New links page

activedir — Sat, 14 Jan 2006 00:58:17 +0000

I’ve now added a page which lists all of the links that I’ll be collecting relating to Active Directory.

You can find the page here: http://activedir.blogtown.co.nz/links/

Remotely reboot a server into DSRM

activedir — Wed, 11 Jan 2006 03:32:39 +0000

I thought I’d start off the blog with something that I learned recently that I will probably never use. However, it’s quite useful to know anyway and it highlights a couple of cool features that you may not have known about.

The scenario is that you have a remote domain controller that you need to take offline and reboot into Directory Services Restore Mode. There are a couple of ways to do this but I am going to look at the most interesting…

The first thing we need to do is access the remote server’s boot.ini file and add a new entry to boot into DSRM. The first way to do this would be to connect to the server through remote desktop or terminal services and edit the file in notepad, but that’s far too easy so we won’t worry about that. What we’ll use is a tool called bootcfg which is included in Windows XP or 2003. This little utility allows you to query and edit the boot.ini file on either the local machine or a remote machine. The syntax is:

C:\>bootcfg /?

BOOTCFG /parameter [arguments]

Description:
This command line tool can be used to configure, query, change or
delete the boot entry settings in the BOOT.INI file.

Parameter List:
/Copy Makes a copy of an existing boot entry [operating
systems] section for which you can add OS options to.

/Delete Deletes an existing boot entry in the [operating
systems] section of the BOOT.INI file. You must specify
the entry# to delete.

/Query Displays the current boot entries and their settings.

/Raw Allows the user to specify any switch options to be
added for a specified boot entry.

/Timeout Allows the user to change the Timeout value.

/Default Allows the user to change the Default boot entry.

/EMS Allows the user to configure the /redirect switch
for headless support for a boot entry.

/Debug Allows the user to specify the port and baudrate for
remote debugging for a specified boot entry.

/Addsw Allows the user to add predefined switches for
a specific boot entry.

/Rmsw Allows the user to remove predefined switches for a
specific boot entry.

/Dbg1394 Allows the user to configure 1394 port debugging
for a specified boot entry.

/? Displays this help/usage.

Examples:
BOOTCFG /Copy /?
BOOTCFG /Delete /?
BOOTCFG /Query /?
BOOTCFG /Raw /?
BOOTCFG /Timeout /?
BOOTCFG /EMS /?
BOOTCFG /Debug /?
BOOTCFG /Addsw /?
BOOTCFG /Rmsw /?
BOOTCFG /Dbg1394 /?
BOOTCFG /Default /?
BOOTCFG /?

The first option we’ll use is the query:

C:\>bootcfg /s dc-server /query

Boot Loader Settings
——————–
timeout:30
default:multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

Boot Entries
————
Boot entry ID: 1
OS Friendly Name: Windows Server 2003, Standard
Path: multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
OS Load Options: /fastdetect /NoExecute=OptOut

The results above are typical of a new Windows Server 2003 build with no special options.

The next thing we need to do is create a copy of the fist entry so that we can add the correct options to it. We do this by using the copy switch and reference id 1 which is the fist entry as follows:

C:\>bootcfg /s dc-server /copy /id 1 /d “Directory Services Restore Mode”
SUCCESS: Made a copy of the boot entry “1”.

Now when we run the query again, we can see that there are now two boot entries in the boot.ini file:

C:\>bootcfg /s dc-server /query

Boot Loader Settings
——————–
timeout:30
default:multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

Boot Entries
————
Boot entry ID: 1
OS Friendly Name: Windows Server 2003, Standard
Path: multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
OS Load Options: /fastdetect /NoExecute=OptOut

Boot entry ID: 2
OS Friendly Name: Directory Services Restore Mode
Path: multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
OS Load Options: /fastdetect /NoExecute=OptOut

The boot.ini file now looks like this:

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS=”Windows Server 2003, Standard” /fastdetect /NoExecute=OptOut
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS=”Directory Services Restore Mode” /fastdetect /NoExecute=OptOut

Now that we have the second boot entry we can add the option to boot into DSRM by using the “/SAFEBOOT:DSREPAIR” option by using the raw switch:

C:\>bootcfg /s dc-server /raw “/SAFEBOOT:DSREPAIR” /a /id 2
SUCCESS: Added the switch to OS entry for line “2” in the BOOT.INI file.

The query now shows this:

C:\>bootcfg /s dc-server /query

Boot Loader Settings
——————–
timeout:30
default:multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

Boot Entries
————
Boot entry ID: 1
OS Friendly Name: Windows Server 2003, Standard
Path: multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
OS Load Options: /fastdetect /NoExecute=OptOut

Boot entry ID: 2
OS Friendly Name: Directory Services Restore Mode
Path: multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
OS Load Options: /fastdetect /NoExecute=OptOut /safeboot:dsrepair

The only thing left to do now is to adjust the timeout period, otherwise you’ll end up with a 30 second delay each time the server reboots. You can set this to what you want, but I’ll set it to 5 seconds here:

C:\>bootcfg /s dc-server /timeout 5
SUCCESS: Changed the timeout value in the BOOT.INI.

Now we have the boot.ini file completely prepared for the next step. Here’s what the query looks like:

C:\>bootcfg /s dc-server /query

Boot Loader Settings
——————–
timeout:5
default:multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

Boot Entries
————
Boot entry ID: 1
OS Friendly Name: Windows Server 2003, Standard
Path: multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
OS Load Options: /fastdetect /NoExecute=OptOut

Boot entry ID: 2
OS Friendly Name: Directory Services Restore Mode
Path: multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
OS Load Options: /fastdetect /NoExecute=OptOut

And the boot.ini file looks like this:

[boot loader]
timeout=5
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS=”Windows Server 2003, Standard” /fastdetect /NoExecute=OptOut
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS=”Directory Services Restore Mode” /fastdetect /NoExecute=OptOut

So back to our scenario… the remote server needs to be rebooted into DSRM. Although we know that the boot.ini file has been edited correctly, we’ll still run the query (bootcfg /s main-vm-server /query) and we’ll make a note that the option we want is boot entry id 2. What we want to do is change the order of the boot sequence so that ID 2 is now ID 1 and the server will boot into DSRM. This is done like this:

C:\>bootcfg /s dc-server /default /id 2
SUCCESS: Changed the default OS entry in the BOOT.INI.

And the query shows that the two boot entrues have swapped positions:

C:\>bootcfg /s dc-server /query

Boot Loader Settings
——————–
timeout:5
default:multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

Boot Entries
————
Boot entry ID: 1
OS Friendly Name: Directory Services Restore Mode
Path: multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
OS Load Options: /fastdetect /NoExecute=OptOut

Boot entry ID: 2
OS Friendly Name: Windows Server 2003, Standard
Path: multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
OS Load Options: /fastdetect /NoExecute=OptOut

Now all we have to is reboot the server using the shutdown.exe command:

shutdown /m \\dc-server /r /t 10 /f

Note that I’m using the /r to reboot the server, the /t to give myself 10 seconds to change my mind (if I do change my mind about rebooting the server I can use the /a switch to abort the reboot), and the /f to force any applications to close that aren’t behaving properly. When the server reboots, it will wait 5 seconds and then continue booting into DSRM. You can now connect to the server through remote desktop and continue restoring Active Directory as needed (more about that in a later article…)

Obviously, you need to remember to change the boot order back to how it was when you’re done otherwise you’ll be scratching your head wondering why the server isn’t booting properly! On the local machine you can use bootcfg without the /s switch and it will work locally by default. You just need to use the /query option to check the boot order, then the /default option to swap the order.

Hope this helps and (as always) comments – good/bad/ugly – are welcomed!

[Tags]Active Directory,Microsoft,bootcfg[/tags]

Source

My new Active Directory blog

activedir — Tue, 10 Jan 2006 06:55:20 +0000

I’ve decided to start up a new [tag]blog[/tag] where I’ll write posts relating to [tag]Microsoft[/tag]’s [tag]Active Directory[/tag]. This will probably include some tips and tricks, problems that I’ve run into in the past, solutions to common problems, perhaps some scripts that I’ve written to help manage to Active Directory, and any interesting links that I feel are important to keep handy.

Hope you enjoy this blog – I’ll keep the comments open so feel free to post your thoughts and ideas and I’ll always aim to respond as soon as I can.

Source

Active Directory Blog

New links page

Remotely reboot a server into DSRM

My new Active Directory blog