# Localized	09/15/2018 04:57 AM (GMT)	303:6.40.10614 	DirectoryServices.psd1
# Only add new (name,value) pairs to the end of this table
# Do not remove, insert or re-arrange entries
   ConvertFrom-StringData @'
       ###PSLOC start localizing
       #
       # helpID 
       #

# Site-specific SRV record checks

chkLdapAtSite_title=This domain controller must advertise as an LDAP server for the domain in its local site
chkLdapAtSite_problem=The "LdapAtSite" DNS service (SRV) resource record that advertises this domain controller as an available LDAP server for the domain in its local site is not registered. All writeable domain controllers and read-only domain controllers (RODCs) must register this record.
chkLdapAtSite_impact=Other member computers and domain controllers in the domain or forest will not be able to locate this domain controller in the local site as an LDAP server. This domain controller will not be able to provide a full suite of services.
chkLdapAtSite_resolution=Ensure that "LdapAtSite" is not configured in the "DnsAvoidRegisteredRecords" list, either through Group Policy or through the registry. Restart the Netlogon service. Verify that the DNS service (SRV) resource record "{4}", pointing to the local domain controller "{0}", is registered in DNS.
chkLdapAtSite_compliant=The domain Controller "{0}" is in compliance with this best practice. The LdapAtSite DNS record for the domain controller {0} is registered in DNS.

chkKdcAtSite_title=This domain controller must advertise as a KDC for the domain in its local site
chkKdcAtSite_problem=The "KdcAtSite" Domain Name System (DNS) service (SRV) resource record that advertises this domain controller as an available Key Distribution Center (KDC) server for the domain is not registered. All KDC servers in the domain must register this record.
chkKdcAtSite_impact=Other member computers and domain controllers in the domain or forest will not be able to locate this domain controller in the local site as a KDC server. This domain controller will not be able to provide a full suite of services.
chkKdcAtSite_resolution=Ensure that "KdcAtSite" is not configured in the "DnsAvoidRegisteredRecords" list, either through Group Policy or through the registry. Restart the Netlogon service. Verify that the DNS record "{4}", pointing to the local domain controller "{0}", is registered in DNS.
chkKdcAtSite_compliant=The domain controller "{0}" is in compliance with this best practice. The KdcAtSite DNS record for the domain controller {0} is registered in DNS.

chkDcAtSite_title=This server must advertise itself as a domain controller for the domain in its local site
chkDcAtSite_problem=The "DcAtSite" DNS service (SRV) resource record that advertises this server as an available domain controller for the domain in its local site is not registered. All writeable and read-only domain controllers (RODCs) in the domain must register this record.
chkDcAtSite_impact=Other member computers and domain controllers in the domain or forest will not be able to locate this domain controller in the local site. This domain controller will not be able to provide a full suite of services.
chkDcAtSite_resolution=Ensure that "DcAtSite" is not configured in the "DnsAvoidRegisteredRecords" list, either through Group Policy or through the registry. Restart the Netlogon service. Verify that the DNS service (SRV) resource record "{4}", pointing to the local domain controller "{0}", is registered in DNS.
chkDcAtSite_compliant=The domain controller "{0}" is in compliance with this best practice. The DcAtSite DNS record for the domain controller {0} is registered in DNS.

chkRfc1510KdcAtSite_title=This domain controller must advertise itself as a Kerberos server for the domain in its local site
chkRfc1510KdcAtSite_problem=The "Rfc1510KdcAtSite" Domain Name System (DNS) service (SRV) resource record that advertises this domain controller as an available Kerberos server for the domain in its local site is not registered. All Kerberos servers in the domain must register this record.
chkRfc1510KdcAtSite_impact=Other member computers and domain controllers in the domain or forest will not be able to locate this domain controller as a Kerberos server in the local site. This domain controller will not be able to provide a full suite of services.
chkRfc1510KdcAtSite_resolution=Ensure that "Rfc1510KdcAtSite" is not configured in the "DnsAvoidRegisteredRecords" list, either through Group Policy or through the registry. Restart the Netlogon service. Verify that the DNS record "{4}", pointing to the local domain controller "{0}", is registered in DNS.
chkRfc1510KdcAtSite_compliant=The domain controller "{0}" is in compliance with this best practice. The Rfc1510KdcAtSite DNS record for the domain controller {0} is registered in DNS.

chkGenericGcAtSite_title=This domain controller must advertise itself as a generic global catalog server for the forest in its local site
chkGenericGcAtSite_problem=The "GenericGcAtSite" DNS service (SRV) resource record that advertises this domain controller as an available generic global catalog server for the forest in its local site is not registered. All global catalogs and read-only global catalogs in the forest must register this record.
chkGenericGcAtSite_impact=Other member computers and domain controllers in the domain or forest will be not be able to locate this domain controller as a generic global catalog server in the local site. This domain controller will not be able to provide a full suite of services.
chkGenericGcAtSite_resolution=Ensure that "GenericGcAtSite" is not configured in the "DnsAvoidRegisteredRecords" list, either through Group Policy or through the registry. Restart the Netlogon service. Verify that the DNS service (SRV) resource record "{4}", pointing to the local domain controller "{0}", is registered in DNS.
chkGenericGcAtSite_compliant=The domain controller "{0}" is in compliance with this best practice. The GenericGcAtSite DNS record for the domain controller {0} is registered in DNS.

chkGcAtSite_title=This domain controller must advertise as a global catalog server for the forest in its local site
chkGcAtSite_problem=The "GcAtSite" DNS service (SRV) resource record that advertises this domain controller as an available global catalog server for the domain in its local site is not registered. All writeable and read-only global catalogs in the forest must register this record.
chkGcAtSite_impact=Other member computers and domain controllers in the domain or forest will not be able locate this domain controller in the local site as a global catalog server. This domain controller will not be able to provide a full suite of services.
chkGcAtSite_resolution=Ensure that "GcAtSite" is not configured in the "DnsAvoidRegisteredRecords" list, either through Group Policy or through the registry. Restart the Netlogon service. Verify that the DNS service (SRV) record "{4}", pointing to the local domain controller "{0}", is registered in DNS.
chkGcAtSite_compliant=The domain controller "{0}" is in compliance with this best practice. The GcAtSite DNS record for the domain controller {0} is registered in DNS.

# Global SRV record checks. Plus domain and forest A/AAAA record checks. Plus, CNAME record check.

chkLdapIpAddress_title=This domain controller must register its DNS host (A or AAAA) resource records for the domain
chkLdapIpAddress_problem=The "LdapIpAddress" DNS (A/AAAA) resource records that advertise this domain controller as an available LDAP server in the domain and point to its IPv4 or IPv6 addresses are not registered. All writeable domain controllers in the domain (but not read-only domain controllers (RODCs)) must register these records.
chkLdapIpAddress_impact=Other member computers and domain controllers in the domain or forest will not be able to locate this domain controller as a writeable Lightweight Directory Access Protocol (LDAP) server. This domain controller will not be able to provide a full suite of services.
chkLdapIpAddress_resolution=Ensure that "LdapIpAddress" is not configured in the "DnsAvoidRegisteredRecords" list, either through Group Policy or through the registry. Restart the Netlogon service. Verify that the host (A/AAAA) resource records "{2}", pointing to the local computer's IP addresses, are registered in DNS.
chkLdapIpAddress_compliant=The domain controller "{0}" is in compliance with this best practice. The LdapIpAddress DNS record for the domain controller {0} is registered in DNS.

chkLdap_title=This domain controller must advertise as an LDAP server for the domain
chkLdap_problem=The "Ldap" DNS service (SRV) resource record that advertises this domain controller as an available LDAP server for the domain is not registered. All writeable domain controllers (but not read-only domain controllers (RODCs)) must register this record.
chkLdap_impact=Other member computers and domain controllers in the domain or forest will not be able to locate this domain controller as a writeable Lightweight Directory Access Protocol (LDAP) server. This domain controller will not be able to provide a full suite of services.
chkLdap_resolution=Ensure that "Ldap" is not configured in the "DnsAvoidRegisteredRecords" list, either through Group Policy or through the registry. Restart the Netlogon service. Verify that the DNS service (SRV) resource record "{4}", pointing to the local domain controller "{0}", is registered in DNS.
chkLdap_compliant=The domain controller "{0}" is in compliance with this best practice. The Ldap DNS record for the domain controller {0} is registered in DNS.

chkDcByGuid_title=This domain controller must register a DNS SRV resource record, which is required for replication to function correctly
chkDcByGuid_problem=The "DcByGuid" DNS service (SRV) resource record that advertises this server as an available domain controller in the domain and ensures correct replication is not registered. All domain controllers (but not RODCs) in the domain must register this record.
chkDcByGuid_impact=Other member computers and domain controllers in the domain or forest will not be able to locate this domain controller. This domain controller will not be able to provide a full suite of services.
chkDcByGuid_resolution=Ensure that "DcByGuid" is not configured in the "DnsAvoidRegisteredRecords" list, either through Group Policy or through the registry. Restart the Netlogon service. Verify that the DNS service (SRV) resource record "{4}", pointing to the local domain controller "{0}", is registered in DNS.
chkDcByGuid_compliant=The domain controller "{0}" is in compliance with this best practice. The DcByGuid DNS record for the domain controller {0} is registered in DNS.

chkKdc_title=This domain controller must advertise as a KDC for the domain
chkKdc_problem=The "Kdc" Domain Name System (DNS) service (SRV) resource record that advertises this domain controller as an available Key Distribution Center (KDC) server for the domain is not registered. All KDC servers in the domain must register this record.
chkKdc_impact=Other member computers and domain controllers in the domain or forest will be not be able to locate this domain controller as a KDC server. This domain controller will not be able to provide a full suite of services.
chkKdc_resolution=Ensure that "Kdc" is not configured in the "DnsAvoidRegisteredRecords" list, either through Group Policy or through the registry. Restart the Netlogon service. Verify that the DNS service (SRV) resource record "{4}", pointing to the local domain controller "{0}", is registered in DNS.
chkKdc_compliant=The domain controller "{0}" is in compliance with this best practice. The Kdc DNS record for the domain controller "{0}" is registered in DNS.

chkDc_title=This server must advertise itself as a domain controller for the domain
chkDc_problem=The "Dc" DNS service (SRV) resource record that advertises this server as an available domain controller for the domain is not registered. All writeable domain controllers (but not read-only domain controllers (RODCs)) in the domain must register this resource record.
chkDc_impact=Other member computers and domain controllers in the domain or forest will not be able to locate this domain controller. This domain controller will not be able to provide a full suite of services.
chkDc_resolution=Ensure that "Dc" is not configured in the "DnsAvoidRegisteredRecords" list, either through Group Policy or through the registry. Restart the Netlogon service. Verify that the DNS record "{4}", pointing to the local domain controller "{0}", is registered in DNS.
chkDc_compliant=The domain controller "{0}" is in compliance with this best practice. The Dc DNS record for the domain controller {0} is registered in DNS.

chkRfc1510Kdc_title=This domain controller must register its Rfc1510Kdc DNS record to advertise itself as Kerberos Server for the domain
chkRfc1510Kdc_problem=The "Rfc1510Kdc" Domain Name System (DNS) service (SRV) resource record that advertises this domain controller as an available Kerberos server for the domain is not registered. All Kerberos servers in the domain must register this record.
chkRfc1510Kdc_impact=Other member computers and domain controllers in the domain or forest will not be able to locate this domain controller as a Kerberos server. This domain controller will not be able to provide a full suite of services.
chkRfc1510Kdc_resolution=Ensure that "Rfc1510Kdc" is not configured in the "DnsAvoidRegisteredRecords" list, either through Group Policy or through the registry. Restart the Netlogon service. Verify that the DNS record "{4}", pointing to the local domain controller "{0}", is registered in DNS.
chkRfc1510Kdc_compliant=The domain controller "{0}" is in compliance with this best practice. The Rfc1510Kdc DNS record for the domain controller {0} is registered in DNS.

chkRfc1510UdpKdc_title=This domain controller must register its Rfc1510UdpKdc DNS record to advertise itself as Kerberos Server for the domain
chkRfc1510UdpKdc_problem=The "Rfc1510UdpKdc" Domain Name System (DNS) service (SRV) resource record that advertises this domain controller as an available Kerberos server for the domain is not registered. All Kerberos servers in the domain must register this resource record.
chkRfc1510UdpKdc_impact=Other member computers and domain controllers in the domain or forest will not be able to locate this domain controller as a Kerberos server. This domain controller will not be able to provide a full suite of services.
chkRfc1510UdpKdc_resolution=Ensure that "Rfc1510UdpKdc" is not configured in the "DnsAvoidRegisteredRecords" list, either through Group Policy or through the registry. Restart the Netlogon service. Verify that the DNS service (SRV) resource record "{4}", pointing to the local domain controller "{0}", is registered in DNS.
chkRfc1510UdpKdc_compliant=The domain controller "{0}" is in compliance with this best practice. The Rfc1510UdpKdc DNS record for the domain controller {0} is registered in DNS.

chkRfc1510Kpwd_title=This domain controller must register its Rfc1510Kpwd DNS record to advertise itself as Kerberos Server for the domain
chkRfc1510Kpwd_problem=The "Rfc1510Kpwd" Domain Name System (DNS) service (SRV) resource record that advertises this domain controller as an available Kerberos server for the domain is not registered. All Kerberos servers in the domain must register this record.
chkRfc1510Kpwd_impact=Other member computers and domain controllers in the domain or forest will not be able to locate this domain controller as a Kerberos server. This domain controller will not be able to provide a full suite of services.
chkRfc1510Kpwd_resolution=Ensure that "Rfc1510Kpwd" is not configured in the "DnsAvoidRegisteredRecords" list, either through Group Policy or through the registry. Restart the Netlogon service. Verify that the DNS service (SRV) resource record "{4}", pointing to the local domain controller "{0}", is registered in DNS.
chkRfc1510Kpwd_compliant=The domain controller "{0}" is in compliance with this best practice. The Rfc1510Kpwd DNS record for the domain controller {0} is registered in DNS.

chkRfc1510UdpKpwd_title=This domain controller must register its Rfc1510UdpKpwd DNS record to advertise itself as Kerberos Server for the domain
chkRfc1510UdpKpwd_problem=The "Rfc1510UdpKpwd" Domain Name System (DNS) service (SRV) resource record that advertises this domain controller as an available Kerberos server for the domain is not registered. All Kerberos servers in the domain must register this record.
chkRfc1510UdpKpwd_impact=Other member computers and domain controllers in the domain or forest will not be able to locate this domain controller as a Kerberos server. This domain controller will not be able to provide a full suite of services.
chkRfc1510UdpKpwd_resolution=Ensure that "Rfc1510UdpKpwd" is not configured in the "DnsAvoidRegisteredRecords" list, either through Group Policy or through the registry. Restart the Netlogon service. Verify that the DNS service (SRV) resource record "{4}", pointing to the local domain controller "{0}", is registered in DNS.
chkRfc1510UdpKpwd_compliant=The domain controller "{0}" is in compliance with this best practice. The Rfc1510UdpKpwd DNS record for the domain controller {0} is registered in DNS.

chkGc_title=This domain controller must advertise as the global catalog server for the forest
chkGc_problem=The "Gc" DNS service (SRV) resource record that advertises this domain controller as an available global catalog server for the domain is not registered. All writeable global catalogs (not including read-only global catalogs) in the forest must register this record.
chkGc_impact=Other member computers and domain controllers in the domain or forest will not be able to locate this domain controller as a global catalog server. This domain controller will not be able to provide a full suite of services.
chkGc_resolution=Ensure that "Gc" is not configured in the "DnsAvoidRegisteredRecords" list, either through Group Policy or through the registry. Restart the Netlogon service. Verify that the DNS service (SRV) resource record "{4}", pointing to the local domain controller "{0}", is registered in DNS.
chkGc_compliant=The domain controller "{0}" is in compliance with this best practice. The Gc DNS record for the domain controller {0} is registered in DNS.

chkGcIpAddress_title=This global catalog server must register its host (A/AAAA) resource records for the forest
chkGcIpAddress_problem=The "GcIpAddress" DNS host (A/AAAA) resource records that advertise this domain controller as a global catalog server for the forest and point to its IPv4 or IPv6 addresses are not registered. All global catalogs (but not read-only global catalogs) in the forest must register these records.
chkGcIpAddress_impact=Other member computers and domain controllers in the domain or forest will not be able to locate this domain controller as a global catalog server. This domain controller will not be able to provide a full suite of services.
chkGcIpAddress_resolution=Ensure that "GcIpAddress" is not configured in the "DnsAvoidRegisteredRecords" list, either through Group Policy or through the registry. Restart the Netlogon service. Verify that the DNS service (SRV) resource record "{4}", pointing to the local domain controller "{0}", is registered in DNS.
chkGcIpAddress_compliant=The domain controller "{0}" is in compliance with this best practice. The GcIpAddress DNS record for the domain controller {0} is registered in DNS.

chkGenericGc_title=This domain controller must advertise itself as a generic global catalog server for the forest
chkGenericGc_problem=The "GenericGc" DNS service (SRV) resource record that advertises this domain controller as an available generic global catalog server for the forest is not registered. All global catalogs (but not read-only global catalogs) in the forest must register this record.
chkGenericGc_impact=Other member computers and domain controllers in the domain or forest will not be able to locate this domain controller as a generic global catalog server. This domain controller will not be able to provide a full suite of services.
chkGenericGc_resolution=Ensure that "GenericGc" is not configured in the "DnsAvoidRegisteredRecords" list, either through Group Policy or through the registry. Restart the Netlogon service. Verify that the DNS record "{4}", pointing to the local domain controller "{0}", is registered in DNS.
chkGenericGc_compliant=The domain controller "{0}" is in compliance with this best practice. The GenericGc DNS record for the domain controller {0} is registered in DNS.

chkPdc_title=This domain controller must advertise as a PDC for the domain
chkPdc_problem=The "Pdc" Domain Name System (DNS) service (SRV) resource record that advertises this domain controller as an available primary domain controller (PDC) for the domain is not registered. All PDCs in the forest must register this resource record.
chkPdc_impact=Other member computers and domain controllers in the domain or forest will not be able to locate this domain controller as a PDC. This domain controller will not be able to provide a full suite of services.
chkPdc_resolution=Ensure that "Pdc" is not configured in the "DnsAvoidRegisteredRecords" list, either through Group Policy or through the registry. Restart the Netlogon service. Verify that the DNS service (SRV) record "{4}", pointing to the local domain controller "{0}", is registered in DNS.
chkPdc_compliant=The domain controller "{0}" is in compliance with this best practice. The Pdc DNS record for the domain controller {0} is registered in DNS.

chkDsaCname_title=This domain controller must register an alias (CNAME) resource record with its DsaGuid for the forest
chkDsaCname_problem=The "DsaCname" Domain Name System (DNS) alias (CNAME) resource record that ensures correct replication functionality is not registered on this domain controller. All writeable domain controllers must register this record.
chkDsaCname_impact=Replication is not functioning correctly on this domain controller. If other domain controllers in the domain or forest are not able to resolve the CNAME record of this domain controller, the changes that are made on this domain controller will not be replicated to any other domain controllers in the domain or forest.
chkDsaCname_resolution=Ensure that "DsaCname" is not configured in the "DnsAvoidRegisteredRecords" list, either through Group Policy or through the registry. Restart the Netlogon service. Verify that the DNS CNAME resource record "{4}", pointing to the local domain controller "{0}", is registered in DNS.
chkDsaCname_compliant=The domain controller "{0}" is in compliance with this best practice. The DsaCname DNS record for the domain controller {0} is registered in DNS.

# Number of DCs in domain check

chkNumDcInDomain_title=All domains should have at least two domain controllers for redundancy
chkNumDcInDomain_problem=The domain {0} has only one domain controller.
chkNumDcInDomain_impact=In the event of a failure on the domain's only domain controller, users will not be able to log in to the domain or access domain resources.
chkNumDcInDomain_resolution=Add one or more additional domain controllers to the domain to handle authentication and authorization requests in case there is a failure on the domain's single available domain controller.
chkNumDcInDomain_compliant=The domain "{0}" is in compliance with this best practice. The domain "{0}" has at least two domain controllers.

# FSMO Connectivity checks

chkDcConnectivityWithRid_title=The domain controller {0} must be able to connect to the RID master in this domain
chkDcConnectivityWithRid_problem=The domain controller {0} cannot connect to the relative ID (RID) master {1} in this domain.
chkDcConnectivityWithRid_impact=When it runs out of the allocated set of RIDs, the domain controller {0} will not be able to generate RIDs for new objects.
chkDcConnectivityWithRid_resolution=Make sure that this domain controller is able to connect with the RID master {1} in this domain.

chkDcConnectivityWithPdc_title=The domain controller {0} must be able to connect to the PDC emulator master in this domain
chkDcConnectivityWithPdc_problem=The domain controller {0} cannot connect to the primary domain controller (PDC) emulator master {1} in this domain.
chkDcConnectivityWithPdc_impact=The PDC emulator processes password changes from earlier-version clients and other domain controllers on a best-effort basis; handles password authentication requests involving passwords that have recently changed and not yet been replicated throughout the domain; and, by default, synchronizes time. If the domain controller {0} cannot connect to the PDC emulator, domain controller {0} cannot process authentication requests, it may not be able to synchronize time, and password updates cannot be replicated to it.
chkDcConnectivityWithPdc_resolution=Make sure that this domain controller is able to connect with the PDC Emulator master {1} in this domain.

# FSMO role grouping checks

chkForestFsmoSameMachine_title=The schema master role and the domain naming master role should be owned by the same domain controller in the forest
chkForestFsmoSameMachine_problem=The schema operations master role and the domain naming operations master role (also known as flexible single master operations (FSMO) roles) are owned by different domain controllers in the forest.
chkForestFsmoSameMachine_impact=When the schema master role and the domain naming master role are held by the same domain controller, administration of these roles is simplified. However, this is not a strict rule, and you can move these roles to different domain controllers if you prefer.
chkForestFsmoSameMachine_resolution=Consider consolidating the schema master role and the domain naming master role onto a single domain controller. Keep the domain controller in a secure environment.
chkForestFsmoSameMachine_compliant=The forest "{0}" is in compliance with this best practice. The schema master role and the domain naming master role in this forest are owned by the same domain controller.

chkDomainFsmoSameMachine_title=The RID master role and the PDC emulator master role should be owned by the same domain controller in the domain
chkDomainFsmoSameMachine_problem=The relative ID (RID) operations master role and the primary domain controller (PDC) emulator operations master role (also known as flexible single master operations (FSMO) roles) are owned by different domain controllers in the domain.
chkDomainFsmoSameMachine_impact=Because of the close interaction between the RID master and the PDC emulator, these two roles should be held by a single domain controller or, as an alternative, by two domain controllers that are well connected.
chkDomainFsmoSameMachine_resolution=If the RID master role and the PDC emulator master role are held by two different domain controllers, ensure that these two domain controllers are well connected or consider consolidating these roles onto a single domain controller.
chkDomainFsmoSameMachine_compliant=The domain "{0}" is in compliance with this best practice. The RID master and PDC emulator roles on this domain are owned by the same domain controller.

# DNS client checks

chkDnsHostRecordRegistration_title=This domain controller must register its DNS host A/AAAA records
chkDnsHostRecordRegistration_problem=The Domain Name System (DNS) host (A/AAAA) resource records that map from the fully qualified DNS domain name to the IPv4 or IPv6 addresses are not registered on this domain controller. All domain controllers must register these records.
chkDnsHostRecordRegistration_impact=Other member computers and domain controllers in the domain or forest will not be able to locate this domain controller. This domain controller will not be able to provide a full suite of services.
chkDnsHostRecordRegistration_resolution=Ensure that the DNS Client service on the server is configured to register the appropriate host (A/AAAA) resource records with an authoritative DNS server for the domain.
chkDnsHostRecordRegistration_compliant=The domain controller "{0}" is in compliance with this best practice. Its host (A/AAAA) resource records are registered in DNS.

chkDnsHostRecordAddress_title=This domain controller must register its correct IP addresses with the DNS server
chkDnsHostRecordAddress_problem=The Domain Name System (DNS) host resource records for this domain controller's fully qualified domain name currently map to the IP addresses that do not belong to this domain controller. The invalid IP addresses are {1}.
chkDnsHostRecordAddress_impact=Other member computers and domain controllers in the domain or forest might not be able to locate this domain controller. This domain controller will not be able to provide a full suite of services.
chkDnsHostRecordAddress_resolution=Ensure that the DNS Client service on this domain controller is configured and able to register valid host resource records with an authoritative DNS server for the domain.

# Lingering objects

chkStrictReplicationConsistency_title=Strict replication consistency should be enabled on all domain controllers in this forest
chkStrictReplicationConsistency_problem=Strict replication consistency is not enabled on the domain controller {0}.
chkStrictReplicationConsistency_impact=If strict replication consistency on the domain controller {0} is not enabled, lingering objects can be replicated to the domain controller {0}.
chkStrictReplicationConsistency_resolution=Use Repadmin to detect and remove lingering objects and to enable strict replication consistency on the domain controller {0}.
chkStrictReplicationConsistency_compliant=Strict replication consistency is enabled on the domain controller {0}.

chkAdOnVM_title=The domain controller {0} should comply with the recommended best practices guidelines because it is running on a VM
chkAdOnVM_problem=The Active Directory Domain Services (AD DS) server role on the domain controller {0} is installed on a virtual machine (VM).
chkAdOnVM_impact=If a domain controller that is running on a VM does not comply with the recommended best practice guidelines, the Active Directory environment is at risk of experiencing various security and replication problems.
chkAdOnVM_resolution=Make sure that the domain controller {0} complies with the best practice guidelines that are described in the Help to avoid performance issues and replication and security failures in the Active Directory environment.

# Time service

chkMaxPosPhaseCorrection_title=The value of MaxPosPhaseCorrection on the domain controller {0} should be equal to 48 hours
chkMaxPosPhaseCorrection_problem=The current value of MaxPosPhaseCorrection on the domain controller {0} is not the recommended value.
chkMaxPosPhaseCorrection_impact=If the value of MaxPosPhaseCorrection on this domain controller is less than 48 hours, this domain controller might reject accurate and genuine time updates from other time servers. If the value of MaxPosPhaseCorrection on this domain controller is greater than 48 hours, this domain controller will be able to adopt large fluctuations forward or backward in time which can cause problems throughout the domain.
chkMaxPosPhaseCorrection_resolution=If the Windows Time Service group policy settings have been applied to this domain controller, configure the MaxPosPhaseCorrection group policy setting to a decimal value of 172800 (48 hours). If the Windows Time Service group policy settings have not been applied to this domain controller, set the value of registry key HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\W32Time\\Config\\MaxPosPhaseCorrection to a decimal value of 172800 (48 hours).
chkMaxPosPhaseCorrection_compliant=The current value of MaxPosPhaseCorrection on the domain controller {0} is set to 48 hours.

chkMaxNegPhaseCorrection_title=The value of MaxNegPhaseCorrection on the domain controller {0} should be equal to 48 hours
chkMaxNegPhaseCorrection_problem=The current value of MaxNegPhaseCorrection on the domain controller {0} is not the recommended value.
chkMaxNegPhaseCorrection_impact=If the value of MaxNegPhaseCorrection on this domain controller is less than 48 hours, this domain controller might reject accurate and genuine time updates from other time servers. If the value of MaxNegPhaseCorrection on this domain controller is greater than 48 hours, this domain controller will be able to adopt large fluctuations forward or backward in time, which can cause problems throughout the domain.
chkMaxNegPhaseCorrection_resolution=If the Windows Time Service group policy settings have been applied to this domain controller, configure the MaxNegPhaseCorrection group policy setting to a decimal value of 172800 (48 hours). If the Windows Time Service group policy settings have not been applied to this domain controller, set the value of registry key HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\W32Time\\Config\\MaxNegPhaseCorrection to a decimal value of 172800 (48 hours).
chkMaxNegPhaseCorrection_compliant=The current value of MaxNegPhaseCorrection on the domain controller {0} is set to 48 hours.

chkRootPdcTimeSync_title=The PDC emulator master {1} in this forest should be configured to correctly synchronize time from a valid time source
chkRootPdcTimeSync_problem=The primary domain controller (PDC) emulator operations master in this forest is not configured to correctly synchronize time from a valid time source.
chkRootPdcTimeSync_impact=If the PDC emulator master in this forest is not configured to correctly synchronize time from a valid time source, it might use its internal clock for time synchronization. If the PDC emulator master in this forest fails or otherwise becomes unavailable (and if you have not configured a reliable time server (GTIMESERV) in the forest root domain), other member computers and domain controllers in the forest will not be able to synchronize their time.
chkRootPdcTimeSync_resolution=Set the PDC emulator master in this forest to synchronize time with a reliable external time source. If you have not configured a reliable time server (GTIMESERV) in the forest root domain, set the PDC emulator master in this forest to synchronize time with a hardware clock that is installed on the network (the recommended approach). You can also set the PDC emulator master in this forest to synchronize time with an external time server by running the w32tm /config /computer:{1} /manualpeerlist:time.windows.com /syncfromflags:manual /update command. If you have configured a reliable time server (GTIMESERV) in the forest root domain, set the PDC emulator master in this forest to synchronize time from the forest root domain hierarchy by running w32tm /config /computer:{1} /syncfromflags:domhier /update.
chkRootPdcTimeSync_compliant=The PDC emulator operations master {1} in this forest is configured to correctly synchronize time from a valid time source.

# Backup

chkResultantBackupLifetime_title=The resultant backup lifetime in this forest should be equal to or greater than 180 days
chkResultantBackupLifetime_problem=The resultant backup lifetime in this forest is set to {1} days, which is less than the recommended minimum of 180 days.
chkResultantBackupLifetime_impact=If the resultant backup lifetime in your Active Directory forest is less than 180 days, the backups of your forest that you can use to recover accidentally deleted data or to promote domain controllers from media will be less effective and usable for a shorter period of time.
chkResultantBackupLifetime_resolution=Make sure that the resultant backup lifetime in your Active Directory environment is equal to or greater than 180 days. If Active Directory Recycle Bin in your environment is not enabled, increase the resultant backup lifetime in your forest by ensuring that the value of the tombstone lifetime is equal to or greater than 180 days. If Active Directory Recycle Bin in your environment is enabled, ensure that the recycled object lifetime (stored in the pre-existing tombstoneLifetime attribute) and the deleted object lifetime (stored in the msDS-deletedObjectLifetime attribute) are equal to or greater than 180 days.
chkResultantBackupLifetime_compliant=The resultant backup lifetime in this forest is set to {1} days, which complies with the best practice guidelines.

chkAccidentalProtectionForOU_title=All OUs in this domain should be protected from accidental deletion
chkAccidentalProtectionForOU_problem=Some organizational units (OUs) in this domain are not protected from accidental deletion.
chkAccidentalProtectionForOU_impact=If all OUs in your Active Directory domains are not protected from accidental deletion, your Active Directory environment can experience disruptions that might be caused by accidental bulk deletion of objects.
chkAccidentalProtectionForOU_resolution=Make sure that all OUs in this domain are protected from accidental deletion.
chkAccidentalProtectionForOU_compliant=All OUs in this domain are protected from accidental deletion.

chkNCsLastBackupTime_title=The directory partition {0} on the domain controller {1} should have been backed up within the last 8 days
chkNCsLastBackupTime_problem=The directory partition {0} on the domain controller {1} has not been backed up within the last 8 days.
chkNCsLastBackupTime_impact=Restoring Active Directory Domain Services (AD DS) from infrequent backups can result in the loss of Active Directory data that was added, accidentally deleted, or modified since the last backup.
chkNCsLastBackupTime_resolution=To ensure that recent system state backups are available to recover Active Directory data that was recently added, deleted, or modified, perform daily backups of all directory partitions in your forest or keep the time between Active Directory backups to a maximum of 8 days.
chkNCsLastBackupTime_compliant=The directory partition {0} on domain controller {1} was backed up within the last 8 days.

# Replication

chkKccEnabled_title=The KCC should be enabled in the site {1} in the forest {0} to generate an optimal replication topology
chkKccEnabled_problem=The Knowledge Consistency Checker (KCC) is disabled in the site {1}.
chkKccEnabled_impact=If the KCC in the site {1} is disabled, you must create replication connections manually to tailor the replication topology. This can increase the workload with regard to monitoring changes in the network topology, or it can cause replication failures on domain controllers.
chkKccEnabled_resolution=Make sure that the KCC is enabled in the site {1}.
chkKccEnabled_compliant_title=The KCC should be enabled in each site in the forest {0}
chkKccEnabled_compliant=The KCC in each site in the forest {0} is enabled.

chkGcOrUgcPerSite_title=The site {1} in the forest {0} should contain at least one global catalog server or have universal group membership caching enabled
chkGcOrUgcPerSite_problem=The site {1} does not contain a global catalog server and does not have universal group membership caching enabled.
chkGcOrUgcPerSite_impact=When a user logs on to a domain, a global catalog server is contacted to determine the universal group memberships of the user. If universal group membership caching in the site is not enabled and if a global catalog server is not available in the site, the domain controller must contact a global catalog server in another site over a potentially slow or unreliable wide area network (WAN), which can result in user authentication failures.
chkGcOrUgcPerSite_resolution=Make sure that the site {1} contains at least one global catalog server, or be sure to enable universal group membership caching in the site {1}.
chkGcOrUgcPerSite_compliant_title=Each site in the forest {0} should contain at least one global catalog server or have universal group membership caching enabled
chkGcOrUgcPerSite_compliant=Each site in the forest {0} with at least one running domain controller contains at least one global catalog server or has universal group membership caching enabled.

# Error

chkAddsError_title=The AD DS service must be running on the domain controller {0}
chkAddsError_problem=The Active Directory Domain Services (AD DS) service is stopped on the domain controller {0}.
chkAddsError_impact=The Active Directory Domain Services Best Practices Analyzer (AD DS BPA) that is running on the domain controller {0} cannot collect configuration data from the Active Directory environment that the domain controller {0} belongs to.
chkAddsError_resolution=Make sure that the AD DS service is running on the domain controller {0}.

chkAdwsError_title=The ADWS service must be running on the domain controller {0}
chkAdwsError_problem=The Active Directory Web Services (ADWS) service is stopped on the domain controller {0}.
chkAdwsError_impact=The Active Directory Domain Services Best Practices Analyzer (AD DS BPA) that is running on the domain controller {0} cannot invoke the Active Directory module for Windows PowerShell script to collect and validate configuration data from the Active Directory environment that the domain controller {0} belongs to.
chkAdwsError_resolution=Make sure that the ADWS service is running on the domain controller {0}.

chkAdpsError_title=The Active Directory module for Windows PowerShell must be installed and functioning properly on the domain controller {0}
chkAdpsError_problem=The Active Directory module either is not installed or is not functioning properly on the domain controller {0}.
chkAdpsError_impact=The Active Directory Domain Services Best Practices Analyzer (AD DS BPA) that is running on the domain controller {0} cannot invoke the Active Directory module for Windows PowerShell script to collect and validate configuration data from the Active Directory environment that the domain controller {0} belongs to.
chkAdpsError_resolution=Make sure that the Active Directory module is installed and functioning properly on the domain controller {0}.

chkDnsError_title=The domain controller {0} must be able to reach a DNS server and retrieve DNS records that are associated with this domain controller
chkDnsError_problem=The Active Directory Domain Services Best Practices Analyzer (AD DS BPA) cannot retrieve information from the server for the domain controller {0}. DNS controls how the domain controller {0} is located by other member computers and domain controllers in the domain or forest.
chkDnsError_impact=The AD DS BPA cannot collect data and validate the configuration for the domain controller {0} domain controller locator (DC Locator) (Netlogon) records that are registered in DNS.
chkDnsError_resolution=Troubleshoot DNS client and DNS server issues to determine the root cause of the problem.

chkGenericError_title=The AD DS BPA should be able to collect data about {0} from {1}
chkGenericError_problem=The Active Directory Domain Services Best Practices Analyzer (AD DS BPA) is not able to collect data about {0} from {1}.
chkGenericError_impact=The AD DS BPA will not be able to validate configuration data about {0}.
chkGenericError_resolution=Troubleshoot {1} to determine the root cause of the problem.

# Set 2 Update

chkDESONLYKerbEncryptionKey_title={0} should not be configured for DES only
chkDESONLYKerbEncryptionKey_problem=A user account or trust for domain {1} is configured for Data Encryption Standard (DES) only. DES is considered weak cryptography and is no longer enabled by default in Kerberos authentication in Windows 7 and Windows Server 2008 R2.
chkDESONLYKerbEncryptionKey_impact=User accounts and trusts configured for DES only will have authentication failures.
chkDESONLYKerbEncryptionKey_resolution=User accounts and trusts should use Advanced Encryption Standard (AES) or RC4 Kerberos encryption keys.
chkDESONLYKerbEncryptionKey_compliant_title=No user accounts and trusts for the domain {0} are configured for DES only
chkDESONLYKerbEncryptionKey_compliant=No user accounts and trusts are configured for DES only encryption.

chkDuplicateSPNRegistration_title=The Service Principal Name {0} is registered on multiple accounts
chkDuplicateSPNRegistration_problem=This service principal name (SPN) that is trusted for delegation is registered on multiple service accounts: {1}.
chkDuplicateSPNRegistration_impact=SPNs are used to locate the service account. Duplicate SPNs cause the Key Distribution Center (KDC) to return a failure because it cannot determine which account the client is connecting to. As a result, duplicate SPNs cause Kerberos authentication failures.
chkDuplicateSPNRegistration_resolution=Delete the SPN that is registered to the wrong account. Run the Setspn tool on your forest to ensure there are no duplicate SPNs for services.
chkDuplicateSPNRegistration_compliant_title=No service accounts that are trusted for delegation in the domain {0} have duplicate SPNs
chkDuplicateSPNRegistration_compliant=No duplicate SPNs found for trusted services. Duplicate SPNs may exist for other accounts. Use Setspn.exe to query forests for all duplicate SPNs.

chkUnregisteredSPN_title=An account or accounts trust(s) this unregistered SPN {0} for delegation
chkUnregisteredSPN_problem={1} in the domain {2} trust(s) service principal name (SPN) {0} for delegation, but SPN {0} is not registered to an account.
chkUnregisteredSPN_impact=If there is no SPN registered for the trusted service, this service will not be able to impersonate the client to make connections to other services.
chkUnregisteredSPN_resolution=Register the SPN to the appropriate account using Setspn.exe. Test the application to ensure that delegation works correctly.
chkUnregisteredSPN_compliant_title=All trusted services within the domain {0} have registered SPNs
chkUnregisteredSPN_compliant=Each service trusted for constrained delegation with the domain {0} have the SPN registered.

chkAccessComputerFromNetwork_title=Domain controller {0} must have "Access this Computer from the Network" granted to the appropriate security principals
chkAccessComputerFromNetwork_problem=Domain Controller {0} does not have user right "Access this computer from the network" granted to 'Builtin Administrators', 'Enterprise Domain Controllers' or 'Authenticated Users', or has the user right "Deny access to this computer from the network" assigned to either of those groups or 'Everyone'.
chkAccessComputerFromNetwork_impact=Replication operations initiated by other domain controllers in the domain or by administrators may fail. Users and computers may also experience failure to apply Group Policy objects.
chkAccessComputerFromNetwork_resolution=Verify that the domain controllers in the domain {1} have this user right granted to the appropriate security principals. Using Group Policy Management and Group Policy Results, verify that the winning Group Policy for the "Access this computer from the network" user right grants that right to the 'Builtin Administrators', 'Enterprise Domain Controllers', and 'Authenticated Users' groups. Verify that the policy setting "Deny access to this computer from the network" does not have 'Everyone', 'Authenticated Users', 'Builtin Administrators' or 'Enterprise Domain Controllers' groups defined in it.
chkAccessComputerFromNetwork_compliant=Group Policy Results for domain controller {0} has "Access this computer from the network" user right granted to 'Authenticated users', 'Builtin Administrators', and 'Enterprise Domain Controllers' security groups and "Deny access to this computer from the network" user right is not granted to 'Everyone', 'Authenticated Users', 'Builtin Administrators', or 'Enterprise Domain Controllers' groups.

chkTrustedDelegationRightForAdministratorGroup_title=Domain controller {0} must have "Enable computer and user accounts to be trusted for delegation" granted to the Builtin Administrators security group
chkTrustedDelegationRightForAdministratorGroup_problem=Domain controller {0} must have the "Enable computer and user accounts to be trusted for delegation" user right granted to the Builtin Administrators security group if domain controller {0} is used as a replication partner during a domain controller promotion.
chkTrustedDelegationRightForAdministratorGroup_impact=Installation of additional domain controllers (promoting replica domain controllers) in domain {1} may fail if they select domain controller {0} as a replication partner during the installation.
chkTrustedDelegationRightForAdministratorGroup_resolution=Verify that the current domain controllers in domain {1} have the "Enable computer and users accounts to be trusted for delegation" user right granted to the Builtin Administrators group.
chkTrustedDelegationRightForAdministratorGroup_compliant=Domain controller {0} has "Enable computer and user accounts to be trusted for delegation" granted to the Builtin Administrators group.

chkDomainGroupPoliciesDCOU_title=The Default Domain Controllers Policy in the domain {0} should be applied to the OU {1}
chkDomainGroupPoliciesDCOU_problem=The Default Domain Controllers Policy is not currently applied to the OU {1}.
chkDomainGroupPoliciesDCOU_impact=If Group Policy settings that are defined in the Default Domain Controllers Policy are not applied to domain controllers, Active Directory operations may fail.
chkDomainGroupPoliciesDCOU_resolution=Link the Default Domain Controllers Policy to the OU {1}.
chkDomainGroupPoliciesDCOU_compliant_title=The Default Domain Controllers Policy is applied to all OUs that contain domain controllers
chkDomainGroupPoliciesDCOU_compliant=The Default Domain Controllers Policy in the domain {0} is applied to all OUs that contain domain controllers.

chkIMFsmoAndGCSameMachine_title=The infrastructure master in the domain {0} should be held by a domain controller that is not a global catalog server
chkIMFsmoAndGCSameMachine_problem=The infrastructure master operations master role (also known as flexible single master operations (FSMO) role) in the domain {0} and the global catalog are held by the same domain controller.
chkIMFsmoAndGCSameMachine_impact=Group-to-user references in the domain {0} will not be updated when members of a group are renamed or changed within the domain.
chkIMFsmoAndGCSameMachine_resolution=Transfer the infrastructure master role to a different domain controller that is not a global catalog server or remove the global catalog from domain controller {1}. If domain controller {1} is the only global catalog server in the site, add the global catalog to another domain controller in the site.
chkIMFsmoAndGCSameMachine_compliant=The Infrastructure master role for the domain {0} is being held by a domain controller which is not a global catalog.

chkSidFilteringQuarantined_title=SID filtering is not enabled for external trust {1}
chkSidFilteringQuarantined_problem=SID filtering is not enabled for external trust {1} established with domain {0}.
chkSidFilteringQuarantined_impact=If authentication occurs across an external trust boundary (where the user and the computer hosting the resource are in different domains), a vulnerability exists because domain {0} (the trusting domain) does not verify that the trusted domain {1} is actually authoritative for all the SIDs in the authorization data (that is, the access token). It is possible for an attacker or rogue administrator to insert SIDs into the authorization data presented to this trusting domain {0}.
chkSidFilteringQuarantined_resolution=Enable SID filtering for external trust {1} by using the netdom trust /quarantine:yes command. Enabling SID filtering may prevent users from accessing resources in your environment. Before enabling SID filtering for the trust, you should review the detailed resolution procedures for this BPA rule.
chkSidFilteringQuarantined_compliant_title=SID filtering is enabled for all external trusts established with domain {0}
chkSidFilteringQuarantined_compliant=SID filtering is enabled for all external trusts established with domain {0}.

# Data item names (These strings go to {0} in chkGenericError strings above.)

timeSourceType_item=the time source type
forestName_item=the name of the forest
domainNumber_item=the number of domains in the forest
forestRootPdcName_item=the hostname of the forest root PDC
ntpServer_item=the network time protocol (NTP) server
domainName_item=the name of the domain
dcNumberInDomain_item=the number of domain controllers in the domain
dcHostname_item=the hostname of the domain controller
dcIpAddr_item=the IP addresses of the domain controller
hostNameDnsRecords_item=the hostname DNS A/AAAA records
dcSite_item=the site of the domain controller
isGc_item=whether the domain controller is a global catalog
isReadonly_item=whether the domain controller is a Read-only domain controller
isPdc_item=whether the domain controller is a PDC
isVm_item=whether the domain controller is running on a virtual machine
time_item=the current system time

desOnly_item=DES only accounts and trusts
accountsDelegation_item=accounts that are trusted for delegation
sPNMappings_item=host SPN mapping in the sPNMappings attribute
SeNetworkLogonRight_item=Group Policy Results setting "Access this computer from the network"
SeDenyNetworkLogonRight_item=Group Policy Results setting "Deny access to this computer from the network"
SeEnableDelegationPrivilege_item=Group Policy Results setting "Enable computer and user accounts to be trusted for delegation"
gpInheritance_item=applied Group Policy objects
gcNumberInDomain_item=the number of global catalog servers in the domain
externalTrust_item=external trust

# {0} is an SPN
registeredBy_item=accounts that registers SPN {0}

# {0} is the FSMO role, e.g. RID Master
fsmoOwnerName_item=the hostname of {0}
fsmoOwnerConnectivity_item=the connectivity with {0}
fsmoGc_item=whether {0} is a global catalog server

# These strings go to {0} in fsmoOwnerName_item and fsmoOwnerConnectivity_item above
RidMaster=the RID master
InfrastructureMaster=the infrastructure master
PdcEmulator=the PDC emulator
SchemaMaster=the schema master
DomainNamingMaster=the domain naming master

# {0} is the mnemonic of the DNS record, e.g., LdapAtSite
dnsRecordName_item=the domain name of the DNS record {0}
dnsRecord_item=the DNS record {0}

strictReplicationConsistency_item=strict replication consistency
maxPosPhaseCorrection_item=MaxPosPhaseCorrection
maxNegPhaseCorrection_item=MaxNegPhaseCorrection
forestFunctionalLevel_item=the forest functional level
recycleBinFeature_item=Active Directory Recycle Bin
tombstoneLifeTime_item=the tombstone lifetime
deletedObjectLifetime_item=the deleted object lifetime
ouAccidentalDeletionProtection_item=whether OUs are protected from accidental deletion

# {0} is the name of the site
dcNumberInSite_item=the number of domain controllers in the site {0}
gcNumberInSite_item=the number of global catalogs in the site {0}

ugcEnabled_item=whether universal group membership caching is enabled
kccEnabled_item=whether KCC is enabled
lastBackupTime_item=the last backup time of the directory partition
daysSinceLastBackup_item=the number of days since the last backup of the directory partition
gtimeserv_item=the reliable time server (GTIMESERV)

# Machine names (These strings go to {1} in chkGenericError strings above.)

forestRootPdc=the forest root PDC
dnsServers=the DNS servers
domainController=the domain controller {0}

'@