The Life of Brian

How to Remove a Failed or Offline DC

I’ve seen this issue come up time and time again.  Some administrator decided to remove an old DC from the network but forgot to remove it from Active Directory or the DC has entered a failed state and cannot be recovered from.  In a perfect world DCPROMO is all you have to do to remove a DC from the environment.  However, if that DC was already shutdown or DCPROMO is giving you problems you will have to remove it the manual way.  That method involves using a command called NTDSUTIL.  NTDSUTIL is a command line tool that allows you to perform some of the more advanced Active Directory maintenance tasks.

Below are the steps needed to remove a failed or offline Domain Controller from your environment.
TIP: NTDSUTIL does not require the full command to be entered…you only have to enter enough of the command that is unique.  For Example, instead of typing metadata cleanup you could just type met cle…or better yet m c

1. Open the Command Prompt
2. Type ntdsutil (all the commands will be entered via this command prompt)
3. Type metadata cleanup
4. Type connections
5. Type connect to server <ServerName> and replace <ServerName> with the name of a functional DC in your environment…even if you are logged in locally.  This step is not needed post W2K3 SP1.
6. Type quit
7. Type select operations target
8. Type lists sites
9. Type select site <#> where <#> is the site where the failed or offline DC resided
10. Type list servers in site
11. Type select server <#>  where <#> is the DC that is failed or offline
12. Type list domains
13. Type select domain <#>  where <#> is the domain where the failed or offline DC resided (at this point you should verify that the site, server and domain are all selected)
14. Type quit (this should set you back to the metadata cleanup menu)
15. Type remove selected server ( a warning message will pop up…verify that this is the correct DC…in fact get a peer to verify it for you too)
16. Click Yes
17. Open Active Directory Sites and Services
18. Expand out the site that the failed or offline DC resided in
19. Verify the DC cannot be expanded out (no connection objects and such)
20. Right Click the DC and select Delete
21. Close Active Directory Sites and Services
22. Open Active Directory Users and Computers
23. Expand the Domain Controllers OU
24. Delete the failed or offline DC from the OU (if it even exists)
25. Close Active Directory Users and Computers
26. Open DNS Manager
27. Expand the zones where this DC was also a DNS server and perform the following steps
28. Right click the zone and select Properties
29. Click the Name Servers tab
30. Remove the failed or offline DC from the Name Servers tab
31. Click OK to also remove the HOST (A) or Pointer (PTR) record if asked
32. Verify the zone no longer has a DNS record for the failed or offline DC

You can also find more info located on Microsoft site here and here for removing orphaned domains.

Microsoft Clustering Resources

This has to be the mother of all resource collections on Microsoft clustering and high availability.  I’ve copied over the links directly from the MS Cluster blog so that I have quick access to them in the future.

General Resources

• Cluster Team Site: Clustering Technical Resources
• Guide: Failover Clustering Deployment
• Guide: Validating Hardware for a Failover Cluster
• Guide: Migrating Cluster Settings
• Guide: Configuring the Quorum in a Failover Cluster
• Guide: Configuring Accounts in Active Directory
• Guide: Configure a Service or Application for High Availability
• Guide: Modifying Settings for a Failover Cluster
• Guide: Installing a Failover Cluster
• Guide: Creating a Failover Cluster
• Guide: Cluster Requirements
• Guide: Validating a cluster
• Guide: Managing a Failover Cluster
• Guide: The Failover Cluster Management Snap-In
• TechNet: Support Policy
• Webcast: Top 10 Windows Server 2008 Failover Clustering Enhancements over Windows Server 2003 Clustering, Based on Best Practices (Level 300)
• Webcast: Failover Clustering 101
• Webcast: Achieving High Availability with Windows Server “Longhorn” Clustering (Level 200)
• Webcast: Microsoft Webcast: Reducing IT Overhead with Windows Server 2008 Storage Features
• Webcast: TechNet Webcast: Build High-Availability Infrastructures with Windows Server 2008 Failover Clustering
• Webcast: IT Manager Webcast: Delivering High Availability to Your Infrastructure
• Webcast: TechNet Webcast: Failover Cluster Validation and Troubleshooting with Windows Server 2008
• Webcast: TechNet Webcast: Failover Clustering and Quorum in Windows Server 2008 Enterprise Storage
• Webcast: TechNet Virtual Lab: Windows Server 2008 Enterprise Failover Clustering Lab
• Whitepaper: Failover Cluster Architecture Overview
• Whitepaper: Microsoft’s HA Strategy
• Whitepaper: Overview of Failover Clustering

Core

• Utility: Remote Server Administration Tools (simplifies Server Core configurations)
• Guide: Server Core
• TechNet: Installation
• Webcast: How Microsoft does IT: Enhancing High Availability with Server Core in Windows Server 2008

Exchange Server

• Lab: TechNet Virtual Lab: Exchange Server 2007 Standby Continuous Replication
• Lab: TechNet Virtual Lab: Using Cluster Continuous Replication (CCR) in Exchange 2007
• TechNet: Installing Cluster Continuous Replication (CCR) on 2008
• TechNet: Deploying Exchange 2003 in a Cluster
• TechNet: Planning for Cluster Continuous Replication (CCR)
• TechNet: Installing CCR on Windows Server 2008
• Webcast: How Microsoft IT Implemented New Storage Designs for Exchange Server 2007

File Server

• Guide: Configuring a Two-Node File Server Failover Cluster
• TechNet: Creating a Clustered File Server checklist
• TechNet: Create a Shared Folder in a Clustered File Server
• WebCast: TechNet Webcast: Prepare Yourself for Windows Server 2008 (Part 5 of 8): New File Server Features
• WebCast: How Microsoft IT Deploys Windows 2008 Clusters for File Services
• Webcast: New File Server Features of Windows Server 2008 (Level 200)

Hyper-V

• Guide: Testing Hyper-V and Failover Clustering
• Guide: Getting Started with Hyper-V
• Guide: Design for a Failover Cluster in Which All Nodes Run Hyper-V
• TechNet: High-Availability for a Server Running Hyper-V
• TechNet: Requirements and Recommendations for Failover Clusters in Which All Nodes Run Hyper-V
• TechNet: Failover Cluster in which the Servers run Hyper-V
• Webcast: TechNet Webcast: High Availability with Hyper-V
• Webcast: TechNet Webcast: 24 Hours of Windows Server 2008 (Part 24 of 24): High Availability with Hyper-V
• Webcast: TechNet Webcast: Creating Business Continuity Solutions Using Windows Virtualization
• Whitepaper: Quick Migration with Hyper-V

Multi-Site Clustering

• Cluster Team Site: http://www.microsoft.com/windowsserver2008/en/us/clustering-multisite.aspx
• Guide: Deployment Considerations for Windows Server 2008 failover cluster nodes on different, routed subnets
• Webcast: TechNet Webcast: Geographically Dispersed Failover Clustering in Windows Server 2008 Enterprise
• Webcast: How You Can Achieve Greater Availability with Failover Clustering Across Multiple Sites (Level 300)
• Whitepaper: Multi-site Clustering

Network Load Balancing

• Guide: NLB Troubleshooting Overview
• Guide: Server Core: Install the NLB feature
• Guide: Create/manage/destroy NLB clusters via NLB Manager remotely from another server, or from RSAT client (admin pack) on Vista
• TechNet: Configuring NLB with Terminal Services
• TechNet: NLB Deployment Guide
• TechNet: Implementing a new NLB Cluster
• TechNet: Verifying the NLB Cluster and Enabling Client Access
• TechNet: Overview of NLB
• TechNet: Creating NLB Clusters
• TechNet: Managing NLB Clusters
• TechNet: Setting NLB Parameters
• TechNet: Controlling Hosts on NLB clusters
• TechNet: Troubleshooting for System Event Messages Related to NLB Cluster
• TechNet: User Interface: NLB Manager
• TechNet: Upgrading a NLB Cluster
• Webcast: 24 Hours of Windows Server 2008 (Part 23 of 24): Failover Clustering and Network Load Balancing

SQL Server

• Guide: SQL Server 2000 with Failover Clustering
• MSDN: Getting Started with SQL Server 2008 Failover Clustering
• MSDN: Configuring SQL Server 2005 Failover Clustering
• MSDN: Configuring SQL Server 2000 Failover Clustering
• TechNet: Database Mirroring and Failover Clustering
• TechNet: SQL Server 2005 Database Mirroring FAQs
• TechNet: Database Mirroring in SQL Server 2005
• Webcast: Microsoft SQL Server 2005 Failover Clustering on Windows Server 2008
• Webcast: TechNet Webcast: 24 Hours of SQL Server 2008: Ensuring Business Continuity
• Webcast: TechNet Webcast: Overview of SQL Server Availability Features and Upcoming Improvements
• Webcast: TechNet Webcast: Achieving Higher Scalability with SQL Server on Windows Server 2003 R2 Enterprise Edition (Level 300)
• Webcast: Ensuring Business Continuance with SQL Server 2005 Data Availability Solutions (Level 300)
• Webcast: Clustering Windows Server 2003 and SQL Server 2000/2005 (Level 200)
• Webcast: SQL Server 2005 for the IT Professional (Part 7 of 11): Technologies and Features to Improve Availability (Level 200)
• Webcast: SQL Server 2005 Failover Clustering for SQL Server 2000 Users (Level 200)
• Webcast: An Introduction to How SQL Server 2005 Can Help You Deliver Highly Available Database Systems (Level 200)
• Webcast: Clustering Windows Server 2003 and SQL Server 2000 and 2005 (Level 200)
• Webcast: How to cluster Microsoft SQL Server 2005 by using Microsoft Virtual Server
• Whitepaper: SQL Server 2008 Replication: Providing High Availability using Database Mirroring

Script That Displays Group Membership and Active Directory Location

The following code can be run to display the group membership of an Active Directory group and also let you know each member’s LDAP Distinguished Name.  The output will name the text file the group name and will include all the members and their location in Active Directory.  Just copy this into a txt file and rename to .vbs  Enjoy!

Set objGroup = GetObject("LDAP://cn=GroupName,ou=OUName,DC=DomainName,DC=local")
Set objFileSystem = CreateObject("Scripting.FileSystemObject")
Set objFile = objFileSystem.OpenTextFile(objGroup.Get("name") & " - Members.txt", 2, True, 0)
For Each objMember in objGroup.Members
  objFile.WriteLine objMember.Get("sAMAccountName") & VbTab & _
    objMember.Get("cn") & VbTab & _
    objMember.Parent
Next
Set objFile = Nothing
Set objFileSystem = Nothing
Set objGroup = Nothing

How to Search for an Email Address in Active Directory

From time to time I’ve had to figure out which user account has a specific email address.  Actually its more like finding who has the “reallycoolemailaccount@company.com” so another “more senior” person can get it.  Well if you work in a smaller company this can be kind of easy…but if your directory has thousands of accounts it becomes more difficult and time consuming.

What you will want to do is open up Active Directory Users and Computers and right-click the domain and select Search.  Select the drop-down arrow in the Find field to select Custom Search.  If you have multiple domains make sure to select Entire Directory on the In field.  Now just click on the Advanced tab and put the following text in the LDAP Query - proxyaddresses=smtp:<whatever the email is you’re looking for>.  Now all you have to do is click on Find Now and if the email is in use it will show the user account that is using it.

Must Have Group Policy Setting!

I recently blogged about time and how critical it is in a domain environment. Just this morning I read a post from the Directory Services Team that shows how to configure WMI Filtering through Group Policy to ensure that the PDC Emulator always has the right time configuration.  You need to read through this post really consider implementing a similar policy into your environment.

The only portion that is missing from that post is the location of the W32Time settings in Group Policy.  The policy you will be configuring is located under the Computer Configuration\Administrative Templates\System\Windows Time Service\Time Providers\Enable Windows NTP Client

After you enable it you will want to change the default setting from NT5DS (which means find and sync with the PDCe) to NTP.  This is because we are configuring this for our PDCe which should be pointing to a reliable time source (internal or external).  You will also configure the location to that reliable source in the NTPServer dialog box.

I haven’t seen a great tip like this in some time.  This is one of those great little finds and I hope you enjoy it.

KDC 11 Error in the System Event Log

I ran into this error awhile back after building a new root level Domain Controller (DC). My initial health checks panned out ok but after about an hour the following should up in my System Event log:
Event Type:    Error
Event Source:    KDC
Event Category:    None
Event ID:    11
User:        N/A
Computer:    DCShortName
Description:
There are multiple accounts with name cifs/DCShortName of type DS_SERVICE_PRINCIPAL_NAME.

My forest root domain has a fairly small amount of accounts with the majority of them being DCs.  I knew that the name that was added was not in conflict with the forest root.  With this name being the shortname of the DC I knew that I would have to check other child domains.  After a quick search of the directory (GC) via Active Directory Users and Computers I was able to find another computer with the same name.  Unfortunately one of the computers had to go bye-bye…and it sure wasn’t going to be my DC.  Needless to say after the computer was removed from Active Directory the errors stopped showing up.

Windows Server 2008 Server Core Default Services

Quite a few people have asked recently about services in Server Core.  They want to know what’s running and what’s not running.  Below you will find a listing that intended to help those out that need to know the status of Services on Server Core.  It is sorted by Service Name.

Another useful item to note on Server Core (or the CMD Prompt on Server) is that you can still use the SC command.  In particular you should run SC Query, this little useful command will tell you which services are running.  If you want to view the ones that are not running just run sc query state=inactive.  There is a bunch of stuff you can do with the SC command and you should really check out the help. 

A great tip for using commands is to append | more to the end of the command.  This should only display one page at a time.

Hyper-V Delegation

I was playing around with Microsoft’s Hyper-V today and ran into some problems managing the service remotely.  I set my server up and wanted to connect via RSAT from my Vista box but was not able to connect to my server because of permissions.  No biggie there, actually I didn’t expect I would just be able to connect to the server and manage Hyper-V.  I did think that after installing Hyper-V that there would be some groups created to help manage Hyper-V…needless to say I was wrong.

Thankfully I found a great series of posts on delegating access to VM and Hyper-V and thought it would be great to share them here with you.

Delegation Model in Hyper-V – Part 1
Delegation Model in Hyper-V – Part 2
Delegation Model in Hyper-V – Part 3
Delegation Model in Hyper-V – Part 4
Delegation Model in Hyper-V – Part 5
Delegation Model in Hyper-V – Part 6

Basically Hyper-V uses Authorization Manager to delegate what you can do within it.  If you haven’t used AzMan don’t be scared, the posts walk you though several scenarios. 

And for those of you that are interested in the HW aspect of my project…This is simply a development server that I'm using to test some things.  It is an HP DL360 G5 with a single quad core XEON (only 2 Ghz) with 16 GB of RAM.  All my VMs will be hosted locally (not sure on the number yet).  I’m trying to set up an environment that people can use to practice Server 2008.  I don’t think the CPU is going to be that much of a limiter since there won’t be a ton of people on at the same time doing processor intensive operations. 

Restartable AD DS and DSRM Logon Behaviors

Ever since Windows 2000's implementation of Active Directory (AD) we have had a method to restore AD objects that were removed.  Although it hasn’t been as easy as hitting CTRL-Z to undo a mistakenly deleted object or to try to restore from the Recycle Bin, we have had a method to restore objects.  That method is to restart the Domain Controller (DC) in Directory Services Restore Mode (DSRM) and logon with the DSRM account and password that is generated using DCPROMO.  (how to reset a DSRM  account password)

Having to restart a DC to restore objects has always been a sore subject with me.  Thankfully in Windows Server 2008, Active Directory Domain Services (AD DS) now functions as a service.  This service may look the same from the outside but if you dig a little deeper you will see that it is a bit different.  For example, you cannot pause this service and the startup is hard coded to Automatic...thus the only way you can start a DC with AD off is via DSRM, but you can Stop it while the server is up in a norm state.

The advantage of this is that you no longer have to bring down a DC to do an offline defrag of your ntds.dit.  One thing you can't do by default is stop AD DS and then perform an authoritative restore.  I say by default because this can change in Server 2008.   This all changes with Server 2008 and you now have the ability to change the DSRM logon behavior.  By modifying the following registry key you can select when you want to allow the DRSM administrator to log on:
HKLM\System\CurrentControlSet\Control\Lsa\DSRMAdminLogonBehavior

There are three values that can be selected:

I'm personally a fan of Value 1.  Value 0 has to big of an impact for restores and maintenance and Value 2 is a little too liberal for my likings.

Finally some commands that can be used for those Server Core Admins: 

• net start ntds (starts AD DS service)
• net stop ntds (stops AD DS service)
• sc \\ <DC Name> query ntds (queries AD DS service)

Important Notes:
When you stop AD DS you are also stopping the following services on that DC:

• File Replication
• Kerberos Key Distribution Center
• Intersite Messaging
• DNS Server (hopefully your clients have multiple DNS sever entries)
• DFS Replication

Be aware that when you change the value of DSRMAdminLogonBehavior the DRSM Administrator account is not checked by any password policy.

What W32tm is it anyway?

My daughter Alyssa and I play a game…well she might not consider it a game but she is constantly  asking me “What time is it without looking”.  I’ve actually gotten pretty good at it and can usually get within a few minutes.  Not sure why she likes to play but perhaps time is something they recently talked about at school but she seems obsessed with it.  I keep telling her that at 6 she really shouldn’t worry to much about time.

Although time may not be important for my daughter, it is immensely important for Active Directory.  Most AD admins know that domain controllers and clients need to be within 5 mins of each other to work correctly.  If your time was out by 5 or more minutes the client would not be able to authenticate.  What most AD admins might not know is that time just doesn’t affect AD, it also can affect certain time sensitive applications.   I don’t know of any out of the box ones from Microsoft but organizations have plenty of custom built apps that may use time syncs.  I’ve seen custom applications that need to be accurate within less than a second.

Let’s take a look at how time synchronization works in an Active Directory forest.  The magic all starts in the root domain (I always wanted to use that in my blog).  The PDC Emulator (PDCe) is solely responsible for time synchronization and uses the Network Time Protocol (NTP) on port UDP 123.  You will want to sync the PDCe with a reliable source, either internal (perhaps a router) or external.  The problem with going external is that there is less security because of the lack of authentication and verifiable authenticity. 

Clients and servers in your forest root domain will sync their time with any DC in the forest root.  This is all configured in the registry at the following location: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters.  Domain members have Nt5DS set for the TYPE key which configures them to use the domain hierarchy for time.  Some people change this to NTP which means it will go to a specific time source besides the PDCe but I prefer to keep the default here because it works!  If you’re crazy enough you could configure it so that it relies on the CMOS clock…I just don’t have enough faith in the batteries for that.

If you have child domains or other tree roots in your forest realize that the forest root PDCe is STILL the authority for forest wide time synchronization.  The PDCe for the child domains will sync their time with the forest root PDCe or any DC in the root (but those root DCs get their time from the PDCe).  The clients and servers in the child domain will always go to a DC in their domain, so they should never go up to the forest root domain.  Clients poll the time every 45 minutes by default.  After three successful synchronizations it will increase that polling time to 8 hours.  Below is a great illustration of how time works in a multi domain forest.

To configure your forest root PDCe with a valid time source you should use the w32tm command:
w32tm /config /manualpeerlist:peers /syncfromflags:manual /reliable:yes /update
You can and I recommend adding multiple peers but simply putting a space between them.  Please don’t forget to run this command on the DC that you have designated as the DC to fail the PDCe role over to during downtime (for example, patching).

To test how close your time is synced you can use the w32tm command again, except this time we can get a really cool command prompt chart…hey its the simple things in life that get me.
w32tm /stripchart /computer:target /samples:n
Replace target target with the name of the forest root PDCe.  I prefer to get 10 samples but you can go for whatever amount you like.  This will tell you the difference between the clocks.   More info can be found on the w32tm here.

The Microsoft Directory Services team has a great blog that talks about high accuracy in w32tm and why they don’t support it.  This is a must read for all AD admins.  Don’t forget to set up an RSS feed to the Windows Time Service blog as well.

I would recommend baseline the time difference in your environment so that if an issue does occur you will know what the norm state is for your time differential.  You may also want to include some monitoring that can alert you of time drift using the baseline numbers you’ve collected.  I would also recommend talking to your developers and ensure they understand how time works in the environment.

Hopefully this sheds some light on how time works in an Active Directory forest but also how you can control and tweak it.  Oh and if you’re bored try playing the time game…its a great exercise for your mind and internal clock! :)

Admin's Guide to Server Core Commands

Repost from AdminPrep.com…I will be moving several of the articles over to this blog.

Before all this starts, credit must go where credit is due.  I did not come up with all of the info within this article.  A lot of people have felt my pain and have contributed in their own ways.  One place you should know about is the Official Server Core Blog, as it is where I learned my all time favorite command which embeds the time into the Command Prompt (read on to see that one!).  As I've collected my own list internally and blogged on for about a year now I see a lot of the same commands there.  The Windows Server 2008 Administrator's Companion has a nice chapter on Server Core but by far the best resource are the scripts that accompany the book.  They allow you to very easily configure common settings.  One last area you should look into is of course Guy Teverovsky's Server Core Configurator...if you haven't see it check it out now!

Server Core is a version of Windows Server 2008 that has a minimal Graphical User Interface (GUI).  I say minimal when most say command-line only because there are GUI tools available such as Notepad and Task Manager.  One thing that definitely doesn't run on Server Core is the Explorer process.  If you're unaware of what that process does, just end the explorer.exe process in Task Manager from your client and look what happens...don't freak out, all you need to do is then go back to Task Manager and select File -> New Task (Run...) and then type explorer.exe.

The purpose of this article is not to give you every last detail to Server Core but to provide you with what you need to know it get it up and running in your environment.

Server Core has a limited amount of roles that can be installed on it, which include:

• Active Directory Domain Services (AD DS) and AD Lightweight Directory Services (AD LDS)
• DNS Server
• Internet Information Services (IIS) (No ASP.NET support)
• DHCP Server
• File Services
• Print Services
• Streaming Media Services
• Hyper V

Now that doesn't mean that Server Core can't do other things.  In fact it can, but Microsoft calls those other items Features and not Roles.

• Microsoft Failover Cluster (not available in Standard Edition)
• Network Load Balancing
• Subsystem for UNIX-based applications
• Backup
• Multipath IO
• Removable Storage Management
• Bitlocker Drive Encryption
• Simple Network Management Protocol (SNMP)
• WINS
• Telnet

Later on in the article I will explain how to install these services.  But first its time to go over what I believe to be the most commonly requested commands for administrating a Server Core environment.

Server Core Common Networking and Firewall Commands

Here is the start of you Networking and Firewall related commands for Server Core:

Server Core Common Networking Commands

To configure the IP address we will have to remember (or learn) Netsh.

Configure a Static IP Address on Server Core:
Netsh int ipv4 set address “Local Area Connection” static 10.1.1.10 255.255.255.0 10.1.1.1
Netsh int ipv4 set dnsserver “Local Area Connection” static 10.1.1.5 primary
Netsh int ipv4 set winsserver “Local Area Connection” static 10.1.1.6 primary

Configure a Dynamic (DHCP) IP Address on Server Core:
Netsh int ipv4 set address “Local Area Connection” source=dhcp

Change the name of the network interface on Server Core:
Netsh int set interface name = “Local Area Connection” newname = “Primary Network”

Server Core Common Windows Firewall Commands:

The Windows Firewall is a blessing to some and a curse to others. Either way it is installed by default and you have to understand the commands that are needed to configure the basics and in some cases some advanced commands.

Disable firewall:
netsh firewall set opmode disable

Server Core can be managed by using MMCs from a remote server. However with the firewall being on by default you will have to allow these tools to work remotely.  The first thing to note here is how to translate the MMC Snap-in to Windows Firewall Rule Group.

MMC Snap-in - Event Viewer
Windows Firewall Rule Group - Remote Event Log Management

MMC Snap-in - Services
Windows Firewall Rule Group - Remote Services ManagementMMC Snap-in - Shared Folders
Windows Firewall Rule Group - File and Printer Sharing

MMC Snap-in - Task Scheduler
Windows Firewall Rule Group - Remote Scheduled Tasks Management

MMC Snap-in - Reliability and Performance
Windows Firewall Rule Group - Performance Logs and Alerts
Windows Firewall Rule Group - File and Printer Sharing

MMC Snap-in - Disk Management
Windows Firewall Rule Group - Remote Volume Management

MMC Snap-in - Windows Firewall with Advanced Security
Windows Firewall Rule Group - Windows Firewall Remote Management

To enable all of these rules follow use this command:
Netsh advfirewall firewall set rule group=“remote administration” new enable=yes

To enable specific commands follow this format:
Netsh advfirewall firewall set rule group=“” new enable=yes

Server Core Common Domain Management Commands

Join a domain:
netdom join ComputerName /domain:DomainName /userd:UserName /passwordd:*
Yes, /passwordd:*
needs to have that second d at the end of it.

Remove from domain:
netdom remove

Rename a Domain Member:
netdom renamecomputer %computername% /NewName: /userd: /password:*

Rename Administrator:
wmic UserAccount where Name="Administrator" call Rename Name="new-name"

Add User to a Local Group
net localgroup GroupName /add \

Remove User from a Local Group
net localgroup GroupName /delete \

Confirm Domain and/ New Computer name
Set

Update User Passwords:
Net user [/domain] *

Server Core Common Server Management Commands

Toggle Remote Desktop on and off:
Cscript \windows\system32\scregedit.wsf /ar 0

Enable reduced security for RDP connections:
Cscript \windows\system32\scregedit.wsf /cs 0

Active Server Core:
Local method - Slmgr.vbs –ato
Remote method - Cscript windows\system32\slmgr.vbsServerName UserName password:-ato

Rename a Stand-Alone Member:
netdom renamecomputer /NewName:

List of installed patches:
wmic qfe list

Install Updates:
wusa .msu /quiet

Configure for AutoUpdates:
cscript scregedit.wsf /AU /4

Disable AutoUpdates:
cscript scregedit.wsf /AU /1

View AutoUpdate Setting:
cscript scregedit.wsf /AU /v

Configure the Page File:
wmic pagefileset where name=”” set InitialSize=,MaximumSize=

Configure a Proxy Server: (Server Core cannot use a proxy that requires a proxy)
netsh Winhttp set proxy :

All your favorite TCP/IP commands work including the following:
IPConfig
ARP
Ping
PathPing
TraceRT
Route
NSLookup
NetStat
NBTStat

List Running Services:
sc query

Start and/or Stop a Service:
sc start
sc stop

Task Manager: (Ctrl+Shift+Esc)
taskmgr

Manage Disk Volumes:
Diskpart /?

Defrag a Volume:
defrag /?

Change Time and Time Zone:
control timedate.cpl

Change the Desktop Resolution: (requires you to log off and back on)
Regedit - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Video
\0000\DefaultSettings.XResolution
\0000\DefaultSettings.YResolution

Display the Time in the Command Prompt:
prompt [$t]$s$p$g

Log off:
shutdown /l

Restart Now:
shutdown /r /t 0

To get the Roles and Features installed you are going to need to use the ocsetup.exe command.  The OC is short for Optional Components.  The most important thing to remember about this command is that IT IS CASE SENSITIVE!!! As a best practice you should always use the /w switch with ocsetup.exe as this will hold the Command Prompt from being active (when you can type again) until the setup is complete.  Below you will find a list of the commands that are required to install Roles and Features on Server Core.

DNS
start /w ocsetup DNS-Server-Core-Role

DHCP
start /w ocsetup DHCPServerCore

File Services (Server service is installed by default) but there are other role features

File Replication Service
start /w ocsetup FRS-Infrastructure

Distributed File System
start /w ocsetup DFSN-Server

Distributed File System Replication
start /w ocsetup DFSR-Infrastructure-ServerEdition

Services for Network File System (NFS)
start /w ocsetup ServerForNFS-Base
start /w ocsetup ClientForNFS-Base

Hyper V
start /w ocsetup Microsoft-Hyper-V

Print Server feature
start /w ocsetup Printing-ServerCore-Role

Line Printer Daemon (LPD) service
start /w ocsetup Printing-LPDPrintService

Active Directory Lightweight Directory Services
start /w ocsetup DirectoryServices-ADAM-ServerCore

Active Directory Domain Services
dcpromo /unattend:

Streaming Media Services
Follow directions found in Article ID 934518

IIS
start /w pkgmgr /iu:IIS-WebServerRole;WAS-WindowsActivationService;WAS-ProcessModel
To uninstall IIS use the following command
start /w pkgmgr /uu:IIS-WebServerRole;WAS-WindowsActivationService;WAS-ProcessModel

NOTE: If you need to install a Role that you installed with ocsetup all you need to do is to append the commands above with /uninstall.

Now let's take a look at how we install Features on Server Core:

Microsoft Failover Clustering
start /w ocsetup FailoverCluster-Core

Network Load Balancing
start /w ocsetup NetworkLoadBalancingHeadlessServer

Subsystem for UNIX-based applications
start /w ocsetup SUACore

Multipath IO
start /w ocsetup MultipathIo

Removable Storage
start /w ocsetup Microsoft-Windows-RemovableStorageManagementCore

Bitlocker Drive Encryption
start /w ocsetup BitLocker

Backup
start /w ocsetup WindowsServerBackup

Simple Network Management Protocol (SNMP)
start /w ocsetup SNMP-SC

Windows Internet Name Service (WINS)
start /w ocsetup WINS-SC

Telnet client
start /w ocsetup TelnetClient

NOTE: If you need to install a Feature that you installed with ocsetup all you need to do is to append the commands above with /uninstall.

Having the Role or Feature installed doesn't do much without going in and configuring the service.  The quick and easy way to manage these Roles and Features is to have either a dedicated Terminal Server have the AdminPak or Remote Server Administrative Tools (RSAT) installed or just install those same tools on XP or Vista. 

Take a look here for more info on how to manage DNS with DNSCMD and then head over here for installing Active Directory via an answer file on Server Core.

I know this isn't a complete listing of the commands but I really believe this should help you get started in the right direction.  One of the best resources out there is from the Windows Server 2008 Step-by-Step Guides.. For this case you will want to download the Server_Core_Installation_Option_of_Windows_Server_2008_Step-By-Step_Guide.doc guide.

Frustration with Server 2008

Please don’t just read this post…participate by answering the questions I ask using the comments.  Don’t worry you don’t have to register.  :)

One of the things that I’ve been waiting awhile for, was a Windows operating system that is smart enough to not have to reboot as much as previous versions.  I thought that wait would end with Windows Server 2008 but unless someone can prove me wrong I think there is actually potential for more reboots.

The first and obvious one that we still have to deal with is patching.  Didn’t Microsoft mention that reboots after patching would be much fewer?  I can’t seem to find anything from the early hype days but, the excellent ASKPERF blog does go into some detail as why there should be fewer reboots.  The problem is system DLL's such as NTDLL.DLL and Kernel32.DLL still require a reboot when they are updated.  Have you seen fewer reboots because of patching?

My next big complaint about Server 2008 reboots has to do with Features and Roles.  I first experienced this after installing the limp Windows Server Backup.  I know many people don’t like the old built in tool but if you manage an AD environment it was perfect for doing AD backups while not allowing domain Backup Operators the ability to restore your AD to their desktop. I know other ways to do this in Server 2008 but that is not my point of this post.

I installed the Windows Server Backup and quickly decided to uninstall it.  What do you know…I have to reboot my server to uninstall backup software.  I couldn’t believe that.  During some testing I had to uninstall AD and DNS on a DC.  I go and run DCPROMO on the DC and of course afterwards I have to reboot.  So I do.  Next I go to uninstall DNS from Server Manager (also removed the AD Binaries) and sure enough not 5 mins after rebooting for DCPROMO I had to reboot again.  This was not an issue with Server 2003.

COME ON MICROSOFT!!!  The last time I had to reboot this frequently was with Windows NT.  Heck I was surprised after a right-click it didn’t ask me to reboot…Okay, so maybe it isn’t that bad but it definitely seems to be more now than it was in Server 2003, especially with Services.  Have you experienced reboots doing tasks that didn’t require them in Server 2003?  Are you happy with that?

The problem with this is when I want to install an additional Feature or Role it won’t let me because it is pending an uninstall.  I’d love to hear what others think of this.

How to Configure Conditional Forwarders in Windows Server 2008

Conditional Forwarders was a new feature within the Microsoft DNS server for Windows Server 2003.  It was a great addition that allowed you to specify a specific DNS server for clients trying to resolve hosts in a specific domain.  This way you could tell the DNS server to always go to a specific DNS server for specific domain names.

One of the things that you will find different in Windows Server 2008’s DNS is how it displays Conditional Forwarders.  Previously you needed to view the Forwarders tab in the DNS server’s properties. Here is shot of the old way.

The new way is in plain site…but it still seems like people miss it.

Now here is a look at what type of options you have for it:

You just place the DNS domain name in the top section and the IP address of the DNS server that is authoritative for that domain below.  Notice you also can store this Conditional Forwarder in Active Directory if you want.  It is NOT the default.  Behind that drop down is the amount of time the DNS server will wait before it times out…which is 5 seconds by default.

Hopefully that helps you figure out how DNS Conditional Forwarders are set up in Windows Server 2008

Display Your Computer Name on Server Core

In my Administrator’s Guide to Server Core Commands article on AdminPrep I showed you how to display the time on the command prompt of your Server Core command window.  I just read that Daniel Petri has some other cool shortcuts on what you can display on the command window of Server Core.  The one that I really like is the computer name.  If manage multiple Server Core servers then you already know how difficult it can be to manage different sessions…especially since they all look the same.

To display the computer name (among other things listed on Daniel’s article) you need to modify the registry.  If you don’t already know please modify the registry carefully! 

1. Navigate to the HKLM\System\CurrentControlSet\Control\Session Manager\Environment key.

2. Create or Edit a key called Prompt (it should be an Expandable String Value)          

3. Add the the following for the data - $_Server:%computername%_$p$g

You will have to log off and log back on to see the change but once you do it is a pleasant addition to the command window.  Daniel’s example shows how you can the Date, Time and User…very cool so make sure you check it out.

Microsoft Certified Master

How many of you have heard of this?  This is the new “Premier Technical Credential” from Microsoft.  The program will be required to obtain the Microsoft Certified Architect program. Kind of weird having the “Premier Technical Credential” in there if it is a prerequisite for another cert…but all the same it looks pretty nice.  In fact the only thing it is missing from the MCA is the review board portion.  The Master program is a three week long hands-on training that only takes place in Redmond WA and then you must pass three written exams and a lab-based exam. 

There are currently three speciality areas, Exchange, SQL, and Directory with OCS and SharePoint to be added in the future.  The cost is pretty high.  A $125 non-refundable application fee and then $18,500 program fee (which includes the exams).  Retakes are $250 for the written and $1,500 for the lab.

If you take the first run (beta) of either of the specialities you can get a 50% discount.  Each speciality has it’s own prerequisites that can be found on the links below.

Here are the running times:

Exchange
October 6–October 25, 2008 (50% off)
January 5–January 24, 2009
March 16–April 4, 2009

SQL
October 20–November 8, 2008 (50% off)
January 12–January 31, 2009
March 16–April 4, 2009

Directory
November 3–November 22, 2008 (50% off)
February 16–March 6, 2009
May 4–May 23, 2009

More info can be found on this blog too.

Good luck to anyone that attends, I wish I could but that cost and time commitment is tough.

What I Love About Server Core

Sometimes a picture is worth a thousand words…

Export Email Addresses from a Distribution Group

One thing that really bugs me is there is no easy way to grab some email addresses from a distribution group.  Usually I end up expanded the group to list all the users and then I have to go to the Outlook properties of each user to view the email address.  Heck, I can’t even copy the email address from there…instead I have to write it down.  This can be a pain for companies that have long complex email addresses.

I’ve finally figured out a way to export this info into a text file…no one said I was quick.  :)  To do this you just need to use either CSVDE or LDIFDE.  I use mail as the attribute I pull from these commands but you could really use any AD attribute that you want to pull.

csvde -f c:\temp\report.txt -r "memberOf=cn=group name,ou=ou name,dc=domain,dc=name" -l mail

ldifde -f c:\temp\report.txt -r "memberOf=cn=group name,ou=ou name,dc=domain,dc=name" -l mail

This may not be the cleanest way to pull this data but at least now I can copy and paste the email addresses.

Windows Server 2008 User Right Assignments - Defined

If you haven’t noticed yet, Windows Server 2008 has several more User Right Assignments in the Local Policy settings.  If you’re looking for a definition of one or all take a look below.  These are the same settings that are found in Group Policy located at this path – Computer Configuration\Windows Settings\Local Policies\User Right Assignment.

Access Credential Manager as a trusted caller

This policy setting is used by Credential Manager during Backup and Restore. No accounts should have this user right, as it is only assigned to Winlogon. Users' saved credentials might be compromised if this user right is assigned to other entities.

By default, no accounts are assigned this right. However, to enforce the default setting, the Access Credential Manager as a trusted caller setting is restricted to No One for the SSLF environment discussed in the security guide.

Act as part of the operating system

This policy setting allows a process to assume the identity of any user and thus gain access to the resources that the user is authorized to access. For this reason, the Act as part of the operating system setting is restricted to No one for both of the environments that are discussed in this guide.

Add workstations to domain

This policy setting only takes effect when applied to domain controllers.

Adjust memory quotas for a process

This policy setting allows a user to adjust the maximum amount of memory that is available to a process. The ability to adjust memory quotas is useful for system tuning, but it can be abused. In the wrong hands, this setting could be used to launch a denial of service (DoS) attack.

For this reason, the Adjust memory quotas for a process setting is restricted to Administrators, Local Service, and Network Service groups for the SSLF environment. The setting is configured to Not Defined for the EC environment.

Allow log on locally

This policy setting determines which users can interactively log on to computers in your environment. Logons that are initiated by pressing the CTRL+ALT+DEL key sequence on the computer keyboard require this user right.

Microsoft recommends that you enable this setting through Group Policy and restrict this right to members of the Administrators group. Assign this user right to the other Operator level administrative security groups, such as Backup Operators or Server Operators, if your organization requires that they have this capability.

Allow log on through Terminal Services

This policy setting determines which users or groups have the right to log on as a Terminal Services client. Remote desktop users require this user right. Microsoft recommends that you restrict this user right to the Administrators group to prevent unwanted users from gaining access to computers on your network by means of the Remote Assistance feature. Dedicated Terminal Servers will require additional configuration.

Back up files and directories

This policy setting allows users to circumvent file and directory permissions to back up the system. This user right is enabled only when an application (such as NTBACKUP) attempts to access a file or directory through the NTFS file system backup application programming interface (API). Otherwise, the assigned file and directory permissions apply.

Bypass traverse checking

This policy setting allows users who do not have the special "Traverse Folder" access permission to "pass through" folders when they browse an object path in the NTFS file system or in the registry. This user right does not allow users to list the contents of a folder, but only allows them to traverse directories.

Change the system time

This policy setting determines which users and groups can change the time and date of the internal clock of the computers in your environment. Users who are assigned this user right can affect the appearance of event logs. When a computer’s time setting is changed, logged events reflect the new time, which may not be the actual time that the events occurred.

Change the time zone

This setting determines which users can change the time zone of the computer. This setting capability poses no great risk for the computer. However, modifications to this setting affect all users and applications on the computer, which could cause confusion in shared terminal server environments.

Create a pagefile

This policy setting allows users to change the size of the pagefile. By making the pagefile extremely large or extremely small, an attacker could easily affect the performance of a compromised computer.

Create a token object

This policy setting allows a process to create an access token, which may provide elevated rights to access sensitive data. In environments in which security is a high priority, this user right should not be assigned to any users. Any processes that require this capability should use the Local System account, which is assigned this user right by default.

Create global objects

This policy setting determines whether users can create global objects that are available to all sessions. Users can still create objects that are specific to their own session if they do not have this user right.

Users who can create global objects could affect processes that run under other users' sessions. This capability could lead to a variety of problems, such as application failure or data corruption.

Create permanent shared objects

This policy setting allows users to create directory objects in the object manager. This user right is useful to kernel-mode components that extend the object namespace. However, components that run in kernel mode have this user right inherently. Therefore, it is typically not necessary to specifically assign this user right.

Create symbolic links

This policy setting determines which users can create symbolic links. In Windows Server 2008, existing NTFS file system objects, such as files and folders, can be accessed by referring to a new kind of file system object called a symbolic link. A symbolic link is a pointer (much like a shortcut or .lnk file) to another file system object, which can be a file, folder, shortcut or another symbolic link. The difference between a shortcut and a symbolic link is that a shortcut only works from within the Windows shell. To other programs and applications, shortcuts are just another file, whereas with symbolic links, the concept of a shortcut is implemented as a feature of the NTFS file system.

Symbolic links can potentially expose security vulnerabilities in applications that are not designed to use them. For this reason, the privilege for creating symbolic links should only be assigned to trusted users. By default, only members of the Administrators group can create symbolic links.

Debug programs

This policy setting determines which user accounts will have the right to attach a debugger to any process or to the kernel, which provides complete access to sensitive and critical operating system components. Developers who are debugging their own applications do not need to be assigned this user right. However, developers who are debugging new system components need it.

Deny access to this computer from the network

This security setting determines which users are prevented from accessing a computer over the network. This policy setting supersedes the Access this computer from the network policy setting if a user account is subject to both policies.

Deny log on as a batch job

This policy setting prohibits users from logging on to a computer through a batch-queue facility, which is a feature in Windows Server 2008 that you can use to schedule jobs to run automatically one or more times in the future.

Deny log on as a service

This policy setting determines whether users can log on as a service. Accounts that can log on as a service could be used to configure and launch new unauthorized services, such as a keylogger or other malware.

Deny log on locally

This policy setting prohibits users from logging on locally to the computer console. If unauthorized users can log on locally to a computer, they can download malicious code or elevate their privileges on the computer. In addition, if attackers have physical access to the console, there are other risks to consider. This user right should not be assigned to those users who need physical access to the computer console.

Deny log on through Terminal Services

This policy setting prohibits users from logging on to computers in your environment through Remote Desktop connections. If you assign this user right to the Everyone group, you also prevent members of the default Administrators group from using Terminal Services to log on to computers in your environment.

Enable computer and user accounts to be trusted for delegation

This policy setting allows users to change the Trusted for Delegation setting on a computer object in Active Directory®. Abuse of this privilege could allow unauthorized users to impersonate other users on the network.

Force shutdown from a remote system

This policy setting allows users to shut down Windows–based computers from remote locations on the network. An unauthorized shut down of a server is a type of denial of service (DoS) condition that makes the computer unavailable to service user requests. Microsoft recommends to only assign this user right to highly trusted administrators.

Generate security audits

This policy setting determines which users or processes can generate audit records in the Security log. An attacker could use this capability to create a large number of audited events, which would make it more difficult for a system administrator to locate any illicit activity. Also, if the event log is configured to overwrite events as needed, any evidence of unauthorized activities could be overwritten by a large number of unrelated events