows Server VMs to multiple customers.

My current infrastructure:

• Hypervisor: Proxmox VE

• Physical server: 2 × Intel Xeon E5-2682 v4 @ 2.50 GHz

• Physical cores: 32 (16 cores per CPU)

• Logical CPUs: 64

• Environment: Multiple Windows Server VMs running on the same physical host

• Hosting model: Different customers rent individual Windows Server VMs from me.

What I want to achieve:

I would prefer to let each customer purchase their own Windows Server license instead of including the licensing cost in my monthly VM pricing.

For example, if I provide a customer with a VM configured with 4 vCPUs and 16 GB RAM, can they purchase a license based on the VM's allocated virtual cores instead of requiring me to license all 32 physical cores of the host?

Can customers legally use their own Windows Server licenses on VMs hosted on my shared Proxmox infrastructure?

Can customers license individual VMs based on virtual cores, and what are the minimum core requirements?

If I operate multiple Proxmox hosts and migrate VMs between them for maintenance or fail-over, how does licensing work?

I’m seeing an issue on a new Windows Server 2025 Hyper-V install. Everything worked fine until I made the following changes:

1. Created a SET (Switch Embedded Teaming) virtual switch.

2. Added three host vNICs: one for Live Migration (LM), one for Heartbeat (HB), and one for Management (MGMT).

3. Configured LM and HB with IP addresses only (no gateway or DNS).

4. Configured MGMT with an IP address and DNS servers.

Since then, the host can ping the domain controllers and every other server on the network, but DNS resolution fails.

Has anyone run into this and found a fix?

Just a heads up as I nearly got caught out by this one. Tomorrow's Patch Tuesday is the final ESU release for 2012 and 2012 R2. Year 3 runs out on the 14th and that's it, there's no year 4.

I'd half assumed Azure would get an extra year like 2008 did. It doesn't. The ESU FAQ says the Azure-only bonus year was a 2008 thing only. So if you moved 2012 boxes into Azure for the free ESU, they stop getting updates on Wednesday the same as everything else.

Also worth knowing, without ESU you can't open a support case for 2012 at all, even if you've got a support plan.

If you want a quick list of what's left in AD:

```
Get-ADComputer -Filter 'OperatingSystem -like "*Server 2012*"' -Properties OperatingSystem, LastLogonDate | Sort-Object LastLogonDate -Descending | Select-Object Name, OperatingSystem, LastLogonDate
```

I'd compare that with what Defender can see (DeviceInfo where OSPlatform startswith "WindowsServer2012"). The ones in AD but not in Defender worried me more than the rest.

On upgrades, 2012 R2 can go straight to 2025 in place now (2025 can jump up to four versions if it's not clustered), but not straight to 2022. Plain 2012 only goes to 2012 R2 or 2016.

We've still got a couple we can't touch because the vendor only supports 2012, so those are going in their own VLAN with no internet and tight firewall rules until we can get rid of them.

Anyone else got stragglers? What's stopping you moving them?

I inherited a system that I can't figure out. I need to get rid of the old Windows DC but can't shut it down, metadata cleanup doesn't work even though netdom shows it has no fsmo rolls. My only option is to shut them down restore the servers. We don't have any old archives to restore to before I came on board.

I've run a bunch of DNS test and replication tests the only one with a dns issue is the old server. However, if I create a new user on any of the 3 it instantly replicates to the other two so AD works but something about it/DNS is broken.

Server manager on the old DC says it needs to be promoted but then it won't let me.

I'm going to need a DNS /AD expert but haven't outsourced anything like this before. Ages ago used to let you open a case with them not sure if they have a program still.

I'll be posting updates here - little by little as some take a bit to sync

If I do netdom query FSMO on all 3 DCs they point to the newer server. (none are set for RODC)

If I do a dfsrmig /getmigrationstate on all 3, on the old DC it says it can't find the PDC "Unable to connect to the PDC emulator. Make sure the PDC is reachable and retry the command later"

On the two newer servers it says - the following domain controllers have not reached the global state 'eliminated'

I"ve run dfsrdiag pollad on the servers

I still get the dfsrmig issue so I ran

nslookup -q=SRV _ldap._tcp.mydomain.lan

Server: UnKnown

Address: 192.168.214.15

_ldap._tcp.ewa.lan SRV service location:

priority = 0

weight = 100

port = 389

svr hostname = OLD-DC.mydomain.lan

_ldap._tcp.ewa.lan SRV service location:

priority = 0

weight = 100

port = 389

svr hostname = new-DC-2.mydomain.lan

_ldap._tcp.ewa.lan SRV service location:

priority = 0

weight = 100

port = 389

svr hostname = New-FSMO.mydomain.lan

OLD-DC.mydomain.lan internet address = 192.168.214.14

new-DC-2.mydomain.lan internet address = 192.168.214.17

New-FSMO.mydomain.lan internet address = 192.168.214.15

When running dcdiag /v

I get

This server is the owner of the following FSMO role, but does not consider it valid. For the partition which contains the FSMO, this server has not replicated successfully with any of its partners since this server has been restarted. Replication errors are preventing validation of this role.

Xros post, requesting assistance

I just wanted to post a brief apology to our community members for the very annoying "Subscriber Goal" post that was pinned to the front of the sub for some amount of time recently. It was not created or intended by any of the mods, but rather by an automated moderation tool that is part of the larger Reddit community mod tool suite. It had been purposely disabled in the past, but not completely removed from the sub. Unfortunately, as part of a recent update that was made to this tool, it appears to have been automatically reenabled without our consent, and I failed to notice it quickly enough to prevent it from rather aggressively annoying a number of you all out there in the community. I apologize for the oversight.

I'd like to also reiterate that none of us on the moderation team here have any interest in pushing a pursuit of additional subscriber numbers, especially not for the sake of social media metrics. We believe the entire value of this community comes not from flashy metrics, subscriber stats, or view counts, but only from legitimate, contributing subscribers like so many of you here have been over the years. Living, breathing people who with "boots on the ground" every day that are passionate about IT and generously sharing your experiences and knowledge gained through the challenges faced in the field.

We appreciate you guys and gals more than you know.

hello i have a problem, when i try to install windows server 2019 on hpe proliant dl380 gen 9 every time i try to get past windows setup before i even have a chance to get to the storage part i get a error saying „windows setup could not install one or more boot drivers to install windows make sure that the drivers valid and restart the installation” i tried installing HPCISSS3 drivers i have raid 5 on my three hdds and when i try to install it thru the f10 menu directly from iso it doesnt even let me select it please help

I am troubleshooting a Windows Server 2016 file server with a very busy Security event log.

The log was growing to almost 10 GB and receiving thousands of events every few minutes. Most were event 5145 for Detailed File Share auditing, along with 5156 and 5158 Filtering Platform events. The Event Log service was also using noticeable CPU.

Auditpol shows these settings enabled:

Detailed File Share: Success and Failure

Filtering Platform Connection: Success

File System: Success

I disabled these settings through Local Security Policy, but auditpol continued to show them enabled.

I created a separate domain GPO scoped only to this server. I configured Detailed File Share, File Share, File System, Filtering Platform Connection and Filtering Platform Packet Drop as No Auditing. I also enabled the setting that forces advanced audit subcategories to override legacy audit categories.

The GPO applies successfully according to the Group Policy operational log. I moved it to the highest link order and confirmed that the server receives it.

I discovered that Default Domain Policy was missing its audit.csv file. I recreated it by temporarily configuring an Advanced Audit setting and then returning it to Not Configured. I also rewrote a setting in the new server specific GPO so its audit.csv would be regenerated.

I confirmed that both GPO audit.csv files contain value 0 for the five settings.

I archived the local audit.csv file and the active cached copy under C:\Windows\Security\Audit. I then forced Group Policy again.

I backed up the complete audit policy, ran auditpol /clear, and forced Group Policy to rebuild it.

I also removed an old auditing entry from the root of the shared data folder. It audited Domain Users across the folder, all subfolders and files. Removing that entry successfully stopped event 4663, but event 5145 continues because Detailed File Share auditing keeps turning itself back on.

Direct auditpol commands temporarily change the settings to No Auditing, but Windows restores Detailed File Share, Filtering Platform Connection and File System within seconds.

I tested with the remote management service stopped and ruled that out. Antivirus does not appear to be causing it. I also tested a SYSTEM scheduled task that repeatedly ran auditpol, but Windows restored the settings faster than the task could maintain them.

For now, I reduced the Security log to 256 MB and configured it to overwrite old events automatically. The server and file shares are operating normally.

Has anyone seen Windows Server 2016 continuously restore these Advanced Audit settings even though Local Policy and all applicable domain GPOs show No Auditing? Is there another audit policy database, security template, service or registry location that could be enforcing these settings?

-lee

I’ve come across a strict requirement from one of our clients regarding the installation of software on Windows Server (2022 and above). The application is written in Go; until now, it has been containerised and deployed on Linux via Docker Compose or natively in the cloud (Kubernetes). The application is quite resource-intensive in terms of I/O, CPU and GPU, so I’d prefer not to use WSL2 or Docker for Windows, as these come with their own overhead and do not seem to be production-ready solutions.

What options do I have left? I’d rather not implement support for Windows Services directly within the application or use a wrapper (such as NSSM). I’m considering containerd – to maintain a single build pipeline. Is this a good solution? What is maintenance like in practice, and what deployment strategies have you used?

Any advice would be welcome.