[RandomChance]

Hah, we (hopefully!) get an update window every 18 months! And a staging a new production like test environment starts with another $100K invoice..

And thank goodness Microsoft hard-coded in a 10 hour delay to ensure the KDS root key of a domain is propagated, even if I create it before I create additional domain controllers...

Such fun!

[tumba]

Off topic, but to create an immediately effective KDS root key, just set the effective time ten hours in the past. You can validate propagation by looking for the 4004 event in the KDS event log. This is probably not a good idea in production, but is useful when building/rebuilding a lab.

  Add-KdsRootKey –EffectiveTime ((get-date).addhours(-10))

See https://technet.microsoft.com/en-us/library/jj128430.aspx

[henrikschroder]

Luxury!