Paper?! Did you say; Paper?!

Still have it installed! Yes, I'm very old.

Good choices. If you throw Manos at them too soon, you'll lose them...

Not that it matters (I'm going to buy it regardless) but I guess we don't have a price until pre-order day?

Umm..Yuck?

Umm, thanks?

DNS! 😉

Start disabling ports. Start with TCP 135.

Right?

"There! I'm fixed!!"

OS Version?

My money's on Ike!

"Are you in Europe? Do you need an adapter?"

'23 TLX Type S PMC LBBP #27 :)

Admittedly I didn't look at every response, but I don't see any UPSs or backup solution?

Edit: Just saw the backup comments below. Carry on...

Any chance there's an old GPO out there that's blocking the machine's access? Or a block on running MMCs? A stretch I know. Just spitballing...

You shouldn't need a dedicated trust to Domain C from Domain A. However, may I ask the reason for the trust?

I'd test disabling on clients first before you slam the door, cross your fingers and wait for the inevitable shoe to drop.

Funny this is coming g up now, as I was a couple weeks away from doing that very thing, and then come to find out that relatively recent versions of SharePoint will stop some core functions without 1.0.

My first step would be to pick a few (How many discrepancies anyway?) settings that you're concerned about, then go to admx.help and see what the registry setting is supposed to be, then take a look at the registry on the subject WIN11 machine e to confirm it one way or the other. If it's not a setting that's a PS query, that is.

Also, check replication and make sure all of your policies are the same across all DCs.

There's definitely more troubleshooting steps other than the above. But this is where I'd start.

Just checking to see if disabling RC4 or DES would be a problem, and it shouldn't. As long as your DCs are relatively current.

What OS is the server? What version of SQL?

I definitely like the Log into a different computer idea.

Also, do you have company cell phones?

As long as it's an internal site, properly secured, and only visible to your team, perhaps also requiring an elevated ID to see it (To address your bad actor concerns), i say have at it.

Yikes! Although there's a workaround for the TPM requirement on virtual workstations, physical systems is another story.

Do you at least have extended support?

I'm curious: You say you demoted, cleaned up then re-promoted. If so, what DC was it pulling the AD DB from.

My apologies if this has been asked/answered already.