Active Directory, Exchange, Microsoft Clustering, Scripting, MOM, SQL. : Active Directory

Tips - 4

Nirmal Sharma — Tue, 03 Nov 2009 14:15:00 GMT

A Quick Tip To Disable "Initial Configuration Tasks List" This article explains how you can disable the Initial Configuration Task List at logon. What All Ports Are Required By Domain Controllers And Client Computers? This article explains the...(read more)

Tips - 3

Nirmal Sharma — Tue, 03 Nov 2009 14:03:00 GMT

Group Policy Offers New Functionality in Windows Server 2008 This article explains the improvements to the Group Policy in Windows Server 2008. Domain Controller Options Not Supported By RODC This article explains the DC Options which are not supported...(read more)

Tips - 2

Nirmal Sharma — Tue, 03 Nov 2009 13:44:00 GMT

A Quick Tip To Prevent Users From Accessing The Computer Tab This article explains a quick tip which you can use to prevent users from accessing the Computer Tab on My Computer property. A Quick Tip To Create A User Mode Process Dump File This article...(read more)

Tips - 1

Nirmal Sharma — Tue, 03 Nov 2009 13:18:00 GMT

Please check all the tips at WindowsNetworking.com: A Quick Tip To Strict FRS Replication To A Specific Port This article explains a registry heck which can be used to strict FRS Replication to a specific port. A Quick Tip To Strict AD Replication To...(read more)

Tip - A Quick Tip To Make Sure FRS Is Working In A Domain

Nirmal Sharma — Wed, 29 Oct 2008 17:35:13 GMT

This article explains a small mechanism you can use to make sure FRS is working. FRS (File Replication Service) is used to replicate Scripts and Group Policy in Active Directory. FRS is dependent on Active Directory Connection Objects Read more here....(read more)

Tip - A Quick Tip To Update Group Policy Settings On Remote Computers

Nirmal Sharma — Thu, 16 Oct 2008 17:20:47 GMT

This article explains a single command you can use to update the Group Policy settings on remote computers. Please note this applies to Windows 2000 Computers only Read more here... http://www.windowsnetworking.com/kbase/WindowsTips/Windows2000/AdminTips...(read more)

WinInstall LE, MSI Creator and Configuration Builder

Nirmal Sharma — Tue, 30 Sep 2008 03:39:29 GMT

This article explains the advantages of tool WinInstall LE (a tool from Veritas software, which ships with Windows Server CD) and how to use this tool to convert EXE applications to MSI packages. About Active Directory and Group Policy You have, no doubt...(read more)

Tip - How does Windows Server 2008 resolve Domain Controller Load Balancing problems?

Nirmal Sharma — Thu, 25 Sep 2008 10:17:12 GMT

This article discusses a new Group Policy setting which solves the Load Balancing issues with the domain controllers. The DC Locator Service has been re-designed in Windows Server 2008 to include a new mechanism. When a client computer finds a preferred...(read more)

Tip - A Quick Tip to configure Group Policy settings in Workgroup Security Model.

Nirmal Sharma — Thu, 25 Sep 2008 10:14:20 GMT

This article will show how you can quickly configure Group Policy in Workgroup Security Model. This article applies to Windows 2000, Windows XP and Windows 2003. The Group Policy can also be deployed in Workgroup security model but there is no central...(read more)

Tip - How To Check If A PSO Has Been Applied To A User Or Group?

Nirmal Sharma — Thu, 11 Sep 2008 15:38:09 GMT

Checking users' password policies in Windows Server 2008 domain. In Windows Server 2008 you can implement multiple password policies for users or groups. The effective password policies for a user or group are stored in AD Attributes. You need to...(read more)

Tip - How To Force Users To Log On To The Domain?

Nirmal Sharma — Wed, 03 Sep 2008 10:05:59 GMT

This article explains a mechanism you can use to force client computers to log on to the domain. Read more here... http://www.windowsnetworking.com/kbase/WindowsTips/Windows2003/AdminTips/ActiveDirectory/HowToForceUsersToLogOnToTheDomain.html...(read more)

Tip - A Quick Tip to make sure Adprep /ForestPrep for Windows Server 2008 has run successfully

Nirmal Sharma — Mon, 18 Aug 2008 22:39:00 GMT

Adprep /ForestPrep must be executed to introduce a Windows Server 2008 in an existing Windows 2000 or Windows 2003 domain environment. This will show you how to make sure that it has run successfully. Read more here... http://www.windowsnetworking.com...(read more)

How does Windows Server 2008 resolve Domain Controller Load Balancing problems?

Nirmal Sharma — Mon, 18 Aug 2008 22:35:00 GMT

This article discusses a new Group Policy setting which solves the Load Balancing issues with the domain controllers. Read more here.... http://www.windowsnetworking.com/kbase/WindowsTips/WindowsServer2008/AdminTips/ActiveDirectory/HowdoesWindowsServer2008resolvesDomainControllerLoadBalancingproblems...(read more)

Tip - DynamicSiteName and SiteName – Which site a client computer belongs to?

Nirmal Sharma — Mon, 18 Aug 2008 11:36:00 GMT

If you are troubleshooting a client computer which always communicates to a domain controller in different site, you should look at the two registry entries explained in this article. This article applies to Windows 2000 and Windows XP. Read more here...(read more)

Tip - A Quick Tip to designate a domain controller for client authentications.

Nirmal Sharma — Mon, 18 Aug 2008 11:33:00 GMT

This article explains the use of SRV priority. This applies to Windows 2000, Windows 2003 and Windows Server 2008. Read more here... http://www.windowsnetworking.com/kbase/WindowsTips/WindowsServer2008/AdminTips/ActiveDirectory/AQuickTiptodesignateadomaincontrollerforclientauthentications...(read more)

User can not log on to the domain while Network Cable is disconnected.

Nirmal Sharma — Sun, 30 Dec 2007 21:23:00 GMT

You may face the above mentioned situation when a user tries to log on to a domain while Network Cable is disconnected. This generally happens if the following conditions meet:

Password Caching is disabled. Check using Registry Editor on the local PC.
User account is created with different language. Make sure account name which is cached at the local machine has the same as stored in AD.
Home Folder path in User’s property contains a blank space. Make sure there is no blank space otherwise users can't log on to the domain.

I will shout more on this if time permits.

SRV Records Of Domain Controller In DNS Zone

Nirmal Sharma — Sun, 23 Sep 2007 20:18:00 GMT

The following knowledgeable help you to determine the problem if SRV records of a domain controller is not registered in the DNS Zone of that domain.

The following may happen when SRV records of a domain controller are not registered in DNS Zone of that domain:

All the client computers make take long time to log on to the domain.
Client computers stuck at Applying Computer Settings.
Group Policy settings may not apply.
Folder Redirection policy is not working
Software Installation is not working.
Replication between domain controllers is not happening.
An application is giving error about SRV records. An application may use DNS to locate domain controllers by sending SRV queries.
Nslookup returns error when querying using SRV records.
Pinging of SRV records (_ldap, _keberos etc) are not successful.
Group Policy Objects are not syncing.

The SRV records may be the cause the above. The SRV Records of a domain controller in the domain plays an important role in Active Directory. Active Directory can not work without a DNS server. The DNS server in Active Directory is used to locate Domain Controllers in the forest or domain with the help of SRV records. Service Records or SRV records are registered specifically for domain controllers when you promote a member server to domain controller. The Netlogon service on domain controller is responsible to register SRV records.

You can use the following methods to re-register SRV records of a domain controller in the domain DNS zone:

1. Restart the Netlogon service on domain controller.
2. Run DcDiag /fix
3. Run NetDiag /ifx
4. Re-register from Netlogon.dns file in \Windows or Winnt\System32\Config directory.

The Netlogon.dns file is created when you promote a member server to domain controller.

Login Scripts, Computer and User Logon Scripts! - Difference

Nirmal Sharma — Sun, 23 Sep 2007 20:12:00 GMT

You may have noticed the following policy settings in Group Policy and for a while confused about these policy settings for user.

There are three places in Group Policy where you can configure programs to run when a computer starts and after a user logon to the system. These three places are under the following container:

User Configuration\Windows Settings\Scripts (Logon\Logoff)
User Configuration\Administrative Templates\System\Logon
Computer Configuration\Administrative Templates\System\Logon

In the last two, you will see the following policy settings:

Run these programs at user logon
Do not process the run once list
Do not process the legacy run list

The above policy settings appear in both: User and Computer Configuration container.

For “Run these programs at user logon” policy setting, if this policy setting is configured in both the container (user and computer) the user policy setting will run just after computer policy setting.

For last two “Do not process the run once list” and “Do not process the legacy run list” policy settings, if this policy setting is configured in both the container (user and computer) the computer policy setting will take precedence over user policy setting.

Why so? The reason is very simple. The Run Once list is configured in Local Machine HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce only. The programs in this registry key are processed only after user has logged on to the system. There is no RunOnce key for user. That is why computer RunOnce will run after user RunOnce.

Now, you may ask that there is logon programs, login scripts and logon scripts but there is no Logoff Programs? It is because a program requires system resources when it runs whereas a logoff shuts down all the applications. While a windows is shutting down a program can not stay in memory.

There is a difference between running a program and a script. Please note the difference. A program is something which is installed on users computer and you configure in “Run these programs at user logon” by specifying the full path of that program. This program runs Locally. On other hand, a script is something which is run over the network. You need to specify a complete path of the program you wish to run when a user’s login script has finished.

So the point is very clear and the script or programs are run in the following order:

Computer Startup / Script runs. Will be applicable to all the computers
User Login script runs. Will be applicable to all the users.
Computer logon programs run Will be applicable to all the computers.
User logon programs run Will be applicable to all the users.

After user login script has finished, the Winlogon at workstation will retrieve a list of programs to run on local computer from GPO.

In above, there is no conflict in policy settings so all the program will run one by one.

Group Policy Key terms:

Not Configured

This means Policy setting is not configured and Winlogon service at client end,

While processing the Group Policy Objects from domain controller, will not process this policy

setting.

Disabled

This means Policy setting is configured but Domain Controller will not publish it for

processing or Winlogon at workstation will not process this setting.

Enabled

This means Policy setting is configured and will be processed by Winlogon service at

workstation.

The Microsoft has designed two options for Group Policy for NOT processing Group Policy settings. The “Disabled” option in Policy settings are configured per policy setting whereas “Disable User or Computer Policy settings” in property of GPO is used to NOT to process any policy settings configured in the said container. The later option overrides settings configured in earlier option.

Computer policy settings only run when computer starts just before user logon. Example, you have a network drive to map for all computers. This network drive mapping will be available for all the users who log on to that system.

User policy settings only run after user log on to the system. In above example, the network drive mapping will be available to all users who logs on to the system.

Third option is filtering Group Policy settings using groups. This option doesn’t necessarily defeat the above rule but is here to process the GPO for selected users or computers. In above example, if you create a Group called “ServiceComputers” and put 4 computers in that group and apply a policy setting to this group then only the computers will receive this policy.

Other options are “Block Policy Inheritance” and “No Override”. The first option can be set on a child policy meaning you can not set this option at site level or there is no use of this option at parent policies. This option, if enabled, forces child GPO not to accept any policy settings coming from Parent GPO. The “No Override” option, if enabled, forces child GPO not to block any policy setting coming from parent GPO. If there is a conflict in the policy, the Parent GPO settings will be applied provided “No Override” option is enabled.

Installing Administrative Tools on Windows Vista

Nirmal Sharma — Sun, 28 Jan 2007 23:52:00 GMT

You can run Windows 2003 Administrative tools on Windows Vista.

Check out here:

http://support.microsoft.com/?scid=kb%3Ben-us%3B930056&x=13&y=13

Duplicate SPN registered in domain.

Nirmal Sharma — Mon, 22 Jan 2007 20:32:00 GMT

Sometimes, your domain controller may report an error for duplicate SPN names registered in Active directory database. These errors are logged when you have duplicate SPN names but don't know their exact location to delete them.

You can use a Microsoft tool called LDP.exe or LDIFDE.exe to search duplicate SPN and remove them from the domain.

Check out here:

http://support.microsoft.com/kb/321044