6 Tips for troublsheooting Active Directory (Link)

I found this article quite helpful.  It contains some excellent detailed information.

https://redmondmag.com/articles/2009/07/01/6-tips-for-troubleshooting-active-directory.aspx

Especially detailed is the AD Diagnostics Registry settings:

Export/Import OU's from Active Directory to LAB

This is a quick and dirty but works.


Here is a simple script to export and then import the OU structure from one AD to another, such as when you want to create a lab from a production AD.


To export the Prod OU's to a CSV, enter the following command:


 Get-ADOrganizationalUnit -Filter *|select name,@{n="Path";E={($_.DistinguishedName).replace("OU="+$_.name+",","") }} | ConvertTo-Csv -NoTypeInformation |out-file -FilePath Prod-OUS-4-Import.csv


Next,  edit the domain name in the CSV to change it to the new domain.
Also, clean up the file to remove any OU's that are out of scope. 


Third, run the following script using the CSV to import the names and Path of the OU's

# Command Line Parameters
Param(
 [Parameter(Mandatory=$false,HelpMessage='CSV FIle')][string]$Inputfile=".\Prod-OUS-4-Import.csv"
)
import-module activedirectory
# Read in data
$OUS = import-csv $InputFile
$ous |ft -a  #validate data on screen
# get current OUs for errorchecking
$currentous = get-adorganizationalunit -filter *
# Create ou for each line in CSV
foreach ($ou in $ous) {
 $error.clear()
 $path = "OU=$($ou.name),$($ou.path)"
 #write-host "$path"
 If ( $currentOUS | ?{$_.DistinguishedName -eq $path } ) {
  write-host  "Exists:  OU=$($ou.name),$($ou.path) already exists" -foregroundcolor yellow
 } else {
  new-ADOrganizationalUnit -name $ou.name -path $ou.path  -ProtectedFromAccidentalDeletion:$false  -ErrorAction:silentlycontinue
  if ($error.count -gt 0) {
   write-host "Failed:  OU=$($ou.name),$($ou.path)"  -foregroundcolor red
  } else {
   write-host "Created: OU=$($ou.name),$($ou.path)"  -foregroundcolor green
  }
 }
}

Securing Active Directory with the Least Privilege Principle

Securing AD with Least Privilege Principle

I have been working for the last number of weeks on a project to secure AD, and to reduce the Attack Surface of AD.

If you are not on board with why you need to secure AD from compromise, and to establish good security work habits, please view one or more of the following videos.  These show how incredibly easy it is for a hacker to break in to your systems.

From Microsoft Ignite 2015.

• How You Can Hack-Proof Your Clients and Servers in a Day
  https://channel9.msdn.com/Events/Ignite/2015/BRK2346
  This is an excellent technical article with hands-on demo of tools, password decodes, remote code execution, enable webcam, etc.
  .
• Detecting the Undetectable
  https://channel9.msdn.com/Events/Ignite/2015/BRK2344
  .

Next step is to review and become familiar with Microsoft's Best Practices for Securing AD.
http://www.microsoft.com/en-ca/download/details.aspx?id=38785

Some of the key components of these documents and video's are:

• Set up your Active Directory so that there are normally ZERO members of the privileged groups.
  Use Role-Based "Least Privileged Principle" and elevate the role of your senior Admin to Domain Admins just for the duration required to perform the task.
• Never assign a Service Account to the Privileged Groups (Domain Admin).
  It is easy for a hacker to ask a server what Service Accounts exist, and then they can focus their attack on those accounts.
• Never log in to a workstation with a Domain Admin ID.
• Set up Alerts for logins to workstations from any members of the AD Privileged groups.
• Restrict access to back-end servers from anything but their corresponding front-end servers.
• Enable Filewall and IPSEC rules to only allow access to important servers from trusted hosts using trusted ID's.  
• ...

Using activedirectory powershell module with 2003 domain controllers

See the following for step by step how to use active directory powersSell cmdlets against 2003 domain controllers
http://blogs.technet.com/b/ashleymcglone/archive/2011/03/17/step-by-step-how-to-use-active-directory-powershell-cmdlets-against-2003-domain-controllers.aspx

Also, in order to run RSAT on Windows 7, with 2003 or 2008 DC's:
This is still untested, but it looks like the author has figured out how to add the Active Directory PowerShell modules to Windows 7.

Why would you want to do this?

Well, I am writing PowerShell script to document AD, and I would like to be able to run them in an older AD environment, such as an upgrade candidate, etc.

With a Win 7 workstation, I am hoping that I can load it up and run the script against an old 2003 server.

System Requirements:

• Windows 2003 SP2 server, with Active Directory Management Gateway Services (Active Directory Web Services for Windows Server 2003 and 2008) installed.
  (http://www.microsoft.com/en-us/download/details.aspx?id=2852)
• Windows 7 with or without RSAT (that is the thing).

This information was found on a forum (http://social.technet.microsoft.com/Forums/windowsserver/en-US/094f9dd3-669a-4bea-9f81-f2ea009384d1/powershell-v2-and-active-directory-module)

Also see: http://www.mikepfeiffer.net/2010/01/how-to-install-the-active-directory-module-for-windows-powershell/

I decided to post the content here just in case I loose access to the blog.

---

In summary:
I found a very Simple and Elegant way to make the AD PowerShell Module Portable.
you will need 3 simple things
1.) the ActiveDirectory Module Directory from a system that has it already installed. 
Standard path on a 64bit windows 7
C:\Windows\System32\WindowsPowerShell\v1.0\Modules
2.)  Global Assembly Cache Utility
Available from the Windows SDK
gacutil.exe
3.) the Microsoft.ActiveDirectory.Management dll assembly
found on a system that already has the RSAT and powershell enabled. Microsoft.ActiveDirectory.Management.dll
Now in order to make this work you need to install the dll using the gacutil program.  commandline is as follows.
GACUTIL.exe -I Microsoft.ActiveDirectory.Management.dll
Once installed you must copy the entire directory from item 1 to the powershell module location.
Once copied you can then use the import command to import it and start using the cmdlets.  below is my batch file I wrote to automate this for deployment during SCCM.
We want our help desk to be able to clone security groups assigned to our computers for application deployment so that when they image a replacement computer the new computer will automatically get the previously assigned applications.  Also see below for that powershell script as well.  Hope this helps the community.
And for the people/MS that say it can not be done,  here to you :)

REM ************************************
REM SET Working Directory
REM ************************************
@setlocal enableextensions
@cd /d "%~dp0"
REM ************************************
REM Copy Module
REM ************************************
if not exist C:\Windows\System32\WindowsPowerShell\v1.0\Modules\ActiveDirectory mkdir C:\Windows\System32\WindowsPowerShell\v1.0\Modules\ActiveDirectory
xcopy /y /e .\ActiveDirectory\*.* C:\Windows\System32\WindowsPowerShell\v1.0\Modules\ActiveDirectory
REM ************************************
REM Install Microsoft Active Directory Assembly
REM ************************************
gacutil.exe -i Microsoft.ActiveDirectory.Management.dll
REM ************************************
REM Set Powershell Execution Policy
REM ************************************
powershell set-executionpolicy remotesigned
REM ************************************
REM Run Computer Membership Clone
REM ************************************
powershell ./ADCompMemberof.ps1
exit

######################################################################
Powershell script to copy group membership of a computer object in AD
  # Create TS Environment COM Object
$TS = New-Object -ComObject Microsoft.SMS.TSEnvironment
$Target=$TS.Value('_SMSTSMachineName')
$Source=$TS.Value('OldComputer')
$array = @()
$groups = Get-AdComputer -Identity $source -property "MemberOf" 
Foreach($group in $groups.memberOf) {
$array +=$group
}
Get-ADComputer -Identity $target | Add-ADPrincipalGroupMembership -MemberOf $array

How to Implement the Central Store for Group Policy Admin Templates

How to Implement the Central Store for Group Policy Admin Templates

http://blogs.technet.com/b/askpfeplat/archive/2011/12/12/how-to-implement-the-central-store-for-group-policy-admin-templates-completely-hint-remove-those-adm-files.aspx

PowerShell Tips #2 - Working with Multi-Instance or Nested Properties

The objective here is to create reports of objects that contain properties with multiple instances, or nested properties.

Example is Get-DNSServer

Get-DNSServer by itself, with no parameters, produces a very detailed, multiple-heading report with a ton of detail.   The internal code to produce this report will be the subject of another technote.

For this exercise though, see the outout from the command

PS C:\ > Get-DnsServer |gm -MemberType Property

Name                       MemberType Definition
----                       ---------- ----------
PSComputerName             Property   string PSComputerName {get;}
ServerCache                Property   CimInstance#Instance ServerCache {get;set;}
ServerDiagnostics          Property   CimInstance#Instance ServerDiagnostics {get;set;}
ServerDsSetting            Property   CimInstance#Instance ServerDsSetting {get;set;}
ServerEdns                 Property   CimInstance#Instance ServerEdns {get;set;}
ServerForwarder            Property   CimInstance#Instance ServerForwarder {get;set;}
ServerGlobalNameZone       Property   CimInstance#Instance ServerGlobalNameZone {get;set;}
ServerGlobalQueryBlockList Property   CimInstance#Instance ServerGlobalQueryBlockList {get;set;}
ServerRecursion            Property   CimInstance#Instance ServerRecursion {get;set;}
ServerRootHint             Property   CimInstance#InstanceArray ServerRootHint {get;set;}
ServerScavenging           Property   CimInstance#Instance ServerScavenging {get;set;}
ServerSetting              Property   CimInstance#Instance ServerSetting {get;set;}
ServerZone                 Property   CimInstance#InstanceArray ServerZone {get;set;}
ServerZoneAging            Property   CimInstance#InstanceArray ServerZoneAging {get;set;}
ServerZoneScope            Property   CimInstance#InstanceArray ServerZoneScope {get;set;}

What I am interested in reporting is the IP Addresses of the Forwarders, which is contained in the "ServerForwarder" property.


So, we now type "(get-dnsserver).ServerForwarder" and get the following:

UseRootHint        : True
Timeout(s)         : 3
EnableReordering   : True
IPAddress          : {10.1.1.4, 10.2.1.20}
ReorderedIPAddress : {10.1.1.4, 10.2.1.20}

Now type:
PS C:\ > (get-dnsserver).ServerForwarder | GM

Name                      MemberType     Definition
----                      ----------     ----------
EnableReordering          Property       bool EnableReordering {get;set;}
PSComputerName            Property       string PSComputerName {get;}
Timeout                   Property       uint32 Timeout {get;set;}
UseRootHint               Property       bool UseRootHint {get;set;}
IPAddress                 ScriptProperty System.Net.IPAddress[] IPAddress {get=[OutputType([Syste...
ReorderedIPAddress        ScriptProperty System.Net.IPAddress[] ReorderedIPAddress {get=[Outpu...

Notice that a "Property" of the ServerForwarder property is not a Property at all, but rather a ScriptProperty.  It contains multiple values as a sudo-property. 

So lets keep going.   
PS C:\> ((get-dnsserver).ServerForwarder).IPAddress
 
Address            : 67174666
AddressFamily      : InterNetwork
ScopeId            :
IsIPv6Multicast    : False
IsIPv6LinkLocal    : False
IsIPv6SiteLocal    : False
IsIPv6Teredo       : False
IsIPv4MappedToIPv6 : False
IPAddressToString  : 10.1.1.4

Address            : 335610378
AddressFamily      : InterNetwork
ScopeId            :
IsIPv6Multicast    : False
IsIPv6LinkLocal    : False
IsIPv6SiteLocal    : False
IsIPv6Teredo       : False
IsIPv4MappedToIPv6 : False
IPAddressToString  : 10.2.1.20

So how do we query the DNS Server and spit out this magical list of IP Addresses?
Method 1) 
PS C:\ > (((get-dnsserver).ServerForwarder).IPAddress).IPAddressToString
10.1.1.4
10.2.1.20

Method 2)


PS C:\ > Get-DnsServer |%{$_.ServerForwarder | %{($_.IPAddress).IPAddressToString}}

10.1.1.4
10.2.1.20

End of Lesson.

Microsoft PKI (Certificate Authority) Migrations

Excellent articles on Migrating CA's

• Microsoft "by the book"
  AD CS Migration: Migrating the Certification Authority
  http://technet.microsoft.com/en-us/library/ee126140(WS.10).aspx#BKMK_GrantPermsAIA
  (Note: This has confusing references to either leaving the CA Server name the same or changing it)
• Moving Your Organization from a Single Microsoft CA to a Microsoft Recommended PKI
  http://blogs.technet.com/b/askds/archive/2010/08/23/moving-your-organization-from-a-single-microsoft-ca-to-a-microsoft-recommended-pki.aspx
• Migrating Windows Certificate Authority Server from Windows 2003 Standard to windows 2008 Enterprise Server
  http://smtpport25.wordpress.com/2010/01/16/migrating-windows-certificate-authority-server-from-windows-2003-standard-to-windows-2008-enterprise-server/
  (Note that this is full of little typos, but looks like a simple solution to a simple scenario.
  Be sure and read the feedback though, and there are lots of unanswered questions).
•  

AD Upgrade Articles

Excellent Articles on AD Upgrades:

• Upgrading an Active Directory Domain from Windows Server 2003 or Windows Server 2003 R2 to Windows Server 2012
  https://msmvps.com/blogs/mweber/archive/2012/07/30/upgrading-an-active-directory-domain-from-windows-server-2003-or-windows-server-2003-r2-to-windows-server-2012.aspx
  
• Group Policy Settings Reference for Windows and Windows Server
  http://www.microsoft.com/en-us/download/details.aspx?id=25250
  
• 
  

How-to Transfer FSMO roles using powershell

Excellent article on how to transfer FSMO roles using powershell
http://thelazyadmin.com/2013/08/managing-fsmo-roles-with-powershell/

Summary:
Netdom query fsmo
Move-ADDirectoryServerOperationMasterRole -Identity “Target_DC_Name” –OperationMasterRole 0,1,2,3,4

Powershell Tricks and Notes

How to expand parameterizedProperty

Note if you issue the following command:

Get-ADComputer -Filter * |Get-Member

You will get the following result:
  TypeName: Microsoft.ActiveDirectory.Management.ADComputer

Name              MemberType            Definition
----              ----------            ----------
Contains          Method                bool Contains(string propertyName)
Equals            Method                bool Equals(System.Object obj)
GetEnumerator     Method                System.Collections.IDictionaryEnumerator GetEnumerator()
GetHashCode       Method                int GetHashCode()
GetType           Method                type GetType()
ToString          Method                string ToString()
Item              ParameterizedProperty Microsoft.ActiveDirectory.Management.ADPropertyValueCollection Item(string p...
DistinguishedName Property              System.String DistinguishedName {get;set;}
DNSHostName       Property              System.String DNSHostName {get;set;}
Enabled           Property              System.Boolean Enabled {get;set;}
Name              Property              System.String Name {get;}
ObjectClass       Property              System.String ObjectClass {get;set;}
ObjectGUID        Property              System.Nullable`1[[System.Guid, mscorlib, Version=4.0.0.0, Culture=neutral, ...
SamAccountName    Property              System.String SamAccountName {get;set;}
SID               Property              System.Security.Principal.SecurityIdentifier SID {get;set;}
UserPrincipalName Property              System.String UserPrincipalName {get;set;}


Notice that property "Item".

So when you type:

Get-ADComputer -Filter * -Property * |Get-Member

You hope tp get something that expands the properties of "Item".

Now.  What if you get an error:
PS C:\Data\Scripts> Get-ADComputer -Identity lab17dc1 -property * |gm
Get-ADComputer : One or more properties are invalid.
Parameter name: msDS-AssignedAuthNPolicy
At line:1 char:1
+ Get-ADComputer -Identity lab17dc1 -property * |gm
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidArgument: (lab17dc1:ADComputer) [Get-ADComputer], ArgumentException
    + FullyQualifiedErrorId : ActiveDirectoryCmdlet:System.ArgumentException,Microsoft.ActiveDirectory.Management.Comm
   ands.GetADComputer

Well that is a big Oops.  It is actually a bug in AD.
Here is a workaround for THIS bug.  To get your properties, do the following:

Get-ADComputer -Identity lab17dc1 |Get-ADObject -properties *|gm

Now you get something like:
    TypeName: Microsoft.ActiveDirectory.Management.ADObject
Name                            MemberType            Definition
----                            ----------            ----------
Contains                        Method                bool Contains(string propertyName)
Equals                          Method                bool Equals(System.Object obj)
GetEnumerator                   Method                System.Collections.IDictionaryEnumerator GetEnumerator()
GetHashCode                     Method                int GetHashCode()
GetType                         Method                type GetType()
ToString                        Method                string ToString()
Item                            ParameterizedProperty Microsoft.ActiveDirectory.Management.ADPropertyValueCollection...
accountExpires                  Property              System.Int64 accountExpires {get;set;}
badPasswordTime                 Property              System.Int64 badPasswordTime {get;set;}
badPwdCount                     Property              System.Int32 badPwdCount {get;set;}
CanonicalName                   Property              System.String CanonicalName {get;}
CN                              Property              System.String CN {get;}
codePage                        Property              System.Int32 codePage {get;set;}
countryCode                     Property              System.Int32 countryCode {get;set;}
Created                         Property              System.DateTime Created {get;}
createTimeStamp                 Property              System.DateTime createTimeStamp {get;}
Deleted                         Property              System.Boolean Deleted {get;}
Description                     Property              System.String Description {get;set;}
DisplayName                     Property              System.String DisplayName {get;set;}
DistinguishedName               Property              System.String DistinguishedName {get;set;}
dNSHostName                     Property              System.String dNSHostName {get;set;}
dSCorePropagationData           Property              Microsoft.ActiveDirectory.Management.ADPropertyValueCollection...
instanceType                    Property              System.Int32 instanceType {get;}
isCriticalSystemObject          Property              System.Boolean isCriticalSystemObject {get;set;}
isDeleted                       Property              System.Boolean isDeleted {get;}
LastKnownParent                 Property              System.String LastKnownParent {get;}
lastLogoff                      Property              System.Int64 lastLogoff {get;set;}
lastLogon                       Property              System.Int64 lastLogon {get;set;}
lastLogonTimestamp              Property              System.Int64 lastLogonTimestamp {get;set;}
localPolicyFlags                Property              System.Int32 localPolicyFlags {get;set;}
logonCount                      Property              System.Int32 logonCount {get;set;}
Modified                        Property              System.DateTime Modified {get;}
modifyTimeStamp                 Property              System.DateTime modifyTimeStamp {get;}
msDFSR-ComputerReferenceBL      Property              Microsoft.ActiveDirectory.Management.ADPropertyValueCollection...
msDS-GenerationId               Property              System.Byte[] msDS-GenerationId {get;}
msDS-SupportedEncryptionTypes   Property              System.Int32 msDS-SupportedEncryptionTypes {get;set;}
Name                            Property              System.String Name {get;}
nTSecurityDescriptor            Property              System.DirectoryServices.ActiveDirectorySecurity nTSecurityDes...
ObjectCategory                  Property              System.String ObjectCategory {get;}
ObjectClass                     Property              System.String ObjectClass {get;set;}
ObjectGUID                      Property              System.Nullable`1[[System.Guid, mscorlib, Version=4.0.0.0, Cul...
objectSid                       Property              System.Security.Principal.SecurityIdentifier objectSid {get;}
operatingSystem                 Property              System.String operatingSystem {get;set;}
operatingSystemVersion          Property              System.String operatingSystemVersion {get;set;}
primaryGroupID                  Property              System.Int32 primaryGroupID {get;set;}
ProtectedFromAccidentalDeletion Property              System.Boolean ProtectedFromAccidentalDeletion {get;set;}
pwdLastSet                      Property              System.Int64 pwdLastSet {get;set;}
rIDSetReferences                Property              Microsoft.ActiveDirectory.Management.ADPropertyValueCollection...
sAMAccountName                  Property              System.String sAMAccountName {get;set;}
sAMAccountType                  Property              System.Int32 sAMAccountType {get;set;}
sDRightsEffective               Property              System.Int32 sDRightsEffective {get;}
serverReferenceBL               Property              Microsoft.ActiveDirectory.Management.ADPropertyValueCollection...
servicePrincipalName            Property              Microsoft.ActiveDirectory.Management.ADPropertyValueCollection...
userAccountControl              Property              System.Int32 userAccountControl {get;set;}
uSNChanged                      Property              System.Int64 uSNChanged {get;}
uSNCreated                      Property              System.Int64 uSNCreated {get;}
whenChanged                     Property              System.DateTime whenChanged {get;}
whenCreated                     Property              System.DateTime whenCreated {get;}
 

Exchange SSL Certs and DNS configurtion(s)

This article discusses how to deal with the fact that you can no longer get a 3rd party SSL Certificate for an internal domain.

The issue is that 3rd party Certs will not allow non-verifiable Certs after Oct 2016.  Essentially, that means that you should now configure your Exchange environment (2007/2010/2013) to not depend on Certs for internal names.

The solution is too simple.  Just configure your DNS server to implement a "Split-DNS-Horizon".
Note that this also works perfectly for auto-configuring your Outlook clients, regardless of whether they are connected internally or externally.

For this example, lets assume that your internal domain is domain.local, and that your email domain is domain.com

The easiest and simplest trick is to configure an entry in your internal DNS servers, to point autodiscover.domain.com to the internal IP address of your CAS server.

The best way to do this is to create a new DNS Zone with the name "autodiscover.domain.com", and then create an unnamed entry ("@") pointing to your internal CAS server(s). 

This way, it does not interfere with all of your existing DNS records for the "domain.com" zone, such as www, etc. 

So now, with this configuration, all that you need for a 3rd party SSL Cert is the "domain.com" name.  

Additional Reference:

• Internal DNS and Exchange Autodiscoverhttp://acbrownit.wordpress.com/2012/12/20/internal-dns-and-exchange-autodiscover/

Office365 DIRSYNC, How to Set a Partition to limit the number of objects that are Synced from AD

The default install of DIRSYNC will synchonize your entire AD with Office365.

To my way of thinking, this is excessive and unnecessary.

During the install, at the end of following running Configuration Wizard, you will be asked if you wish to "Synchronize now".   Uncheck this box and then, after a reboot, follow the instructions below:

Step 1:

• Create a shortcut to C:\Program Files\Windows Azure Active Directory Sync\SYNCBUS\Synchronization Service\UIShell\miiclient.exe (Synchronization Service Manager)
• Change the advanced properties to Run as Administrator.
•  Launch this tool

Step 2:

• After the install,  Open Active Directory Users and Computers and search for all users starting with "MSOL_".  You will see that there is a new account called "MSOL_6b06ffadffb5" or some such giberish.  The number is different on every Server.  
• Change the password on this account to something secure, that you can enter in the Service Manager

Step 3: 

• In Synchronization Service Manager, click on the Management Agents button, and highlight Active Directory Connector.

• Click Actions and then Properties 

• Click on the "Connect to Active Directory Forest" menu on the left.
• Enter the Password that you assigned to the default account

• Click "Configure Directory Partitions".  It will verify the AD credentials and change to the "Configure Directory Partitions" menu.
• Click on the Containers button

• Uncheck the select at the root of the Domain, and instead select the appropriate OU(s) that you wish to sync.

 Step 4:

• Verify DirSync.  Do this by opening up Powershell, and adding the snapin
  
  ADD-PSSnapin Coexistence-Configuration
• Type Start-OnlineCoexistenceSync
• Watch the Status screen of the Synchronization Service Manager 

•  Make sure that you see "Success" for each of the 4 tasks.

IT Information Favorite Links

Reference

• http://blogs.technet.com/b/canitpro/

Cloud

• http://www.windowsnetworking.com/articles-tutorials/cloud-computing/planning-hybrid-it-infrastructure-using-windows-azure-infrastructure-services-part1.html

Exchange

• Exchange Service Packs and Rollups
  http://social.technet.microsoft.com/wiki/contents/articles/240.exchange-server-and-update-rollups-build-numbers.aspx
• Exchange Server 2013 and Cumulative Updates (CU’s) Build Numbers
  http://social.technet.microsoft.com/wiki/contents/articles/15776.exchange-server-2013-and-cumulative-updates-cus-build-numbers.aspx

Office365

• manage-office-365-using-powershell
  http://www.o365info.com/2012/07/manage-office-365-using-powershell-12.html

Some DNS queries are unsuccessful after deploying a Windows Server 2008 R2 DNS server

Some DNS name queries are unsuccessful after you deploy a Windows Server 2008 R2-based DNS server.  It seems inconsistent but it all depends on the DNS Name being called.  (BMO.COM always exhibits the problem)

http://support.microsoft.com/kb/832223

 

Scenario:

1. Clear DNS cache on the server:
   dnscmd /clearcache
2. Run NSLOOKUP
3. Set type=all
4. BMO.COM
   Notice that the first attempt times out.  Repeated attempts will eventually be successful.
5. Workaround:
   Type: dnscmd /config /enableednsprobes 0

 

Quick AD Replication summary

REPADMIN /replsummary *

 

A sample report looks like this:

 

C:\Windows\system32>repadmin /replsummary *

Replication Summary Start Time: 2013-05-09 20:14:39

 

Beginning data collection for replication summary, this may take awhile:

  .........................

 

 

Source DSA          largest delta    fails/total %%   error

AMSDC                 02h:19m:19s    0 /   5    0

ASHDC                     26m:31s    0 /   5    0

ATHDC                     11m:42s    0 /   5    0

CHRDC                 02h:26m:42s    0 /  10    0

EDBDC                 02h:19m:19s    0 /   5    0

FVBDC                 02h:26m:17s    0 /  10    0

GPRDC                     26m:17s    0 /  10    0

KAODC                 02h:24m:40s    0 /  85    0

KAODC2                    26m:02s    0 /   5    0

KCHSDB                    26m:43s    0 /   5    0

KRLDC                 02h:28m:34s    0 /  40    0

POCDC            >60 days            5 /   5  100  (1722) The RPC server is unavailable.

PRLDC                 02h:26m:31s    0 /  10    0

PRVDC2                    26m:38s    0 /   5    0

QCHDC                     26m:43s    0 /   5    0

RAOADC01              02h:24m:41s    0 /  40    0

RAODC                 02h:17m:29s    0 /  10    0

SRLDC                 02h:17m:30s    0 /  10    0

STWDC                 02h:19m:34s    0 /   5    0

TACDC                 02h:19m:51s    0 /   5    0

 

 

Destination DSA     largest delta    fails/total %%   error

AMSDC                 02h:24m:02s    0 /  10    0

ASHDC                     23m:49s    0 /  10    0

ATHSDB                    04m:12s    0 /   5    0

CHRDC                 02h:24m:42s    0 /  10    0

EDBDC                 02h:23m:28s    0 /  10    0

FVBDC                 02h:21m:54s    0 /  10    0

GPRDC                     27m:13s    0 /  10    0

INDDC                 02h:26m:50s    0 /   5    0

KAODC                 02h:27m:10s    0 /  35    0

KAODC2                    26m:42s    0 /   5    0

KCHSDB                    20m:55s    0 /   5    0

KRLDC            >60 days            5 /  35   14  (1722) The RPC server is unavailable.

POCDC                 02h:29m:05s    0 /   5    0

PRLDC                 02h:17m:40s    0 /  10    0

PRVDC2                    22m:59s    0 /   5    0

QCHDC                     29m:38s    0 /   5    0

RAOADC                02h:26m:31s    0 /  45    0

RAODC                     18m:04s    0 /   5    0

SCTDC                 02h:18m:07s    0 /  30    0

SRLDC                     16m:22s    0 /   5    0

STWDC                 02h:18m:31s    0 /  10    0

TACDC                 02h:22m:58s    0 /  10    0

 

C:\Windows\system32>

 

Changing the AD Tombstone Lifetime

The default AD Tombstone lifetime in Windows 2003 AD is 60 days.

This was raised to 120 days in AD on Windows 2008

You can increase the lifetime before tombstoning an AD Object using the following:

http://www.petri.co.il/changing_the_tombstone_lifetime_windows_ad.htm

HYPER-V Logon as a service

Discovered today that you need to create a GPO to allow the account “NT Virtual Machine\Virtual Machines” to logon as a service.

Without this, you will discover that eventually you will not be able to start a VM.   It will give a Logon denied error message.

• Install the GPMC on a Hyper-V server
• Create or modify an existing GPO to include the above account in the LOGON AS A Service policy
• Run GPUPDATE /FORCE on all Hyper-V servers.

CSVDE Command Syntax

I learned today how to query AD from the command line to list only active servers. The filter includes the conditions "not disabled" and also "not an EMC Celerra"

csvde -f output.csv -r "(&(objectClass=computer)(!(userAccountControl=4098))(&(operatingSystem=*server*)(!(operatingSystem=EMC Celerra *))))" -l displayName,operatingSystem,operatingSystemVersion,operatingSystemServicePack,name,cn,dNSHostName