The Swede's blog

Change DNS on multiple computers - Now in PowerShell

2012-01-05T18:04:00.003+01:00

I published a script to change DNS on multiple computers a while back (here it is). It was written in VBScript. Now there is an update written in PowerShell by my colleague and friend Jan Egil Ring (PowerShell MVP).

Here is his mail with a link to the module:
--BEGIN--
“Hi Jimmy,

I finally got time to finish the blog-post:

http://blog.powershell.no/2011/11/22/introducing-the-powershell-network-adapter-configuration-module

Rather than creating a single script for the specific task I ended up creating a function in PowerShell, including capabilities such as error handling, logging and the option to either replace or add/remove entries from the DNSSearchOrder-list.
I also ended up creating a module I published on Codeplex, since I couldn`t find any complete library for managing network adapters from PowerShell (or other languages for that matter).
So let`s hope people in the community will contribute with more commands to the module… J (Win 8 will provide native modules for things like this, but I guess they won`t be backward compatible)”
--END--

And here is the Script:

--BEGIN--
I couldn`t resist re-writing your script into PowerShell ;)

It does reset the DNSServerSearchOrder rather than replacing specified IPs, so it`s not exactly the same.

# NAME:Set-DNSServer.ps1

#
# AUTHOR: Jan Egil Ring
# EMAIL: [JImmy removed this]
#
# VERSION HISTORY:
# 1.0 06.10.2011 - Initial release

#Custom variables

$FilePath = "C:\serverNames.txt"
$DNSServerSearchOrder = "10.230.20.9","10.230.20.10"

foreach ($computer in $FilePath) {

if (Test-Connection -ComputerName $computer -Count 1 -Quiet) {
$NICs = Get-WmiObject -Query "SELECT * FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled = TRUE AND DHCPEnabled = FALSE" -Computer $computer
if ($NICs) {
foreach ($NIC in $NICs) {
if ($NIC.DNSServerSearchorder) {
$NIC.SetDNSServerSearchOrder($DNSServerSearchOrder)
}
}
}

}

else {
Write-Host "Unable to contact $computer"
}
}
--END--

SCM v2

2011-10-13T12:34:00.000+02:00

SCM 2 provides ready-to-deploy policies and DCM configuration packs that are tested and fully supported. Our product baselines are based on Microsoft Security Guide recommendations and industry best practices, allowing you to manage configuration drift, address compliance requirements, and reduce security threats.

Download Security Compliance Manager 2

Learn more about Security Compliance Manager 2

MVP Award

2011-10-02T10:06:00.002+02:00

I received this in my mail yesterday:

___________
Dear Jimmy Andersson,

Congratulations! We are pleased to present you with the 2011 Microsoft® MVP Award! This award is given to exceptional technical community leaders who actively share their high quality, real world expertise with others. We appreciate your outstanding contributions in Directory Services technical communities during the past year.
___________

This is the 13th year in a row I got honored with this award, and I'm proud of it!

MVA - Microsoft Virtual Academy

2011-09-26T09:08:00.000+02:00

http://www.microsoftvirtualacademy.com/GetStarted.aspx

MVA is a training portal that offers you (at present date) the following tracks:

Clustering
Hyper-V
IaaS
Office 365
PaaS
Private Cloud
Public Cloud
SaaS
Security
SQL Azure
System Center
VDI
Virtualization
VMware
Windows Azure

Windows 8 License Fun

2011-09-16T08:32:00.000+02:00

When installing the Windows 8 Developer Preview with Tools, this funny license came up. Notice the second row, it's funny :)

More info on Windows 8

2011-09-16T08:28:00.002+02:00

Mark Minasi have written an article about Windows 8:
http://www.minasi.com/newsletters/nws1109.htm

Windows 8

2011-09-15T22:33:00.000+02:00

Are you curious about Windows 8?
Take a look at Sean Deuby's article in Windows IT Pro, I'm uncertain if I break NDA at this point so I will direct you to the official article on the Internet. When I'm certain about what I can blog without breaking NDA I will of course blog it :)

http://www.windowsitpro.com/author/5202540/SeanDeuby.aspx

Windows 8 Developer Preview

2011-09-14T20:41:00.002+02:00

Here it is!

http://msdn.microsoft.com/en-us/windows/apps/br229516

PowerShell Cheat Sheet

2011-09-12T12:36:00.000+02:00

On the Windows PowerShell Blog you will find Cheat Sheets for PowerShell.

Kerberos authentication over external trust

2011-09-12T10:13:00.002+02:00

Yes, it is possible! See Jorge's blog for details.

Nordic Infrastructure Conference

2011-09-12T10:10:00.000+02:00

Welcome to NIC2012!

Our goal is to create the premier event for all IT-professionals in the Nordics, offering broad technical education on Microsoft and 3. party products, tools and services. Our two day event will focus on deep-dives and practical knowledge on the most used products. This means less slides, more hands-on. We will show you the good and the bad sides, we will show you how to solve the most common tasks and challenges, sharing all our experience from the real world, the tips & the tricks.

So if you are deploying, managing, securing and mobilizing Microsoft solutions, NIC is the place to be. We will focus on the key technologies within current and soon-to-be released products, helping you to better solve today's IT-challenges, and preparing for tomorrow's innovations.

http://www.nic2012.com/

Interviews

2011-01-25T12:53:00.000+01:00

Just saw this one, and it is kind of spot on!

http://www.microsoft.com/showcase/en/us/details/b0f33cc2-8ead-46e9-9737-16435efa7c2b

Interactive logon information

2010-12-02T19:25:00.001+01:00

I got into some discussions about these 4 attributes and how they work. Here it is:

msDS-FailedInteractiveLogonCount: The total number of failed Ctrl + Alt + Del (C-A-D) logon attempts at a Windows Vista or Windows Server 2008 domain joined member (or higher) since the Last Interactive Logon Information feature was turned on.
Integer

msDS-FailedInteractiveLogonCountAtLastSuccessfulLogon: The total number of failed C-A-D logon attempts at a Windows Vista or Windows Server 2008 domain joined member (or higher) up until the last successful C-A-D logon.
Integer
msDS-LastFailedInteractiveLogonTime: The time that an incorrect password was presented during a C-A-D logon attempt at a Windows Vista or Windows Server 2008 domain joined member (or higher).
Timestamp

msDS-LastSuccessfulInteractiveLogonTime: The time that a successful C-A-D logon occurred at a Windows Vista or Windows Server 2008 domain joined (or higher).
Timestamp

If the and username/password is correct, it writes the timestamp to the msDS-LastSuccessfulInteractiveLogonTime . If the username/password is wrong it will write the timestamp to the msDS-LastFailedInteractiveLogonTime. Then the values of msDS-FailedInteractiveLogonCountAtLastSuccessfulLogon and msDS-FailedInteractiveLogonCount get raised by one (1). For example, if the msDS-FailedInteractiveLogonCount already have 2 it becomes 3.

When it is configured two things will happen:
1) The domain controller writes the information to AD and replicates it.. [Screenshot 1]
2) On the machine the user logs on to (at least Vista or 2008 server (or higher)) a query is sent to display the information at the logon screen. [Screenshot 2]

[Screenshot 1] The information waiting to be replicated to other DCs:

(0) modify CN=Jimmy Andersson,OU=Users,OU=ADS,OU=Services,OU=_Operations,DC=qadvice,DC=prv
1> objectGUID: 1e8979ba-94f8-47fe-83cc-99e9c28fa016
1> instanceType: 0x4 = ( WRITE )
1> msDS-LastSuccessfulInteractiveLogonTime: 2010-11-14 19:43:54 W. Europe Standard Time

[Screenshot 2] The information displayed to the user after a successful logon

What you need to think about:

Each time a user logon it will create replication traffic as you can see in screenshot 1. This information is then replicated to all domain controllers – in large environments this will most likely be an issue. So this feature should be used with caution!

If a RODC authenticates the user, this will happen:
• msDS-LastSuccessfulInteractiveLogonTime will only be written to the RODC and not forwarded to the RWDC
• msDS-LastFailedInteractiveLogonTime is written to the RODC and the RWDC. Then it will be replicated back from the RWDC to the RODC.
• msDS-FailedInteractiveLogonCountAtLastSuccessfulLogon will only be written to the RODC and not forwarded to the RWDC
• msDS-FailedInteractiveLogonCount is written to the RODC and the RWDC. Then it gets replicated back from the RWDC

Note! If you configure this for an OU, but not configure this on the domain controllers the users will not be faced with this error and not be able to logon:

Security policies on this computer are set to display information about the last interactive logon. Windows could not retrieve this information. Please contact your network administrator for assistance.

If a domain controller can’t be located the user will not be able to logon.

If you still see a need to use this feature, this is how you configure it:
Create a GPO and link it to both the domain controllers OU and to the OU you have the clients you want the users to see this logon information on. Of course if you want to be more flexible create two GPOs, one for the domain controllers OU and one for the clients which you then can use groups and filter etc.

Note! Even if you select only a few clients to show this information on, you actually affect all DCs. So even if the users only see this information on a selected number of clients – the information is still written to a DC (for all logons) and then replicates to all DCs. This is because you enable it on the DC(s) and thus all users get affected.

My recommendation:
Only use it when you really need it. Display the information for normal end-users is useless since they won’t understand it – most users will only click OK without reading it anyway…

Dcpromo and DNS installation message

2010-11-17T22:25:00.001+01:00

Have you ever seen this?
"A delegation for this DNS server cannot be created because the authoritative parent zone cannot be found or it does not run Windows DNS server. If you are integrating with an existing DNS infrastructure, you should manually create a delegation to this DNS server in the parent zone to ensure reliable name resolution from outside the domain “FQDN”. Otherwise, no action is required."
This happens when:
- Dcpromo.exe has been configured to install the DNS server role, and enough delegations do not already exist between DNS servers in the immediate parent DNS zone and the subdomain where you are installing the new DC. And the DC is unable to create delegation to the DNS subdomain on a DNS server that is autoritative for the parent zone.
Do you need to care about it?
Not if you don't have users in other domains (Internet included) that have the need to resolve DNS queries in the local domain.
Why does it happen?
- It will try to create the delegation to ensure name resolution from other domains.
- You can also see this in the forest root when it is immediately subordinate to top-level domains.
- Dcpromo can auto-create this delegation, but only for MS DNS and will fail for non-MS DNS servers.
- If the domain (root) is subordinate to an existing intranet namespace that is owned by non-MS DNS servers such as BIND.
- I also heard that this can happen if the AD domain is registered on the Internet, but the ISP have not created necessary delegation yet.
How to avoid it?
- On your non-MS DNS servers, pre-create the delegation in the parent domain.
- If you have MS DNS servers in the parent domain, make sure you have the necessary permissions to create the delegation in the parent zone.

MVP Award

2010-10-02T16:16:00.000+02:00

I received this in my mail yesterday:

"Dear Jimmy Andersson,

Congratulations! We are pleased to present you with the 2010 Microsoft® MVP Award! This award is given to exceptional technical community leaders who actively share their high quality, real world expertise with others. We appreciate your outstanding contributions in Directory Services technical communities during the past year.
The Microsoft MVP Award provides us the unique opportunity to celebrate and honor your significant contributions and say "Thank you for your technical leadership.""

This is the 12:th year in a row I get honered with this award. I am proud.

Active Directory Web Services (ADWS)

2010-09-28T17:16:00.002+02:00

This is a service that came with Windows Server 2008 R2 and provides a Web service interface to AD DS, AD LDS and the AD Database Mounting Tool which are running on the same server as ADWS.

ADWS is installed automatically when you add the AD DS or AD LDS role to your server.

What happen if I stop it?
The Powershell module and AD Administrative Center will not be able to access any directory instances on the server. I personally think that in the future even more applications will stop working as well.

Any considerations?
Yes, ADWS requires TCP port 9389 to be open on the servers that run ADWS.

Can I configure how the traffic is handled?
Yes, in the %windir%\ADWS directory there is a file called Microsoft.ActiveDirectory.WebServices.exe.config file you can edit. This is the default values:

Parameter name: MaxConcurrentCalls
Default value: 32
Description: Specifies the maximum number of simultaneous service requests that the ADWS service is configured to process at a given time. Set a higher value for this parameter if the ADWS service on your Windows Server 2008 R2 server must be able to process more than 32 service requests at any given time.

Parameter name: MaxConcurrentSessions
Default value: 500
Description: Specifies the maximum number of client sessions that the ADWS service can accept at any given time. Set this parameter to a higher value if the ADWS service on your Windows Server 2008 R2 server must be able to accept more than 500 concurrent client sessions at any given time.

Parameter name: MaxReceivedMessageSize
Default value: 1 MB
Description: Specifies the maximum message request size, in megabytes (MB), that a client computer can send to the directory service instances that the ADWS service supports. This setting can affect the memory consumption of the ADWS service. For example, if MaxConcurrentCalls is set to 32 and MaxReceivedMessageSize is set to 1 MB, the ADWS service is configured to process a maximum of 32 MB in client message requests at any given time.

Parameter name: MaxStringContentLength
Default value: 32 KB
Description: Specifies the maximum string size, in kilobytes (KB) of a Lightweight Directory Access Protocol (LDAP) attribute that the ADWS service is configured to process in a message request that a client computer sends to a directory service instance that the ADWS service supports. Increasing this value can increase the maximum possible memory consumption of the ADWS service.

Parameter name: MaxPoolConnections
Default value: 10
Description: Specifies the maximum number of LDAP connections for each directory service instance that is used by the ADWS service that is running on a given Windows Server 2008 R2 server.

For example, if MaxPoolConnections on a particular Windows Server 2008 R2 server is set to 10 and there are 3 directory service instances running on this server, ADWS uses a maximum of 10 LDAP connections to each of these directory service instances to process requests that are sent to the ADWS service. Along with MaxConcurrentCalls, this can affect the maximum number of simultaneous requests that the ADWS service can process. Set this parameter to a higher value if you notice that client service requests are timing out while they wait for an LDAP connection to be available to process their request.

Note: To improve performance, the ADWS service on a Windows Server 2008 R2 server maintains a separate LDAP connection pool for every directory service instance that is running on this server. For example if your Windows Server 2008 R2 server is a domain controller (and is, therefore, running the AD DS server role) and also a global catalog server and if it is running two AD LDS instances and one Active Directory Database Mounting Tool instance (a total of five directory service instances), the ADWS service on this Windows Server 2008 R2 server maintains five separate LDAP connection pools. Because a global catalog does not share the same LDAP port as AD DS, it is considered a separate directory instance.

Parameter name: MaxPercentageReservedConnections
Default value: 50%
Description: Specifies the percentage of LDAP connections that are reserved for performing query operations for each directory service instance that the ADWS service supports on a given Windows Server 2008 R2 server. Set this parameter to a higher percentage if the ADWS service on this Windows Server 2008 R2 server is used mostly for running queries.

Parameter name: MaxConnectionsPerUser
Default value: 5
Description: Specifies the maximum number of LDAP connections (to a single directory service instance) that the ADWS service permits to be used at one time for operations that are associated with a single set of client credentials (one user). Set this parameter to a higher value if you are experiencing more than five concurrent client requests by one user to a single directory service instance running on your Windows Server 2008 R2 server. The value of MaxConnectionsPerUser cannot be greater than the value of MaxPoolConnections. If the value of MaxConnectionsPerUser is equal to the value of MaxPoolConnections, it will allow a single set of client credentials (for a single client computer) to consume all available LDAP connections for a given directory service instance.

Parameter name: MaxEnumContextExpiration
Default value: 30 minutes
Description: Specifies the maximum allowed time period during which the ADWS service processes and retrieves the results of a query request from a client computer.

Caution: Changing the default value of this parameter is strongly discouraged. Most of the search results are returned within 30 minutes.

Parameter name: MaxPullTimeout
Default value: 2 minutes
Description: Specifies the maximum allowed time-out value that a client computer can set when it retrieves one page of search results. Set this parameter to a higher value if slow wide area network (WAN) traffic results in a time-out value for returning one page of search results that is longer than two minutes

Note: The ADWS service processes search requests from client computers in the following manner:
- A client submits a search request.
- The ADWS service establishes a search context and returns a search context ID to the client computer.
- Using this search context ID, the client computer issues a page request to extract the search results specifying how many LDAP objects can be returned per page.

MaxPullTimeout controls the maximum amount of time a client can ask the ADWS service to spend retrieving a page of results, while MaxEnumContextExpiration is the maximum time that the search context can be kept open.

Parameter name: MaxEnumCtxsPerSession
Default value: 5
Description: Specifies the maximum number of search requests (search contexts) that can be submitted over a single client session to the ADWS service.

Parameter name: MaxEnumCtxsTotal
Default value: 100
Description: Specifies the maximum number of search requests (search contexts) that can be submitted over all active client sessions to the ADWS service.

Parameter name: MaxGroupOrMemberEntries
Default value: 5000
Description: Specifies the maximum number of group members (recursive or non-recursive), group memberships, and authorization groups that can be retrieved by the Active Directory module Get-ADGroupMember, Get-ADPrincipalGroupMembership, and Get-ADAccountAuthorizationGroup cmdlets. Set this parameter to a higher value if you anticipate these cmdlets to return more than 5000 results in your environment.

Note: This setting can affect the memory consumption of the ADWS service.
This configuration parameter is applicable only to the three Active Directory module cmdlets mentioned above.
If your operation returns an exceptionally large results set, you might run into a non-configurable 5-minute timeout.

Parameter name: OperationTimeout
Default value: 2 minutes
Description: Specifies the timeout limit for any ADWS service-based query request. Set this parameter to a higher value if you expect your query to return an exceptionally large results set that might take longer than 2 minutes to retrieve.

Recommendations:
- Let ADWS run on all domain controllers.
- Don't edit the config file unless you really need to.
- Do remember that this config file is not replicated. You need to edit it on all domain controllers.

Down-level servers (Windows Server 2003 SP2, R2, 2008, 2008 SP2):
The Active Directory Management Gateway Service provides the same functionality as ADWS on 2008 R2. It is available as a download on the Microsoft web site.

Are there absolutely no differences between ADWS and AD Management Gateway Service?
Yes, there is one difference that you will see, the AD Management Gateway Service do not support instances of the AD Database Mounting Tool running on Windows Server 2008.

Authentication Mechanism Assurance

2010-09-28T15:44:00.000+02:00

Many people ask me about this feature and how it works. Let me first give an example scenario:

Let's say you have a user named Mark, this user is a member of the department Section5. Section5 deals with classified development. In the classical Windows way, you would create a group, let's name it "S5-Classified" (stupid name but it is just an example) and add the users within the department Section5 to it.

Let's say you have a file server with a share with top secret material, and you want only the members of the group S5-Classified to have access to it. You obviously grant the S5-Classified group the needed access, right?

This is all good, except that you now want them only to be able to access the files when they logon with a certifiacate-based logon. I.e. they should not be able to access it without the smart-card.

So this is what it is all about, granting access based on the logon method. With certificate-based logon you will get a certain access, without a smart-card - you get less access.

What happens behind the GUI:
First, it is not enabled by default in Windows Server 2008 R2 and it requires DFL Windows Server 2008 R2. What happens when you enable it is that authentication mechanism assurance adds a universal group (which you as an admin designate) to the user's access token when the user logon with a certificate-based method.

So if access is granted based on the designated universal group, the user Mark have only access if using a certificate-based logon. If using another logon method the universal group will not be present in the access token, and thus no access.

Powershell script to put migrated users into a group

2010-08-12T10:24:00.000+02:00

My friend Tony Murray has written a very good script that helps you keep track of migrated users that I wanted to share:

Note: I couldn't get the tabs in so it looks a little funny :(

-Script Begins-

#########################################################

#
# Name: SIDHistoryBasedGroupMembership.ps1
# Author: Tony Murray
# Version: 1.0
# Date: 11/07/2010
# Comment: PowerShell 2.0 script to
# populate group membership based on sIDHistory values
#
#########################################################

#Import the Active Directory Powershell Module
Import-Module ActiveDirectory -ErrorAction SilentlyContinue

#Create a new Event log source for the script (only needs to be run once)
New-EventLog -logName Application -Source "Legacy Users Group Management" `
-ErrorAction SilentlyContinue

$SearchBase = "OU=User Objects,DC=fabrikam,DC=local"
$OUArr = Get-ADUser -LDAPFilter "(samaccounttype=805306368)" `
-SearchBase $SearchBase -SearchScope SubTree

# Now we need the domain security identifier or at least a portion of it
$DomSID = "S-1-5-21-1584567894-2535104369-4141123456"

$Group = "Legacy Users"
$MbrArr = get-adgroupmember -identity $Group

# Loop through the Users found beneach the OU tree
# and check to see if the user is already
# a member of the group. If so, do nothing.
# If not, then add the user as a member.
Foreach ($User in $OUArr)
{
$object = [ADSI]"ldap://$User/"
$objectsidh = $object.sIDHistory.value
If (!$objectsidh)
{
# write-host "sIDHistory is blank"
}
Else
{
$objectsidh = $Object.getex(“sidhistory”)
trap
{
#write-host "Error: $_"
continue
}
foreach($sid in $objectSidh)
{
$sidh = new-object System.Security.Principal.SecurityIdentifier $sid,0
if ($sidh -Match $DomSID)
{
if ($MbrArr -Match $User.distinguishedName)
{
#The user is already member - do nothing
}
else
{
# We need to add the user as a member
write-eventlog -logname Application `
-source "Legacy Users Group Management" `
-eventID 3001 -entrytype Information -message "$User added to $Group"
Add-ADGroupMember -Identity $Group -Members $User
}
}
else
{
# No match with sidHistory - do nothing
}
}
}
}

-Script Ends-

TechEd sessions

2010-07-23T20:28:00.000+02:00

If you couldn't attend, you will find the sessions here: http://www.msteched.com/

Tired

2010-07-18T13:34:00.000+02:00

And people say I look funny when I'm tired and sleep with the laptop on my knees.....

New member in the Andersson family

2010-07-18T13:32:00.000+02:00

Yep, there is a new member in our family. A very charming Boarder Collie that is 8 weeks and 4 days. She will most certainly make me leave the computer once in a while :)

Windows Summit 2010

2010-04-12T15:32:00.000+02:00

Attend Windows Summit 2010: May 25–27

This is a special opportunity to learn—straight from the Windows team—how you can best use Windows 7 and Internet Explorer to enable great solutions for your customers. This three day event takes place at the Microsoft Conference Center on Microsoft's campus in Redmond, WA and is designed for people who engineer and test Windows 7 PCs, devices, and software. Take advantage of this uniquely intimate event on the Microsoft campus to network with Microsoft technical experts and leaders at breakout sessions, chalk talks, and an Ask the Experts evening and social event.

More info here.

TechDays

2010-03-15T18:38:00.000+01:00

I will speak on TechDays this year together with my colleague Fredrik Pålerud (scroll down and you'll see him). If you want to know what it is, see this. TechDays is a Microsoft Sweden event and is held once per year. This year it is fully booked already so I'm looking forward to it!

Crayon also have a booth that we will spend as much time as possible in, please come and join us! And despite what the Crayon website says - we do have some seriously good consultants (they just haven't updated it with the consultant department yet....).

Install DFS Management Console - when you can't use the mouse

2010-02-19T14:00:00.000+01:00

ServerManagerCmd -install RSAT-DFS-Mgmt-Con

Installing DFS replication - when you can't use the mouse

2010-02-19T13:58:00.000+01:00

If you want to install DFS replication on web edition or server core. You need to do it from a command prompt:

OCSetup DFSR-Infrastructure-ServerEdition

or:

ServerManagerCmd -install FS-DFS-Replication

Protect "old" OUs from accidental deletion

2010-02-09T14:32:00.002+01:00

In Win 2K8 and newer. There is a a check-box you can set to protect an OU from accidental deletion. This is good, but if you don't use ADUC in Win 2K8 (or R2) it will not be set by default. Also if you upgraded or migrated to a Win 2K8 (or R2) it won't be set automagically on "old" objects. So here is two ways of doing it.

for /f "tokens=*" %i in ('dsquery ou -limit 0') do dsacls %i /d everyone:SDDT

or:

Get-ADOrganizationalUnit -filter * |

Set-ADOrganizationalUnit -ProtectedFromAccidentalDeletion $true

(the above should be one line)

Thank you Ulf for posting these two one-liners!

Defining a new attribute - version 2

2010-01-22T09:02:00.000+01:00

My colleague, Fredrik Pålerud, just saw what I blogged and he has another recommendation. Use Active Roles and you don't have to touch the actual Schema. Wanna lear more.... Click here.

Defining a new attribute

2010-01-22T08:58:00.000+01:00

I just stumbled over a pretty good article. It describes how to define a new attribute when you extend the Schema. Take a look at it if you haven't memorized it yet....

Outlook signature based on user info from AD

2010-01-22T08:53:00.000+01:00

My colleague from Crayon Norway, Jan Egil Ring, have written a cool Powershell script that creates an Outlook signature based on information from AD. Take a look at it, it is posted here.

Enable Recycle Bin - with Powershell

2010-01-15T12:42:00.001+01:00

This is the Powershell way to enable Recycle Bin in a domain called DEMO.PRV:

Enable-ADOptionalFeature –Identity ‘CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=demo,DC=prv’ –Scope ForestOrConfigurationSet –Target ‘demo.prv’

Enable Recycle Bin - but not with Powershell

2010-01-15T12:32:00.004+01:00

A question from yesterday: "Must I use Powershell to enable Recycle Bin in AD?"
The answer is: No.

You can also use LDP to do it. What you need to know is the GUID of the Recycle Bin and where to add it.

To find the GUID you need to browse to:
CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=domainName,DC=xxx

And look at the msDS-OptionalFeatureGUID value (which is 766ddcd8-acd0-445e-f3b9-a7f9b6744f2a).

Then you need to modify the CN=Partitions,CN=Configuration, DC=domainName,DC=xxx container:
1. Right-click it and select: "Modify"
2. Delete everything in the "DN:" box, it MUST be empty!
3. In the "Edit Entry Attribute:" box type: enableOptionalFeature
4. In the "Values" box type: CN=Partitions,CN=Configuration, DC=domainName,DC=xxx:766ddcd8-acd0-445e-f3b9-a7f9b6744f2a
5. In "Operation" you select "Add" click "Enter" and last you click "Run"

You have now enabled the Recycle Bin feature in AD!

Note - this is a Windows 2008 R2 feature so it won't work on legacy OS. You must also replace domainName and xxx with whatever your environment is called.

Canonical Names of Control Panel Items

2010-01-06T15:53:00.001+01:00

As a follow-up on the other post. Wolf sent a link with more info:

http://msdn.microsoft.com/en-us/library/ee330741(VS.85).aspx

Windows 7 God Mode

2010-01-05T19:06:00.001+01:00

My good friend Wolfgang Schedlbauer sent me a mail today. The subject was "GodMode in Windows 7". So that got my attention and I needed to try it. It is cool! If you want to know what it is and try it (below text copy/pasted from his mail):

What is God Mode? This is a secret Windows 7 Feature (If you can call so!!), which provides you an extended control panel to control your machine.

Here are the Steps to invoke the God Mode:

Create a new folder (right-click and click on “New Folder”). Right-click on the folder and click on rename, copy and paste this: GodMode.{ED7BA470-8E54-465E-825C-99712043E01C}

This folder will now be a shortcut to the Windows 7 God Mode. The GodMode allows you to quickly access many Windows 7 functions via a GUI.

New job!

2009-12-17T15:42:00.000+01:00

1 minute ago, I signed the employment contract for Crayon (http://www.crayon.no/, http://www.crayon.se/). I will start the first of January as Crayon Sweden's Chief Architect for Microsoft technology.

So if you want me as a consultant, you contact Crayon.

Restore of an object or subtree

2009-11-20T13:27:00.001+01:00

I've been asked several times how to get an object or subtree of objects back if an accidental deletion happened and you have one DC that still have the objects. In other words mark these objects as authoritative so they replicate back to the DCs that have them deleted. This is usual in a lag site scenario, or if you are lucky to find a DC that haven't already delete the object(s).

So here is a step-by-step on Windows 2008, note that this is not applicable for versions lower than 2008.

1. Stop relication on a DC that have the object(s) with repadmin. I usually stop both inbound and outbound to be safe:
- Repadmin /options +disable_inbound_repl
- Repadmin /options +disable_outbound_repl

2. Stop AD Service. This will also stop the following services:
- File Replication
- Kerberos Key Distribution Center
- Intersite Messaging
- DNS Server
- DFS Replication

3. Set instance:
- Ntdsutil
- Activate instance NTDS

4. Authoritative Restore (while in ntdsutil):
- Authoritative restore
- Restore subtree ou=dr-test,dc=qadvice,dc=prv

Example screenshot:
authoritative restore: restore subtree ou=dr-test,dc=qadvice,dc=prv
Opening DIT database... Done.

The current time is 11-20-09 12:35.45.
Most recent database update occured at 11-20-09 12:32.09.
Increasing attribute version numbers by 100000.
Counting records that need updating...
Records found: 0000001001
Done.

Found 1001 records to update.
Updating records...
Records remaining: 0000000000
Done.

Successfully updated 1001 records.
The following text file with a list of authoritatively restored objects has been created in the current working directory:
ar_20091120-123545_objects.txt
None of the specified objects have back-links in this domain. No link restore file has been created.
Authoritative Restore completed successfully.

5. Start AD and related services (if they don't start automatically)

6. Enable replication on the DC:
- Repadmin /options -disable_inbound_repl
- Repadmin /options -disable_outbound_repl

2009-10-06T11:40:00.002+02:00

MVP Award. I received this in my mail Oct 1st:

"Dear Jimmy Andersson,Congratulations!

We are pleased to present you with the 2009 Microsoft® MVP Award! This award is given to exceptional technical community leaders who actively share their high quality, real world expertise with others. We appreciate your outstanding contributions in Directory Services technical communities during the past year."

I'm very glad and proud of it. This is the 11th year in a row!

TEC Europe

2009-08-07T17:28:00.002+02:00

I just decided to attend TEC Europe in September. It will be held in Berlin at the Hilton, September 14-16.
Hope to see you there!

Warning: The software you are installing does not match your mental model

2009-08-04T15:28:00.001+02:00

I just read this on Jesper's blog. It is funny :)

Recommended settings for event log sizes in Windows Server 2003 and in Windows Server 2008

2009-08-04T15:10:00.000+02:00

http://support.microsoft.com/kb/957662

Sooz arrived

2009-07-30T17:42:00.004+02:00

Sooz arrived, picked her up at the airport. And guess what..... Yes, she arrives without the bag, it is still in Copenhagen and we hope it will arrive sometime soon. Tomorrow we're going on a road trip to Sundsvall so I really hope she gets her bag tonight....

Find account based on a given SID

2009-07-29T23:56:00.006+02:00

Here is some code that will find the account based on a given SID:

-Script Begins-
'============================================================
' NAME: find-Account.vbs
' AUTHOR: Jimmy Andersson, Q Advice AB
' DATE: 21/04/2009
' Version: 1.0 - initial version
' USAGE: cscript find-Account.vbs
'============================================================
Option Explicit

'============================================================
'==== Declare variables and sets objWMIService
'============================================================
Dim strComputer, objWMIService, objAccount
strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

'===========================================================
'==== Below code finds the account based on a given
'==== SID (both local and domain accounts)
'===========================================================
Set objAccount = objWMIService.Get _
("Win32_SID.SID='S-1-5-21-842925246-725345543-682003330-4474'")
wScript.Echo objAccount.ReferencedDomainName &_
"\" & objAccount.AccountName
-Script Ends-

A way of finding the local admin account by searching SIDs

2009-07-29T23:39:00.008+02:00

Let's say you don't know the account name for the local admin account. The below code will find it for you. This is really good to have if a customer used the "oh-not-so-good-way-to-apply-security" approach.
I actually had a customer (before I came along and changed it) randomize the renaming of the local admin on their workstations....
Do I need to say that they didn't have a log. And even more "strange" is that they actually created 20+ local accounts just to confuse a potential bad guy.....
I will not start to rant about what I think of this approach. Never the less I had to find all the local admin accounts on their workstations. So I wrote some code that I fired off remotely and logged the information in a secure place. The basis of that code is below:
(as usual wrapping might be an issue)

-Script Begins-
'============================================================
' NAME: find-AdminName.vbs
' AUTHOR: Jimmy Andersson, Q Advice AB
' DATE: 21/04/2009
' Version: 1.0 - initial version
' USAGE: cscript find-AdminName.vbs
'============================================================
Option Explicit

'============================================================
'==== Declare variables and sets objWMIService
'============================================================
Dim strComputer, objWMIService, objAccount, colAccounts
strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

'===========================================================
'==== Below code finds the local ADMINISTRATOR account
'==== by searching the SIDs of local accounts
'===========================================================
Set colAccounts = objWMIService.ExecQuery _
("Select * From Win32_UserAccount Where LocalAccount = TRUE")
For Each objAccount in colAccountsIf Left (objAccount.SID, 6) = "S-1-5-" and Right(objAccount.SID, 4) = "-500" Then
Call getInfo
End If
Next

'===========================================================
'==== Function to get properties
'===========================================================
Function getInfo
wScript.Echo "Name: " & objAccount.Name
wScript.Echo "SID: " & objAccount.SID
wScript.Echo "Description: " & objAccount.Description
wScript.Echo "Disabled: " & objAccount.Disabled
wScript.Echo "Pwd Expires: " & objAccount.PasswordExpires
wScript.Echo "Pwd Required: " & objAccount.PasswordRequired
wScript.Echo "Pwd Changeable: " & objAccount.PasswordChangeable
End Function
-Script Ends-

How to get the SID of an account

2009-07-29T23:10:00.008+02:00

Someone asked me how to write a script that will show you the SID and some other "stuff" of a specified username. So here it is, really simple and fast to do. The below will show you:
- name (which you need to know in advance)
- SID
- Description
- If it is disabled or not
- If the password expires
- If a password is required
- If the password can be changed.

-Script Begins-
'============================================================
' NAME: findSID-Name.vbs
' AUTHOR: Jimmy Andersson, Q Advice AB
' DATE: 21/04/2009
' Version: 1.0 - initial version
' USAGE: cscript findSID-Name.vbs
'============================================================
Option Explicit

'============================================================
'==== Declare variables and sets objWMIService
'============================================================
Dim strComputer, objWMIService, objAccount
strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

'============================================================
'==== Below code gets the SID of a specified account.
'==== NOTE: If you specify a domain name instead of a computer name you'll
'==== get the SID of a domain account. E.g. name='admin',domain='root' '================'===========================================
Set objAccount =_
objWMIService.Get("Win32_UserAccount.Name='x-admin',Domain='client001'")
Call getInfo

'===========================================================
'==== Function to get properties
'===========================================================
Function getInfo
wScript.Echo "Name: " & objAccount.Name
wScript.Echo "SID: " & objAccount.SID
wScript.Echo "Description: " & objAccount.Description
wScript.Echo "Disabled: " & objAccount.Disabled
wScript.Echo "Pwd Expires: " & objAccount.PasswordExpires
wScript.Echo "Pwd Required: " & objAccount.PasswordRequired
wScript.Echo "Pwd Changeable: " & objAccount.PasswordChangeable
End Function
-Script Ends-

How to show color indices in Excel with VBScript

2009-07-29T22:17:00.002+02:00

Ok, someone asked me how to find out the color indices in Excel via Script. So here it goes:

(as always, formatting and word wrap might not work.....And you need Excel installed on the machine where the code executes of course)

-Script Begins-

Set objExcel = CreateObject("Excel.Application")
objExcel.Visible = TrueSet
objWorkbook = objExcel.Workbooks.Add()
Set objWorksheet = objWorkbook.Worksheets(1)

For i = 1 to 14
objExcel.Cells(i, 1).Value = i
objExcel.Cells(i, 2).Interior.ColorIndex = i
Next

For i = 15 to 28
objExcel.Cells(i - 14, 3).Value = i
objExcel.Cells(i - 14, 4).Interior.ColorIndex = i
Next

For i = 29 to 42
objExcel.Cells(i - 28, 5).Value = i
objExcel.Cells(i - 28, 6).Interior.ColorIndex = i
Next

For i = 43 to 56
objExcel.Cells(i - 42, 7).Value = i
objExcel.Cells(i - 42, 8).Interior.ColorIndex = i
Next

-Script Ends-

Back from Philly

2009-07-29T22:00:00.003+02:00

Came back from Philly and I must say that I had a great time!
It was really nice to meet Laura and Mark again. Their new place is really nice and have everything you need. Including a very nice pub (Charlie's) just around the corner!

All in all - time well spent, good food, good drinks! Hopefully I'll see them again in December in New York!

Now I'm getting ready for Sooze to come visit us tomorrow. That will also be loads of fun, travelling around Sweden and then Germany. Hopefully we have the time to stop by Zürich as well....

Ok, carry on! :)

"I want to look after old people"

2009-07-22T16:49:00.001+02:00

Nick, you are old. Get over it :)

For you that don't know us, Nick is my mate and I can take the Mickey out of him if I want!

Philly

2009-07-22T16:44:00.003+02:00

Ok, arrived in Philly. Mark picked me up at the airport but not my bag... Read Mark's blog for details. Anyway, I'm here and we're having fun!

As always, good food an wine is a given!

Getting quick info from systems

2009-07-19T23:59:00.005+02:00

One thing that is pretty common when you get to a new customer is that they usually have no clue what systems they actually have on their network.
In most cases not all servers are members of AD so that is the reason I use an input list instead of getting all the computer objects from AD and then filter on OS, or specify a "top" OU and then search all computer objects from that OU and then all sub-OUs. This can of course be easily changed in the below script to do just that if you want, I might even post how to do it later... :)

The second thing is that when I wrote this, I actually just needed the info to be showed on the screen. Which is why I didn't created an output file and saved it directly to it (here I just pipe it). I will post a function how to create an output file later and the below script can easily be changed for this as well.

Do note that I couldn't get proper formatting (especially TAB) in this post so the script might look a bit strange. Also note that line breaks are not always correct, so test it first in your lab! I take NO responsibility for the script and it is your responsibility to test it in a lab environment!

-Script Begins-
'============================================================
' NAME: quickInfo.vbs
' AUTHOR: Jimmy Andersson, Q Advice AB
' DATE: 1/12/2008
' Version: 1.0 - initial version
'
' COMMENT: Used to find out settings remotely.
' You need to pipe the output to a text file (see below usage example) that you can
' open in Excel. It will be delimited with semicolons.
' It will do a ping test before trying to connect' to the remote machine.
'
' USAGE: cscript quickInfo.vbs > output.txt
'
' NOTE: If you don't have access it will just move on ' to the next one in the list.
'
'============================================================
On Error Resume Next

'============================================================
'====== Header ===============================================
'============================================================
wScript.Echo "Hostname;Manufacturer;Model;OS;Build;SP;Installed;Last Reboot;Distributed;NIC;MAC;DHCP Enabled;DHCP Server;IP;Subnet;Default Gateway;WINS1; WINS2;DNS"

'============================================================
'====== Specify input file and open it ===============================
'============================================================
' Input file with the server names
strFilename = "C:\_scripts\servers.txt"

Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objTS = objFSO.OpenTextFile(strFilename)

Do Until objTS.AtEndOfStream

strComputer = objTS.ReadLine
DoObject strComputer

Loop

objTS.Close

'============================================================
'====== Sub that collects data ====================================
'============================================================
Sub DoObject(strComputer)

strPingStatus = PingStatus(strComputer)

If strPingStatus = "Success" Then
Set objWMI = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colOS = objWMI.ExecQuery("SELECT * FROM Win32_OperatingSystem")

For Each objOS In colOS
Set colHW = objWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem",,48)

For Each hwItem in colHW
strHW = hwItem.Manufacturer
strModel = hwItem.Model

Set colItem = objWMI.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled = TRUE",,48)

For Each objItem In colItem

strInfo = objOS.CSName & ";" & strHW & ";" & strModel & ";" & objOS.Caption &_
";" & objOS.BuildNumber & ";" & objOS.CSDVersion & ";" & objOS.InstallDate &_
";" & objOS.LastBootUpTime & ";" & objOS.Distributed & ";" &_
objItem.Caption & ";" & objItem.MACAddress & ";" & objItem.DHCPEnabled &_
";" & objItem.DHCPServer & ";" & Join(objItem.IPAddress, ",") & ";" &_
Join(objItem.IPSubnet, ",") & ";" & Join(objItem.DefaultIPGateway, ",") & ";" &_
objItem.WINSPrimaryServer & ";" & objItem.WINSSecondaryServer & ";" &_
Join(objItem.DNSServerSearchOrder, ",")

wScript.Echo strInfo
Next
Next
Next

Else
wScript.Echo strComputer & ";" & "Didn't answer ping"
End If
End Sub

'============================================================
'====== Function for w32_PingStatus WMI class =======================
'============================================================
Function PingStatus(strComputer)
On Error Resume Next

' Uses the local machine as the system to ping from
strWorkstation = "."

Set objWMIService = GetObject("winmgmts:" _& "{impersonationLevel=impersonate}!\\" & strWorkstation & "\root\cimv2")Set colPings = objWMIService.ExecQuery _
("SELECT * FROM Win32_PingStatus WHERE Address = '" & strComputer & "'")

For Each objPing in colPings ' Return codes
Select Case objPing.StatusCode

Case 0 PingStatus = "Success"
Case 11001 PingStatus = "Status code 11001 - Buffer Too Small"
Case 11002 PingStatus = "Status code 11002 - Destination Net Unreachable"
Case 11003 PingStatus = "Status code 11003 - Destination Host Unreachable"
Case 11004 PingStatus = "Status code 11004 - Destination Protocol Unreachable"
Case 11005 PingStatus = "Status code 11005 - Destination Port Unreachable"
Case 11006 PingStatus = "Status code 11006 - No Resources"
Case 11007 PingStatus = "Status code 11007 - Bad Option"
Case 11008 PingStatus = "Status code 11008 - Hardware Error"
Case 11009 PingStatus = "Status code 11009 - Packet Too Big"
Case 11010 PingStatus = "Status code 11010 - Request Timed Out"
Case 11011 PingStatus = "Status code 11011 - Bad Request"
Case 11012 PingStatus = "Status code 11012 - Bad Route"
Case 11013 PingStatus = "Status code 11013 - TimeToLive Expired Transit"
Case 11014 PingStatus = "Status code 11014 - TimeToLive Expired Reassembly"
Case 11015 PingStatus = "Status code 11015 - Parameter Problem"
Case 11016 PingStatus = "Status code 11016 - Source Quench"
Case 11017 PingStatus = "Status code 11017 - Option Too Big"
Case 11018 PingStatus = "Status code 11018 - Bad Destination"
Case 11032 PingStatus = "Status code 11032 - Negotiating IPSEC"
Case 11050 PingStatus = "Status code 11050 - General Failure"
Case Else PingStatus = "Status code " & objPing.StatusCode & _
" - Unable to determine cause of failure."
End Select
Next
End Function

-Script Ends-

Philadelphia

2009-07-19T23:39:00.002+02:00

Tomorrow morning I'm off to Philly! :)

Going to spend some time with the old boy Mark for a few days. After his move to the States it's not that often we have the chance to meet up and hang out. But this week it all worked out!

I expect only three things:
- Good wine
- Good food
- Fun!

If you know us, you know how to get in touch if you're in town.

Change DNS on multiple computers

2009-07-14T16:48:00.007+02:00

Ok, here is the background. We needed to get rid of some old hardware and replace them with new kit. These servers was DC/DNS and unfortunately we couldn't re-use the IP addresses which meant that all the DNS settings on the servers (the clients used DHCP) needed to get updated.

My client at the time was planning to do this manually, which was not smart at all. Even though their server park was only about 900 servers. So what to do? Obviously scripting was the answer so I put this little script together for them.

Do note that I couldn't get proper formatting (especially TAB) in this post so the script might look a bit strange. Also note that line breaks are not always correct, so test it first in your lab! I take NO responsibility for the script and it is your responsibility to test it in a lab environment!

-Script Begins-
'============================================================
' NAME: replaceDNS_Server.vbs
'
' AUTHOR: Jimmy Andersson, Q Advice AB
' DATE: 19/11/2008
' Version: 1.0 - initial version
'
' COMMENT: Used to replace an IP entry for the DNS settings with a new IP. It will
' do a ping test before trying to connect to the remote machine. Do note that it
' ONLY replaces the IP if it is found, if it can't find the IP nothing will happen
' and it will also return the name of the machine it didn't find it on. If a NIC is
' DHCP ENABLED it will not change anything on that particular NIC.
'
' USAGE: cscript ReplaceDNS_Server.vbs
'
' NOTE: If you don't have access it will just move on to the next one in the list.
' If you want to save the output' pipe it to a text file.
' Example: cscript ReplaceDNS_Server.vbs > output.txt
'============================================================
On Error Resume Next

'============================================================
'====== Specify input file and open it - One computer name per row ========
'============================================================
strFilename = "C:\serverNames.txt"

Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objTS = objFSO.OpenTextFile(strFilename)

Do Until objTS.AtEndOfStream
strComputer = objTS.ReadLine
DoObject strComputer
Loop
objTS.Close

'============================================================
'====== Sub to replace a DNS entry ================================
'============================================================
Sub DoObject(strComputer)

strOldDNSServer = "10.80.255.122" ' Specify which DNS IP that should be replaced
strNewDNSServer = "10.80.255.206" ' Specify the new DNS IP

' Run ping test before starting to run WMI queries
strPingStatus = PingStatus(strComputer)
If strPingStatus = "Success" Then ' See return codes in the Function

Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

' Only do changes if IP is enabled and DHCP is not used
Set colNicConfigs = objWMIService.ExecQuery _
("SELECT * FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled = TRUE AND DHCPEnabled = FALSE")

For Each objNicConfig In colNicConfigs
wScript.Echo VbCrLf & "Computer: " & strComputer
wScript.Echo VbCrLf & " Network Adapter " & objNicConfig.Index
arrDNSServerSearchOrder = objNicConfig.DNSServerSearchOrder

wScript.Echo " DNS Server Search Order - Before:"
If Not IsNull(objNicConfig.DNSServerSearchOrder) Then
For Each strDNSServer In objNicConfig.DNSServerSearchOrder
wScript.Echo " " & strDNSServer
Next
End If

blnFound = 0
For i = 0 to UBound(arrDNSServerSearchOrder)
If arrDNSServerSearchOrder(i) = strOldDNSServer Then
arrDNSServerSearchOrder(i) = strNewDNSServer
blnFound = 1
End If
Next

If blnFound Then
retSetDNS = objNicConfig.SetDNSServerSearchOrder(arrDNSServerSearchOrder)
If retSetDNS = 0 Then
wScript.Echo " Replaced " & strOldDNSServer & " with " & _
strNewDNSServer & " in DNS search order."

Else
wScript.Echo " Unable to change DNS server search order."
End If

Else
WScript.Echo " DNS server " & strOldDNSServer & " not found."
End If
Next

Set colNicConfigs = objWMIService.ExecQuery _
("SELECT * FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled = TRUE")
For Each objNicConfig In colNicConfigs
wScript.Echo VbCrLf & "Computer: " & strComputer & " -- " & "DHCP Enabled => NO changes done."
wScript.Echo VbCrLf & String(80, "-")
Next

Else
wScript.Echo VBCrLf & "Computer: " & strComputer & " -- " & "Didn't answer ping => NO changes done."

' Return which machines that didn't answered on ping
wScript.Echo VbCrLf & String(80, "-")
End If

End Sub

'============================================================
'====== Function for w32_PingStatus WMI class =======================
'============================================================
Function PingStatus(strComputer)
On Error Resume Next

' Uses the local machine as the system to ping from
strWorkstation = "."

Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strWorkstation & "\root\cimv2")

Set colPings = objWMIService.ExecQuery _
("SELECT * FROM Win32_PingStatus WHERE Address = '" & strComputer & "'")

For Each objPing in colPings ' Return codes
Select Case objPing.StatusCode

Case 0 PingStatus = "Success"
Case 11001 PingStatus = "Status code 11001 - Buffer Too Small"
Case 11002 PingStatus = "Status code 11002 - Destination Net Unreachable"
Case 11003 PingStatus = "Status code 11003 - Destination Host Unreachable"
Case 11004 PingStatus = "Status code 11004 - Destination Protocol Unreachable"
Case 11005 PingStatus = "Status code 11005 - Destination Port Unreachable"
Case 11006 PingStatus = "Status code 11006 - No Resources"
Case 11007 PingStatus = "Status code 11007 - Bad Option"
Case 11008 PingStatus = "Status code 11008 - Hardware Error"
Case 11009 PingStatus = "Status code 11009 - Packet Too Big"
Case 11010 PingStatus = "Status code 11010 - Request Timed Out"
Case 11011 PingStatus = "Status code 11011 - Bad Request"
Case 11012 PingStatus = "Status code 11012 - Bad Route"
Case 11013 PingStatus = "Status code 11013 - TimeToLive Expired Transit"
Case 11014 PingStatus = "Status code 11014 - TimeToLive Expired Reassembly"
Case 11015 PingStatus = "Status code 11015 - Parameter Problem"
Case 11016 PingStatus = "Status code 11016 - Source Quench"
Case 11017 PingStatus = "Status code 11017 - Option Too Big"
Case 11018 PingStatus = "Status code 11018 - Bad Destination"
Case 11032 PingStatus = "Status code 11032 - Negotiating IPSEC"
Case 11050 PingStatus = "Status code 11050 - General Failure"
Case Else PingStatus = "Status code " & objPing.StatusCode & _
" - Unable to determine cause of failure."
End Select
Next

End Function

-Script Ends-

MVP Award

2008-10-27T08:56:00.002+01:00

Yes, I got awarded for the 10th time this year. So I'm still a DS MVP :)

Again, I'm too lazy...

2008-07-04T00:01:00.004+02:00

Ok, so what has been going on since the last post... Well, the project is going forward. Too much stuff going on at the same time since my team are migrating in all continents at the same time - a lot of coordination is going on! From management side the schedule shifts on a daily basis which makes it really hard to plan accordingly - but that's the way it is as everybody knows.

Besides that one of my best friends got married in May - Awesome wedding! They will be the host and hostess on my wedding. Oh! I might not have told you.... Yes, I'm getting married Aug 16th. And I'm looking forward to it!

Ok, I have to be honest - we have a wedding sharepoint site (thank you Thomas Bittner and Daniel Wessels!) and I have a MS project plan as well.... Jesper said: "you're such a geek! A Sharepoint site for your wedding!" (don't remember the exact words, but that was the gist of it). Well, what can I say - I'm a geek! As most people know already!

Some tech stuff - are 3rd party software really ready for a Server Core? It is an open question - and my experience is - not yet. Which will open the discussion about why... Correct? The reason why is because most of the companies still install antivirus on their domain controllers and the install package require a GUI, which means it is a big no-no. The same goes for printer installations (well, many cases). This will open up a sub-question, do you really need AV on your domain controllers? My answer is: depending on your security and network design - I know it is an open answer. But think about it and post a comment! :)

Long time since last post

2008-05-01T14:12:00.002+02:00

Ok, I know there has been a long time since I blogged.... A lot have happened so let me summarise.

- My mate Mark Arnold have married Laura Hunter. And I was the bestman, well I tried at least... Since I couldn't attend the tour of Philly our mates bought a doll as my stand-in which now have its own blog! :)

- The Windows Server 2008 Security Resource Kit is released, I wrote a chapter in it.

- I've been to Redmond/Seattle to attend the MVP summit.

- Our wedding site is up :) Yes, I'm getting married in August!!!

Windows Server 2008 Schema

2007-12-03T16:36:00.000+01:00

I just finished documenting the default Schema for Windows Server 2008. Let me know if you want a copy of it.

MVP Award

2007-10-22T12:11:00.000+02:00

It was some time ago since my last post. I'm currently very busy doing domain migrations in a project for HP so I don't have much time to blog.
But one update is that I received the MVP Award for Directory Services again, this is my ninth year in a row... Which means I must get a life :)

Secure Public Relations Excuse Bingo

2007-08-13T22:42:00.000+02:00

Wanna play security excuse bingo for management? If so, click here

Group Policy failure

2007-07-24T14:24:00.001+02:00

Troubleshooting steps for GPOs when it fail for one user, not the best solution though... But I heard that it is not uncommon to have this situation and Jesper blogged it all, so if you're interested in our steps to try to find a solution, click here.

Windows Vista Security

2007-07-24T14:10:00.001+02:00

Hi, Jesper have once again written an excellent article about ACLs, if you're interested, click here. It is from the book Windows Vista Security written by Jesper M. Johansson and Roger A. Grimes.

Staging folders

2007-07-24T13:48:00.000+02:00

Do not mix staging folders and prestaging. They are completely different things!

I got the below from my friend Thomas Bittner, it was written by his team for the APS (All Purpose Server) guide.

Staging folders are used to isolate the files from the changes on the file system, and amortize the cost of compression and computing RDC hashes across multiple partners.
Here is some background on current staging space management. There are three values that are important to staging space management.

· Staging size in MB (configured per-replicated folder in AD)
· Staging low watermark percentage (configured per-server via WMI, applies to all replicated folders on the server)
· Staging high watermark percentage (configured per-server via WMI, applies to all replicated folders on the server)

DFS Replication will do roughly the following when trying to stage a file:
· Request a reservation for staging space for the file based on an estimate of the file size.
· If the currently used staging space is less than the configured staging size, the file is allowed to stage regardless of the reservation amount. This allows large files to replicate and not get stuck with the familiar “huge file” replication blocker on FRS. The reservation amount is accounted for in the used staging space.
· After staging completes, DFS Replication fixes up the reservation amount by using the actual used amount. Note that due to compression, there could been different file sizes.
· If the used staging space is higher than the high watermark, staging space cleanup is triggered. Staging space cleanup will clean up until it hits the low watermark or there are no more files that are candidates for cleanup i.e., all files in staging are actively being used. Note that the cleanup is on a per replicated folder scope.

There are several factors that affect the size of staging. Without going into theories, here are some rules of thumb:
· It is desirable to set the staging folder to be as large as possible (as available space) and comparable to the size of the replicated folder. Hence if the size of the replicated folder is 24.5 GB, then ideally a staging folder of comparable size is desirable. Note that this amortizes the cost of staging and hash calculation over all connections. It is also a best practice to locate the staging folder on a different spindle to prevent disk contention.
· If staging cannot be set comparable to the size of the replicated folder, then reduce the size by 20%. Depending on how well the data compresses, staging files will be 30-50% of the original file size.
· Note that the mentioned two recommendations are particularly important if all the data is preexisting and DFS Replication must process all content at the same time during initial replication. On the other hand, if the replicated folder is relatively empty and gradually grows over time, the recommendation is to determine the projected size of the replicated folder and size the staging appropriately.
· If the size of the staging folder cannot be set proportional to the size of the replicated folder, then increase the size of the staging folder to be equal to the five largest files in the replicated folder.

Prestage DFS-R

2007-07-24T13:46:00.000+02:00

A lot of people are wondering how to prestage DFS-R, so here are the steps:

Make sure that the primary member has the latest version of each file. This is done during configuration of replication because it will be seen as authoritative during first replication. This is similar as doing a D2/D4 restore of a broken sysvol.

During first replication these things will happen:

[P1 = Primary]
[M1 = Member]

Scenario 1:
File1 exists on both P1 and M1 and are identical = File is not replicated, but metadata is to update the replication DB on M1.

Scenario 2:
File2 exists on both P1 and M1, but is newer on P1 = File2 will be replicated, and the file on M1 will be treated as a conflict and moved to a special folder called something like "conflict or deleted"

Scenario 3:
File3 does not exist on P1, but gets created on M1 during first replication = File3 will replicate to P1.

Scenario 4:
File4 exist on both P1 and M1, but gets deleted during first replication = The deletion doesn't replicate.

Finally a new post!

2007-07-17T22:29:00.000+02:00

I know it has been a long time since I blogged so don't start ;)

Have you ever installed a 64-bit OS for personal use? If not, think twice!
I just got my new Dell machine, dual-core 4GB RAM and all sorts of goodies (but NO fancy graphics card, it will only be used as a test machine for servers). Ok, I ordered it with XP 64-bit from Dell, but I forgot to order the darn wireless card. So I thought you could call Dell, tell them that you just ordered a new machine from them and give them the specs...
How stupid was I!!!! First they say that they have no wireless card that support 64-bit, so I told him there was an option during the "configure my computer" wizard that had an option for a wireless card. He says, NO we don't have any wireless cards that supports 64-bit.

Now I'm getting a bit worried, so I (during the time I was on the phone with him) ran through the wizard again and did some screen shots and sent them to him. He says that it is impossible, which forced me to ask him:
"So you have a NIC that customers can order with the wizard that will not work when the computer arrives?"

His answer:
"Yes, but people should know what they order"

Which I replied to:
"But I had to tell you what a 64-bit OS is! And you are selling these things!"

He replied:
"You need to call another NIC supplier."

So, I went to MS website and scrolled through the HCL for 64-bit XP, and guess what! There is a Dell card that will work! But unfortunately the Dell website actually lists 2 NICs with the same name and on the HCL the one that is NOT manufactured by Dell is the one that will work on 64-bit. (The name on Dell's website is 1450)

Conclusion:
You get the correct hardware from the HCL, the company that sells them have 2 NICs available with the same name and NO specs so you can't tell which one is supported or not!

Guess what, I will not order a Dell NIC, I will find another manufacturer on the HCL and order from them......

BTW - Next post will be DFSR in R2....

Ok, back to work now :)

Back from South Africa...

2007-04-08T00:28:00.000+02:00

I'm back in Sweden, but in less than 6 hours it is take off heading to Brisbane, Australia. After a couple of days work I'm off again to Santiago, Chile for a couple of days and then I'm heading for London, UK.
So, what am I doing during these short stays you might wonder.... Well, in Johannesburg, South Africa we realized that we wasn't told the whole truth about the environment... Let's just say new forests and domains was discovered so we thought that it would be better if myself and Wolfgang, who is responsible for Exchange, would be the ones going to the major locations and do some discovery work, i.e. run our scripts to find out the details and the truth about the environment.

So what we will be doing the next 12 days is a trip around the world... And people were impressed by doing it in 80 days.... :)

Windows - the story

2007-03-05T08:33:00.000+01:00

A friend of mine just sent me this link about the story behind Windows. I don't know if it is the absolute truth, but it sure is fun :)

...it has been a long time since I posted

2007-02-21T11:08:00.000+01:00

Yes, I know I haven't been posting for a while. It's been crazy with all the travels and work, so I honestly just haven't had any time for it.

This morning I received an e-mail confirming a new contract, basically I will be travelling the next 18 month doing a massive forest/domain consolidation/migration. Hopefully I will have time to post some interesting things that will be discovered during this work and post it here. At this point I have no knowledge about exactly how big it is, but I do know we are talking about 100s of DCs... Which will be some good fun :)

At the moment my schedule looks like this:

- Feb 28 thru March 3 in Germany
- March 11 thru March 16 in Germany
- March 18 thru April 27 in South Africa

After that I will know more about what needs to be done and also the travel plans for the next few months...

...Oh if you are interested I will post a few "findings" I did when I had to do LCS troubleshooting which is very interesting/strange/goofy...

Advanced AD Troubleshooting and Theory

2006-08-21T10:30:00.000+02:00

The dates for my course are now available at Cornerstone's website. Contact Cornerstone if you want to attend.

Jesper's new blog

2006-08-18T00:39:00.000+02:00

It is up, and you'll find it here.

Sad day for MS/Good day for Jesper.

2006-08-01T17:01:00.000+02:00

As you might know, Jesper M. Johansson is leaving Microsoft. He's a buddy and whatever makes him (and his family) happy makes me happy! Good luck with the new job!

As a MS employee he has been (to me):
- A good friend.
- Known as a "know-how" person.
- He's respected amongst his peers.
- His presentation skills are great (I wish I was half as good).

Future (knowing Jesper):
- A good friend.
- Known as a "know-how" person.
- He's respected amongst his peers.
- His presentation skills are great.
- Don't stop reading his blog! He will continue posting useful things.
- He will stay on top of his area.
- He will not leave the "security business"

When the new URL is known to his blog, I will post it.

lastLogonTimestamp

2006-07-05T15:57:00.000+02:00

So yet another question about how to find out the last logon time for users.... Ok, here is how it works in Windows 2003.

One of the new attributes in Windows 2003 is lastLogonTimestamp which can be used to retrieve the last logon time for users, good so we have a new attribute to use! Sounds easy, right?

But this is not as trivial as you might think! The lastLogonTimestamp is not always showing the truth since it is only replicated every 14 days... Then take into account that when you read the value for the attribute it is stored as a 64-bit integer calculated from 1601 January 1st in 100-nano secs interval. (No, it was not MS fault. It was the darn Cobol programmers!!)

And another funny thing is that VBScript can't handle 64-bit integers!!!!! So you need to break it down into two 32-bit integers with IADsLargeInteger, which has two properties:

highpart = store the high 32-bits
lowpart = store the low 32-bits

…then you add them to get a single value.

So how would a script that does this look like you might wonder.

I will not just put the code here but rather I will walk you through how to “think” to solve it. (If you really need the code and don’t know how to write it, send me an e-mail).

Use “Get” to retrieve the attribute (lastLogonTimestamp)

Store the value in an IADsLargeInteger object

Combine the highpart and lowpart values into one value by taking the highpart * (2^32) and add the lowpart.

Ok, step 3 which is one line of code will give us the last logon for a user. But it will give us the time in a format of how many 100-nano secs intervals occurred since Jan 1, 1601 and the user’s last logon.

The value might look like this: 2.5643571264596E+16

This, at least to me, looks kind of hard to read. And I bet the one asked for the report will not be happy if you give him/her this….. So now we need to do something about it, but first a little bit on nanosecs:

1 second = 1,000,000,000 nanosecs = 10,000,000 nanosec intervals per second (10,000,000 * 100 = 1,000,000,000). This means that there are 600,000,000 100-nano secs intervals per minute.

To find out how many minutes elapsed since Jan 1, 1601 and last logon we can take the last logon time and divide it by (60*10000000).

If we want to find out the number of days that have elapsed we dived the last logon time with 1440 (which is the number of minutes per 24 hrs).

The above steps (5 and 6) can be done in one step if you want…..

Now we know how many days elapsed since Jan 1, 1601 so we take that and add it to Jan 1, 1601 (“last logon time” + #1/1/1601#) and we get the result in an easy to read format!

But I assume it is W2K3 otherwise you need to use the lastLogon which is not replicated at all, which means you have to retrieve it from all DCs and then compare the values, sounds boring but can be solved with some code...

Rome

2006-06-24T20:14:00.000+02:00

Yep, here once again with Carola, if we could give anyone advice for visiting Rome it would be:

Stay at the Hilton Cavalieri.

Go to the private club “Blue” by the sea (40 minutes by car from the hotel and the hotel will arrange a private driver)

Oh! And just to mention, we got engaged the 20th of June at Blue!

More details later!

Mark Arnold missed the plane

2006-05-21T11:02:00.000+02:00

I’m not alone!!

My good friend Mark Arnold is visiting this weekend, he was supposed to fly in on Friday and land at 13.20... Guess what happens, he missed the plane… And no, he didn’t even try to get to the airport in time because he missed the date!! Yes, the man missed the plane by a day!!

BTW - if you have the chance to attend Exchange Forum in Sweden this week, check out Mark's presentation about Exchange 2007. I've had the luck to see the .ppts and it looks good, if Mark is speaking about Exchange I will listen.

Good cluster configuration...

2006-03-14T18:20:00.000+01:00

I just remembered a conversation I had with a mate of mine, he stated that the only good cluster configuration is Inactive/Passive... Go figure.... :)

The fast recovery components

2006-03-13T17:22:00.000+01:00

The fast recovery components

Creation of Shadow Copies
As I stated earlier, the process of creation initiates by the requestor (a backup program) contacting the Volume Shadow Copy Service (VSC service) to request a copy of the System State. The VSC service will act as a coordinator and notifies the System State writers to prepare for writing data for creation of a shadow copy.
Once the data is ready for the actual backup process each writer notifies the VSC service which then relays information to the backup requestor. Next step is that the requestor halts Active Directory I/O writes as long as it takes the provider to create single point-in-time copies of the three volumes. Usually this takes just a few seconds and should have no to little impact on Active Directory operations.

After the copy is made the VSC service will be instructed to break the connection with the original and the copy. At this point the shadow copy becomes read-only and the original will continue as usual (read/write). Now we are at the point where the shadow copy is no longer associated with a particular server and resides on the SAN until we need it.

Using EFS on virtual DCs

2006-03-13T11:23:00.000+01:00

I just read this post about the possibility to use EFS to encrypt a DC that is running as a virtual machine. Sounds interesting, need to spend some time in the lab :)

When do you need to recover AD?

2006-03-09T13:48:00.000+01:00

...hopefully never!
But just in case, I will describe something called Fast Recovery during the following days...

There are alternatives to tape backups such as lag sites, but I will not go into that but rather I will talk about how it is possible to use shadow copies instead. I find it interesting and in conjunction with tape backups it can be effective.

The reason way I found this interesting is because it is fast and use a mirroring process that doesn't affect the system performance much. So in order to understand this we need some information how the underlying services works. Not to get into bit-level discussion I will give an overview:

Volume Shadow Copy (I will call it VSC)
With VSC you can create point-in-time snapshots of a volume, the service itself coordinates with other applications like backup software for instance and storage hardware to enable app-aware data management and it also support backup of open files.

There are three components that are needed in order to make a full shadow copy:
1. Requestor, which is the utility that request the copy (or rather request for the creation)
2. Writer, this is the software (app-specific) that makes sure that the data is ready to be copied.
3. Provider, this component gives the functionality to make the copy. VSC can use 3rd party hardware provider if needed.

Virtual Disk Service (I will call it VDS)
To make it short, it provides volume management with a single Windows interface which is used to manage storage devices. It also provides APIs for ISVs and IHVs to create storage solutions. The service itself use two CLI utilities, Diskpart and Diskraid. The Diskpart command is used to control creation, deletion and extension of dynamic and basic disk partitions. Diskraid is used to configure hardware RAID, to be specific, it is used to create, extend, delete and unmask LUs (logical units) on SANs.

Well, it simply makes your VSC data available for use. It do this by unmasking the backups stored on SAN. This means that it makes them visible and change the status from read-only to read/write. It also mounts the volume on the server. The whole process is called transport and is a virtual process since the data is on the storage array.

That is all I have time for now, got to catch a flight. I will continue another day :)

Windows Server 2003 Disaster Recovery

2006-03-09T13:34:00.000+01:00

As many of you already know, besides the project in Finland I also do a tour (ExpertZone) in Sweden. One of the sessions is about troubleshooting AD and I get a lot of questions about recovery and the different ways of doing it.

Most people tend to have similar questions so I will start a series of posts about this topic, so keep an eye on this blog if you're interested in disaster recovery :)

Securing Exchange 2003

2006-02-25T11:36:00.000+01:00

A friend of mine that happens to be an Exchange MVP just told me the secret of securing Exchange. Do you want to know?

“Don’t break the seal!”
- Mark Arnold, February 25, 2006

Mark as arrived...

2006-02-24T14:45:00.000+01:00

Landed at Arlanda, went to the bar to get a beer while waiting for M. Arnold. Realized I had nothing to do! So, as the geek I am I pulled up my two laptops and started to work on my next presentation.

Mark finally calls and says that he’s waiting for his bag; I pack up my things and get to the luggage belt, surprise! No Mark, the bloody Englishman had wandered off so I go through the customs and see the cabbie with a big sign “M. Arnold” and there were only about 7 people outside but no Mark.
I call him and he’s nearby, mind that the cabbie is the first thing you see after customs, but NO Mark didn’t see him and walked passed him…

We’re off to a good start….. ;)

Advanced AD Troubleshooting and Theory

2006-02-22T22:46:00.000+01:00

As I said in an earlier blog, my troubleshooting course is available at Cornerstone. I have changed the name to Advanced AD Troubleshooting and Theory. Please notice the course code T640 if you want to attend.

This weekend Mark is in Sweden!

2006-02-22T22:39:00.000+01:00

This weekend Mark is coming to my place in Uppsala! Carola has planned his activities and I’m not sure what is going to happen other than I had to go get some good champagne and wine and book a table at Mancini. That was all she trusted me to do!
Well, to be honest she knows us far too well and she has seen us goofing around in Amsterdam and London with her own eyes already. But in our defense, in Amsterdam we had Gianluca, Olaf, Steve and Daniel (last name left out to save the innocent) in the same apartment and in London we spent the time (not the same apartment) with Nick, Oli and Steve… Yeah, if you know which ones I’m talking about you know how the rest went. ;)

Well, it is always good to have one of your best friends visiting and it will be fun and hopefully relaxed. As I said, I have only one plan and that is to take him to the best restaurant in Stockholm, after that Carola is in charge.

Ok, I know I haven't been updating...

2006-02-22T22:38:00.000+01:00

Ok, I know it was month ago since I last updated this blog, to be honest I haven’t had much time. Since the last post I’ve worked about 17 hours on average almost 7 days a week and as many of you know, that never goes well since the Enterprise Admin in my house also want to spend time with me (still)…

What have I been up to you might ask, well first of all I’ve spent most of my time in Finland on a project for HP as a subcontractor. We are doing a company split and it is more work than I signed up for… But it is a challenge; sometimes fun and sometimes not. You all know how it is, some good and some bad as always in a project this size.

If that was not enough I also do a seminar series for Cornerstone called ExpertZone. This time the main theme is Active Directory & MIIS where I present two sessions, Active Directory Future and Active Directory Troubleshooting. First session is about the original idea with Active Directory and what lies ahead for the future (well, at least what I can say without breaking NDA) and the second one I don’t think I have to explain… ;)
We’ve been I Stockholm last week, next week is in Gothenburg and then I think we are going to Sundsvall…?

I just visit the website for Exchange Forum here in Sweden, I’m going to speak about how to use Monad to administrate Exchange 12, and realized a lot of my friends are also speaking there! I’m already looking forward to it!

Besides this I had 4 days where I was in Sandviken and trained their global Active Directory team in troubleshooting, obviously my own course tweaked to suit their needs. Sandvik is an interesting company with all the challenges you need as an Active Directory admin, it is kind of big and if memory serves they have a presence in 131 countries. They were a lot of fun and we had a good time, last day we did more like an Q&A with a lot of people outside their Active Directory team.

Well, now I’m back at Hilton in Helsinki sitting by the open fire in the bar and just relaxing…

Q Advice announce partnership with Cornerstone

2005-12-19T10:03:00.000+01:00

I’m pleased to announce that Cornerstone is the only training company in Sweden that exclusively offers Q Advice’s courses and seminars.

First on the agenda is the “ExpertZone: Active Directory & MIIS” which is a one-day conference held in Stockholm and Gothenburg. I will be presenting two sessions:

Active Directory Troubleshooting

Future of Directory Services

We are working on dates to deliver my “Active Directory Troubleshooting” as an open course. Most likely it will be delivered at all Cornerstone locations, contact Q Advice or Cornerstone for details.

London - Part 4

2005-11-23T14:49:00.000+01:00

Saturday; time to do the tourist stuff and meet another Geek, aka Oli Restorick aka Oli.
Met up with Oli around lunch, realized that we need food and wine so we went into the first bar we saw. The waiter spilled wine all over me, and don’t start – it wasn’t my fault this time!
I “casually” told him to bring another bottle (not glass) for free – he looked stumped… but actually brought us another bottle! :)
Hailed a cab and “became” tourists for a couple of hours, it was really fun and Mark had some interesting facts to share about the London Bridge. All and all, we had a good day.

Time to get back to the hotel and freshen up for the night; the plan was to have a nice dinner. An old friend of mine called and we decided to meet up at the hotel. They came pretty late and we started to chat… After some wine/beer we realized it was too late to get a decent table at any restaurant we decided to have pizza at the hotel. Pizza was good and we had a great relaxing time.

Sunday – Time to get up early to say goodbye to Mark that needed to get back home. Oli gave us a lift to Thomas Lee’s (aka Bubba) place in Cookham for a late lunch which included fantastic wines and wonderful food. I must say that I’m impressed by his wine cellar!
Comment of the day was said by Carola after she saw Bubba’s office; - “You’re not a geek!”
Obviously Bubba had more geeky things than I :)
After a couple of hours of wine and good food, we needed to get back to London – by train. But we actually did it with getting lost! Took a long walk in the London night and finished the day early if memory serves…

Monday, last day – Me and Carola is trying to get to Picadilly to meet Jesika for lunch.
Of course we took the wrong train, ended up God knows where…. Found a local pub – really small and everybody knew everybody in there. So Carola decided to have Fish & Chips, of course that would be the place to have it – far away from the tourist places.
Since we weren’t sure in which part of London (if it was London) the pub was, we decided to take a cab instead of the tube. Met up with Jesika, had a nice lunch and then it was time for shopping!
Ok, we shopped for less than an hour…..

Just before midnight we got back to Uppsala, Sweden – Repacked for Helsinki and got 4 hours sleep until I was back at Arlanda airport again…..

London - Part 3

2005-11-17T10:57:00.000+01:00

Waiting for the two lost souls:
So there we are, sitting and drinking at the bar and finally they showed up. I don’t recall how long we sat and waited, but I do remember the wine… :( Well, to be honest, I know what I like and don’t like, this was in between….

Now when the gang is gathered, bear in mind that we haven’t seen each other in a couple of weeks <g> so we had to start with the usual greeting habits… Since this can be viewed by non-adults, I can’t tell you how it goes… Just have a vivid imagination and you’ll figure it out.
After a couple of drinks we headed up to the Exec Lounge for some more drinks and snacks. If I where a manager of the Exec Lounge in Britain – I wouldn’t serve “Swedish meatballs” to Swedes. That’s all I’m going to say and that should cover it.
Usually when we all meet, there is good food involved – this time not so much… Instead we ate the snacks, had more beer and (I think) Nick came up with the brilliant (and I’m not sarcastic here) idea to head for Soho and a Champagne bar!!!!! The best idea so far!!

After the usual “I’m a cabbie, you are foreigners…” situation, if you don’t know what that means, you need to travel more, we arrived :)
And to be honest, Nick is a good lad since he knows where to find a Champagne bar. Fozzie bought two bottles and we just hung out having a nice time.
After we all had enough, we decided to call it a night. Mark, Carola and I hailed a cab and went back to the hotel with a cunning plan – let’s have another bottle of champagne!

We got the champagne; me and Mark tested it and decided that it was BAD. Got the waiters attention, go figure – this bloke (is that the correct “queens English” spelling?) knew jack about Champagne.
Since both Mark and I are such nice blokes, we called for the manager. He wasn’t convinced that we where right. So, we did what every Champagne loving man would do, offer him a choice:
Bring in another bottle, if it tastes the same we buy both. If not, we only pay for the second one. To me, that’s fair but not to this *?!=#*
Since they “knew” it was ok (without testing it) they wouldn’t bring us another bottle unless we agreed to pay for it, no matter if it’s gone bad or not…. Well, let’s cut our losses and buy regular wine instead we thought.

We had a good time and it’s always good to see Fozzie and Nick. Too bad they couldn’t be there for the second night…

Weekend in London, part 2

2005-11-09T19:49:00.000+01:00

Arrived at Heathrow:
Ok, I know most people don’t believe me but we actually took the underground all the way to Kensington from Heathrow… Mark couldn’t believe it…
Came to Hilton Kensington to check in, I’d requested for 10am check-in which of course wouldn’t happen but she checked us in at the Executive floor, (Mark, the real exec floor, not the one you where in :)) told us that we could use the Executive Lounge (which sounds much better than it is) to have drinks and food while we wait an hour until we get access to the room.
Got into the lounge, realized it had NO food, NO drinks (but coffee for order) ONLY water! Well to be honest they actually had it chilled and sparkling… Ok, the moral so far; don’t book Hilton Kensington if you are used to a proper lounge….

In the room we unpacked, thinking of heading out when we realized that Mark (known as Shrek) will check-in in an hour or two… Instead we took a catnap.
Mark text me saying he’s arrived, we didn’t care because we were asleep……

Woke up and called up Mark and went down to meet him at the bar and had some wine (or was it beer?). Now we only waited for Nick and Steve to join us….

Weekend in London, part 1

2005-11-09T19:27:00.000+01:00

My dear but crazy friends blogged about my trip to London last weekend, so I thought I should give my version... In multiple posts…

On the way to the airport:
Woke up in time for the cab for once, me and Carola arrived at the airport with plenty of time to kill before boarding. Since we didn’t have breakfast, we headed to the lounge for some coffee and sandwiches (yes, we tried the beer as well). After a while we got bored and headed for the gate, still with plenty of time.
Arrived at pier F (far walk and I couldn’t hail a cab) and realized that boarding has not started yet. Walk past the pier (50m) to the bar, bought some drinks and relaxed.

Ok, recap – we’re sitting 50m from the gate, have plenty of time before boarding.

Took a look at the watch and realized that we should move towards the gate, arrived at the gate – we are the only ones there!! Walk up and the girl was just about to get on the PA… Yeah, I was late again and almost missed the plane…
After the usual “angry faces” from the other passengers already sitting and waiting for us we where ready for take-off!

Finally at home, and what do I do.... Part 2

2005-10-25T18:31:00.000+02:00

Ok, I started the installations and couldn't decide what to install so I installed this:
-4 DCs, SMS, MOM, Exchange, ISA, SPS, MIIS, SQL, Storage and a bunch of clients.
Well, you're right the clients are not that interesting - but you need to have them for a reality check (more info on this further down). Totally there is 12 servers with a connected "home-SAN" + clients.

To be honest I'm not done yet... I think.... Why?
Well, since I'm rarely at home with Carola (girlfriend) I was feeling guilty after a while... Come on! You know how it is, right? In regards of "reality check" I mean that I haven't fully tested all functionality yet, but trust me, if there is something wrong that will cause the clients to fail I will have a "support call" pretty soon! Yep, you guessed it, the laptop that Carola is using is part of this network, and she will go online any minute now :)

If you're interested in the procedure to do a full forest recovery search here. The reason I just post a URL is that if I would write a step-by-step, I wouldn't have time to finish my wine in this "oh-so-boring-hotel-bar" until it's time to go back to Sweden... :)

Finally at home, and what do I do....

2005-10-22T21:27:00.000+02:00

Ok, woke up this morning and thought... Wouldn't it be fun to do a forest recovery again? Well, kind of fun, but since I do a forest recover every other month I need to make it harder this time.
How can I make it harder? Well, first I backed up my vital data of course, totally redesign my network, installed a bunch of servers I don't need, you know SMS, Exchange, MIIS, SPPS and other more or less fun systems from MS...
I'll be done in a couple of hours and then I will break it in a major way :)

So, if you ever feel like you have too much time on your hands, this will certainly kill a couple of hours! :)

I'll post the results when I'm done...

Windows and Linux

2005-10-20T11:47:00.000+02:00

Most people that discuss Windows vs. Linux should get the facts straight.... The discussions tends to be more like "mine-is-better-than-yours" type of thing, and I'm sick of it!

If you're interested in more than just b*tch about it, then read this!

Port D3D in Windows - Decimal to Binary to Hex...

2005-10-20T08:12:00.000+02:00

Ok, I usually say port D3D when I talk about Windows Terminal Services. This often gets me into discussions about hex conversions, again.... :) The reason I use D3D is because I think it's easier to remember than the actual port number, and yes I'm talking about RDP and port 3389 if you don't want to read it all ;)

So how did 3389 become D3D?

-- 1. Convert the decimal number 3389 into binary, 3389 = 110100111101 in binary.

-- 2. Convert the binary number into hex, 110100111101 = D3D in hex.

If you want me to break it down in detail, this is how I did:

-- 1. Created a table in order to convert 3389 into binary:

2048-1024-512-256-128-64-32-16-8-4-2-1
1-1-0-1-0-0-1-1-1-1-0-1

This is the same as 2048+1024+256+32+16+8+4+1 which gives us 3389.

-- 2. I then took 110100111101 and broke it down into three clusters:
1101 – 0011 – 1101 which is equal to 13 - 3 - 13 in decimal.

-- 3. Then I convert each cluster into hex:
13 = D, 3 = 3, 13 = D which gives us D3D!

Isn’t math beautiful! :)

Great Italian food in Stockholm

2005-10-17T15:59:00.000+02:00

After the UG meeting I took Jesper Johansson, Michael Anderberg, Fia (aka Fido) Lindström and my girlfriend Carola Mattsson out for dinner at Bohemia by Mancini. I just love this restaurant, all the staff and their food can be summed up in one word; FANTASTIC!

Well, if you ever have been out eating with me in Stockholm, you know that this is the place to go. It’s absolutely my favorite place; some people call it my home since I try to go there as much as possible when I’m at home in Sweden.

So what would I recommend?
Ask them if you can visit the wine cellar, they have some really good ones – But they might be spoken for since I have my own rack in their cellar :)
Then be sure to have enough time when you go back to the restaurant, since I recommend the tasting menu. Trust me; it will give the word “dinner” a whole new meaning...

So, what did we do then?
Well, read above...... :)

Carola and Fido (aka Fia) were a bit concerned that the “dinner discussions” would be too geeky and all about bits and bytes... Well, to be honest every “normal” human would.... Me and Jesper (both likes to discuss SDDL as an example) at the same table.... Then add Michael and you should be very concerned.... BUT we actually managed to keep ourselves from getting too technical (or the word geeky might be a better choice...)

To sum it up:

Great wine

Great food

Fun discussions

Lovely company - hey, I’m talking about the girls here... ;)

Usergroup meeting

2005-10-17T15:41:00.000+02:00

Now this UG (no name yet) is born!

We decided to create a mailinglist, Sharepoint site and have a meeting once a month to start with. We will keep this UG informal and use it as a forum to discuss ideas about infrastructure, mostly Microsoft but also other vendors. Why? Because that’s real-life!

It was really fun and we had some great discussions with Jesper Johansson about security and other fun things as SDDL and the undocumented stuff ;)
Of course I will blog about SDDL as the true geek I am – but I just haven’t found time to do it yet….

What if I would like to join this UG?

Sorry, there is not yet an official site (or whatever) to sign up. BUT keep an eye on this blog and I’ll post information as soon as it is available.

Thanks to all of you that took time on a Saturday and showed up at the meeting!

My AD troubleshooting course is now available as an open course!

2005-10-11T19:04:00.000+02:00

Description
This course provides students with the knowledge and skills necessary to troubleshoot a Microsoft Active Directory infrastructure in an enterprise environment.
Audience
This course is intended for senior support professionals, architects, engineers and consultants responsible for maintaining a Microsoft Active Directory environment.
Prerequisites
This course requires that students meet the following prerequisites:

MOC course 2279 - Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure.

Hands-on experience of troubleshooting Microsoft Active Directory environments.

Trainer and Training Center Qualification
Only trainers and training centers authorized in writing by Quality Advice AB may deliver this course. If the trainer and/or training center can’t prove authorization in writing, please contact Quality Advice AB at info@qadvice.com, as the course materials are being used illegally.

The course is designed by Jimmy Andersson, Principal Advisor at Quality Advice AB. More information about courses and consultancy, please contact Quality Advice AB at info@qadvice.com.

Overview of course material

Module 1

Active Directory Data Store

Database Layer

Data Store Protocols

Data Store Physical Structure

Security Descriptor

Database Issues

Database and Log File Tasks

Database Integrity

Module 2

Object Deletions

Lingering Objects

Tools

Module 3

Account Lockout Troubleshooting

Monitoring Account Lockout

Analyzing Information

Account Lockout Tools

Module 4

FRS Architecture

FRS Physical Structure

FRS Objects in Active Directory

FRS Troubleshooting

Module 5

DFS-Related Architecture on DCs

DFS Physical Structures and Caches on DCs

DFS Troubleshooting

Module 6

Replication Architecture

Replication Subsystem

Replication Model

Replication Sequence

Data Updates

Identifying Replication Partners

Module 7

Replication Monitoring Tools

Replication Troubleshooting

Module 8

FSMO

FSMO Failures

Module 9

PDC Load Management

PDC Emulator Load Reduction

Symptoms of Overload

Steps to Optimize PDC

Load Reduction Techniques (DNS)

Load Reduction Techniques (WINS)

Block Enumeration

Module 10

Non-Authoritative Restore

Authoritative Restore

Forest Recovery

MVP status

2005-10-11T16:19:00.000+02:00

Yep, it's now official. I got awarded Microsoft MVP for Directory Services this year again! :)

My MVP profile:
http://tinyurl.com/4ydpo

Binary to Hex values for dummies...

2005-10-10T19:11:00.000+02:00

Binary to Hex values for dummies...

I tend to get questions about Hex pretty often. So I thought – why not write something short to get people to understand more about hex?
Since I’m stuck at the hotel bar, now would be the perfect time to do it! :)

Prereq – you should know how binary values work.

You all know that hex uses letters (A-F), which is mind-boggling in itself. But if you think about it, it’s rather simple:
A = 10
B = 11
C = 12
D = 13
E = 14
F = 15

Since hex will use four bits and give it a value it only goes up to F, why? Cause 1111 in binary equals 15 (8+4+2+1). Now you might think – Hey, that’s simple! What’s all the fuzz about? Well, as everything fun in life – there are exceptions. But I will not go into that now, just accept that and read on ;)

Ok, how can I use hex to make binary easier (shorter)?
Let’s take an example, if I want to write the binary number 1010 in hex I simply convert it to decimal which is 10 thus is the binary number 1010 the same as A in hex.

Let’s make it more interesting, lets say I have this binary number 00111101. So first we break it down into this 0011 – 1101 which gives us 3 and 13 converted to hex that would be 3d, starting to get the idea?

So now the final imaginary example:
1111011001110001100011001111 – once again I break it down into clusters:
1111 = F, 0110 = 6, 0111 = 7, 0001 = 1, 1000 = 8, 1100 = C, 1111 = F so the answer would be:
f6718cf

So, now you know how to take binary values and convert them into hex values. End of lesson 1 :)

Ps. You can also do it in reverse order if you want. And if you want to be a real geek, then use the ASCII table to write words ;) Ds.

/6a696d6d79

AD and LDAP compliance

2005-10-10T14:08:00.000+02:00

I often get the question if Active Directory is LDAP compliant. Well, I could start ranting here but I won't. Instead I'll just direct you to the Active Directory LDAP Compliance paper:
http://tinyurl.com/4g3u6

This paper discuss the following:
- What is LDAP?
- What does it mean to be LDAP compliant?
- AD's LDAP compliance
- Compliance misconceptions
- Directory Interoperability

So, if you want to learn more about LDAP compliance I recommend to start with this paper. If you're a geek like me :) there's always a bunch of RFCs to read...

Mr. Andersson you are delaying the flight.....

2005-10-10T12:53:00.000+02:00

Yep, they said it again!

For those of you who know me, I really s*ck when it comes to be on time at the airport. I was supposed to be up at 5am this morning, but what happens..... The cab driver called and woke my girlfriend and she woke me up, so as usual I threw some clothes in the bag, grabbed my laptops (yes, it's laptopS) and told the driver:
"Hurry up - I'll pay any speeding ticket, just get me there asap"....

Got to check-in, I was too late so they had to call the gate and ask them to wait for me. After security check I had to run like my a** was on fire, and heard "Mr. Andersson, please hurry to the gate. You are delaying the flight!" over and over on the PA.

Ok, I made the flight. Landed in Helsinki, Finland just to realize I took the wrong currency with me.... No biggie, just change from USD to Euro. Got into the cab when I realized that I didn't know which office to go to, HP have two offices in Helsinki but no one told me that....
Told the cabbie, go to the closest one and I can go in and ask. Yep, you're right - of course it was the wrong office....

But I made it eventually, and now I'm here to start my consultant gig where I'm helping HP with a migration/company split. So it looks like I will spend most of my time in Finland the rest of the year. :)

Usergroup

2005-10-08T20:24:00.000+02:00

I've started a new UG in Sweden! So far the interest have been good, we are now a core team of about 20 people which include Microsoft staff and people from different companies.

The first meeting will take place on the 15th of October at Humandata's office in Stockholm (www.humandata.se). Since this is the first meeting we will discuss how to proceed, maybe set up a Sharepoint site for members and so on... And I'm glad to say that the first guest speaker will be Jesper Johansson from Microsoft Security Business Unit (or at least that is what it used to be called before the reorg) in Redmond.

I've already secured speakers from the UK and US for the next meeting! :)

I will post a URL where people can sign up for the usergroup as soon as we have finalized how to proceed.

My first post!

2005-10-08T20:05:00.000+02:00

Hey!

This is my first blog ever. Still haven't figured out what to write about, but it'll come to me eventually....

So who am I? Well I'm a Microsoft Directory Services and Security MVP based in Sweden, when I say based I mean that I live there, but since I'm almost always on the road and my new nickname according to Sean O'Driscoll at Microsoft is now "Jimmy The Global Swede" I leave it at that.

So, expect to be reading about conferences, bad airlines/hotels and technology on this site. :)