TechDays

I will speak on TechDays this year together with my colleague Fredrik Pålerud (scroll down and you'll see him). If you want to know what it is, see this. TechDays is a Microsoft Sweden event and is held once per year. This year it is fully booked already so I'm looking forward to it!

Crayon also have a booth that we will spend as much time as possible in, please come and join us! And despite what the Crayon website says - we do have some seriously good consultants (they just haven't updated it with the consultant department yet....).

Install DFS Management Console - when you can't use the mouse

ServerManagerCmd -install RSAT-DFS-Mgmt-Con

Installing DFS replication - when you can't use the mouse

If you want to install DFS replication on web edition or server core. You need to do it from a command prompt:

OCSetup DFSR-Infrastructure-ServerEdition


or:
 
ServerManagerCmd -install FS-DFS-Replication

Protect "old" OUs from accidental deletion

In Win 2K8 and newer. There is a a check-box you can set to protect an OU from accidental deletion. This is good, but if you don't use ADUC in Win 2K8 (or R2) it will not be set by default. Also if you upgraded or migrated to a Win 2K8 (or R2) it won't be set automagically on "old" objects. So here is two ways of doing it.

for /f "tokens=*" %i in ('dsquery ou -limit 0') do dsacls %i /d everyone:SDDT

or:

Get-ADOrganizationalUnit -filter * |

Set-ADOrganizationalUnit -ProtectedFromAccidentalDeletion $true
 
(the above should be one line)
 
Thank you Ulf for posting these two one-liners!

Defining a new attribute - version 2

My colleague, Fredrik Pålerud, just saw what I blogged and he has another recommendation. Use Active Roles and you don't have to touch the actual Schema. Wanna lear more.... Click here.

Defining a new attribute

I just stumbled over a pretty good article. It describes how to define a new attribute when you extend the Schema. Take a look at it if you haven't memorized it yet....

Outlook signature based on user info from AD

My colleague from Crayon Norway, Jan Egil Ring, have written a cool Powershell script that creates an Outlook signature based on information from AD. Take a look at it, it is posted here. 

Enable Recycle Bin - with Powershell

This is the Powershell way to enable Recycle Bin in a domain called DEMO.PRV:

Enable-ADOptionalFeature –Identity ‘CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=demo,DC=prv’ –Scope ForestOrConfigurationSet –Target ‘demo.prv’

Enable Recycle Bin - but not with Powershell

A question from yesterday: "Must I use Powershell to enable Recycle Bin in AD?"
The answer is: No.

You can also use LDP to do it. What you need to know is the GUID of the Recycle Bin and where to add it.

To find the GUID you need to browse to:
CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=domainName,DC=xxx

And look at the msDS-OptionalFeatureGUID value (which is 766ddcd8-acd0-445e-f3b9-a7f9b6744f2a).

Then you need to modify the CN=Partitions,CN=Configuration, DC=domainName,DC=xxx container:
1. Right-click it and select: "Modify"
2. Delete everything in the "DN:" box, it MUST be empty!
3. In the "Edit Entry Attribute:" box type: enableOptionalFeature
4. In the "Values" box type: CN=Partitions,CN=Configuration, DC=domainName,DC=xxx:766ddcd8-acd0-445e-f3b9-a7f9b6744f2a
5. In "Operation" you select "Add" click "Enter" and last you click "Run"

You have now enabled the Recycle Bin feature in AD!

Note - this is a Windows 2008 R2 feature so it won't work on legacy OS. You must also replace domainName and xxx with whatever your environment is called.

Canonical Names of Control Panel Items

As a follow-up on the other post. Wolf sent a link with more info:

http://msdn.microsoft.com/en-us/library/ee330741(VS.85).aspx

Windows 7 God Mode

My good friend Wolfgang Schedlbauer sent me a mail today. The subject was "GodMode in Windows 7". So that got my attention and I needed to try it. It is cool! If you want to know what it is and try it (below text copy/pasted from his mail):


What is God Mode? This is a secret Windows 7 Feature (If you can call so!!), which provides you an extended control panel to control your machine.


Here are the Steps to invoke the God Mode:

Create a new folder (right-click and click on “New Folder”). Right-click on the folder and click on rename, copy and paste this: GodMode.{ED7BA470-8E54-465E-825C-99712043E01C}

This folder will now be a shortcut to the Windows 7 God Mode. The GodMode allows you to quickly access many Windows 7 functions via a GUI.

New job!

1 minute ago, I signed the employment contract for Crayon (http://www.crayon.no/, http://www.crayon.se/). I will start the first of January as Crayon Sweden's Chief Architect for Microsoft technology.

So if you want me as a consultant, you contact Crayon.

Restore of an object or subtree

I've been asked several times how to get an object or subtree of objects back if an accidental deletion happened and you have one DC that still have the objects. In other words mark these objects as authoritative so they replicate back to the DCs that have them deleted. This is usual in a lag site scenario, or if you are lucky to find a DC that haven't already delete the object(s).

So here is a step-by-step on Windows 2008, note that this is not applicable for versions lower than 2008.


1. Stop relication on a DC that have the object(s) with repadmin. I usually stop both inbound and outbound to be safe:
- Repadmin /options +disable_inbound_repl
- Repadmin /options +disable_outbound_repl

2. Stop AD Service. This will also stop the following services:
- File Replication
- Kerberos Key Distribution Center
- Intersite Messaging
- DNS Server
- DFS Replication

3. Set instance:
- Ntdsutil
- Activate instance NTDS

4. Authoritative Restore (while in ntdsutil):
- Authoritative restore
- Restore subtree ou=dr-test,dc=qadvice,dc=prv

Example screenshot:
authoritative restore: restore subtree ou=dr-test,dc=qadvice,dc=prv
Opening DIT database... Done.

The current time is 11-20-09 12:35.45.
Most recent database update occured at 11-20-09 12:32.09.
Increasing attribute version numbers by 100000.
Counting records that need updating...
Records found: 0000001001
Done.

Found 1001 records to update.
Updating records...
Records remaining: 0000000000
Done.

Successfully updated 1001 records.
The following text file with a list of authoritatively restored objects has been created in the current working directory:
ar_20091120-123545_objects.txt
None of the specified objects have back-links in this domain. No link restore file has been created.
Authoritative Restore completed successfully.

5. Start AD and related services (if they don't start automatically)

6. Enable replication on the DC:
- Repadmin /options -disable_inbound_repl
- Repadmin /options -disable_outbound_repl

MVP Award. I received this in my mail Oct 1st:

"Dear Jimmy Andersson,Congratulations!

We are pleased to present you with the 2009 Microsoft® MVP Award! This award is given to exceptional technical community leaders who actively share their high quality, real world expertise with others. We appreciate your outstanding contributions in Directory Services technical communities during the past year."

I'm very glad and proud of it. This is the 11th year in a row!

TEC Europe

I just decided to attend TEC Europe in September. It will be held in Berlin at the Hilton, September 14-16.
Hope to see you there!

Warning: The software you are installing does not match your mental model

I just read this on Jesper's blog. It is funny :)

Recommended settings for event log sizes in Windows Server 2003 and in Windows Server 2008

http://support.microsoft.com/kb/957662

Sooz arrived

Sooz arrived, picked her up at the airport. And guess what..... Yes, she arrives without the bag, it is still in Copenhagen and we hope it will arrive sometime soon. Tomorrow we're going on a road trip to Sundsvall so I really hope she gets her bag tonight....

Find account based on a given SID

Here is some code that will find the account based on a given SID:

-Script Begins-
'============================================================
' NAME: find-Account.vbs
' AUTHOR: Jimmy Andersson, Q Advice AB
' DATE: 21/04/2009
' Version: 1.0 - initial version
' USAGE: cscript find-Account.vbs
'============================================================
Option Explicit

'============================================================
'==== Declare variables and sets objWMIService
'============================================================
Dim strComputer, objWMIService, objAccount
strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

'===========================================================
'==== Below code finds the account based on a given
'==== SID (both local and domain accounts)
'===========================================================
Set objAccount = objWMIService.Get _
("Win32_SID.SID='S-1-5-21-842925246-725345543-682003330-4474'")
wScript.Echo objAccount.ReferencedDomainName &_
"\" & objAccount.AccountName
-Script Ends-

A way of finding the local admin account by searching SIDs

Let's say you don't know the account name for the local admin account. The below code will find it for you. This is really good to have if a customer used the "oh-not-so-good-way-to-apply-security" approach.
I actually had a customer (before I came along and changed it) randomize the renaming of the local admin on their workstations....
Do I need to say that they didn't have a log. And even more "strange" is that they actually created 20+ local accounts just to confuse a potential bad guy.....
I will not start to rant about what I think of this approach. Never the less I had to find all the local admin accounts on their workstations. So I wrote some code that I fired off remotely and logged the information in a secure place. The basis of that code is below:
(as usual wrapping might be an issue)

-Script Begins-
'============================================================
' NAME: find-AdminName.vbs
' AUTHOR: Jimmy Andersson, Q Advice AB
' DATE: 21/04/2009
' Version: 1.0 - initial version
' USAGE: cscript find-AdminName.vbs
'============================================================
Option Explicit

'============================================================
'==== Declare variables and sets objWMIService
'============================================================
Dim strComputer, objWMIService, objAccount, colAccounts
strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

'===========================================================
'==== Below code finds the local ADMINISTRATOR account
'==== by searching the SIDs of local accounts
'===========================================================
Set colAccounts = objWMIService.ExecQuery _
("Select * From Win32_UserAccount Where LocalAccount = TRUE")
For Each objAccount in colAccountsIf Left (objAccount.SID, 6) = "S-1-5-" and Right(objAccount.SID, 4) = "-500" Then
Call getInfo
End If
Next

'===========================================================
'==== Function to get properties
'===========================================================
Function getInfo
wScript.Echo "Name: " & objAccount.Name
wScript.Echo "SID: " & objAccount.SID
wScript.Echo "Description: " & objAccount.Description
wScript.Echo "Disabled: " & objAccount.Disabled
wScript.Echo "Pwd Expires: " & objAccount.PasswordExpires
wScript.Echo "Pwd Required: " & objAccount.PasswordRequired
wScript.Echo "Pwd Changeable: " & objAccount.PasswordChangeable
End Function
-Script Ends-