SCM v2

SCM 2 provides ready-to-deploy policies and DCM configuration packs that are tested and fully supported. Our product baselines are based on Microsoft Security Guide recommendations and industry best practices, allowing you to manage configuration drift, address compliance requirements, and reduce security threats.

Download Security Compliance Manager 2

Learn more about Security Compliance Manager 2

MVP Award

I received this in my mail yesterday:

___________
Dear Jimmy Andersson,

Congratulations! We are pleased to present you with the 2011 Microsoft® MVP Award! This award is given to exceptional technical community leaders who actively share their high quality, real world expertise with others. We appreciate your outstanding contributions in Directory Services technical communities during the past year.
___________

This is the 13th year in a row I got honored with this award, and I'm proud of it!

MVA - Microsoft Virtual Academy

http://www.microsoftvirtualacademy.com/GetStarted.aspx

MVA is a training portal that offers you (at present date) the following tracks:

Clustering
Hyper-V
IaaS
Office 365
PaaS
Private Cloud
Public Cloud
SaaS
Security
SQL Azure
System Center
VDI
Virtualization
VMware
Windows Azure

Windows 8 License Fun

When installing the Windows 8 Developer Preview with Tools, this funny license came up. Notice the second row, it's funny :)

More info on Windows 8

Mark Minasi have written an article about Windows 8:
http://www.minasi.com/newsletters/nws1109.htm

Windows 8

Are you curious about Windows 8?
Take a look at Sean Deuby's article in Windows IT Pro, I'm uncertain if I break NDA at this point so I will direct you to the official article on the Internet. When I'm certain about what I can blog without breaking NDA I will of course blog it :)

http://www.windowsitpro.com/author/5202540/SeanDeuby.aspx

Windows 8 Developer Preview

Here it is!

http://msdn.microsoft.com/en-us/windows/apps/br229516

PowerShell Cheat Sheet

On the Windows PowerShell Blog you will find Cheat Sheets for PowerShell.

Kerberos authentication over external trust

Yes, it is possible! See Jorge's blog for details.

Nordic Infrastructure Conference

Welcome to NIC2012!


Our goal is to create the premier event for all IT-professionals in the Nordics, offering broad technical education on Microsoft and 3. party products, tools and services. Our two day event will focus on deep-dives and practical knowledge on the most used products. This means less slides, more hands-on. We will show you the good and the bad sides, we will show you how to solve the most common tasks and challenges, sharing all our experience from the real world, the tips & the tricks.

So if you are deploying, managing, securing and mobilizing Microsoft solutions, NIC is the place to be. We will focus on the key technologies within current and soon-to-be released products, helping you to better solve today's IT-challenges, and preparing for tomorrow's innovations.

http://www.nic2012.com/

Interviews

Just saw this one, and it is kind of spot on!

http://www.microsoft.com/showcase/en/us/details/b0f33cc2-8ead-46e9-9737-16435efa7c2b

Interactive logon information

I got into some discussions about these 4 attributes and how they work. Here it is:


msDS-FailedInteractiveLogonCount: The total number of failed Ctrl + Alt + Del (C-A-D) logon attempts at a Windows Vista or Windows Server 2008 domain joined member (or higher) since the Last Interactive Logon Information feature was turned on.
Integer

msDS-FailedInteractiveLogonCountAtLastSuccessfulLogon: The total number of failed C-A-D logon attempts at a Windows Vista or Windows Server 2008 domain joined member (or higher) up until the last successful C-A-D logon.
Integer
msDS-LastFailedInteractiveLogonTime: The time that an incorrect password was presented during a C-A-D logon attempt at a Windows Vista or Windows Server 2008 domain joined member (or higher).
Timestamp

msDS-LastSuccessfulInteractiveLogonTime: The time that a successful C-A-D logon occurred at a Windows Vista or Windows Server 2008 domain joined (or higher).
Timestamp

If the and username/password is correct, it writes the timestamp to the msDS-LastSuccessfulInteractiveLogonTime . If the username/password is wrong it will write the timestamp to the msDS-LastFailedInteractiveLogonTime. Then the values of msDS-FailedInteractiveLogonCountAtLastSuccessfulLogon and msDS-FailedInteractiveLogonCount get raised by one (1). For example, if the msDS-FailedInteractiveLogonCount already have 2 it becomes 3.

When it is configured two things will happen:
1) The domain controller writes the information to AD and replicates it.. [Screenshot 1]
2) On the machine the user logs on to (at least Vista or 2008 server (or higher)) a query is sent to display the information at the logon screen. [Screenshot 2]

[Screenshot 1] The information waiting to be replicated to other DCs:

(0) modify CN=Jimmy Andersson,OU=Users,OU=ADS,OU=Services,OU=_Operations,DC=qadvice,DC=prv
1> objectGUID: 1e8979ba-94f8-47fe-83cc-99e9c28fa016
1> instanceType: 0x4 = ( WRITE )
1> msDS-LastSuccessfulInteractiveLogonTime: 2010-11-14 19:43:54 W. Europe Standard Time

[Screenshot 2] The information displayed to the user after a successful logon

What you need to think about:

Each time a user logon it will create replication traffic as you can see in screenshot 1. This information is then replicated to all domain controllers – in large environments this will most likely be an issue. So this feature should be used with caution!

If a RODC authenticates the user, this will happen:
• msDS-LastSuccessfulInteractiveLogonTime will only be written to the RODC and not forwarded to the RWDC
• msDS-LastFailedInteractiveLogonTime is written to the RODC and the RWDC. Then it will be replicated back from the RWDC to the RODC.
• msDS-FailedInteractiveLogonCountAtLastSuccessfulLogon will only be written to the RODC and not forwarded to the RWDC
• msDS-FailedInteractiveLogonCount is written to the RODC and the RWDC. Then it gets replicated back from the RWDC

Note! If you configure this for an OU, but not configure this on the domain controllers the users will not be faced with this error and not be able to logon:

Security policies on this computer are set to display information about the last interactive logon. Windows could not retrieve this information. Please contact your network administrator for assistance.

If a domain controller can’t be located the user will not be able to logon.

If you still see a need to use this feature, this is how you configure it:
Create a GPO and link it to both the domain controllers OU and to the OU you have the clients you want the users to see this logon information on. Of course if you want to be more flexible create two GPOs, one for the domain controllers OU and one for the clients which you then can use groups and filter etc.

Note! Even if you select only a few clients to show this information on, you actually affect all DCs. So even if the users only see this information on a selected number of clients – the information is still written to a DC (for all logons) and then replicates to all DCs. This is because you enable it on the DC(s) and thus all users get affected.

My recommendation:
Only use it when you really need it. Display the information for normal end-users is useless since they won’t understand it – most users will only click OK without reading it anyway…

Dcpromo and DNS installation message

Have you ever seen this?
"A delegation for this DNS server cannot be created because the authoritative parent zone cannot be found or it does not run Windows DNS server. If you are integrating with an existing DNS infrastructure, you should manually create a delegation to this DNS server in the parent zone to ensure reliable name resolution from outside the domain “FQDN”. Otherwise, no action is required."
This happens when:
- Dcpromo.exe has been configured to install the DNS server role, and enough delegations do not already exist between DNS servers in the immediate parent DNS zone and the subdomain where you are installing the new DC. And the DC is unable to create delegation to the DNS subdomain on a DNS server that is autoritative for the parent zone.
Do you need to care about it?
Not if you don't have users in other domains (Internet included) that have the need to resolve DNS queries in the local domain.
Why does it happen?
- It will try to create the delegation to ensure name resolution from other domains.
- You can also see this in the forest root when it is immediately subordinate to top-level domains.
- Dcpromo can auto-create this delegation, but only for MS DNS and will fail for non-MS DNS servers.
- If the domain (root) is subordinate to an existing intranet namespace that is owned by non-MS DNS servers such as BIND.
- I also heard that this can happen if the AD domain is registered on the Internet, but the ISP have not created necessary delegation yet.
How to avoid it?
- On your non-MS DNS servers, pre-create the delegation in the parent domain.
- If you have MS DNS servers in the parent domain, make sure you have the necessary permissions to create the delegation in the parent zone.

MVP Award

I received this in my mail yesterday:

"Dear Jimmy Andersson,


Congratulations! We are pleased to present you with the 2010 Microsoft® MVP Award! This award is given to exceptional technical community leaders who actively share their high quality, real world expertise with others. We appreciate your outstanding contributions in Directory Services technical communities during the past year.
The Microsoft MVP Award provides us the unique opportunity to celebrate and honor your significant contributions and say "Thank you for your technical leadership.""

This is the 12:th year in a row I get honered with this award. I am proud.

Active Directory Web Services (ADWS)

This is a service that came with Windows Server 2008 R2 and provides a Web service interface to AD DS, AD LDS and the AD Database Mounting Tool which are running on the same server as ADWS.

ADWS is installed automatically when you add the AD DS or AD LDS role to your server.

What happen if I stop it?
The Powershell module and AD Administrative Center will not be able to access any directory instances on the server. I personally think that in the future even more applications will stop working as well.

Any considerations?
Yes, ADWS requires TCP port 9389 to be open on the servers that run ADWS.

Can I configure how the traffic is handled?
Yes, in the %windir%\ADWS directory there is a file called Microsoft.ActiveDirectory.WebServices.exe.config file you can edit. This is the default values:

Parameter name: MaxConcurrentCalls
Default value: 32
Description: Specifies the maximum number of simultaneous service requests that the ADWS service is configured to process at a given time. Set a higher value for this parameter if the ADWS service on your Windows Server 2008 R2 server must be able to process more than 32 service requests at any given time.

Parameter name: MaxConcurrentSessions
Default value: 500
Description: Specifies the maximum number of client sessions that the ADWS service can accept at any given time. Set this parameter to a higher value if the ADWS service on your Windows Server 2008 R2 server must be able to accept more than 500 concurrent client sessions at any given time.

Parameter name: MaxReceivedMessageSize
Default value: 1 MB
Description: Specifies the maximum message request size, in megabytes (MB), that a client computer can send to the directory service instances that the ADWS service supports. This setting can affect the memory consumption of the ADWS service. For example, if MaxConcurrentCalls is set to 32 and MaxReceivedMessageSize is set to 1 MB, the ADWS service is configured to process a maximum of 32 MB in client message requests at any given time.

Parameter name: MaxStringContentLength
Default value: 32 KB
Description: Specifies the maximum string size, in kilobytes (KB) of a Lightweight Directory Access Protocol (LDAP) attribute that the ADWS service is configured to process in a message request that a client computer sends to a directory service instance that the ADWS service supports. Increasing this value can increase the maximum possible memory consumption of the ADWS service.

Parameter name: MaxPoolConnections
Default value: 10
Description: Specifies the maximum number of LDAP connections for each directory service instance that is used by the ADWS service that is running on a given Windows Server 2008 R2 server.

For example, if MaxPoolConnections on a particular Windows Server 2008 R2 server is set to 10 and there are 3 directory service instances running on this server, ADWS uses a maximum of 10 LDAP connections to each of these directory service instances to process requests that are sent to the ADWS service. Along with MaxConcurrentCalls, this can affect the maximum number of simultaneous requests that the ADWS service can process. Set this parameter to a higher value if you notice that client service requests are timing out while they wait for an LDAP connection to be available to process their request.

Note: To improve performance, the ADWS service on a Windows Server 2008 R2 server maintains a separate LDAP connection pool for every directory service instance that is running on this server. For example if your Windows Server 2008 R2 server is a domain controller (and is, therefore, running the AD DS server role) and also a global catalog server and if it is running two AD LDS instances and one Active Directory Database Mounting Tool instance (a total of five directory service instances), the ADWS service on this Windows Server 2008 R2 server maintains five separate LDAP connection pools. Because a global catalog does not share the same LDAP port as AD DS, it is considered a separate directory instance.

Parameter name: MaxPercentageReservedConnections
Default value: 50%
Description: Specifies the percentage of LDAP connections that are reserved for performing query operations for each directory service instance that the ADWS service supports on a given Windows Server 2008 R2 server. Set this parameter to a higher percentage if the ADWS service on this Windows Server 2008 R2 server is used mostly for running queries.

Parameter name: MaxConnectionsPerUser
Default value: 5
Description: Specifies the maximum number of LDAP connections (to a single directory service instance) that the ADWS service permits to be used at one time for operations that are associated with a single set of client credentials (one user). Set this parameter to a higher value if you are experiencing more than five concurrent client requests by one user to a single directory service instance running on your Windows Server 2008 R2 server. The value of MaxConnectionsPerUser cannot be greater than the value of MaxPoolConnections. If the value of MaxConnectionsPerUser is equal to the value of MaxPoolConnections, it will allow a single set of client credentials (for a single client computer) to consume all available LDAP connections for a given directory service instance.

Parameter name: MaxEnumContextExpiration
Default value: 30 minutes
Description: Specifies the maximum allowed time period during which the ADWS service processes and retrieves the results of a query request from a client computer.

Caution: Changing the default value of this parameter is strongly discouraged. Most of the search results are returned within 30 minutes.

Parameter name: MaxPullTimeout
Default value: 2 minutes
Description: Specifies the maximum allowed time-out value that a client computer can set when it retrieves one page of search results. Set this parameter to a higher value if slow wide area network (WAN) traffic results in a time-out value for returning one page of search results that is longer than two minutes

Note: The ADWS service processes search requests from client computers in the following manner:
- A client submits a search request.
- The ADWS service establishes a search context and returns a search context ID to the client computer.
- Using this search context ID, the client computer issues a page request to extract the search results specifying how many LDAP objects can be returned per page.

MaxPullTimeout controls the maximum amount of time a client can ask the ADWS service to spend retrieving a page of results, while MaxEnumContextExpiration is the maximum time that the search context can be kept open.

Parameter name: MaxEnumCtxsPerSession
Default value: 5
Description: Specifies the maximum number of search requests (search contexts) that can be submitted over a single client session to the ADWS service.

Parameter name: MaxEnumCtxsTotal
Default value: 100
Description: Specifies the maximum number of search requests (search contexts) that can be submitted over all active client sessions to the ADWS service.

Parameter name: MaxGroupOrMemberEntries
Default value: 5000
Description: Specifies the maximum number of group members (recursive or non-recursive), group memberships, and authorization groups that can be retrieved by the Active Directory module Get-ADGroupMember, Get-ADPrincipalGroupMembership, and Get-ADAccountAuthorizationGroup cmdlets. Set this parameter to a higher value if you anticipate these cmdlets to return more than 5000 results in your environment.

Note: This setting can affect the memory consumption of the ADWS service.
This configuration parameter is applicable only to the three Active Directory module cmdlets mentioned above.
If your operation returns an exceptionally large results set, you might run into a non-configurable 5-minute timeout.

Parameter name: OperationTimeout
Default value: 2 minutes
Description: Specifies the timeout limit for any ADWS service-based query request. Set this parameter to a higher value if you expect your query to return an exceptionally large results set that might take longer than 2 minutes to retrieve.

Recommendations:
- Let ADWS run on all domain controllers.
- Don't edit the config file unless you really need to.
- Do remember that this config file is not replicated. You need to edit it on all domain controllers.

Down-level servers (Windows Server 2003 SP2, R2, 2008, 2008 SP2):
The Active Directory Management Gateway Service provides the same functionality as ADWS on 2008 R2. It is available as a download on the Microsoft web site.

Are there absolutely no differences between ADWS and AD Management Gateway Service?
Yes, there is one difference that you will see, the AD Management Gateway Service do not support instances of the AD Database Mounting Tool running on Windows Server 2008.

Authentication Mechanism Assurance

Many people ask me about this feature and how it works. Let me first give an example scenario:


Let's say you have a user named Mark, this user is a member of the department Section5. Section5 deals with classified development. In the classical Windows way, you would create a group, let's name it "S5-Classified" (stupid name but it is just an example) and add the users within the department Section5 to it.

Let's say you have a file server with a share with top secret material, and you want only the members of the group S5-Classified to have access to it. You obviously grant the S5-Classified group the needed access, right?

This is all good, except that you now want them only to be able to access the files when they logon with a certifiacate-based logon. I.e. they should not be able to access it without the smart-card.

So this is what it is all about, granting access based on the logon method. With certificate-based logon you will get a certain access, without a smart-card - you get less access.

What happens behind the GUI:
First, it is not enabled by default in Windows Server 2008 R2 and it requires DFL Windows Server 2008 R2. What happens when you enable it is that authentication mechanism assurance adds a universal group (which you as an admin designate) to the user's access token when the user logon with a certificate-based method.

So if access is granted based on the designated universal group, the user Mark have only access if using a certificate-based logon. If using another logon method the universal group will not be present in the access token, and thus no access.

Powershell script to put migrated users into a group

My friend Tony Murray has written a very good script that helps you keep track of migrated users that I wanted to share:

Note: I couldn't get the tabs in so it looks a little funny :(

-Script Begins-

#########################################################

#
# Name: SIDHistoryBasedGroupMembership.ps1
# Author: Tony Murray
# Version: 1.0
# Date: 11/07/2010
# Comment: PowerShell 2.0 script to
# populate group membership based on sIDHistory values
#
#########################################################


#Import the Active Directory Powershell Module
Import-Module ActiveDirectory -ErrorAction SilentlyContinue


#Create a new Event log source for the script (only needs to be run once)
New-EventLog -logName Application -Source "Legacy Users Group Management" `
-ErrorAction SilentlyContinue


$SearchBase = "OU=User Objects,DC=fabrikam,DC=local"
$OUArr = Get-ADUser -LDAPFilter "(samaccounttype=805306368)" `
-SearchBase $SearchBase -SearchScope SubTree


# Now we need the domain security identifier or at least a portion of it
$DomSID = "S-1-5-21-1584567894-2535104369-4141123456"


$Group = "Legacy Users"
$MbrArr = get-adgroupmember -identity $Group


# Loop through the Users found beneach the OU tree
# and check to see if the user is already
# a member of the group. If so, do nothing.
# If not, then add the user as a member.
Foreach ($User in $OUArr)
{
$object = [ADSI]"ldap://$User/"
$objectsidh = $object.sIDHistory.value
If (!$objectsidh)
{
# write-host "sIDHistory is blank"
}
Else
{
$objectsidh = $Object.getex(“sidhistory”)
trap
{
#write-host "Error: $_"
continue
}
foreach($sid in $objectSidh)
{
$sidh = new-object System.Security.Principal.SecurityIdentifier $sid,0
if ($sidh -Match $DomSID)
{
if ($MbrArr -Match $User.distinguishedName)
{
#The user is already member - do nothing
}
else
{
# We need to add the user as a member
write-eventlog -logname Application `
-source "Legacy Users Group Management" `
-eventID 3001 -entrytype Information -message "$User added to $Group"
Add-ADGroupMember -Identity $Group -Members $User
}
}
else
{
# No match with sidHistory - do nothing
}
}
}
}
 
-Script Ends-

TechEd sessions

If you couldn't attend, you will find the sessions here: http://www.msteched.com/

Tired

And people say I look funny when I'm tired and sleep with the laptop on my knees.....

New member in the Andersson family

Yep, there is a new member in our family. A very charming Boarder Collie that is 8 weeks and 4 days. She will most certainly make me leave the computer once in a while :)

Windows Summit 2010

Attend Windows Summit 2010: May 25–27

This is a special opportunity to learn—straight from the Windows team—how you can best use Windows 7 and Internet Explorer to enable great solutions for your customers. This three day event takes place at the Microsoft Conference Center on Microsoft's campus in Redmond, WA and is designed for people who engineer and test Windows 7 PCs, devices, and software. Take advantage of this uniquely intimate event on the Microsoft campus to network with Microsoft technical experts and leaders at breakout sessions, chalk talks, and an Ask the Experts evening and social event.

More info here.

TechDays

I will speak on TechDays this year together with my colleague Fredrik Pålerud (scroll down and you'll see him). If you want to know what it is, see this. TechDays is a Microsoft Sweden event and is held once per year. This year it is fully booked already so I'm looking forward to it!

Crayon also have a booth that we will spend as much time as possible in, please come and join us! And despite what the Crayon website says - we do have some seriously good consultants (they just haven't updated it with the consultant department yet....).

Install DFS Management Console - when you can't use the mouse

ServerManagerCmd -install RSAT-DFS-Mgmt-Con

Installing DFS replication - when you can't use the mouse

If you want to install DFS replication on web edition or server core. You need to do it from a command prompt:

OCSetup DFSR-Infrastructure-ServerEdition


or:
 
ServerManagerCmd -install FS-DFS-Replication

Protect "old" OUs from accidental deletion

In Win 2K8 and newer. There is a a check-box you can set to protect an OU from accidental deletion. This is good, but if you don't use ADUC in Win 2K8 (or R2) it will not be set by default. Also if you upgraded or migrated to a Win 2K8 (or R2) it won't be set automagically on "old" objects. So here is two ways of doing it.

for /f "tokens=*" %i in ('dsquery ou -limit 0') do dsacls %i /d everyone:SDDT

or:

Get-ADOrganizationalUnit -filter * |

Set-ADOrganizationalUnit -ProtectedFromAccidentalDeletion $true
 
(the above should be one line)
 
Thank you Ulf for posting these two one-liners!

Defining a new attribute - version 2

My colleague, Fredrik Pålerud, just saw what I blogged and he has another recommendation. Use Active Roles and you don't have to touch the actual Schema. Wanna lear more.... Click here.

Defining a new attribute

I just stumbled over a pretty good article. It describes how to define a new attribute when you extend the Schema. Take a look at it if you haven't memorized it yet....

Outlook signature based on user info from AD

My colleague from Crayon Norway, Jan Egil Ring, have written a cool Powershell script that creates an Outlook signature based on information from AD. Take a look at it, it is posted here. 

Enable Recycle Bin - with Powershell

This is the Powershell way to enable Recycle Bin in a domain called DEMO.PRV:

Enable-ADOptionalFeature –Identity ‘CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=demo,DC=prv’ –Scope ForestOrConfigurationSet –Target ‘demo.prv’

Enable Recycle Bin - but not with Powershell

A question from yesterday: "Must I use Powershell to enable Recycle Bin in AD?"
The answer is: No.

You can also use LDP to do it. What you need to know is the GUID of the Recycle Bin and where to add it.

To find the GUID you need to browse to:
CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=domainName,DC=xxx

And look at the msDS-OptionalFeatureGUID value (which is 766ddcd8-acd0-445e-f3b9-a7f9b6744f2a).

Then you need to modify the CN=Partitions,CN=Configuration, DC=domainName,DC=xxx container:
1. Right-click it and select: "Modify"
2. Delete everything in the "DN:" box, it MUST be empty!
3. In the "Edit Entry Attribute:" box type: enableOptionalFeature
4. In the "Values" box type: CN=Partitions,CN=Configuration, DC=domainName,DC=xxx:766ddcd8-acd0-445e-f3b9-a7f9b6744f2a
5. In "Operation" you select "Add" click "Enter" and last you click "Run"

You have now enabled the Recycle Bin feature in AD!

Note - this is a Windows 2008 R2 feature so it won't work on legacy OS. You must also replace domainName and xxx with whatever your environment is called.

Canonical Names of Control Panel Items

As a follow-up on the other post. Wolf sent a link with more info:

http://msdn.microsoft.com/en-us/library/ee330741(VS.85).aspx

Windows 7 God Mode

My good friend Wolfgang Schedlbauer sent me a mail today. The subject was "GodMode in Windows 7". So that got my attention and I needed to try it. It is cool! If you want to know what it is and try it (below text copy/pasted from his mail):


What is God Mode? This is a secret Windows 7 Feature (If you can call so!!), which provides you an extended control panel to control your machine.


Here are the Steps to invoke the God Mode:

Create a new folder (right-click and click on “New Folder”). Right-click on the folder and click on rename, copy and paste this: GodMode.{ED7BA470-8E54-465E-825C-99712043E01C}

This folder will now be a shortcut to the Windows 7 God Mode. The GodMode allows you to quickly access many Windows 7 functions via a GUI.

New job!

1 minute ago, I signed the employment contract for Crayon (http://www.crayon.no/, http://www.crayon.se/). I will start the first of January as Crayon Sweden's Chief Architect for Microsoft technology.

So if you want me as a consultant, you contact Crayon.

Restore of an object or subtree

I've been asked several times how to get an object or subtree of objects back if an accidental deletion happened and you have one DC that still have the objects. In other words mark these objects as authoritative so they replicate back to the DCs that have them deleted. This is usual in a lag site scenario, or if you are lucky to find a DC that haven't already delete the object(s).

So here is a step-by-step on Windows 2008, note that this is not applicable for versions lower than 2008.


1. Stop relication on a DC that have the object(s) with repadmin. I usually stop both inbound and outbound to be safe:
- Repadmin /options +disable_inbound_repl
- Repadmin /options +disable_outbound_repl

2. Stop AD Service. This will also stop the following services:
- File Replication
- Kerberos Key Distribution Center
- Intersite Messaging
- DNS Server
- DFS Replication

3. Set instance:
- Ntdsutil
- Activate instance NTDS

4. Authoritative Restore (while in ntdsutil):
- Authoritative restore
- Restore subtree ou=dr-test,dc=qadvice,dc=prv

Example screenshot:
authoritative restore: restore subtree ou=dr-test,dc=qadvice,dc=prv
Opening DIT database... Done.

The current time is 11-20-09 12:35.45.
Most recent database update occured at 11-20-09 12:32.09.
Increasing attribute version numbers by 100000.
Counting records that need updating...
Records found: 0000001001
Done.

Found 1001 records to update.
Updating records...
Records remaining: 0000000000
Done.

Successfully updated 1001 records.
The following text file with a list of authoritatively restored objects has been created in the current working directory:
ar_20091120-123545_objects.txt
None of the specified objects have back-links in this domain. No link restore file has been created.
Authoritative Restore completed successfully.

5. Start AD and related services (if they don't start automatically)

6. Enable replication on the DC:
- Repadmin /options -disable_inbound_repl
- Repadmin /options -disable_outbound_repl

MVP Award. I received this in my mail Oct 1st:

"Dear Jimmy Andersson,Congratulations!

We are pleased to present you with the 2009 Microsoft® MVP Award! This award is given to exceptional technical community leaders who actively share their high quality, real world expertise with others. We appreciate your outstanding contributions in Directory Services technical communities during the past year."

I'm very glad and proud of it. This is the 11th year in a row!

TEC Europe

I just decided to attend TEC Europe in September. It will be held in Berlin at the Hilton, September 14-16.
Hope to see you there!

Warning: The software you are installing does not match your mental model

I just read this on Jesper's blog. It is funny :)

Recommended settings for event log sizes in Windows Server 2003 and in Windows Server 2008

http://support.microsoft.com/kb/957662

Sooz arrived

Sooz arrived, picked her up at the airport. And guess what..... Yes, she arrives without the bag, it is still in Copenhagen and we hope it will arrive sometime soon. Tomorrow we're going on a road trip to Sundsvall so I really hope she gets her bag tonight....

Find account based on a given SID

Here is some code that will find the account based on a given SID:

-Script Begins-
'============================================================
' NAME: find-Account.vbs
' AUTHOR: Jimmy Andersson, Q Advice AB
' DATE: 21/04/2009
' Version: 1.0 - initial version
' USAGE: cscript find-Account.vbs
'============================================================
Option Explicit

'============================================================
'==== Declare variables and sets objWMIService
'============================================================
Dim strComputer, objWMIService, objAccount
strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

'===========================================================
'==== Below code finds the account based on a given
'==== SID (both local and domain accounts)
'===========================================================
Set objAccount = objWMIService.Get _
("Win32_SID.SID='S-1-5-21-842925246-725345543-682003330-4474'")
wScript.Echo objAccount.ReferencedDomainName &_
"\" & objAccount.AccountName
-Script Ends-

A way of finding the local admin account by searching SIDs

Let's say you don't know the account name for the local admin account. The below code will find it for you. This is really good to have if a customer used the "oh-not-so-good-way-to-apply-security" approach.
I actually had a customer (before I came along and changed it) randomize the renaming of the local admin on their workstations....
Do I need to say that they didn't have a log. And even more "strange" is that they actually created 20+ local accounts just to confuse a potential bad guy.....
I will not start to rant about what I think of this approach. Never the less I had to find all the local admin accounts on their workstations. So I wrote some code that I fired off remotely and logged the information in a secure place. The basis of that code is below:
(as usual wrapping might be an issue)

-Script Begins-
'============================================================
' NAME: find-AdminName.vbs
' AUTHOR: Jimmy Andersson, Q Advice AB
' DATE: 21/04/2009
' Version: 1.0 - initial version
' USAGE: cscript find-AdminName.vbs
'============================================================
Option Explicit

'============================================================
'==== Declare variables and sets objWMIService
'============================================================
Dim strComputer, objWMIService, objAccount, colAccounts
strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

'===========================================================
'==== Below code finds the local ADMINISTRATOR account
'==== by searching the SIDs of local accounts
'===========================================================
Set colAccounts = objWMIService.ExecQuery _
("Select * From Win32_UserAccount Where LocalAccount = TRUE")
For Each objAccount in colAccountsIf Left (objAccount.SID, 6) = "S-1-5-" and Right(objAccount.SID, 4) = "-500" Then
Call getInfo
End If
Next

'===========================================================
'==== Function to get properties
'===========================================================
Function getInfo
wScript.Echo "Name: " & objAccount.Name
wScript.Echo "SID: " & objAccount.SID
wScript.Echo "Description: " & objAccount.Description
wScript.Echo "Disabled: " & objAccount.Disabled
wScript.Echo "Pwd Expires: " & objAccount.PasswordExpires
wScript.Echo "Pwd Required: " & objAccount.PasswordRequired
wScript.Echo "Pwd Changeable: " & objAccount.PasswordChangeable
End Function
-Script Ends-

How to get the SID of an account

Someone asked me how to write a script that will show you the SID and some other "stuff" of a specified username. So here it is, really simple and fast to do. The below will show you:
- name (which you need to know in advance)
- SID
- Description
- If it is disabled or not
- If the password expires
- If a password is required
- If the password can be changed.

-Script Begins-
'============================================================
' NAME: findSID-Name.vbs
' AUTHOR: Jimmy Andersson, Q Advice AB
' DATE: 21/04/2009
' Version: 1.0 - initial version
' USAGE: cscript findSID-Name.vbs
'============================================================
Option Explicit

'============================================================
'==== Declare variables and sets objWMIService
'============================================================
Dim strComputer, objWMIService, objAccount
strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

'============================================================
'==== Below code gets the SID of a specified account.
'==== NOTE: If you specify a domain name instead of a computer name you'll
'==== get the SID of a domain account. E.g. name='admin',domain='root' '================'===========================================
Set objAccount =_
objWMIService.Get("Win32_UserAccount.Name='x-admin',Domain='client001'")
Call getInfo

'===========================================================
'==== Function to get properties
'===========================================================
Function getInfo
wScript.Echo "Name: " & objAccount.Name
wScript.Echo "SID: " & objAccount.SID
wScript.Echo "Description: " & objAccount.Description
wScript.Echo "Disabled: " & objAccount.Disabled
wScript.Echo "Pwd Expires: " & objAccount.PasswordExpires
wScript.Echo "Pwd Required: " & objAccount.PasswordRequired
wScript.Echo "Pwd Changeable: " & objAccount.PasswordChangeable
End Function
-Script Ends-

How to show color indices in Excel with VBScript

Ok, someone asked me how to find out the color indices in Excel via Script. So here it goes:

(as always, formatting and word wrap might not work.....And you need Excel installed on the machine where the code executes of course)

-Script Begins-

Set objExcel = CreateObject("Excel.Application")
objExcel.Visible = TrueSet
objWorkbook = objExcel.Workbooks.Add()
Set objWorksheet = objWorkbook.Worksheets(1)

For i = 1 to 14
objExcel.Cells(i, 1).Value = i
objExcel.Cells(i, 2).Interior.ColorIndex = i
Next

For i = 15 to 28
objExcel.Cells(i - 14, 3).Value = i
objExcel.Cells(i - 14, 4).Interior.ColorIndex = i
Next

For i = 29 to 42
objExcel.Cells(i - 28, 5).Value = i
objExcel.Cells(i - 28, 6).Interior.ColorIndex = i
Next

For i = 43 to 56
objExcel.Cells(i - 42, 7).Value = i
objExcel.Cells(i - 42, 8).Interior.ColorIndex = i
Next

-Script Ends-

Back from Philly

Came back from Philly and I must say that I had a great time!
It was really nice to meet Laura and Mark again. Their new place is really nice and have everything you need. Including a very nice pub (Charlie's) just around the corner!

All in all - time well spent, good food, good drinks! Hopefully I'll see them again in December in New York!

Now I'm getting ready for Sooze to come visit us tomorrow. That will also be loads of fun, travelling around Sweden and then Germany. Hopefully we have the time to stop by Zürich as well....

Ok, carry on! :)

"I want to look after old people"

Nick, you are old. Get over it :)

For you that don't know us, Nick is my mate and I can take the Mickey out of him if I want!

Philly

Ok, arrived in Philly. Mark picked me up at the airport but not my bag... Read Mark's blog for details. Anyway, I'm here and we're having fun!

As always, good food an wine is a given!

Getting quick info from systems

One thing that is pretty common when you get to a new customer is that they usually have no clue what systems they actually have on their network.
In most cases not all servers are members of AD so that is the reason I use an input list instead of getting all the computer objects from AD and then filter on OS, or specify a "top" OU and then search all computer objects from that OU and then all sub-OUs. This can of course be easily changed in the below script to do just that if you want, I might even post how to do it later... :)

The second thing is that when I wrote this, I actually just needed the info to be showed on the screen. Which is why I didn't created an output file and saved it directly to it (here I just pipe it). I will post a function how to create an output file later and the below script can easily be changed for this as well.


Do note that I couldn't get proper formatting (especially TAB) in this post so the script might look a bit strange. Also note that line breaks are not always correct, so test it first in your lab! I take NO responsibility for the script and it is your responsibility to test it in a lab environment!

-Script Begins-
'============================================================
' NAME: quickInfo.vbs
' AUTHOR: Jimmy Andersson, Q Advice AB
' DATE: 1/12/2008
' Version: 1.0 - initial version
'
' COMMENT: Used to find out settings remotely.
' You need to pipe the output to a text file (see below usage example) that you can
' open in Excel. It will be delimited with semicolons.
' It will do a ping test before trying to connect' to the remote machine.
'
' USAGE: cscript quickInfo.vbs > output.txt
'
' NOTE: If you don't have access it will just move on ' to the next one in the list.
'
'============================================================
On Error Resume Next

'============================================================
'====== Header ===============================================
'============================================================
wScript.Echo "Hostname;Manufacturer;Model;OS;Build;SP;Installed;Last Reboot;Distributed;NIC;MAC;DHCP Enabled;DHCP Server;IP;Subnet;Default Gateway;WINS1; WINS2;DNS"

'============================================================
'====== Specify input file and open it ===============================
'============================================================
' Input file with the server names
strFilename = "C:\_scripts\servers.txt"

Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objTS = objFSO.OpenTextFile(strFilename)

Do Until objTS.AtEndOfStream

strComputer = objTS.ReadLine
DoObject strComputer

Loop

objTS.Close

'============================================================
'====== Sub that collects data ====================================
'============================================================
Sub DoObject(strComputer)

strPingStatus = PingStatus(strComputer)

If strPingStatus = "Success" Then
Set objWMI = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colOS = objWMI.ExecQuery("SELECT * FROM Win32_OperatingSystem")

For Each objOS In colOS
Set colHW = objWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem",,48)

For Each hwItem in colHW
strHW = hwItem.Manufacturer
strModel = hwItem.Model

Set colItem = objWMI.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled = TRUE",,48)

For Each objItem In colItem

strInfo = objOS.CSName & ";" & strHW & ";" & strModel & ";" & objOS.Caption &_
";" & objOS.BuildNumber & ";" & objOS.CSDVersion & ";" & objOS.InstallDate &_
";" & objOS.LastBootUpTime & ";" & objOS.Distributed & ";" &_
objItem.Caption & ";" & objItem.MACAddress & ";" & objItem.DHCPEnabled &_
";" & objItem.DHCPServer & ";" & Join(objItem.IPAddress, ",") & ";" &_
Join(objItem.IPSubnet, ",") & ";" & Join(objItem.DefaultIPGateway, ",") & ";" &_
objItem.WINSPrimaryServer & ";" & objItem.WINSSecondaryServer & ";" &_
Join(objItem.DNSServerSearchOrder, ",")

wScript.Echo strInfo
Next
Next
Next

Else
wScript.Echo strComputer & ";" & "Didn't answer ping"
End If
End Sub

'============================================================
'====== Function for w32_PingStatus WMI class =======================
'============================================================
Function PingStatus(strComputer)
On Error Resume Next

' Uses the local machine as the system to ping from
strWorkstation = "."

Set objWMIService = GetObject("winmgmts:" _& "{impersonationLevel=impersonate}!\\" & strWorkstation & "\root\cimv2")Set colPings = objWMIService.ExecQuery _
("SELECT * FROM Win32_PingStatus WHERE Address = '" & strComputer & "'")

For Each objPing in colPings ' Return codes
Select Case objPing.StatusCode

Case 0 PingStatus = "Success"
Case 11001 PingStatus = "Status code 11001 - Buffer Too Small"
Case 11002 PingStatus = "Status code 11002 - Destination Net Unreachable"
Case 11003 PingStatus = "Status code 11003 - Destination Host Unreachable"
Case 11004 PingStatus = "Status code 11004 - Destination Protocol Unreachable"
Case 11005 PingStatus = "Status code 11005 - Destination Port Unreachable"
Case 11006 PingStatus = "Status code 11006 - No Resources"
Case 11007 PingStatus = "Status code 11007 - Bad Option"
Case 11008 PingStatus = "Status code 11008 - Hardware Error"
Case 11009 PingStatus = "Status code 11009 - Packet Too Big"
Case 11010 PingStatus = "Status code 11010 - Request Timed Out"
Case 11011 PingStatus = "Status code 11011 - Bad Request"
Case 11012 PingStatus = "Status code 11012 - Bad Route"
Case 11013 PingStatus = "Status code 11013 - TimeToLive Expired Transit"
Case 11014 PingStatus = "Status code 11014 - TimeToLive Expired Reassembly"
Case 11015 PingStatus = "Status code 11015 - Parameter Problem"
Case 11016 PingStatus = "Status code 11016 - Source Quench"
Case 11017 PingStatus = "Status code 11017 - Option Too Big"
Case 11018 PingStatus = "Status code 11018 - Bad Destination"
Case 11032 PingStatus = "Status code 11032 - Negotiating IPSEC"
Case 11050 PingStatus = "Status code 11050 - General Failure"
Case Else PingStatus = "Status code " & objPing.StatusCode & _
" - Unable to determine cause of failure."
End Select
Next
End Function

-Script Ends-

Philadelphia

Tomorrow morning I'm off to Philly! :)

Going to spend some time with the old boy Mark for a few days. After his move to the States it's not that often we have the chance to meet up and hang out. But this week it all worked out!

I expect only three things:
- Good wine
- Good food
- Fun!

If you know us, you know how to get in touch if you're in town.

Change DNS on multiple computers

Ok, here is the background. We needed to get rid of some old hardware and replace them with new kit. These servers was DC/DNS and unfortunately we couldn't re-use the IP addresses which meant that all the DNS settings on the servers (the clients used DHCP) needed to get updated.

My client at the time was planning to do this manually, which was not smart at all. Even though their server park was only about 900 servers. So what to do? Obviously scripting was the answer so I put this little script together for them.

Do note that I couldn't get proper formatting (especially TAB) in this post so the script might look a bit strange. Also note that line breaks are not always correct, so test it first in your lab! I take NO responsibility for the script and it is your responsibility to test it in a lab environment!

-Script Begins-
'============================================================
' NAME: replaceDNS_Server.vbs
'
' AUTHOR: Jimmy Andersson, Q Advice AB
' DATE: 19/11/2008
' Version: 1.0 - initial version
'
' COMMENT: Used to replace an IP entry for the DNS settings with a new IP. It will
' do a ping test before trying to connect to the remote machine. Do note that it
' ONLY replaces the IP if it is found, if it can't find the IP nothing will happen
' and it will also return the name of the machine it didn't find it on. If a NIC is
' DHCP ENABLED it will not change anything on that particular NIC.
'
' USAGE: cscript ReplaceDNS_Server.vbs
'
' NOTE: If you don't have access it will just move on to the next one in the list.
' If you want to save the output' pipe it to a text file.
' Example: cscript ReplaceDNS_Server.vbs > output.txt
'============================================================
On Error Resume Next

'============================================================
'====== Specify input file and open it - One computer name per row ========
'============================================================
strFilename = "C:\serverNames.txt"

Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objTS = objFSO.OpenTextFile(strFilename)

Do Until objTS.AtEndOfStream
strComputer = objTS.ReadLine
DoObject strComputer
Loop
objTS.Close

'============================================================
'====== Sub to replace a DNS entry ================================
'============================================================
Sub DoObject(strComputer)

strOldDNSServer = "10.80.255.122" ' Specify which DNS IP that should be replaced
strNewDNSServer = "10.80.255.206" ' Specify the new DNS IP

' Run ping test before starting to run WMI queries
strPingStatus = PingStatus(strComputer)
If strPingStatus = "Success" Then ' See return codes in the Function

Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

' Only do changes if IP is enabled and DHCP is not used
Set colNicConfigs = objWMIService.ExecQuery _
("SELECT * FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled = TRUE AND DHCPEnabled = FALSE")

For Each objNicConfig In colNicConfigs
wScript.Echo VbCrLf & "Computer: " & strComputer
wScript.Echo VbCrLf & " Network Adapter " & objNicConfig.Index
arrDNSServerSearchOrder = objNicConfig.DNSServerSearchOrder

wScript.Echo " DNS Server Search Order - Before:"
If Not IsNull(objNicConfig.DNSServerSearchOrder) Then
For Each strDNSServer In objNicConfig.DNSServerSearchOrder
wScript.Echo " " & strDNSServer
Next
End If

blnFound = 0
For i = 0 to UBound(arrDNSServerSearchOrder)
If arrDNSServerSearchOrder(i) = strOldDNSServer Then
arrDNSServerSearchOrder(i) = strNewDNSServer
blnFound = 1
End If
Next

If blnFound Then
retSetDNS = objNicConfig.SetDNSServerSearchOrder(arrDNSServerSearchOrder)
If retSetDNS = 0 Then
wScript.Echo " Replaced " & strOldDNSServer & " with " & _
strNewDNSServer & " in DNS search order."

Else
wScript.Echo " Unable to change DNS server search order."
End If

Else
WScript.Echo " DNS server " & strOldDNSServer & " not found."
End If
Next

Set colNicConfigs = objWMIService.ExecQuery _
("SELECT * FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled = TRUE")
For Each objNicConfig In colNicConfigs
wScript.Echo VbCrLf & "Computer: " & strComputer & " -- " & "DHCP Enabled => NO changes done."
wScript.Echo VbCrLf & String(80, "-")
Next

Else
wScript.Echo VBCrLf & "Computer: " & strComputer & " -- " & "Didn't answer ping => NO changes done."

' Return which machines that didn't answered on ping
wScript.Echo VbCrLf & String(80, "-")
End If

End Sub

'============================================================
'====== Function for w32_PingStatus WMI class =======================
'============================================================
Function PingStatus(strComputer)
On Error Resume Next

' Uses the local machine as the system to ping from
strWorkstation = "."


Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strWorkstation & "\root\cimv2")

Set colPings = objWMIService.ExecQuery _
("SELECT * FROM Win32_PingStatus WHERE Address = '" & strComputer & "'")


For Each objPing in colPings ' Return codes
Select Case objPing.StatusCode

Case 0 PingStatus = "Success"
Case 11001 PingStatus = "Status code 11001 - Buffer Too Small"
Case 11002 PingStatus = "Status code 11002 - Destination Net Unreachable"
Case 11003 PingStatus = "Status code 11003 - Destination Host Unreachable"
Case 11004 PingStatus = "Status code 11004 - Destination Protocol Unreachable"
Case 11005 PingStatus = "Status code 11005 - Destination Port Unreachable"
Case 11006 PingStatus = "Status code 11006 - No Resources"
Case 11007 PingStatus = "Status code 11007 - Bad Option"
Case 11008 PingStatus = "Status code 11008 - Hardware Error"
Case 11009 PingStatus = "Status code 11009 - Packet Too Big"
Case 11010 PingStatus = "Status code 11010 - Request Timed Out"
Case 11011 PingStatus = "Status code 11011 - Bad Request"
Case 11012 PingStatus = "Status code 11012 - Bad Route"
Case 11013 PingStatus = "Status code 11013 - TimeToLive Expired Transit"
Case 11014 PingStatus = "Status code 11014 - TimeToLive Expired Reassembly"
Case 11015 PingStatus = "Status code 11015 - Parameter Problem"
Case 11016 PingStatus = "Status code 11016 - Source Quench"
Case 11017 PingStatus = "Status code 11017 - Option Too Big"
Case 11018 PingStatus = "Status code 11018 - Bad Destination"
Case 11032 PingStatus = "Status code 11032 - Negotiating IPSEC"
Case 11050 PingStatus = "Status code 11050 - General Failure"
Case Else PingStatus = "Status code " & objPing.StatusCode & _
" - Unable to determine cause of failure."
End Select
Next

End Function

-Script Ends-

MVP Award

Yes, I got awarded for the 10th time this year. So I'm still a DS MVP :)

Again, I'm too lazy...

Ok, so what has been going on since the last post... Well, the project is going forward. Too much stuff going on at the same time since my team are migrating in all continents at the same time - a lot of coordination is going on! From management side the schedule shifts on a daily basis which makes it really hard to plan accordingly - but that's the way it is as everybody knows.

Besides that one of my best friends got married in May - Awesome wedding! They will be the host and hostess on my wedding. Oh! I might not have told you.... Yes, I'm getting married Aug 16th. And I'm looking forward to it!

Ok, I have to be honest - we have a wedding sharepoint site (thank you Thomas Bittner and Daniel Wessels!) and I have a MS project plan as well.... Jesper said: "you're such a geek! A Sharepoint site for your wedding!" (don't remember the exact words, but that was the gist of it). Well, what can I say - I'm a geek! As most people know already!

Some tech stuff - are 3rd party software really ready for a Server Core? It is an open question - and my experience is - not yet. Which will open the discussion about why... Correct? The reason why is because most of the companies still install antivirus on their domain controllers and the install package require a GUI, which means it is a big no-no. The same goes for printer installations (well, many cases). This will open up a sub-question, do you really need AV on your domain controllers? My answer is: depending on your security and network design - I know it is an open answer. But think about it and post a comment! :)

Long time since last post

Ok, I know there has been a long time since I blogged.... A lot have happened so let me summarise.

- My mate Mark Arnold have married Laura Hunter. And I was the bestman, well I tried at least... Since I couldn't attend the tour of Philly our mates bought a doll as my stand-in which now have its own blog! :)

- The Windows Server 2008 Security Resource Kit is released, I wrote a chapter in it.

- I've been to Redmond/Seattle to attend the MVP summit.

- Our wedding site is up :) Yes, I'm getting married in August!!!

Windows Server 2008 Schema

I just finished documenting the default Schema for Windows Server 2008. Let me know if you want a copy of it.

MVP Award

It was some time ago since my last post. I'm currently very busy doing domain migrations in a project for HP so I don't have much time to blog.
But one update is that I received the MVP Award for Directory Services again, this is my ninth year in a row... Which means I must get a life :)

Secure Public Relations Excuse Bingo

Wanna play security excuse bingo for management? If so, click here

Group Policy failure

Troubleshooting steps for GPOs when it fail for one user, not the best solution though... But I heard that it is not uncommon to have this situation and Jesper blogged it all, so if you're interested in our steps to try to find a solution, click here.

Windows Vista Security

Hi, Jesper have once again written an excellent article about ACLs, if you're interested, click here. It is from the book Windows Vista Security written by Jesper M. Johansson and Roger A. Grimes.

Staging folders

Do not mix staging folders and prestaging. They are completely different things!

I got the below from my friend Thomas Bittner, it was written by his team for the APS (All Purpose Server) guide.

Staging folders are used to isolate the files from the changes on the file system, and amortize the cost of compression and computing RDC hashes across multiple partners.
Here is some background on current staging space management. There are three values that are important to staging space management.

· Staging size in MB (configured per-replicated folder in AD)
· Staging low watermark percentage (configured per-server via WMI, applies to all replicated folders on the server)
· Staging high watermark percentage (configured per-server via WMI, applies to all replicated folders on the server)

DFS Replication will do roughly the following when trying to stage a file:
· Request a reservation for staging space for the file based on an estimate of the file size.
· If the currently used staging space is less than the configured staging size, the file is allowed to stage regardless of the reservation amount. This allows large files to replicate and not get stuck with the familiar “huge file” replication blocker on FRS. The reservation amount is accounted for in the used staging space.
· After staging completes, DFS Replication fixes up the reservation amount by using the actual used amount. Note that due to compression, there could been different file sizes.
· If the used staging space is higher than the high watermark, staging space cleanup is triggered. Staging space cleanup will clean up until it hits the low watermark or there are no more files that are candidates for cleanup i.e., all files in staging are actively being used. Note that the cleanup is on a per replicated folder scope.

There are several factors that affect the size of staging. Without going into theories, here are some rules of thumb:
· It is desirable to set the staging folder to be as large as possible (as available space) and comparable to the size of the replicated folder. Hence if the size of the replicated folder is 24.5 GB, then ideally a staging folder of comparable size is desirable. Note that this amortizes the cost of staging and hash calculation over all connections. It is also a best practice to locate the staging folder on a different spindle to prevent disk contention.
· If staging cannot be set comparable to the size of the replicated folder, then reduce the size by 20%. Depending on how well the data compresses, staging files will be 30-50% of the original file size.
· Note that the mentioned two recommendations are particularly important if all the data is preexisting and DFS Replication must process all content at the same time during initial replication. On the other hand, if the replicated folder is relatively empty and gradually grows over time, the recommendation is to determine the projected size of the replicated folder and size the staging appropriately.
· If the size of the staging folder cannot be set proportional to the size of the replicated folder, then increase the size of the staging folder to be equal to the five largest files in the replicated folder.

Prestage DFS-R

A lot of people are wondering how to prestage DFS-R, so here are the steps:

Make sure that the primary member has the latest version of each file. This is done during configuration of replication because it will be seen as authoritative during first replication. This is similar as doing a D2/D4 restore of a broken sysvol.

During first replication these things will happen:

[P1 = Primary]
[M1 = Member]

Scenario 1:
File1 exists on both P1 and M1 and are identical = File is not replicated, but metadata is to update the replication DB on M1.

Scenario 2:
File2 exists on both P1 and M1, but is newer on P1 = File2 will be replicated, and the file on M1 will be treated as a conflict and moved to a special folder called something like "conflict or deleted"

Scenario 3:
File3 does not exist on P1, but gets created on M1 during first replication = File3 will replicate to P1.

Scenario 4:
File4 exist on both P1 and M1, but gets deleted during first replication = The deletion doesn't replicate.

Finally a new post!

I know it has been a long time since I blogged so don't start ;)

Have you ever installed a 64-bit OS for personal use? If not, think twice!
I just got my new Dell machine, dual-core 4GB RAM and all sorts of goodies (but NO fancy graphics card, it will only be used as a test machine for servers). Ok, I ordered it with XP 64-bit from Dell, but I forgot to order the darn wireless card. So I thought you could call Dell, tell them that you just ordered a new machine from them and give them the specs...
How stupid was I!!!! First they say that they have no wireless card that support 64-bit, so I told him there was an option during the "configure my computer" wizard that had an option for a wireless card. He says, NO we don't have any wireless cards that supports 64-bit.

Now I'm getting a bit worried, so I (during the time I was on the phone with him) ran through the wizard again and did some screen shots and sent them to him. He says that it is impossible, which forced me to ask him:
"So you have a NIC that customers can order with the wizard that will not work when the computer arrives?"

His answer:
"Yes, but people should know what they order"

Which I replied to:
"But I had to tell you what a 64-bit OS is! And you are selling these things!"

He replied:
"You need to call another NIC supplier."

So, I went to MS website and scrolled through the HCL for 64-bit XP, and guess what! There is a Dell card that will work! But unfortunately the Dell website actually lists 2 NICs with the same name and on the HCL the one that is NOT manufactured by Dell is the one that will work on 64-bit. (The name on Dell's website is 1450)

Conclusion:
You get the correct hardware from the HCL, the company that sells them have 2 NICs available with the same name and NO specs so you can't tell which one is supported or not!

Guess what, I will not order a Dell NIC, I will find another manufacturer on the HCL and order from them......


BTW - Next post will be DFSR in R2....

Ok, back to work now :)

Back from South Africa...

I'm back in Sweden, but in less than 6 hours it is take off heading to Brisbane, Australia. After a couple of days work I'm off again to Santiago, Chile for a couple of days and then I'm heading for London, UK.
So, what am I doing during these short stays you might wonder.... Well, in Johannesburg, South Africa we realized that we wasn't told the whole truth about the environment... Let's just say new forests and domains was discovered so we thought that it would be better if myself and Wolfgang, who is responsible for Exchange, would be the ones going to the major locations and do some discovery work, i.e. run our scripts to find out the details and the truth about the environment.

So what we will be doing the next 12 days is a trip around the world... And people were impressed by doing it in 80 days.... :)

Windows - the story

A friend of mine just sent me this link about the story behind Windows. I don't know if it is the absolute truth, but it sure is fun :)

...it has been a long time since I posted

Yes, I know I haven't been posting for a while. It's been crazy with all the travels and work, so I honestly just haven't had any time for it.

This morning I received an e-mail confirming a new contract, basically I will be travelling the next 18 month doing a massive forest/domain consolidation/migration. Hopefully I will have time to post some interesting things that will be discovered during this work and post it here. At this point I have no knowledge about exactly how big it is, but I do know we are talking about 100s of DCs... Which will be some good fun :)

At the moment my schedule looks like this:

- Feb 28 thru March 3 in Germany
- March 11 thru March 16 in Germany
- March 18 thru April 27 in South Africa

After that I will know more about what needs to be done and also the travel plans for the next few months...

...Oh if you are interested I will post a few "findings" I did when I had to do LCS troubleshooting which is very interesting/strange/goofy...

Advanced AD Troubleshooting and Theory

The dates for my course are now available at Cornerstone's website. Contact Cornerstone if you want to attend.

Jesper's new blog

It is up, and you'll find it here.

Sad day for MS/Good day for Jesper.

As you might know, Jesper M. Johansson is leaving Microsoft. He's a buddy and whatever makes him (and his family) happy makes me happy! Good luck with the new job!

As a MS employee he has been (to me):
- A good friend.
- Known as a "know-how" person.
- He's respected amongst his peers.
- His presentation skills are great (I wish I was half as good).

Future (knowing Jesper):
- A good friend.
- Known as a "know-how" person.
- He's respected amongst his peers.
- His presentation skills are great.
- Don't stop reading his blog! He will continue posting useful things.
- He will stay on top of his area.
- He will not leave the "security business"

When the new URL is known to his blog, I will post it.

lastLogonTimestamp

So yet another question about how to find out the last logon time for users.... Ok, here is how it works in Windows 2003.

One of the new attributes in Windows 2003 is lastLogonTimestamp which can be used to retrieve the last logon time for users, good so we have a new attribute to use! Sounds easy, right?

But this is not as trivial as you might think! The lastLogonTimestamp is not always showing the truth since it is only replicated every 14 days... Then take into account that when you read the value for the attribute it is stored as a 64-bit integer calculated from 1601 January 1st in 100-nano secs interval. (No, it was not MS fault. It was the darn Cobol programmers!!)

And another funny thing is that VBScript can't handle 64-bit integers!!!!! So you need to break it down into two 32-bit integers with IADsLargeInteger, which has two properties:

highpart = store the high 32-bits
lowpart = store the low 32-bits

…then you add them to get a single value.

So how would a script that does this look like you might wonder.

I will not just put the code here but rather I will walk you through how to “think” to solve it. (If you really need the code and don’t know how to write it, send me an e-mail).

1. Use “Get” to retrieve the attribute (lastLogonTimestamp)


2. Store the value in an IADsLargeInteger object


3. Combine the highpart and lowpart values into one value by taking the highpart * (2^32) and add the lowpart.

Ok, step 3 which is one line of code will give us the last logon for a user. But it will give us the time in a format of how many 100-nano secs intervals occurred since  Jan 1, 1601 and the user’s last logon.

The value might look like this: 2.5643571264596E+16

This, at least to me, looks kind of hard to read. And I bet the one asked for the report will not be happy if you give him/her this….. So now we need to do something about it, but first a little bit on nanosecs:

1 second = 1,000,000,000 nanosecs = 10,000,000 nanosec intervals per second (10,000,000 * 100 = 1,000,000,000). This means that there are 600,000,000 100-nano secs intervals per minute.

1. To find out how many minutes elapsed since Jan 1, 1601 and last logon we can take the last logon time and divide it by (60*10000000).


2. If we want to find out the number of days that have elapsed we dived the last logon time with 1440 (which is the number of minutes per 24 hrs).

The above steps (5 and 6) can be done in one step if you want…..

1. Now we know how many days elapsed since Jan 1, 1601 so we take that and add it to Jan 1, 1601 (“last logon time” + #1/1/1601#) and we get the result in an easy to read format!

But I assume it is W2K3 otherwise you need to use the lastLogon which is not replicated at all, which means you have to retrieve it from all DCs and then compare the values, sounds boring but can be solved with some code...

Rome

Yep, here once again with Carola, if we could give anyone advice for visiting Rome it would be:

• Stay at the Hilton Cavalieri.


• Go to the private club “Blue” by the sea (40 minutes by car from the hotel and the hotel will arrange a private driver)

Oh! And just to mention, we got engaged the 20th of June at Blue!

More details later!

Mark Arnold missed the plane

I’m not alone!!

My good friend Mark Arnold is visiting this weekend, he was supposed to fly in on Friday and land at 13.20... Guess what happens, he missed the plane… And no, he didn’t even try to get to the airport in time because he missed the date!! Yes, the man missed the plane by a day!!

BTW - if you have the chance to attend Exchange Forum in Sweden this week, check out Mark's presentation about Exchange 2007. I've had the luck to see the .ppts and it looks good, if Mark is speaking about Exchange I will listen.

Good cluster configuration...

I just remembered a conversation I had with a mate of mine, he stated that the only good cluster configuration is Inactive/Passive... Go figure.... :)

The fast recovery components

The fast recovery components

Creation of Shadow Copies
As I stated earlier, the process of creation initiates by the requestor (a backup program) contacting the Volume Shadow Copy Service (VSC service) to request a copy of the System State. The VSC service will act as a coordinator and notifies the System State writers to prepare for writing data for creation of a shadow copy.
Once the data is ready for the actual backup process each writer notifies the VSC service which then relays information to the backup requestor. Next step is that the requestor halts Active Directory I/O writes as long as it takes the provider to create single point-in-time copies of the three volumes. Usually this takes just a few seconds and should have no to little impact on Active Directory operations.

After the copy is made the VSC service will be instructed to break the connection with the original and the copy. At this point the shadow copy becomes read-only and the original will continue as usual (read/write). Now we are at the point where the shadow copy is no longer associated with a particular server and resides on the SAN until we need it.

Using EFS on virtual DCs

I just read this post about the possibility to use EFS to encrypt a DC that is running as a virtual machine. Sounds interesting, need to spend some time in the lab :)

When do you need to recover AD?

...hopefully never!
But just in case, I will describe something called Fast Recovery during the following days...

There are alternatives to tape backups such as lag sites, but I will not go into that but rather I will talk about how it is possible to use shadow copies instead. I find it interesting and in conjunction with tape backups it can be effective.

The reason way I found this interesting is because it is fast and use a mirroring process that doesn't affect the system performance much. So in order to understand this we need some information how the underlying services works. Not to get into bit-level discussion I will give an overview:

Volume Shadow Copy (I will call it VSC)
With VSC you can create point-in-time snapshots of a volume, the service itself coordinates with other applications like backup software for instance and storage hardware to enable app-aware data management and it also support backup of open files.

There are three components that are needed in order to make a full shadow copy:
1. Requestor, which is the utility that request the copy (or rather request for the creation)
2. Writer, this is the software (app-specific) that makes sure that the data is ready to be copied.
3. Provider, this component gives the functionality to make the copy. VSC can use 3rd party hardware provider if needed.

Virtual Disk Service (I will call it VDS)
To make it short, it provides volume management with a single Windows interface which is used to manage storage devices. It also provides APIs for ISVs and IHVs to create storage solutions. The service itself use two CLI utilities, Diskpart and Diskraid. The Diskpart command is used to control creation, deletion and extension of dynamic and basic disk partitions. Diskraid is used to configure hardware RAID, to be specific, it is used to create, extend, delete and unmask LUs (logical units) on SANs.

Well, it simply makes your VSC data available for use. It do this by unmasking the backups stored on SAN. This means that it makes them visible and change the status from read-only to read/write. It also mounts the volume on the server. The whole process is called transport and is a virtual process since the data is on the storage array.

That is all I have time for now, got to catch a flight. I will continue another day :)

Windows Server 2003 Disaster Recovery

As many of you already know, besides the project in Finland I also do a tour (ExpertZone) in Sweden. One of the sessions is about troubleshooting AD and I get a lot of questions about recovery and the different ways of doing it.

Most people tend to have similar questions so I will start a series of posts about this topic, so keep an eye on this blog if you're interested in disaster recovery :)

Securing Exchange 2003

A friend of mine that happens to be an Exchange MVP just told me the secret of securing Exchange. Do you want to know?

“Don’t break the seal!”
     - Mark Arnold, February 25, 2006

Mark as arrived...

Landed at Arlanda, went to the bar to get a beer while waiting for M. Arnold. Realized I had nothing to do! So, as the geek I am I pulled up my two laptops and started to work on my next presentation.

Mark finally calls and says that he’s waiting for his bag; I pack up my things and get to the luggage belt, surprise! No Mark, the bloody Englishman had wandered off so I go through the customs and see the cabbie with a big sign “M. Arnold” and there were only about 7 people outside but no Mark.
I call him and he’s nearby, mind that the cabbie is the first thing you see after customs, but NO Mark didn’t see him and walked passed him…

We’re off to a good start….. ;)

Advanced AD Troubleshooting and Theory

As I said in an earlier blog, my troubleshooting course is available at Cornerstone. I have changed the name to Advanced AD Troubleshooting and Theory. Please notice the course code T640 if you want to attend.

This weekend Mark is in Sweden!

This weekend Mark is coming to my place in Uppsala! Carola has planned his activities and I’m not sure what is going to happen other than I had to go get some good champagne and wine and book a table at Mancini. That was all she trusted me to do!
Well, to be honest she knows us far too well and she has seen us goofing around in Amsterdam and London with her own eyes already. But in our defense, in Amsterdam we had Gianluca, Olaf, Steve and Daniel (last name left out to save the innocent) in the same apartment and in London we spent the time (not the same apartment) with Nick, Oli and Steve… Yeah, if you know which ones I’m talking about you know how the rest went. ;)

Well, it is always good to have one of your best friends visiting and it will be fun and hopefully relaxed. As I said, I have only one plan and that is to take him to the best restaurant in Stockholm, after that Carola is in charge.

Ok, I know I haven't been updating...

Ok, I know it was month ago since I last updated this blog, to be honest I haven’t had much time. Since the last post I’ve worked about 17 hours on average almost 7 days a week and as many of you know, that never goes well since the Enterprise Admin in my house also want to spend time with me (still)…

What have I been up to you might ask, well first of all I’ve spent most of my time in Finland on a project for HP as a subcontractor. We are doing a company split and it is more work than I signed up for… But it is a challenge; sometimes fun and sometimes not. You all know how it is, some good and some bad as always in a project this size.

If that was not enough I also do a seminar series for Cornerstone called ExpertZone. This time the main theme is Active Directory & MIIS where I present two sessions, Active Directory Future and Active Directory Troubleshooting. First session is about the original idea with Active Directory and what lies ahead for the future (well, at least what I can say without breaking NDA) and the second one I don’t think I have to explain… ;)
We’ve been I Stockholm last week, next week is in Gothenburg and then I think we are going to Sundsvall…?

I just visit the website for Exchange Forum here in Sweden, I’m going to speak about how to use Monad to administrate Exchange 12, and realized a lot of my friends are also speaking there! I’m already looking forward to it!

Besides this I had 4 days where I was in Sandviken and trained their global Active Directory team in troubleshooting, obviously my own course tweaked to suit their needs. Sandvik is an interesting company with all the challenges you need as an Active Directory admin, it is kind of big and if memory serves they have a presence in 131 countries. They were a lot of fun and we had a good time, last day we did more like an Q&A with a lot of people outside their Active Directory team.

Well, now I’m back at Hilton in Helsinki sitting by the open fire in the bar and just relaxing…