Admins Experience

Useful commands

2012-11-23T00:38:00.002-08:00

Useful commands

How many users are logged on/connected to a server?

Sometimes we may need to know how many users are logged on to a (file) server, like maybe when there is a performance degradation.
At the server's console itself, with native commands only:

NET SESSION | FIND /C "\\"

Remotely, with the help of SysInternals' PSTools:

PSEXEC \\servername NET SESSION | FIND /C "\\"

By replacing FIND /C "\\" by FIND "\\" (removing the /C switch) you'll get a list of logged on users instead of just the number of users.

Who is logged on to a computer?

We often need to know who is currently logged on to a remote computer.
With native Windows (up to and including XP) commands only:

NBTSTAT -a remotecomputer | FIND "<03>" | FIND /I /V "remotecomputer"

The first name in the list usually is the logged on user (try playing with the NET NAME command to learn more about the names displayed by NBTSTAT).
This is the fastest way to find the logged on user name, and the results that you do get are correct, but NBTSTAT won't always return a user name, even when a user is logged on.

Note:

Unfortunately, NBTSTAT is no longer available in Windows 7 (not sure about Vista)

Using WMIC (Windows XP Professional and later):

WMIC /Node:remotecomputer ComputerSystem Get UserName

What is this collegue's login name?

My collegues often forget to mention their logon account name when calling the helpdesk, and the helpdesk doesn't always ask either. I suppose they expect me to know all 1500+ accounts by heart.
With (native) Windows Server 2003 commands only:

DSQUERY USER -name *lastname* | DSGET USER -samid -display

What is the full name for this login name?

With the native NET command:

NET USER loginname /DOMAIN | FIND /I " name "

With (native) Windows Server 2003 commands:

DSQUERY USER -samid *loginname* | DSGET USER -samid -display

What groups is this user a member of?

In Windows NT 4 and later, users usually are members of global groups. These global groups in turn are members of (domain) local groups. Access permissions are given to (domain) local groups.
To check if a user has access to a resource, we need to check group membership recursively.
With (native) Windows Server 2003 commands:

DSQUERY USER -samid loginname | DSGET USER -memberof -expand

What permissions does a user have on this directory?

One could use the previous command to check what permissions a user has on a certain directory.
However, sometimes SHOWACLS from the Windows Server 2003 Resource Kit Tools is a better alternative:

CD /D d:\directory2check

SHOWACLS /U:domain\userid

When did someone last change his password?

With the native NET command:

NET USER loginname /DOMAIN | FIND /I "Password last set"

How do I reset someone's password?

With the native NET command:

NET USER loginname newpassword /DOMAIN

With (native) Windows Server 2003 commands:

DSQUERY USER -samid loginname | DSMOD USER -pwd newpassword

Is someone's account locked?

With the native NET command:

NET USER loginname /DOMAIN | FIND /I "Account active"

The account is either locked ("Locked") or active ("Yes").

How to unlock a locked account

With the native NET command:

NET USER loginname /DOMAIN /ACTIVE:YES

or, if the password needs to be reset as well:

NET USER loginname newpassword /DOMAIN /ACTIVE:YES

Make sure a local user's password never expires

With WMIC (Windows XP Professional or later):

WMIC.EXE /Node:remotecomputer Path Win32_UserAccount Where Name="user" Set PasswordExpires="FALSE"

Make sure a local user's password will expire

With WMIC (Windows XP Professional or later):

WMIC.EXE /Node:remotecomputer Path Win32_UserAccount Where Name="user" Set PasswordExpires="TRUE"

List all domains and workgroups in the network

With the native NET command:

NET VIEW /DOMAIN

List all computers in the network

With the native NET command:

NET VIEW

or, to list the names only:

FOR /F "skip=3 delims=\ " %%A IN ('NET VIEW') DO ECHO.%%A

delims is a backslash, followed by a tab and a space.

List all domain controllers

With native Windows 2000 commands:

NETDOM QUERY /D:MyDomain DC

With (native) Windows Server 2003 commands (Active Directory only):

DSQUERY Server

or, if you prefer host names only (tip by Jim Christian Flatin):

DSQUERY Server -o rdn

Find the primary domain controller

With native Windows 2000 commands:

NETDOM QUERY /D:MyDomain PDC

or, to find the FSMO with (native) Windows Server 2003 commands (Active Directory only):

NETDOM QUERY /D:mydomain.com FSMO

List all member servers

With native Windows 2000 commands:

NETDOM QUERY /D:MyDomain SERVER

List all workstations

With native Windows 2000 commands:

NETDOM QUERY /D:MyDomain WORKSTATION

Delete a computer account

With native Windows 2000 commands:

NETDOM /DOMAIN:MyDomain MEMBER \\computer2Bdeleted /DELETE

"I need an up-to-date list of disk space usage for all servers, on my desk in 5 minutes"

Sounds familiar?

With (native) Windows XP Professional or Windows Server 2003 commands:

FOR /F %%A IN (servers.txt) DO (

WMIC /Node:%%A LogicalDisk Where DriveType="3" Get

Disable Windows Firewall for domain only

Disable the firewall only when the computer (e.g. a laptop) is connected to the domain:

NETSH Firewall Set OpMode Mode = DISABLE Profile = DOMAIN

Completely disable Windows Firewall (not recommended)

Disable the firewall comletely (not recommended unless an alternative enterprise firewall is used that requires you to do so):

SC [ \\Remote_computer ] Stop SharedAccess

SC [ \\Remote_computer ] Config SharedAccess start= disabled

Is IP v4 supported on this computer?

Check if IP v4 is supported on the local computer:

PING 127.0.0.1 | FIND "TTL=" >NUL 2>&1

IF ERRORLEVEL 1 (ECHO IP v4 NOT supported) ELSE (IP v4 supported)

or:

WMIC Path Win32_PingStatus WHERE "Address='127.0.0.1'" Get StatusCode /Format:Value | FINDSTR /X "StatusCode=0" >NUL 2>&1

IF ERRORLEVEL 1 (ECHO IP v4 NOT supported) ELSE (IP v4 supported)

The WMIC command is faster, but requires Windows XP Professional or later.

Is IP v6 supported on this computer?

Check if IP v6 is supported on the local computer:

PING ::1 | FINDSTR /R /C:"::1:[ˆ$]" >NUL 2>&1

IF ERRORLEVEL 1 (ECHO IP v6 NOT supported) ELSE (IP v6 supported)

or:

WMIC Path Win32_PingStatus WHERE "Address='::1'" Get StatusCode >NUL 2>&1

IF ERRORLEVEL 1 (ECHO IP v6 NOT supported) ELSE (IP v6 supported)

The WMIC command is faster, but requires Windows XP Professional or later.

How to Create the Printer Queues

2012-11-23T00:37:00.000-08:00

http://www.google.com/#hl=en&sclient=psy-ab&q=printer+backup+utility+Printbrm&oq=printer+backup+utility+Printbrm&gs_l=hp.3...2900911.2900911.1.2902180.1.1.0.0.0.0.638.638.5-1.1.0.les%3B..0.0...1c.1.vPyU6A9tzkM&pbx=1&bav=on.2,or.r_gc.r_pw.r_qf.&fp=92da361fb107ce2f&bpcl=35466521&biw=1280&bih=852

http://file-print-server.blogspot.com/2009/04/how-to-create-printer-queues.html

How to Create the Printer Queues

Now that you have properly configured the Spooler resource with the necessary resources, you can create all of the print queues for all of the physical printers. You can also use the Clustool utility from the Resource Kit to migrate previously existing printer queues on a server to a clustered server. After that, use the Print Migrate utility to migrate the printer drivers. For best results, avoid having multiple servers configured to communicate directly with the same printer.

1. From one of the nodes or a remote computer that has administrative permissions to the cluster click Start, click Run, type \\VirtualServer where VirtualServer is the name that is specified for the Network Name resource on which the Spooler resource is dependent.

2. Double-click the Printers folder.

3. Double-click Add Printers to open the Add Printer Wizard, and then click Next.

4. Select Create a new port, and then click Next.

Note: TCP/IP ports are the only supported port type on a Windows Clustering. Use the Standard TCP/IP Port option unless the printing clients need RFC-compliant LPR ports. If this is the case, follow these steps:

1. In Control Panel, double-click Add/Remove Programs, and then click Add/Remove Windows Components to start the Windows Components Wizard.

2. Under Components, scroll down and click to select the Other Network File and Print Services check box.

3. Click Details to open the Other Network File and Print Services window, click to select the Print Services for UNIX check box, and then click OK to close the Other Network File and Print Services window.

4. Click Next to continue with the Windows Components Wizard.

When you complete the wizard, the LPR port will be available as a port type. By default, according to RFC 1179, LPR will use only eleven TCP ports.

5. Type the IP address of the network printer that you want to process the print jobs in the Printer Name or IP Address box.

You no longer have to create a locally-defined printer port configuration for each node. In Windows 2000 (and later) the port configuration is stored in the cluster registry and is therefore shared between all cluster nodes, under the following key:

HKEY_Local_Machine\Cluster\Resources\%Spooler GUID%\Parameters\Monitors\

6. Choose the appropriate driver for this printer, and then click Next.

7. Give the printer a unique name on the cluster server.

8. Choose a share name for the printer; this name must also be unique on this cluster. You do not want to have any other printers with the same share name on this cluster, even if they are in a different group and associated with a different Spooler resource.

9. Test the printing for this printer:

After you add all the desired print queues, use Cluster Administrator to move the group that contains the Print Spooler resource to all other nodes. This copies the printer drivers from the \PrinterDrivers folder on the shared disk to the %SystemRoot%\System32\Spool\Drivers\%Spooler GUID%\Drivers folder on that node.

For Detail Info: http://support.microsoft.com/kb/278455

Benefits of Print Server

Sunday, January 31, 2010 Labels: cheap print server, network monitoring 0 comments

Print server can be a computer or any device which is capable of connecting with one or more printers along with the client computers over a network.

Print server has many benefits because it lowers the administrative and management workload. A print server enables an administrator to manage and control access to each printer. Three level of printer permissions are available, print, manage documents and manage printer. Print permission is granted to everyone in the group. It allows a user to print documents, pause, resume, start and cancel his documents.

Manage documents permission is allocated by administrator to some selected users for controlling job settings for all documents. Manage printer permission enables the user to pause and restart the printer, share a printer, adjust printer permissions, modify printer properties and modify spooler settings.

Client computer jobs are quickly spooled to print server when compared to printer. The main point to be noted is that while printing large jobs from an own printer, resources of client computer are used and he may have to leave his computer running until printing task gets completed. But with the use of print server, if any job has been spooled to it, then user can shutdown his system without any harm.

Print server can also work according to priority of documents. The document with the highest priority will be printed first.

How to Set Up a Di450 Print Server to Vista

Thursday, October 15, 2009 Labels: cheap print server, file and print server monitoring, multifunction print server, network print server, print server, print server software 0 comments

This post provides print server support for Microsoft windows Vista operating system and provide steps by steps solution to fix multifunction print server

The Minolta Di450 all-in-one machine is meant for high-capacity printing applications such as printing multiple documents with many pages in rapid succession for a home or office computer network. If you want all of the computers on your network to be able to access the Minolta printer individually, you can set up a print server by using the built-in networking features of the Microsoft Windows Vista operating system.

Insert the software installation disc that came with the Minolta Di450 printer into the computer on your network that is closest to the router. Follow the instructions that will pop up on the computer screen to install the Minolta printer software.

Take an Ethernet cable and connect one end into the Ethernet port on the back of the Minolta Di450 printer. Connect the other end into an open Ethernet port on the back of your network's router.

Open the "Start" menu on the computer where you installed the Minolta software. Click on the icon labeled "Control Panel." Scroll through the options and locate the icon labeled as "Network and Sharing Center." Double click the icon to bring up a new window. Click on the "View Computers and Devices" link at the left side of the window.

Click on the blue button labeled "Add A Printer" at the top of the window. Click on the "Add a Network Printer" button, then click on the "Next" button at the bottom of the window. Wait for the list of available printers to appear on the menu screen. Click on the Minolta printer, then click on "Next." Click "OK" to finish the process.

Close the "Network and Sharing Center" window. Access the other computers on the network that will need to use the Minolta printer and repeat the process of adding the printer in the "Network and Sharing Center" menu.

How To Troubleshoot a Print Server

Tuesday, October 13, 2009 Labels: cheap print server, multifunction print server, network print server, print server, print server software, print server support 0 comments

This post provides print server support to fix print server problems, If you have problem with your print server listed below you can get troubleshooting via this post.

1) If the printer is printing "garbage" characters, go to step 7b).

2) If there is a Windows error message when printing then, consult Windows Server Support.

3) Try printing from another computer. If this is successful, then there is a problem with your computer configuration, not the print server. Consult the computer and operating system documentation.

4) Turn off the print server, then turn it on. Test whether print server works.

5) Run the print server Setup Wizard. (Start > Programs > NETGEAR Print Server > NETGEAR Print Server Setup Wizard.)

6) For PC users, In the "Network Protocols on this PC" one of the three protocols must read "installed".

7) Click Next in the Wizard. If the print server is on the list found then:

(Retest your printer if you make changes to any of the following.)

7a) Check the print server's IP address. If it is 0.0.0.0, then the printer is not recognized. Unless you have a router, the print server's IP must be on the same segment. To set the IP, click Next until you see the TCP/IP screen. If you have a DHCP server on your network, select Obtain IP Address Automatically. Otherwise, click Fixed IP Address, and Suggest New Values. Click Next and Finish to exit the Wizard.

7b) If the printer does not match the printer driver in the operating system then run the Add Printer Wizard. (As described in the product manuals.)

7c) If the printer driver is PSName_Px, then run the Add Printer Wizard, or change it to the print server port.

7d) Disable the printer's bidirectional feature, if it's turned on.

8) Else, if the print server is not found:

8a) Click Refresh.

8b) Make sure you can access other places from your computer. If you can't, then troubleshoot computer or Internet connectivity.

8c) If you are running a software firewall, disable it, and use the NETGEAR firewall, instead. (It's almost certain to be faster.) This includes the Windows XP firewall — which may have been turned on during Windows upgrade or installation without you being aware of it. See Firewalls that Conflict with NETGEAR Such as Windows XP — unless you know for certain this feature isn't on.

Wireless Print Servers

Wednesday, May 6, 2009 Labels: print server, wireless print server 0 comments

A wireless print server allows one or two printers to be conveniently shared across a WiFi network. Wireless print servers for home networks generally are available in both 802.11b and 802.11g varieties.

Wireless print servers offer the following advantages:

* Allows printers to be conveniently located anywhere within wireless network range, not tied to the location of computers

* Does not require a computer be always turned on in order to print

* Does not require a computer to manage all print jobs, that can bog down its performance

* Allows administrators to change computer names and other settings without having to re-configure the network printing settings.

A wireless print server must be connected to printers by a network cable, normally USB 1.1 or USB 2.0. The print server itself can connect to a wireless router over WiFi, or it can be joined using an Ethernet cable.

Most print server products include setup software on a CD-ROM that must be installed on one computer to complete the initial configuration of the device. As with network adapters, wireless print servers must be configured with the correct network name (SSID) and encryption settings. Additionally, a wireless print server requires client software be installed on each computer needing to use a printer.

The Linksys WPS54G 802.11g USB wireless print server is shown. Print servers are very compact devices that include a built-in wireless antenna and LED lights to indicate status.

Source: compnetworking.about.com/

Print Server Features

Monday, February 2, 2009 Labels: print server, Print Server Features 0 comments

A print server helps reduce administrative and management workload by centralizing local and remote printer management at the print server. It also simplifies many of the labor intensive functions experienced by users when using direct IP printer connections. This section describes the key print server features and their benefits to both the administrator and the end user.

Point and Print

Point and Print allows a user to create a new connection to a shared printer without requiring the user to install any software for that printer. Point and Print downloads the printer files and configuration information automatically when a user installs the printer. Point and Print will update the user’s printer software as the printer software is updated on the server.

Point and Print also updates printer driver configurations when they change. For example, the administrator might install a new printer option such as a duplexer or a stapler. After the administrator reconfigures the driver to use the new feature, Point and Print will update the configuration for each user of that printer.

In contrast, those users with a direct IP connection to a shared printer must have that printer’s current version of the printer software available to them, as well as the permission to install and configure that software on their computer. This process may be manageable and actually quite reasonable in a small office, but as the number of users or printers grows, distributing and updating this software for each potential printer user can become a difficult task.

In addition, Point and Print can help you avoid security issues because users do not need Administrator access to their machines in order to install the software for a new printer. Point and Print installs the software on the user’s machine automatically in a limited system context, which protects against security issues that take advantage of a user running with Administrator access.

Users connecting to shared printers using direct IP connections must have Administrator or Power User access to their system in order to install the necessary printer software. These elevated levels of access may allow virus software running on the machine to cause severe damage to users’ systems and, in the worst case, to other computers on the network.

File & Print Server Monitoring

The Sentry-go Quick File & Print Monitor allows you to quickly & easily monitor your Windows File & Print server, including local printers & print queues, changes made to both local and remote files, the contents of those files, directory changes & structure modifications, entries written to local Event Logs.

If problems are detected, it can either take automatic action, or alert you before end-users are affected. Using it's in-built web-based reporting, you also have immediate access to monitored information direct from your web browser.

Monitoring Features

Monitor key services

You can monitor key Windows & Print Spooler services running on the local server out of the box. In addition, custom services can also be added, monitored & automatically restarted.

Check the status of local printers

Print monitoring allows you to check for & be alerted to errors on local printers such as paper jams, out of paper errors, attention required etc.

Check the status of local print queues

Printer queue monitoring & print monitoring allows you to check for & be alerted to problems associated with a local print queue - e.g. excessively high queue length, print job size (higher than expected no. pages or job size) etc.

Changes made to files & directories

By monitoring files & monitoring directories, you can be alerted to changes in files, directory structure or the underlying file system. For example, files added, deleted, when files have been updated or not updated, directory/file count, directory/file sizes etc.

Monitor Server & Print Spooler performance

Out of the box you can monitor the threshold of important Windows & Print Spooler performance counters such as CPU usage, queue lengths, print job errors etc.

Monitor errors written to the Windows Event Log

Sentry-go allows you to monitor messages written to the Windows Event Logs based on error type, event ID, source or keywords & phrases within the text.

Monitor messages written to custom log files

In addition to Event Logs, log file monitoring can easily be performed using Sentry-go. Using this, you can also monitor the entries written to text-based log files such as those used for custom applications, based on keywords or phrases within the text.

Ensure sufficient disk space is available

To print, the print spooler needs adequate free disk space. Sentry-go can check this for you, clearing down temporary files automatically if free space becomes limited.

Respond Automatically or Alert

Quick Monitors allow you to respond in a number of ways, in the event a fault is detected ...

Respond automatically by running a command, application, batch file or script

Automatically restart a failed Windows Service or reboot the server

Alert you via network messaging, standard or custom e-mails

Different alerting methods based on day of week and time of day

Alert you via the Quick Monitor Console

Alert you via your SMS pager gateway provider Interface with external systems via SMTP, HTTP, or scripting

Log details to a SysLog Server, database or text file

Web-based Reporting

The built-in web server provides access to the following information direct from your desktop browser ...

Standard reports - for recent alerts, current status & performance history

Real-time Printer & Print Queue Summary

Real-time Printer & Queue Status

Source:sentry-go.com/qm-file-print-server-monitoring.aspx

Print Server Features

Monday, February 2, 2009 Labels: print server, Print Server Features 0 comments

Point and Print

Build a Print Server From an Old Computer

Monday, December 22, 2008 Labels: install print server, print server 0 comments

How to Build a Print Server From an Old Computer?? Below are the tips, follow and save your money as well as time:

Make sure your computer is up to snuff. It doesn't take a lot to build a print server. All you need is a machine with a 386 processor or faster, 8 megs of RAM, a parallel port and a floppy drive.

Install an ethernet network adapter card. If the machine doesn't already have an ethernet port, you'll need to install one. It doesn't have to be up-to-date either, an old 10 Mbps PCI card ought to do the trick.

Install winzip and winimage. You'll need these programs to unpack the printer server software. Visit the Winzip and Winimage websites and read how to download and install it (

Download the print server software. We'll be using a free print server from Pigtail.net. See the link below in Resources to download.

Download a network card driver. You'll need a file called modules.lrp. There are many different versions of it, however, so follow the link for a modules.lrp list in the Resources section.

Open winimage. If you installed it to the default directory, you'll need to click "Run" and then type C:\winimage\winimage.exe.

Create a disk image. Drag and drop the printsrv image into the winimage window. This is the file you downloaded in Step 3. Next, drag and drop the modules.lrp file in.

Save the image onto a disk. Insert a blank disk into your A drive and click Disk | Write.

Connect your printer and power up. Connect the print server to the network. Connect a printer to the print server with a parallel printer cable, insert the disk you just wrote and boot it up. It will beep 3 times to indicate that it is ready.

Source: http://www.ehow.com/how_2034850_build-server-computer.html

File Server Migration to Windows Server 2008

Windows Server 2008 has been out for a while and has proven to be a stable operating system. Now that Microsoft has released the first "real" service pack (SP2), more companies are looking at the possibility of upgrading to Windows Server 2008. Although the coexistence of Windows Server 2008 and Windows 2003 shouldn't pose a problem, the actual server migration process can be a bit tricky. In this article, I want to talk about some of the issues that you may encounter when migrating file servers.

The file server migration process can be deceptively simple. In fact, Microsoft offers a free utility to assist you with the migration process. Even so, there is usually a lot more to performing a migration than just running a migration utility.

Hardware considerations

One of the first things to consider is whether or not you will be reusing your existing file server hardware. Keep in mind that if you deploy new server hardware, then the migration process will likely be easier -- especially if you are using the Windows Distributed File System (DFS) on your current file servers. One of the primary advantages to using new hardware is that you can leave your existing server in its current state. That way, if something goes wrong during the migration process, you can still fall back on your old server.

If you choose to reuse your existing hardware, it's important to carefully plan the operating system upgrade. This is especially true if you are using DFS or a clustering solution.

How long will the migration take?

Another major consideration is the amount of time it takes to complete the file server migration process. For instance, suppose you are not using DFS, and you want to use new hardware to host the new file server. In that situation, you can install and configure Windows Server 2008 on the new server without disrupting the users.

The File Server Migration Toolkit

Microsoft has created a free download called the File Server Migration Toolkit that you can use to get around the UNC path issue for migrations to Windows Server 2003 or 2008.

PRINTBRM.exe

Print queue Backup/Recovery/Migration.

Syntax

PRINTBRM -b -s \\server_name -f file_name options

PRINTBRM -r -s \\server_name -f file_name options

PRINTBRM -q options

Key

-s server_name The unc path to the print server.

-b Back up the server to the specified file.

-r Restore the configuration in the file to the server.

-q Query the server or the backup file.

-f file_name The backup file.

-d directory Unpack the backup file to the directory (with -r),

or repack a backup file from the directory (with -b).

-o force Forces overwriting of existing objects.

-p all Publish all printers in the directory, or

-p org Publish the printers that were originally published.

-nobin Omit binary files from the backup.

-lpr2tcp Convert LPR ports to standard TCP/IP ports on restore.

-c file_name Use the specified configuration file.

-noacl Remove ACLs from print queues on restore.

In Windows 2008 PrintBRM replaces the old Win 2003 PrintMig utility, it is backwards compatible with 2003.

Get a list of all printer share names for a print server: net view \\printserv1

Full detail available here: http://searchwindowsserver.techtarget.com/tip/0,289483,sid68_gci1353653,00.html

Windows Server 2008 R2 Clustering Technologies

2012-11-23T00:34:00.002-08:00

Windows Server 2008 R2 Clustering Technologies

Windows Server 2008 R2 provides two clustering technologies, which are both included on the Enterprise and Datacenter Editions. Clustering is the grouping of independent server nodes that are accessed and viewed on the network as a single system. When a service and/or application is run from a cluster, the end user can connect to a single cluster node to perform his work, or each request can be handled by multiple nodes in the cluster. In cases where data is read-only, the client might request data from one server in the cluster and the next request might be made to a different server and the client would never know the difference. Also, if a single node on a multiple node cluster fails, the remaining nodes will continue to service client requests and only the clients that were originally connected to the failed node may notice either a slight interruption in service, or their entire session might need to be restarted depending on the service or application in use and the particular clustering technology that is in use for that cluster.

The first clustering technology provided with Windows Server 2008 R2, Enterprise and Datacenter Editions is failover clustering. Failover clusters provide system fault tolerance through a process called failover. When a system or node in the cluster fails or is unable to respond to client requests, the clustered services or applications that were running on that particular node are taken offline and moved to another available node where functionality and access are restored. Failover clusters, in most deployments, require access to shared data storage and are best suited, but not necessarily limited to, the deployment of the following services and applications:

File services— File services deployed on failover clusters provide much of the same functionality a standalone Windows Server 2008 R2 system can provide, but when deployed as clustered file services, a single data storage repository can be presented and accessed by clients through the currently assigned and available cluster node without replicating the file data.
Print services— Print services deployed on failover clusters have one main advantage over a standalone print server: If the active print server fails, each of the shared printers is made available to clients using another designated print server in the cluster. Although deploying and replacing printers to computers and users is easily managed using Group Policy deployed printers, when standalone print servers fail, the impact can be huge, especially when servers, devices, services, and applications that cannot be managed with group policies access these printers.
Database services— When large organizations deploy line-of-business applications, e-commerce, or any other critical services or applications that require a back-end database system that must be highly available, deploying database services on failover clusters is the preferred method. Also, in many cases configuring enterprise database services can take hours and the size of the databases, indexes, and logs can be huge, so deploying database services on a standalone system encountering a system failure may results in several hours of undesired downtime during repair or restore, instead of quick recovery as with a failover cluster.
Back-end enterprise messaging systems— For many of the same reasons as cited previously for deploying database services, enterprise messaging services have become critical to many organizations and are best deployed in failover clusters.
Hyper-V virtual machines— As many organizations move toward server consolidation and conversion of physical servers to virtual servers, providing a means to also maintain high availability and reliability has become even more essential when a single physical Hyper-V host has several critical virtual machines running on it.

The second Windows Server 2008 R2 clustering technology is Network Load Balancing (NLB), which is best suited to provide fault tolerance for front-end web applications and websites, Remote Desktop Services Session Host server systems, VPN servers, streaming media servers, and proxy servers. NLB provides fault tolerance by having each server in the cluster individually run the network services or applications, removing any single points of failure. Depending on the particular needs of the service or application deployed on an NLB cluster, there are different configuration or affinity options to determine how clients will be connected to the back-end NLB cluster nodes. For example, on a read-only website, client requests can be directed to any of the NLB cluster nodes; during a single visit to a website, a client might be connected to different NLB cluster nodes. As another example, when a client attempts to utilize an e-commerce application to purchase goods or services provided through a web-based application on an NLB cluster, the client session should be initiated and serviced by a single node in the cluster, as this session will most likely be using Secure Sockets Layer (SSL) encryption and will also contain specific session data, including the contents of the shopping cart and the end-user specific information.

Note

Microsoft does not support running failover clusters and Network Load Balancing on the same Windows Server 2008 R2 system.

Windows Server 2008 R2 Cluster Terminology

Before failover or NLB clusters can be designed and implemented, the administrator deploying the solution should be familiar with the general terms used to define the clustering technologies. The following list contains the many terms associated with Windows Server 2008 R2 clustering technologies:

Cluster— A cluster is a group of independent servers (nodes) that are accessed and presented to the network as a single system.
Node— A node is an individual server that is a member of a cluster.
Cluster resource— A cluster resource is a service, application, IP address, disk, or network name defined and managed by the cluster. Within a cluster, cluster resources are grouped and managed together using cluster resource groups, now known as Services and Applications groups.
Services and Applications group— Cluster resources are contained within a cluster in a logical set called a Services and Applications group or historically referred to as a cluster group. Services and Applications groups are the units of failover within the cluster. When a cluster resource fails and cannot be restarted automatically, the Services and Applications group this resource is a part of will be taken offline, moved to another node in the cluster, and the group will be brought back online.
Client Access Point— A Client Access Point is a term used in Windows Server 2008 R2 failover clusters that represents the combination of a network name and associated IP address resource. By default, when a new Services and Applications group is defined, a Client Access Point is created with a name and an IPv4 address. IPv6 is supported in failover clusters but an IPv6 resource either needs to be added to an existing group or a generic Services and Applications group needs to be created with the necessary resources and resource dependencies.
Virtual cluster server— A virtual cluster server is a Services or Applications group that contains a Client Access Point, a disk resource, and at least one additional service or application-specific resource. Virtual cluster server resources are accessed either by the domain name system (DNS) name or a NetBIOS name that references an IPv4 or IPv6 address. A virtual cluster server can in some cases also be directly accessed using the IPv4 or IPv6 address. The name and IP address remain the same regardless of which cluster node the virtual server is running on.
Active node— An active node is a node in the cluster that is currently running at least one Services and Applications group. A Services and Applications group can only be active on one node at a time and all other nodes that can host the group are considered passive for that particular group.
Passive node— A passive node is a node in the cluster that is currently not running any Services and Applications groups.
Active/passive cluster— An active/passive cluster is a cluster that has at least one node running a Services and Applications group and additional nodes the group can be hosted on, but are currently in a waiting state. This is a typical configuration when only a single Services and Applications group is deployed on a failover cluster.
Active/active cluster— An active/active cluster is a cluster in which each node is actively hosting or running at least one Services and Applications group. This is a typical configuration when multiple groups are deployed on a single failover cluster to maximize server or system usage. The downside is that when an active system fails, the remaining system or systems need to host all of the groups and provide the services and/or applications on the cluster to all necessary clients.
Cluster heartbeat— The cluster heartbeat is a term used to represent the communication that is kept between individual cluster nodes that is used to determine node status. Heartbeat communication can occur on a designated network but is also performed on the same network as client communication. Due to this internode communication, network monitoring software and network administrators should be forewarned of the amount of network chatter between the cluster nodes. The amount of traffic that is generated by heartbeat communication is not large based on the size of the data but the frequency of the communication might ring some network alarm bells.
Cluster quorum— The cluster quorum maintains the definitive cluster configuration data and the current state of each node, each Services and Applications group, and each resource and network in the cluster. Furthermore, when each node reads the quorum data, depending on the information retrieved, the node determines if it should remain available, shut down the cluster, or activate any particular Services and Applications groups on the local node. To extend this even further, failover clusters can be configured to use one of four different cluster quorum models and essentially the quorum type chosen for a cluster defines the cluster. For example, a cluster that utilizes the Node and Disk Majority Quorum can be called a Node and Disk Majority cluster.
Cluster witness disk or file share— The cluster witness or the witness file share are used to store the cluster configuration information and to help determine the state of the cluster when some, if not all, of the cluster nodes cannot be contacted.
Generic cluster resources— Generic cluster resources were created to define and add new or undefined services, applications, or scripts that are not already included as available cluster resources. Adding a custom resource provides the ability for that resource to be failed over between cluster nodes when another resource in the same Services and Applications group fails. Also, when the group the custom resource is a member of moves to a different node, the custom resource will follow. One disadvantage or lack of functionality with custom resources is that the Failover Clustering feature cannot actively monitor the resource and, therefore, cannot provide the same level of resilience and recoverability as with predefined cluster resources. Generic cluster resources include the generic application, generic script, and generic service resource.
Shared storage— Shared storage is a term used to represent the disks and volumes presented to the Windows Server 2008 R2 cluster nodes as LUNs. In particular, shared storage can be accessed by each node on the cluster, but not simultaneously.
Cluster Shared Volumes— A Cluster Shared Volume is a disk or LUN defined within the cluster that can be accessed by multiple nodes in the cluster simultaneously. This is unlike any other cluster volume, which normally can only be accessed by one node at a time, and currently the Cluster Shared Volume feature is only used on Hyper-V clusters but its usage will be extended in the near future to any failover cluster that will support live migration.
LUN— LUN stands for Logical Unit Number. A LUN is used to identify a disk or a disk volume that is presented to a host server or multiple hosts by a shared storage array or a SAN. LUNs provided by shared storage arrays and SANs must meet many requirements before they can be used with failover clusters but when they do, all active nodes in the cluster must have exclusive access to these LUNs.
Failover — Failover is the process of a Services and Applications group moving from the current active node to another available node in the cluster when a cluster resource fails. Failover occurs when a server becomes unavailable or when a resource in the cluster group fails and cannot recover within the failure threshold.
Failback— Failback is the process of a cluster group automatically moving back to a preferred node after the preferred node resumes operation. Failback is a nondefault configuration that can be enabled within the properties of a Services and Applications group. The cluster group must have a preferred node defined and a failback threshold defined as well, for failback to function. A preferred node is the node you would like your cluster group to be running or hosted on during regular cluster operation when all cluster nodes are available. When a group is failing back, the cluster is performing the same failover operation but is triggered by the preferred node rejoining or resuming cluster operation instead of by a resource failure on the currently active node.
Live Migration— Live Migration is a new feature of Hyper-V that is enabled when Virtual Machines are deployed on a Windows Server 2008 R2 failover cluster. Live Migration enables Hyper-V virtual machines on the failover cluster to be moved between cluster nodes without disrupting communication or access to the virtual machine. Live Migration utilizes a Cluster Shared Volume that is accessed by all nodes in the group simultaneously and it transfers the memory between the nodes during active client communication to maintain availability. Live Migration is currently only used with Hyper-V failover clusters but will most likely extend to many other Microsoft services and applications in the near future.
Quick Migration— With Hyper-V virtual machines on failover clusters, Quick Migration provides the option for failover cluster administrators to move the virtual machine to another node without shutting the virtual machine off. This utilizes the virtual machine’s shutdown settings options and if set to Save, the default setting, performing a Quick Migration will save the current memory state, move the virtual machine to the desired node, and resume operation shortly. End users should only encounter a short disruption in service and should reconnect without issue depending on the service or application hosted within that virtual machine. Quick Migration does not require Cluster Shared Volumes to function.
Geographically dispersed clusters— These are clusters that span physical locations and sometimes networks to provide failover functionality in remote buildings and data centers, usually across a WAN link. These clusters can now span different networks and can provide failover functionality, but network response and throughput must be good and data replication is not handled by the cluster.
Multisite cluster— Geographically dispersed clusters are commonly referred to as multisite clusters as cluster nodes are deployed in different Active Directory sites. Multisite clusters can provide access to resources across a WAN and can support automatic failover of Services and Applications groups defined within the cluster.
Stretch clusters— A stretch cluster is a common term that, in some cases, refers to geographically dispersed clusters in which different subnets are used but each of the subnets is part of the same Active Directory site—hence, the term stretch, as in stretching the AD site across the WAN. In other cases, this term is used to describe a geographically dispersed cluster, as in the cluster stretches between geographic locations.

Troubleshooting Network Load Balancing Clusters

2012-11-23T00:31:00.001-08:00

Troubleshooting Network Load Balancing Clusters

This topic has not yet been rated - Rate this topic

Applies To: Windows Server 2008, Windows Server 2008 R2, Windows Server 2012

This section lists some common issues that you might encounter when using Network Load Balancing (NLB) clusters.

Note

The NLB functionality in Windows Server 2012 is generally the same as in Windows Server 2008 R2. However, some task details are changed in Windows Server 2012. For information on new ways to do tasks in Windows Server 2012, see Common Management Tasks and Navigation.

What problem are you having?

After installing Network Load Balancing and restarting a cluster host, a message appears: "The system has detected an IP address conflict with another system on the network..."

Cause: The same IP address already exists on the network.
Solution: Choose a new IP address, or remove the duplicate address.
Cause: You have configured different cluster operation modes (Unicast or Multicast) on the hosts, which causes two different MAC addresses to map to the same IP address.
Solution: Ensure that all hosts are configured with the same cluster operation mode.
Cause: You configured the cluster's IP address before NLB was bound to the network adapter.
Solution: Remove the cluster's IP address from TCP/IP properties, enable NLB on the proper adapter, and then configure the cluster's IP address.
Cause: You added the cluster's IP address to a network adapter that has not been enabled for NLB.
Solution: Remove the cluster's IP address from the incorrect adapter's TCP/IP properties, enable NLB on the proper adapter, and then configure the cluster's IP address.

For more information about enabling NLB, see Installing Network Load Balancing

There is no response when you use ping to access the cluster's IP address from an outside network.

Verify that you can use ping to access the dedicated IP addresses for the cluster hosts from a computer outside the router. If this test fails, and you are using multiple network adapters, the issue is not related to NLB. If you are using a single network adapter for the dedicated and cluster IP addresses, consider the following causes:

Cause: If you are using multicast support, you might find that your router has difficulty resolving the primary IP address into a multicast media access control (MAC) address by using the Address Resolution Protocol (ARP).
Solution: Verify that you can use ping to access the cluster from a client on the cluster's subnet and to access the cluster hosts' dedicated IP addresses from a computer outside the router. If these tests work properly, the router is probably at fault. You should be able to add a static ARP entry to the router to circumvent the issue. You can also turn off NLB multicast support and use a unicast network address without a hub.
Cause: When using NLB in multicast or unicast mode, routers need to accept proxy ARP responses (IP-to-network address mappings that are received with a different network source address in the Ethernet frame).
Solution: Make sure that your router has proxy ARP support turned on. You can also set a static ARP entry to keep proxy ARP support disabled in the router.
Cause: Internet control message protocol (ICMP) to the cluster is blocked by a router or firewall.
Solution: Allow ICMP traffic through the router or firewall. Be aware that this may expose your system to additional security risk.

There is no response when using ping to access a host's dedicated IP addresses from another cluster host.

Cause: When using NLB in multicast or unicast mode, routers need to accept proxy ARP responses (IP-to-network address mappings that are received with a different network source address in the Ethernet frame).
Solution: Make sure that your router has proxy ARP support turned on. You can also set a static ARP entry to keep proxy ARP support disabled in the router.
Cause: Internet control message protocol (ICMP) to the cluster is blocked by a router or firewall.
Solution: Allow ICMP traffic through the firewall or router. Be aware that this may expose your system to additional security risk.

When attempting to use Network Load Balancing Manager to connect to a host in your cluster, you receive the error "Host unreachable."

Cause: Internet control message protocol (ICMP) to the host is either blocked by a router or firewall or disabled on the host's network adapter.
Solution: Enable ICMP on the host's network adapter or allow ICMP traffic through the firewall or router. Be aware that this may expose your system to additional security risk. You can also use NLB Manager's /noping option.

When using Telnet or attempting to browse a computer outside the cluster from a cluster host, there is no response.

Cause: Verify that you can use ping to access the computer outside the cluster. If this test is successful, you might not have listed the host's dedicated IP address first in the TCP/IP properties.
Solution: If ping fails to access the computer outside of the cluster, refer to the following issues (described earlier in this Troubleshooting topic):

When invoking the Network Load Balancing remote control commands from a computer outside the cluster, there is no response from one or more cluster hosts.

Cause: Remote control commands are not being sent to the cluster's IP address.
Solution: Commands must be sent to the cluster's primary IP address, which was assigned in the Network Load Balancing Properties dialog box. Be sure that you send remote commands to the correct IP address.
Cause: The remote control traffic is being encrypted by Internet Protocol security (IPSec). NLB remote control commands will not work correctly if they are sent from a computer that has IPSec configured so that the remote control traffic is encrypted by IPSec.
Solution: Disable IPSec.

For more information, see the Internet Protocol Security (IPSec) Help content.
Cause: NLB UDP control ports are protected incorrectly by a firewall. By default, remote control commands are sent to UDP ports 1717 and 2504 at the cluster IP address.
Solution: Be sure that these ports have not been blocked incorrectly by a router or firewall. You can also change the port number by modifying the corresponding NLB parameter.

There is no reply when you use the dedicated IP address of a host to specify it as a target for a remote control command. However, specifying the host by its priority (ID) works.

Cause: None of the hosts have a dedicated IP address.
Solution: Assign a dedicated IP address to each host. For more information, see Configure Network Load Balancing Host Parameters.

Connectivity to the cluster is denied to some users, but not all.

Cause: An application that is being load balanced is not responding.
Solution: This is an application-specific issue that is not related to NLB. Refer to your application's documentation to correct this issue. You may need to stop and restart the application.
Cause: If your cluster is configured for unicast mode, a switch might have learned the NLB network adapter's MAC address.
Solution: Clear the switch's port to MAC address mapping.
Cause: The cluster's IP address was not added to TCP/IP on one or more of the hosts.
Solution: If you do not use NLB Manager to configure your cluster, you must manually configure TCP/IP with the cluster's IP address.
Cause: A host is leaving the cluster because of a drainstop or stop command, but convergence did not complete correctly.
Solution: Wait for the convergence to complete. If the convergence does not complete, see the following issue later in this Troubleshooting topic:

After the cluster hosts start, they begin converging, but they never complete convergence.

You cannot view or change the Network Load Balancing properties by using net config and Windows Management Instrumentation (WMI).

Cause: To view or change Network Load Balancing properties, you must be a member of the Administrators group.
Solution: Log on as a user who is in the local Administrators group of the computer that is running NLB.

An unusual number of TCP connections to the cluster's IP address are being reset by the server or the client.

Cause: The HTTP keep-alive values are enabled on the NLB hosts and keep-alive value-enabled clients are connecting to the cluster.
Solution: Disable HTTP keep-alive values. For more information about HTTP keep-alive values and Internet Information Services (IIS), refer to the IIS documentation set.

To view the IIS documentation set from your desktop, install IIS, then click Start, click Run, and type the following command in the Open text box:

%windir%\help\iisrv.chm
Cause: Low system resources on the server are causing TCP to reject the connections.
Solution: Free system resources by, for example, adding additional system memory or closing unnecessary applications.
Cause: The cluster has diverged into two separately converged clusters, which causes more than one node to claim ownership of every connection.
Solution: Remove the two clusters, then recreate a single cluster.

Virtual Private Network (VPN) calls fail when you make a change that causes convergence (such as adding a host, removing a host, or draining a host).

Cause: When using NLB to load balance VPN traffic, you must configure the port rules that govern the ports handling the VPN traffic (TCP port 1723 for PPTP/GRE and UDP port 500 for IPSEC/L2TP) to use either Single or Network affinity.
Solution: Configure the port rules that govern ports 500 and 1723 to use Single or Network affinity. For more information, see Network Load Balancing Manager Properties.

After the cluster hosts start, they begin converging, but they never complete convergence.

Cause: A different number of port rules or incompatible port rules on different cluster hosts were entered. This will inhibit convergence.
Solution: Open the Network Load Balancing Properties dialog box on each cluster host and verify that all hosts have identical port rules.
Cause: You have a bad network adapter or cable.
Solution: Use the ping command to test connectivity. Enter the host's fully qualified domain name. You can also learn more about the issue by using the ping command to search your domain controller by IP address and other network servers by name and IP address.
Cause: Duplex settings on a switch or hub are mismatched.
Solution: Confirm that the duplex settings in each of your switches and hubs are configured appropriately.
Cause: The dedicated IP address that you used for one of the hosts already exists on the network.
Solution: Choose a new IP address, or remove the duplicate address.
Cause: Your cluster contains hosts that are running Windows 2000.
Solution: Your cluster must be running Windows Server 2008 on all hosts. An NLB cluster environment that contains hosts with Windows Server 2003 and Windows Server 2008 is supported only when performing a rolling upgrade to Windows Server 2008. Mixing Windows Server 2003 and Windows Server 2008 in the same cluster is not supported for long periods of time.
Cause: You have configured different cluster operation modes (unicast and multicast) on the hosts.
Solution: Use NLB Manager to ensure that all hosts are configured with the same cluster operation mode.

Note

You can also view the Windows event logs to check for errors and warnings. For more information see Installing Network Load Balancing.

The cluster moves in and out of a converged state.

Cause: Heartbeats are being missed due to intermittent network connectivity caused by a bad network adapter or cable or other network problems.
Solution: Use the ping command to test connectivity. Enter the host's fully qualified domain name. You can also learn more about the issue by using the ping command to search your domain controller by IP address and other network servers by name and IP address.

After the cluster hosts start, Network Load Balancing reports that convergence has finished, but more than one host is a default host.

Cause: The cluster hosts have become members of different subnets, so all the hosts are not accessible on the same network.
Solution: Be sure that all cluster hosts can communicate with each other.
Cause: A layer-three switch is being used.
Solution: Put a layer-two switch between the hosts and the layer-three switch.
Cause: A break in a redundant switch caused the cluster to separate into two clusters, creating two default hosts.
Solution: Remove the two clusters, then create a single cluster.
Cause: Your switch is configured to reject broadcast packets.
Solution: Configure your switch to accept broadcast packets (be aware that this might introduce certain security risks), or configure your NLB cluster to use multicast mode.
Cause: One host is unable to send or receive heartbeats.
Solution: Use the ping command to test connectivity to each of the hosts. Enter the hosts' fully-qualified domain name.
Cause: A host is plugged into the wrong port on the switch.
Solution: Use the correct port on the switch.

Network Load Balancing is not load balancing applications, and the default host handles all the network traffic.

Cause: A port rule is missing. By default, NLB directs all incoming network traffic that is not governed by port rules to the default host—this ensures that applications that you do not want load balanced behave properly.
Solution: To load balance an application across the cluster, create a port rule on every cluster host for the TCP/IP ports that are serviced by the application.
Cause: You added a second host to a single host cluster, but the second host is not configured correctly. The cluster never converges and the original host continues to handle all of the traffic.
Solution: Carefully review (and if necessary, correct) each of the settings on the second host—for example, the cluster IP address, dedicated IP address, and port rules.
Cause: If your cluster is configured for unicast mode, a switch might have learned the NLB network adapter's MAC address.
Solution: Clear the switch's port to MAC address mapping.
Cause: A proxy server is sending all connections that are using a single IP address to your cluster in single affinity mode.
Solution: Configure your proxy server to use multiple IP addresses.

Traffic alternates unexpectedly between the cluster hosts, and it breaks TCP connections.

Cause: Unicast network addresses are causing issues with the switching hub. If you are using a switching hub to interconnect the cluster hosts, you must use NLB multicast support. Otherwise, the switch can behave erratically when the same unicast network is used on multiple switch ports.
Solution: Check that you have selected multicast support in the Network Load Balancing Properties dialog box. If you do not want to use multicast support, you can interconnect the cluster hosts with a hub or coaxial cable instead of with a switch.

Network traffic does not appear to load balance evenly among the cluster hosts.

Cause: The network traffic is coming from a limited number of IP addresses, possibly due to the setting on a proxy server.
Solution: Configure your proxy server to use multiple IP addresses.

When you are using Network Load Balancing with Microsoft Internet Security and Acceleration (ISA) Server, one cluster host logs blocked packets that are directed to the dedicated Internet Protocol (IP) address of another host.

Cause: One of the cluster hosts is configured with a host priority identifier equal to 1.
Solution: Do not configure any cluster host with a host priority identifier of 1. Use numbers that are greater than 1. For more information, see Configure Network Load Balancing Host Parameters.

You are unable to create a Network Load Balancing cluster in a 64-bit version environment.

Cause: You might not be running the appropriate NLB version for your environment. NLB cannot form a cluster when the 32-bit version of NLB is used on a 64-bit version computer. This issue might have gone undetected because 32-bit NLB components (nlb.exe, wlbs.exe, and nlbmgr.exe) appear to run correctly in the 64-bit version environment.
Solution: If you plan to use a 64-bit version computer environment, you must use the 64-bit NLB version.

Note

The following topics describe several common issues that you might encounter when installing and initially using NLB. The topics describe the likely reasons for each issue and one or more suggested remedies. These topics assume that your system and applications meet the minimum requirements for NLB. For more information, see: Overview of Network Load Balancing and Installing Network Load Balancing.

You should test your network and all network adapters for proper operation before installing NLB. Be sure to follow all installation steps, and check that the cluster parameters and port rules are identically set for all cluster hosts. If an issue occurs, always check the Windows event log for a message from the NLB driver. For more information, see the sections titled Cluster parameters, Host parameters, and Port rules in Network Load Balancing Manager Properties.

MICROSOFT WINDOWS SERVER 2008 FAILOVER CLUSTER

2012-11-23T00:30:00.001-08:00

Microsoft Windows Server 2008 Failover Cluster

This template assesses the status and overall performance of a Microsoft Windows 2008 Failover Cluster by retrieving information from performance counters and the Windows System Event Log. For more information, refer to the following Microsoft article: http://technet.microsoft.com/en-us/library/cc720058%28WS.10%29.aspx.

Prerequisites: WMI access to the target server.

Credentials: Windows Administrator on the target server.

Note: All Windows Event Log monitors should return zero values. Returned values other than zero indicates an abnormality. Examining the Windows system log files should provide information pertaining to the issue. Detailed information about these events can be found here: http://technet.microsoft.com/en-us/library/dd353290(WS.10).aspx.

Monitored Components

Note: You need to set thresholds for counters according to your environment. It is recommended to monitor counters for some period of time to understand potential value ranges and then set the thresholds accordingly. For

more information, seehttp://knowledgebase.solarwinds.com/kb/questions/2415.

Service: Windows Time

This monitor returns the CPU and memory usage of the Windows Time service. This service maintains date and time synchronization on all clients and servers in the network. If this service is stopped, date and time synchronization will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

Service: Cluster Service

This monitor returns the CPU and memory usage of the Cluster service. This service enables servers to work together as a cluster to keep server-based applications highly available, regardless of individual component failures. If this service is stopped, clustering will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

Network Reconnections: Reconnect Count

This monitor returns the number of times the nodes have reconnected.

Note: The instance field is installation-specific. You need to specify the hostname of your cluster node (for example: node1). By default, this component monitor is disabled and should only be enabled for troubleshooting purposes.

Network Reconnections: Normal Message Queue Length

This monitor returns the number of normal messages that are in the queue waiting to be sent. Normally this number is 0, but if the TCP connection breaks, you might observe it is going up until the TCP connection is reestablished and we can send all of them through.

Note: The instance field is installation-specific. You need to specify the hostname of your cluster node (for example: node1). By default, this component monitor is disabled and should only be enabled for troubleshooting purposes.

Network Reconnections: Urgent Message Queue Length

This monitor returns the number of urgent messages that are in the queue waiting to be sent. Normally this number is 0, but if the TCP connection breaks, you might observe it going up until the TCP connection is re-established, thereby allowing all messages to be sent.

Messages Outstanding

This monitor returns the number of cluster MRR outstanding messages. The returned value should be near zero.

Resource Control Manager: Groups Online

This monitor returns the number of online cluster resource groups on this node. The returned value should be above zero at all times.

Resource Control Manager: RHS Processes

This monitor returns the number of running resource host subsystem processes (rhs.exe). The returned value should be above zero at all times.

Resource Control Manager: RHS Restarts

This monitor returns the number of resource host subsystem process (rhs.exe) restarts.

Note: By default, this component monitor is disabled and should only be enabled for troubleshooting purposes.

Resources: Resource Failure

This monitor returns the number of resource failures. The returned value should be as low as possible.

Resources: Resource Failure Access Violation

This monitor returns the number of resource failures caused by access violation. The returned value should be as low as possible.

Note: By default, this component monitor is disabled and should only be enabled for troubleshooting purposes.

Resources: Resource Failure Deadlock

This monitor returns the number of resource failures caused by deadlock. Deadlocks are usually caused by the resource taking too long to execute certain operations. The returned value should be as low as possible.

Note: By default, this component monitor is disabled and should only be enabled for troubleshooting purposes.

Backup and Restore Functionality Problems

This monitor returns the number of events that occur when:

o The backup operation for the cluster configuration data has been aborted because quorum for the cluster has not yet been achieved;

o The restore request for the cluster configuration data has failed during the "pre-restore" or "post-restore" stage.

Type of event: Error. Event ID: 1541, 1542, 1543.

Check for the following pre-conditions to make sure they have been met, and then retry the backup or restore operation:

o The cluster must achieve quorum. In other words, enough nodes must be running and communicating (perhaps with a witness disk or witness file share, depending on the quorum configuration) that the cluster has achieved a majority, that is, quorum.

o The account used by the person performing the backup must be in the local Administrators group on each clustered server, and must be a domain account, or must have been delegated the equivalent authority.

During a restore, the restore software must obtain exclusive access to the cluster configuration database on a given node. If other software has access (open handles to the database), the restore cannot be performed.

Cluster Network Connectivity Problems

This monitor returns the number of events that occur when:

o The Cluster network interface for some cluster node on a special network failed;

o The Cluster network is partitioned and some attached failover cluster nodes cannot communicate with each other over the network;

o The Cluster network is down;

o The Cluster IP address resource failed to come online;

o Attempting to use IPv4 for a special network adapter failed.

Type of event: Warning and Error. Event ID: 1127, 1129, 1130, 1360, 1555.

Run the Validate a Configuration Wizard, selecting only the network tests. Also check network devices (adapters, cables, hubs, switches, etc) and quorum configuration.

Compare the properties of the IP Address resource with the properties of the corresponding network to ensure that the network and subnet information match. If this is an IPv6 resource, make sure that the cluster network for this resource has at least one IPv6 prefix that is not link-local or tunnel.

Cluster Service Startup Problems

This monitor returns the number of events that occur when:

o The Cluster service suffered an unexpected fatal error;

o The Cluster service was halted due to incomplete connectivity with other cluster nodes;

o The Cluster service was halted to prevent an inconsistency within the failover cluster;

o The Cluster resource host subsystem (RHS) stopped unexpectedly;

o The Cluster resource either crashed or deadlocked;

o The Cluster service encountered an unexpected problem and will be shut down;

o The Cluster service has prevented itself from starting on this node. (This node does not have the latest copy of cluster configuration data.)

o The membership engine detected that the arbitration process for the quorum device has stalled.

Type of event: Error. Event ID: 1000, 1006, 1073, 1146, 1230, 1556, 1561, 1178.

There are various software or hardware related causes that can prevent the Cluster service from starting on a node. Sometimes the Cluster service can restart successfully after it has been interrupted by one of those causes. Review the event logs for indications of the problem.

Check network hardware and configuration. Use the Validate a Configuration Wizard to review the network configuration.

Check to see which resource DLL is causing the issue and report the problem to the resource vendor. Consider configuring the resource to run in its own Resource Monitor. Note that while a problem with a resource DLL will not stop the Cluster service from running, it can prevent other resource DLLs from running unless the resource runs in its own Resource Monitor.

Try starting the Cluster service on all other nodes in the cluster. If the Cluster service can be started on a node with the latest copy of the cluster configuration data, then the node that previously could not be started will probably be able to obtain the latest copy and then join the cluster successfully.

Cluster Shared Volume Functionality Problems

This monitor returns the number of events that occur when:

o The Cluster Shared Volume is no longer available on this node;

o The Cluster Shared Volume is no longer directly accessible from this cluster node;

o The Cluster service failed to create the Cluster Shared Volumes root directory;

o The Cluster service failed to set the permissions (ACL) on the Cluster Shared Volumes root directory;

o The Cluster Shared Volume is no longer accessible from this cluster node;

o The Cluster service failed to create a cluster identity token for Cluster Shared Volumes.

Type of event: Error. Event ID: 5120, 5121, 5123, 5134, 5135, 5142, 5200.

Review events related to communication with the volume.

Check storage and network configuration.

Check Cluster Shared Volumes folder creation and permissions.

Check communication between domain controllers and nodes.

Cluster Storage Functionality Problems

This monitor returns the number of events that occur when:

o The Cluster Physical Disk resource cannot be brought online because the associated disk could not be found;

o While the disk resource was being brought online, access to one or more volumes failed with an error;

o The file system for one or more partitions on the disk for the resource may be corrupt;

o The Cluster disk resource indicates corruption for specific volume;

o The Cluster disk resource contains an invalid mount point.

Type of event: Error. Event ID: 1034, 1035, 1037, 1066, 1208.

Confirm that the affected disk is available.

Check the underlying storage hardware and confirm that the device is being presented correctly to the cluster nodes.

If you have problems with partitions on the disk or corruption, we recommend that you run Chkdsk so that it can correct any problems with the file system.

Confirm that the mounted disk is configured according to the following guidelines:

Clustered disks can only be mounted onto clustered disks (not local disks);

The mounted disk and the disk it is mounted onto must be part of the same clustered service or application. They cannot be in two different clustered services or applications, and they cannot be in the general pool of Available Storage in the cluster.

Cluster Witness Problems

This monitor returns the number of events that occur when:

o The Cluster service failed to update the cluster configuration data on the witness resource due to resource inaccessibility;

o The Cluster service detected a problem with the witness resource;

o The File Share Witness resource failed a periodic health check;

o The File Share Witness resource failed to come online;

o The File Share Witness resource failed to arbitrate for the specific file share;

o The node failed to form a cluster because the witness was not accessible.

Type of event: Error. Event ID: 1557, 1558, 1562, 1563, 1564, 1573.

Confirm witness accessibility by viewing the quorum configuration of a failover cluster and the status of a witness disk.

Configuration Availability Problems

This monitor returns the number of events that occur when:

o The cluster configuration database could not be loaded or unloaded;

o The cluster service cannot start due to failed attempts to read configuration data.

Type of event: Error. Event ID: 1057, 1090, 1574, 1575, 1593.

When the cluster configuration on a node is missing or corrupt, the Cluster service cannot load the configuration and therefore cannot start. Where possible, the Cluster service will obtain the latest cluster configuration from other nodes in the cluster. Ensure that other nodes are started. If the only node or nodes that can be started appear to have a missing or corrupt cluster configuration database, you will probably need to restore one of the nodes from a system state backup. (For a failover cluster node, the system state backup includes the cluster configuration.) Sometimes when the node attempts to unload the cluster configuration database, the action does not fully complete. Try stopping and restarting the Cluster service. If this does not succeed, restart the operating system on the affected node.

DFS Namespace Resource Availability Problems

This monitor returns the number of events that occur when:

o The creation of DFS namespace root failed with error;

o The resynchronization of DFS root target failed with error;

o The cluster file share resource for DFS Namespace cannot be brought online due to error.

Type of event: Error. Event ID: 1138, 1141, 1142.

Check DFS namespace configuration.

Encrypted Settings for Cluster Resource Could not Applied

This monitor returns the number of events when encrypted settings for a cluster resource could not be successfully applied to the container on this node.

Type of event: Error. Event ID: 1121.

Close any application that might have an open handle to the registry checkpoint indicated by the event. This will allow the registry key to be replicated as configured with the resource properties. If necessary, contact the application vendor about this problem. You can use a utility calledHandle with the -a option to view handles to the registry.

Failed to Form Cluster

This monitor returns the number of Failed to Form cluster events.

Type of event: Error. Event ID: 1092, 1009.

You might be able to correct this issue by restarting the Cluster service.

File Share Resource Availability Problems

This monitor returns the number of events that occur when:

o The Cluster File Share cannot be brought online because a file share could not be created;

o The retrieving of information for a specific share returned an error code;

o The retrieving of information for a specific share indicated that the share does not exist;

o The Creation of a file share failed due to an error;

o The Cluster file share resource has detected shared folder conflicts;

o The Cluster file server resource failed a health check because some of its shared folders were inaccessible.

Type of event: Warning and Error. Event ID: 1053, 1054, 1055, 1068, 1560, 1585, 1586, 1587, 1588.

Confirm that the share exists and that the permissions allow access to the share.

If possible, determine whether the path to the share has been changed. If so, recreate the share with the correct name.

View all the resources in the clustered file server instance to ensure that they are coming online, and review the dependencies among the resources. Reconfigure as necessary to correct any problems.

Ensure that no two shared folders have the same share name.

Check shared folder accessibility and the State of Server service.

Generic Application Could not be Brought Online

This monitor returns the number of events that occur when a generic application could not be brought online during an attempt to create the process due to; the application not being present on this node, an incorrect path name, or an incorrect binary name.

Type of event: Error. Event ID: 1039.

Confirm that the following are true for the application used by the clustered Generic Application instance:

o The application is fully installed on all nodes that are possible owners of the Generic Application resource;

o The configuration for the Generic Application resource specifies the correct application and path;

o The configuration for the Generic Application resource specifies the appropriate parameters and settings for registry replication.

Generic Service Resource Availability Problems

This monitor returns the number of events that occur when:

o The generic service is either not installed or the specified service name is invalid;

o The specified generic service parameters might be invalid;

o The generic service failed with an error.

Type of event: Error. Event ID: 1040, 1041, 1042.

Confirm that the correct service is specified in the configuration for the Generic Service resource and confirm that the service is fully installed on all nodes that are possible owners of the resource.

Check service operation and examine the application event log.

IP address Resource Availability Problems

This monitor returns the number of events that occur when:

o The Cluster IP address resource cannot be brought online because the subnet mask value is invalid;

o The Cluster IP address resource cannot be brought online because the address value is invalid;

o The configuration data for the network adapter corresponding to the cluster network interface could not be determined;

o The Cluster IP address resource cannot be brought online because a duplicate IP address was detected on the network;

o The Cluster IP address resource cannot be brought online because WINS registration;

o The lease of the IP address associated with the cluster IP address resource has expired or is about to expire, and currently cannot be renewed;

o The IPv6 Tunnel address resource failed to come online because it does not depend on an IP Address (IPv4) resource;

o The Cluster network associated with dependent IP address (IPv4) resource does not support ISATAP tunneling.

Type of event: Error. Event ID: 1046, 1047, 1048, 1049, 1078, 1242, 1361, 1363.

Check the address, subnet, and network properties of the IP Address resource.

If the resource is an IPv6 Tunnel address resource, make sure it depends on at least one IP Address (IPv4) resource. Also make sure the network supports Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) tunneling.

If the IP Address resource appears to be configured correctly, check the condition of network adapters and other network components used by the cluster.

Network Connectivity and Configuration Problems

This monitor returns the number of events that occur when:

o The Cluster Service was unable to access the network adapter or the cluster node has no network connectivity;

o The Cluster node has no network connectivity;

o The Cluster node has lost all network connectivity;

o The failover cluster virtual adapter failed to initialize the miniport adapter.

Type of event: Error. Event ID: 1289, 1553, 1554, 4871.

Correct any problems with the physical network adapters and the cluster virtual adapter. If a previous change in the configuration is interfering with the function of the cluster virtual adapter, it might be necessary to reinstall the failover clustering feature on the node. Also, use the Validate a Configuration Wizardto review the network configuration.

Node Failed to Join Cluster

This monitor returns the number of events that occur when the node failed to join the failover cluster due to an error.

Type of event: Error. Event ID: 1070.

You might be able to correct this issue by restarting the Cluster service.

Problems with Cluster Service

This monitor returns the number of events that occur when:

o The cluster resource in the Clustered service or application failed;

o The Cluster service failed to bring the Clustered service or application completely online or offline and one or more resources may be in a failed state.

Type of event: Warning and Error. Event ID: 1039, 1205.

Check and correct any problems with the application or service associated with the resource.

Check and correct any problems with cables or cluster-related devices.

Adjust the properties for the resource in the cluster configuration, especially the value for the Pending Timeout for the resource. This value must allow enough time for the associated application or service to start.

Check the state of all resources in the clustered service or application.

Quorum was Lost

This monitor returns the number of events that occur when the Cluster service is shutting down because quorum was lost.

Type of event: Error. Event ID: 1177.

This can occur when network connectivity is lost between some or all of the nodes in the cluster, or the witness disk fails over. It can also occur if you make a change in the cluster configuration such as increasing the number of nodes, when the number of nodes currently online is too few to achieve quorum in the new configuration. Run the Validate a Configuration Wizard, selecting only the network tests. Also check network devices (adapters, cables, hubs, switches, etc.) and quorum configuration.

Registry Checkpoint Could not be Restored to Registry Key

This monitor returns the number of events that occur when the Registry Checkpoint for Cluster resource could not be restored to a registry key.

Type of event: Error. Event ID: 1024.

System is not being Responsive

This monitor returns the number of events that occur when the Failover cluster virtual adapter has lost contact with the process.

Type of event: Error. Event ID: 4869, 4870.

Use Resource Monitor to determine, in real time, how many system resources a service or application is utilizing. This may take several minutes if the system is critically low on resources.

Memory Leak

2012-10-14T04:43:00.001-07:00

A Memory leak occurs in strmfilt.dll with event error 1000 and event error 1015 after you apply update KB970430 or update KB973917

Article ID: 979730 - View products that this article applies to.

Hotfix Download Available

System TipThis article applies to a different version of Windows than the one you are using. Content in this article may not be relevant to you. Visit the Windows 7 Solution Center

Expand all | Collapse all

On This Page

· SYMPTOMS

· CAUSE

· RESOLUTION

o Hotfix information

§ Prerequisites

§ Registry information

§ Restart requirement

§ Hotfix replacement information

§ File information

§ Windows Server 2003 file information note

§ For all supported x86-based versions of Windows Server 2003 SP2

§ For all supported x64-based versions of Windows Server 2003 SP2

§ For all supported IA-64-based versions of Windows Server 2003 SP2

· STATUS

· MORE INFORMATION

· Properties

· Give Feedback

SYMPTOMS

Consider the following scenario:

· On a computer that is running Windows Server 2003 Service Pack 2 (SP2), you install Internet Information Services (IIS) 6.0.

· You have applied update KB970430 or update KB973917.

In this scenario, a memory leak occurs in Strmfilt.dll after the computer runs for some time. When the memory leak occurs, Lsass.exe crashes and the computer restarts automatically. Additionally, the following events are logged in the Application log:

Event ID: 1000
Category: None
Source: Application Error
Type: Error
Message: Faulting application lsass.exe, version 5.2.3790.0, faulting module schannel.dll, version 5.2.3790.4530, fault address <memory address>.

Event ID: 1015
Category: None
Source: Winlogon
Type: Error
Message: A critical system process, <system drive>:\WINDOWS\system32\lsass.exe, failed with status code c0000005. The machine must now be restarted.

Back to the top | Give Feedback

CAUSE

This issue occurs because the Strmfilt.dll file does not free allocated memory correctly. Therefore, a memory leak occurs in the Local Security Authority Subsystem Service process (LSASS).

Back to the top | Give Feedback

RESOLUTION

Hotfix information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing the problem described in this article. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:

http://support.microsoft.com/contactus/?ws=support

Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Prerequisites

To apply this hotfix, you must be running Windows Server 2003 Service Pack 2 (SP2).

For more information about how to obtain a Windows Server 2003 service pack, click the following article number to view the article in the Microsoft Knowledge Base:

889100

How to obtain the latest service pack for Windows Server 2003

Registry information

To use the hotfix in this package, you do not have to make any changes to the registry.

Restart requirement

You must restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace a previously released hotfix.

File information

The English (United States) version of this hotfix installs files that have the attributes that are listed in the following tables. The dates and the times for these files are listed in Coordinated Universal Time (UTC). The dates and the times for these files on your local computer are displayed in your local time together with your current daylight saving time (DST) bias. Additionally, the dates and the times may change when you perform certain operations on the files.

Windows Server 2003 file information note

· In addition to the files that are listed in these tables, this hotfix also installs an associated security catalog file (KBnumber.cat) that is signed with a Microsoft digital signature.

For all supported x86-based versions of Windows Server 2003 SP2

File name	File version	File size	Date	Time	Platform	SP requirement
Http.sys	5.2.3790.4655	294,912	25-Jan-2010	11:01	x86	SP2
Httpapi.dll	5.2.3790.4655	25,088	27-Jan-2010	06:34	x86	SP2
Strmfilt.dll	6.0.3790.4655	86,528	27-Jan-2010	06:34	x86	SP2

For all supported x64-based versions of Windows Server 2003 SP2

File name	File version	File size	Date	Time	Platform	SP requirement	Service branch
Http.sys	5.2.3790.4655	567,808	27-Jan-2010	04:27	x64	SP2	Not applicable
Httpapi.dll	5.2.3790.4655	37,376	27-Jan-2010	04:27	x64	SP2	Not applicable
Strmfilt.dll	6.0.3790.4655	134,656	27-Jan-2010	04:27	x64	SP2	Not applicable
Whttpapi.dll	5.2.3790.4655	25,088	27-Jan-2010	04:27	x86	SP2	WOW
Wstrmfilt.dll	6.0.3790.4655	86,528	27-Jan-2010	04:27	x86	SP2	WOW

For all supported IA-64-based versions of Windows Server 2003 SP2

File name	File version	File size	Date	Time	Platform	SP requirement	Service branch
Http.sys	5.2.3790.4655	815,104	27-Jan-2010	04:26	IA-64	SP2	Not applicable
Httpapi.dll	5.2.3790.4655	69,632	27-Jan-2010	04:26	IA-64	SP2	Not applicable
Strmfilt.dll	6.0.3790.4655	254,976	27-Jan-2010	04:26	IA-64	SP2	Not applicable
Whttpapi.dll	5.2.3790.4655	25,088	27-Jan-2010	04:26	x86	SP2	WOW
Wstrmfilt.dll	6.0.3790.4655	86,528	27-Jan-2010	04:26	x86	SP2	WOW

To change the quorum disk designation

2012-10-14T04:27:00.001-07:00

How to change the quorum disk designation

Article ID: 280353 - View products that this article applies to.

System TipThis article applies to a different version of Windows than the one you are using. Content in this article may not be relevant to you. Visit the Windows 7 Solution Center

This article was previously published under Q280353

Notice

This article applies to Windows 2000. Support for Windows 2000 ends on July 13, 2010. The Windows 2000 End-of-Support Solution Center is a starting point for planning your migration strategy from Windows 2000. For more information see the Microsoft Support Lifecycle Policy.

Expand all | Collapse all

SUMMARY

This article explains the quorum disk resource in Windows Clustering, and describes how to change the drive for the quorum device.

MORE INFORMATION

In the event of failure, Windows Clustering maintains a primary node, and replicates changes for the cluster registry by means of a shared disk. This disk is called the quorum drive. The quorum drive has two responsibilities:

It replicates the cluster registry to all other nodes in the server cluster. The cluster registry is stored in the following location on each node:

%SystemRoot%\Cluster\Clusdb

The cluster registry is replicated to the \Mscs\Chkxxx.tmp file on the quorum drive. These files are exact copies of each other and can be manually copied and renamed to replace each other. The Quolog.log file is a transaction log that maintains a record of all changes to the checkpoint file so that these changes can be appended to nodes that were offline when they join back into the cluster. Quolog.log is stored in the \Mscs directory on the quorum disk.

If there is a loss of communication between the nodes in the cluster, a "Split Brain" scenario occurs. In this situation, the owner of the quorum disk resource becomes the only owner of the cluster and all the resources. The owner then makes the resources available for clients. When the node that owns the quorum disk does not function correctly, the surviving nodes arbitrate to take ownership of the device. In a single cluster, there is a local quorum resource. In the event of a hardware failure of the quorum disk, it may be necessary to designate another device as the quorum disk.

The quorum disk is located on a shared bus in the cluster. Use the following procedure to designate a different drive for the quorum device:

Start Cluster Administrator (CluAdmin.exe).
Right-click the cluster name in the upper-left corner, and then click Properties.
Click the Quorum tab.
In the Quorum resource box, click a different disk resource.
If the disk has more than one partition, click the partition where you want the cluster-specific data to be kept, and then click OK.

NOTE: If you cannot start Cluster service because the quorum disk is unavailable, use the /FIXQUORUM switch to start Cluster service. You are then able to change the quorum disk designation.

When you change the quorum disk designation, Cluster service does not remove the /Mscs directory from the old drive. For administrative purposes, you may want to delete this old directory, or keep it as a backup. Do not continue running Cluster service with the /FIXQUORUM switch enabled. When the new quorum disk is established, stop the service and restart it without a switch. Then it is safe to bring other nodes online.

It is recommended that you increase the quorum log size to 4,096 KB.

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

225081 Cluster resources quorum log size defaults to 64 KB

Properties

Article ID: 280353 - Last Review: March 1, 2007 - Revision: 3.6

APPLIES TO

Microsoft Windows 2000 Advanced Server
Microsoft Windows 2000 Datacenter Server
Microsoft Windows NT Server 4.0 Enterprise Edition
Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
Microsoft Windows Server 2003, Enterprise x64 Edition
Microsoft Windows Server 2003, Datacenter x64 Edition

Keywords:

kbclustering kbinfo KB280353

How to replace a disk that is on a Windows 2000 or a Windows 2003 server cluster

Article ID: 305793 - View products that this article applies to.

System TipThis article applies to a different version of Windows than the one you are using. Content in this article may not be relevant to you. Visit the Windows 7 Solution Center

This article was previously published under Q305793

Expand all | Collapse all

SUMMARY

This article discusses how to replace a shared hard disk that is on a Microsoft Windows Server 2003 or a Windows 2000 server cluster.

MORE INFORMATION

Windows server clusters are dependent on the disk signatures of the drives that are on the shared bus. The disk may be a single hard disk or, more typically, a hardware array. When the cluster service starts, it scans the shared disk looking for disk signatures that match those in the cluster registry. Drive letters are not used to track disks on a server cluster. When the cluster service starts, it tries to bring the Physical Disk resources in the cluster online. These physical disks are tracked by using the disk signatures. If the cluster service cannot find a disk that matches the disk signature in the cluster registry, the following event may appear in the system log of your Event Viewer:

Event ID: 1034
Source: ClusDisk
Description: The disk associated with cluster disk resource %DriveLetter% could not be found. The expected signature of the disk was %Disk Signature%.

If the signature of the quorum disk changes, the cluster service does not start. The disk signature can change in a variety of ways. For example:

· An existing disk on the shared bus failed and was replaced with a new disk.

· An existing disk on the shared bus was low on disk space and was replaced with a larger disk.

· A utility such as an array management, multipath, or file system tool was run and changed the disk signature.

· An array on the shared bus was reconfigured.

In previous versions of Windows server clusters, the process of restoring a failed disk to an online state was more complex. In Microsoft Windows Server 2003, the ClusterRecovery utility speeds the process of restoring a failed hard disk on the shared bus. This utility is also ported (backported) to Microsoft Windows 2000 Server. This utility is included with the Microsoft Windows Server 2003 Resource Kit. To obtain this utility, visit the following Microsoft Web site:

http://technet.microsoft.com/en-us/windowsserver/bb633748.aspx

You can also use this utility to replace the Dumpcfg utility on Windows 2000-based server clusters. Or you can use Dumpcfg can with either Windows 2000 or Windows Server 2003. For more information about how to use the Dumpcfg utility, click the following article number to view the article in the Microsoft Knowledge Base:

280425 Recovering from an Event ID 1034 on a server cluster

For additional information about how to use the ClusterRecovery tool to recover a shared cluster disk, including the quorum disk, view the ClusterRecovery.chm help file that is included with the ClusterRecovery.exe program.

Note The ClusterRecorery utility does not correctly replace disks in the Japanese Version of Windows Server 2003. For more information about the problem, click the following article number to view the article in the Microsoft Knowledge Base:

843295 The Server Cluster Recovery utility does not work in the Japanese version of Windows Server 2003

For more information about how to replace a disk in a Microsoft Windows NT 4.0 server cluster, click the following article number to view the article in the Microsoft Knowledge Base:

243195 Event ID 1034 for MSCS shared disk after disk replacement

Properties

Article ID: 305793 - Last Review: March 1, 2007 - Revision: 6.5

APPLIES TO

· Microsoft Windows 2000 Advanced Server

· Microsoft Windows 2000 Datacenter Server

· Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)

· Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)

Keywords:

kbinfo KB305793

Quorum Drive Configuration Information

SUMMARY

This article provides information about configuring the quorum drive.

MORE INFORMATION

When you install Microsoft Cluster service, you must configure storage at the hardware level so that the operating system and Cluster service have two separate physical devices for cluster usage. For example, in Disk Administrator or Disk Management, the following disks should be displayed:

Disk 0 (usually drive C)
Disk 1 (quorum)
Disk 2 (data drive)

At a minimum, you must create at least one physical drive for the quorum disk and a separate physical drive for data. Each drive must be formatted as NTFS.

NTFS architecture is structured to enable file attribute indexing on a disk volume. This functionality enables the file system to efficiently locate files that match certain criteria so that sorting and searching processes function faster. However, you should not place any input/output (I/O) intensive programs on your quorum drive. Heavy input/output traffic from another source could interfere with the cluster's ability to write to the disk, which may cause the quorum resource to fail. If the quorum resource fails, the entire cluster may fail as well.

It is recommended that you configure the quorum disk size to be 500 MB; this size is the minimum required for an efficient NTFS partition. Larger disk sizes are allowable but are not currently needed. It is also recommended that you configure some form of fault tolerance at the hardware level to be used for the quorum drive, such as hardware mirroring or hardware RAID. If the quorum drive is lost, the cluster may not be available.

The quorum resource plays a crucial role in the operation of the cluster. In every cluster, a single resource is designated as the quorum resource. A quorum resource can be any resource with the following functionality:

It offers a means of persistent arbitration. Persistent arbitration means that the quorum resource must allow a single node to gain physical control of the node and defend its control. For example, Small Computer System Interface (SCSI) disks can use Reserve and Release commands for persistent arbitration.
It provides physical storage that can be accessed by any node in the cluster. The quorum resource stores data that is critical to recovery after there is a communication failure between cluster nodes.

Windows 2003 introduces a new quorum resource type called Majority Node Set (MNS). MNS is tailored for geographically dispersed clusters.

For additional information about MNS, click the following article number to view the article in the Microsoft Knowledge Base:

838612 TechNet Support Webcast: Majority Node Set support in Microsoft Windows Server 2003 Cluster

NOTE: Changes in future releases of Cluster service may require a larger quorum disk size. Therefore, the recommended quorum disk size may be modified in future releases of the product.

For additional information, click the following article numbers to view the articles in the Microsoft Knowledge Base:

251284 Cluster Server cannot start if the Quorum disk space is full

245762 Recovering from a lost or corrupted Quorum log

168948 Information about the Cluster group

https://support.ca.com/cadocs/0/CA%20ARCserve%20%20Backup%2015-ENU/Bookshelf_Files/HTML/DR/index.htm?toc.htm?76953.html

Recover Cluster Quorum Disks with No Node Failures

To recover cluster quorum disks with no node failures

Stop the cluster services on the secondary node.
Shut down the secondary node.
On the primary node, from the Windows Service Control Manager, set the cluster service startup type to Manual.
From the Device Manager View menu, select Show Hidden Devices and disable the Cluster Disk Driver setting.
Shut down the primary node.
If the cluster quorum disks are physically damaged, replace the cluster quorum shared disk with new disks.
Start the primary node.

Note: Have the Cluster Disaster Recovery Requirements readily available for reference.

Use the dumpcfg.exe utility to restore the original disk signature for the shared disk. See the output file created by the dumpcfg.exe utility during the backup.
Recreate and reformat the partitions on the non-quorum shared disk.
From the Device Manager View menu, select Show Hidden Devices and enable the Cluster Disk Driver setting.
Restore the system state backup. In CA ARCserve Backup, select System State session and right-click to select the local option.

The System State Restore Options dialog opens.

Note: If the cluster nodes are Active Directory Servers, you must reboot the primary node into directory restore mode when restoring the system state session.

Restart the primary node.
If the cluster files are not restored to the quorum disk, run the caclurst.exe utility to load the cluster database from the following:

14. %windir%\clusbkup

caclurst.exe is available in the ARCserve Home directory.

caclurst /s c:\%SystemRoot%\clusbkup /q Q:

If this is a remote disaster recovery, copy the caclurst.exe file to the Client Agent for Windows directory.

Reboot the primary node.
Connect the shared disks to the secondary node.
Start the secondary node.

Recovering from a lost or corrupted quorum log

Article ID: 245762 - View products that this article applies to.

System TipThis article applies to a different version of Windows than the one you are using. Content in this article may not be relevant to you. Visit the Windows 7 Solution Center

This article was previously published under Q245762

Expand all | Collapse all

SYMPTOMS

The Cluster service may not start if a hardware failure occurs or power is lost to both nodes of a cluster and to the storage device known as the quorum on the shared device bus. In such cases, the following error message may occur when you attempt to start the Cluster service on the forming node of the server cluster:

Event ID: 1147
Source: ClusSvc
Description: The Microsoft Clustering Service encountered a fatal error. The vital quorum log file 'Q:\MSCS\quolog.log' could not be found. If you have a backup of the quorum log file, you may try to start the cluster service by entering 'clussvc -debug -noquorumlogging' at a command window, copy the backed up quorum log file to the MSCS directory in the quorum drive, stop the cluster service, and restart the cluster service normally using the 'net start clussvc' command. If you do not have a backup of the quorum log file, you may try to start the cluster service as 'clussvc -debug -resetquorumlog' and this will attempt to create a new quorum log file based on possibly stale information in the cluster hive. You may then stop the cluster service and restart it normally using the 'net start clussvc' command.

Important If this cluster is Windows 2000 Service Pack 4 (SP4)-based, and if the KB 872970 hotfix is installed, do not use the -ResetQuorumLog switch. Start the Cluster service normally.

Back to the top | Give Feedback

CAUSE

This error message occurs if the quorum log file (Quolog.log) cannot be found or read at Cluster service startup. It must be readable to confirm that the cluster configuration on the local node is up-to-date. If it cannot read the log, the Cluster service does not start to prevent potentially loading stale configuration data.

Back to the top | Give Feedback

RESOLUTION

If you have a backup of the system state on one of the computers after the last changes were made to the cluster, you can restore the quorum by restoring this information. For more information about backing up and restoring cluster configuration information, click the following article number to view the article in the Microsoft Knowledge Base:

248998 How to properly restore cluster information

If you do not have a backup of the Quorum log file, re-create a new quorum log file based on the cluster configuration information in the local system's cluster hive by starting the Cluster service with the -ResetQuorumLog switch. To do this, follow these steps:

Start the Services snap-in. (Click Start, point to Programs, click Administrative Tools, and then click Services.)
Right-click and select the properties of the Cluster service.
In the Start Parameters box, type:

-resetquorumlog

Then click the Start button.

If the error message occurs after you restore the system state on a computer that has lost the quorum log, the quorum information is copied to %SystemRoot%\Cluster\Cluster_backup. You can use the Clusrest.exe tool from the Resource Kit to restore this information to the quorum disk. For more information about Clusrest.exe and other useful Resource kit tools, see the Resource kit online Help.

Back to the top | Give Feedback

MORE INFORMATION

Important If possible, perform the procedure that is described in this article from the node in the cluster that was known to have the latest configuration with regards to the resources that are contained in the cluster. If you had a node that has not been a member in the cluster since the time that the last changes, deletions, or additions were made to the cluster resources, that node will not have the latest configuration. Using this node with the -ResetQuorumLog switch could result in permanent loss of data, such as Resources or Resource Configurations.

The -ResetQuorumLog switch is new for Windows 2000. This switch is not available in Microsoft Windows NT 4.0. In Windows NT 4.0, if no quorum log is found, the Cluster service assumes that it is a new installation and creates the quorum log fresh from the local system information. It gets any updated cluster and program check points from the cluster nodes when they are brought online.

Important If this cluster is Windows 2000 SP4-based, and if the KB 872970 hotfix is installed, do not use the -ResetQuorumLog switch. Start the Cluster service normally.

Back to the top | Give Feedback

REFERENCES

For more informationabout the KB 872970 hotfix, click the following article number to view the article in the Microsoft Knowledge Base:

872970 The quorum log file becomes corrupted in your Windows 2000 Advanced Server-based cluster environment

Failover Cluster Step-by-Step Guide: Configuring the Quorum in a Failover Cluster

2012-10-14T04:25:00.002-07:00

Failover Cluster Step-by-Step Guide: Configuring the Quorum in a Failover Cluster

Applies To: Windows Server 2008, Windows Server 2008 R2

A failover cluster is a group of independent computers that work together to increase the availability of applications and services. The clustered servers (called nodes) are connected by physical cables and by software. If one of the cluster nodes fails, another node begins to provide service (a process known as failover). Users experience a minimum of disruptions in service.

This guide describes the new quorum options in failover clusters in Windows Server® 2008 and provides steps for configuring the quorum in a failover cluster. By following the configuration steps in this guide, you can learn about failover clusters and familiarize yourself with quorum modes in failover clustering.

In Windows Server 2008, the improvements to failover clusters (formerly known as server clusters) are aimed at simplifying clusters, making them more secure, and enhancing cluster stability. Cluster setup and management are easier. Security and networking in clusters have been improved, as has the way a failover cluster communicates with storage. For more information about improvements to failover clusters, see http://go.microsoft.com/fwlink/?LinkId=62368.

In this guide

Overview of quorum in a failover cluster

Requirements and recommendations for quorum configurations

Steps for viewing the quorum configuration of a failover cluster

Steps for changing the quorum configuration in a failover cluster

Troubleshooting: how to force a cluster to start without quorum

Additional references

For additional background information, also see Appendix A: Details of How Quorum Works in a Failover Cluster and Appendix B: Additional Information About Quorum Modes.

Overview of quorum in a failover cluster

In simple terms, the quorum for a cluster is the number of elements that must be online for that cluster to continue running. In effect, each element can cast one “vote” to determine whether the cluster continues running. The voting elements are nodes or, in some cases, a disk witness or file share witness. Each voting element (with the exception of a file share witness) contains a copy of the cluster configuration, and the Cluster service works to keep all copies synchronized at all times.

It is essential that the cluster stops running if too many failures occur or if there is a problem with communication between the cluster nodes. For a more detailed explanation, see the next section, Why quorum is necessary.

Note that the full function of a cluster depends not just on quorum, but on the capacity of each node to support the services and applications that fail over to that node. For example, a cluster that has five nodes could still have quorum after two nodes fail, but each remaining cluster node would continue serving clients only if it had enough capacity to support the services and applications that failed over to it.

Why quorum is necessary

When network problems occur, they can interfere with communication between cluster nodes. A small set of nodes might be able to communicate together across a functioning part of a network, but might not be able to communicate with a different set of nodes in another part of the network. This can cause serious issues. In this “split” situation, at least one of the sets of nodes must stop running as a cluster.

To prevent the issues that are caused by a split in the cluster, the cluster software requires that any set of nodes running as a cluster must use a voting algorithm to determine whether, at a given time, that set has quorum. Because a given cluster has a specific set of nodes and a specific quorum configuration, the cluster will know how many “votes” constitutes a majority (that is, a quorum). If the number drops below the majority, the cluster stops running. Nodes will still listen for the presence of other nodes, in case another node appears again on the network, but the nodes will not begin to function as a cluster until the quorum exists again.

For example, in a five node cluster that is using a node majority, consider what happens if nodes 1, 2, and 3 can communicate with each other but not with nodes 4 and 5. Nodes 1, 2, and 3 constitute a majority, and they continue running as a cluster. Nodes 4 and 5 are a minority and stop running as a cluster, which prevents the problems of a “split” situation. If node 3 loses communication with other nodes, all nodes stop running as a cluster. However, all functioning nodes will continue to listen for communication, so that when the network begins working again, the cluster can form and begin to run.

For more information about how quorum works, see Appendix A: Details of How Quorum Works in a Failover Cluster.

Overview of the quorum modes

There have been significant improvements to the quorum model in Windows Server 2008. In Windows Server 2003, almost all server clusters used a disk in cluster storage (the “quorum resource”) as the quorum. If a node could communicate with the specified disk, the node could function as a part of a cluster, and otherwise it could not. This made the quorum resource a potential single point of failure. In Windows Server 2008, a majority of ‘votes’ is what determines whether a cluster achieves quorum. Nodes can vote, and where appropriate, either a disk in cluster storage (called a “disk witness”) or a file share (called a “file share witness”) can vote. There is also a quorum mode called No Majority: Disk Only which functions like the disk-based quorum in Windows Server 2003. Aside from that mode, there is no single point of failure with the quorum modes, since what matters is the number of votes, not whether a particular element is available to vote.

This new quorum model is flexible and you can choose the mode best suited to your cluster.

Important

In most situations, it is best to use the quorum mode selected by the cluster software. If you run the quorum configuration wizard, the quorum mode that the wizard lists as “recommended” is the quorum mode chosen by the cluster software. We only recommend changing the quorum configuration if you have determined that the change is appropriate for your cluster.

There are four quorum modes:

Node Majority: Each node that is available and in communication can vote. The cluster functions only with a majority of the votes, that is, more than half.
Node and Disk Majority: Each node plus a designated disk in the cluster storage (the “disk witness”) can vote, whenever they are available and in communication. The cluster functions only with a majority of the votes, that is, more than half.
Node and File Share Majority: Each node plus a designated file share created by the administrator (the “file share witness”) can vote, whenever they are available and in communication. The cluster functions only with a majority of the votes, that is, more than half.
No Majority: Disk Only: The cluster has quorum if one node is available and in communication with a specific disk in the cluster storage.

Choosing the quorum mode for a particular cluster

The following table describes clusters based on the number of nodes and other cluster characteristics, and lists the quorum mode that is recommended in most cases.

A “multi-site” cluster is a cluster in which an investment has been made to place sets of nodes and storage in physically separate locations, providing a disaster recovery solution.

Description of cluster	Quorum recommendation
Odd number of nodes	Node Majority
Even number of nodes (but not a multi-site cluster)	Node and Disk Majority
Even number of nodes, multi-site cluster	Node and File Share Majority
Even number of nodes, no shared storage	Node and File Share Majority

Diagrams of quorum modes

The following diagrams show how each of the quorum modes affects whether a cluster can or cannot achieve quorum.

Node Majority

The following diagram shows Node Majority used (as recommended) for a cluster with an odd number of nodes.

Node Majority quorum configuration, three nodes

In this mode, each node gets one vote. In certain circumstances, you might want to install a hotfix that lets you select which nodes will have votes. This can be useful with certain multi-site clusters, for example, where you want one site to have more votes than other sites in a disaster recovery situation. For more information, see Changing the quorum configuration in a failover cluster for unequal node weight.

Node and Disk Majority

The following diagram shows Node and Disk Majority used (as recommended) for a cluster with an even number of nodes. Each node can vote, as can the disk witness.

Node and Disk Majority quorum configuration, four nodes (plus disk)

The following diagram shows how the disk witness also contains a replica of the cluster configuration database in a cluster that uses Node and Disk Majority.

Replicas of cluster configuration in cluster that uses Node and Disk Majority

Node and File Share Majority

The following diagram shows Node and File Share Majority used (as recommended) for a cluster with an even number of nodes and a situation where having a file share witness works better than having a disk witness. Each node can vote, as can the file share witness.

Node and File Share Majority quorum configuration, four nodes (plus file share)

The following diagram shows how the file share witness can vote, but does not contain a replica of the cluster configuration database. Note that the file share witness does contain information about which version of the cluster configuration database is the most recent.

Replicas of cluster configuration in cluster that uses Node and File Share Majority

No Majority: Disk Only

The following illustration shows how a cluster that uses the disk as the only determiner of quorum can run even if only one node is available and in communication with the quorum disk. It also shows how the cluster cannot run if the quorum disk is not available (single point of failure). For this cluster, which has an odd number of nodes, Node Majority is the recommended quorum mode.

No Majority: Disk Only quorum configuration, three nodes

Additional information about quorum modes

For more information about quorum modes, see Appendix B: Additional Information About Quorum Modes.

Requirements and recommendations for quorum configurations

Before configuring the quorum for a failover cluster you must of course meet the requirements for the cluster itself. For information about cluster requirements, see http://go.microsoft.com/fwlink/?LinkId=114536. For information about cluster validation, see http://go.microsoft.com/fwlink/?LinkId=114537 and http://go.microsoft.com/fwlink/?LinkId=114538.

For a cluster using the Node Majority quorum mode (which includes almost all clusters with an odd number of nodes), there are no additional requirements for the quorum. The following sections provide guidelines for clusters using the Node and Disk Majority quorum mode and the Node and File Share Majority quorum mode. (The requirements and recommendations for the Node and Disk Majority mode also apply to the No Majority: Disk Only mode.)

Requirements and recommendations for clusters using Node and Disk Majority

When using the Node and Disk Majority mode, review the following requirements and recommendations for the disk witness.

Note

These requirements and recommendations also apply to the quorum disk for the No Majority: Disk Only mode.

Use a small Logical Unit Number (LUN) that is at least 512 MB in size.
Choose a basic disk with a single volume.
Make sure that the LUN is dedicated to the disk witness. It must not contain any other user or application data.
Choose whether to assign a drive letter to the LUN based on the needs of your cluster. The LUN does not have to have a drive letter (to conserve drive letters for applications).
As with other LUNs that are to be used by the cluster, you must add the LUN to the set of disks that the cluster can use. For more information, see http://go.microsoft.com/fwlink/?LinkId=114539.
Make sure that the LUN has been verified with the Validate a Configuration Wizard.
We recommend that you configure the LUN with hardware RAID for fault tolerance.
In most situations, do not back up the disk witness or the data on it. Backing up the disk witness can add to the input/output (I/O) activity on the disk and decrease its performance, which could potentially cause it to fail.
We recommend that you avoid all antivirus scanning on the disk witness.
Format the LUN with the NTFS file system.

If there is a disk witness configured, but bringing that disk online will not achieve quorum, then it remains offline. If bringing that disk online will achieve quorum, then it is brought online by the cluster software.

In certain circumstances, you might use an asymmetric storage configuration, where only a subset of cluster nodes have access to the storage array that contains the disk witness. For information about how to work within an asymmetric storage configuration and specify either Node and Disk Majority mode or No Majority: Disk Only mode, see Changing the quorum configuration in a failover cluster with asymmetric storage.

Requirements and recommendations for clusters using Node and File Share Majority

When using the Node and File Share Majority mode, review the following recommendations for the file share witness.

Use a Server Message Block (SMB) share on a Windows Server 2003 or Windows Server 2008 file server.
Make sure that the file share has a minimum of 5 MB of free space.
Make sure that the file share is dedicated to the cluster and is not used in other ways (including storage of user or application data).
Do not place the share on a node that is a member of this cluster or will become a member of this cluster in the future.
You can place the share on a file server that has multiple file shares servicing different purposes. This may include multiple file share witnesses, each one a dedicated share. You can even place the share on a clustered file server (in a different cluster), which would typically be a clustered file server containing multiple file shares servicing different purposes.
For a multi-site cluster, you can co-locate the external file share at one of the sites where a node or nodes are located. However, we recommend that you configure the external share in a separate third site.
Place the file share on a server that is a member of a domain, in the same forest as the cluster nodes.
For the folder that the file share uses, make sure that the administrator has Full Control share and NTFS permissions.
Do not use a file share that is part of a Distributed File System (DFS) Namespace.

Note

After the Quorum Configuration Wizard has been run, the computer object for the Cluster Name will automatically be granted read and write permissions to the file share.

If there is a file share witness configured, but bringing that file share online will not achieve quorum, then it remains offline. If bringing that file share online will achieve quorum, then it is brought online by cluster software.

For more information about file share witness recommendations, see:

Steps for viewing the quorum configuration of a failover cluster

When you install a failover cluster, the cluster software automatically chooses an appropriate quorum configuration for that cluster, based mainly on the number of nodes (even or odd). You can easily view the quorum configuration of an existing cluster using either the failover cluster snap-in or the command line.

To view the quorum configuration of an existing cluster using the failover cluster snap-in

To open the failover cluster snap-in, click Start, click Administrative Tools, and then click Failover Cluster Management (in Windows Server 2008) or Failover Cluster Manager (in Windows Server 2008 R2).If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
In the console tree, if the cluster that you want to view is not displayed, right-click Failover Cluster Management or Failover Cluster Manager, click Manage a Cluster, and then select the cluster you want to view.
In the center pane, find Quorum Configuration, and view the description.

In the following example, the quorum mode is Node and Disk Majority and the disk witness is Cluster Disk 2.

To view the quorum configuration of an existing cluster using the Command Prompt window

To open a Command Prompt window, on a cluster node, click Start, right-click Command Prompt, and then either click Run as administrator or click Open.
If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
Review the configuration of the quorum by typing:

cluster /quorum

Steps for changing the quorum configuration in a failover cluster

The procedure in this section describes how you can configure quorum configuration in a failover cluster by using the failover cluster snap-in. Additional subsections provide information about quorum configurations for use in certain circumstances where you want to use unequal node weight or asymmetric storage.

Important

Unless you have changed the number of nodes in your cluster, it is usually best to use the quorum configuration recommended by the quorum configuration wizard. We only recommend changing the quorum configuration if you have determined that the change is appropriate for your cluster.

Changing the quorum configuration in a failover cluster

The following procedure describes how you can configure quorum configuration in a failover cluster by using the failover cluster snap-in.

Membership in the local Administrators group on each clustered server, or equivalent, is the minimum permissions required to complete this procedure. Also, the account you use must be a domain user account. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To change the quorum configuration in a failover cluster by using the failover cluster snap-in

To open the failover cluster snap-in, click Start, click Administrative Tools, and then click Failover Cluster Management (in Windows Server 2008) or Failover Cluster Manager (in Windows Server 2008 R2). If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
In the console tree, if the cluster you want to configure is not displayed, right-click Failover Cluster Management or Failover Cluster Manager, click Manage a Cluster, and select or specify the cluster you want.
With the cluster selected, under Actions, click More Actions, and then click Configure Cluster Quorum Settings.

Click Next. The following illustration shows the wizard page that displays for a cluster with an even number of nodes. Note that the text on this page varies, depending on whether the cluster has an even number or odd number of nodes. To view more information about the selections on this page, at the bottom of the page, click More about quorum configurations.

Select a quorum mode from the list. For more information, see Choosing the quorum mode for a particular cluster, earlier in this guide.
Click Next and then go to the appropriate step in this procedure:

If you chose Node Majority, go to the last step in this procedure.
If you chose Node and Disk Majority or No Majority, go to the next step in this procedure.
If you chose Node and File Share Majority, skip to step 8 in this procedure.

If you chose Node and Disk Majority or No Majority, a wizard page similar to the following appears. (For No Majority, the title of the page is Select Storage Resource.) Select the storage volume that you want to use for the disk witness (or if you chose No Majority, for the quorum resource), and then skip to step 9. For information about the requirements for the disk witness, see Requirements and recommendations for clusters using Node and Disk Majority.

If you change disk assignments on this page, the former storage volume is no longer assigned to the core Cluster Group and instead goes back to Available Storage.

If you chose Node and File Share Majority, the following wizard page appears. Specify the file share you want to use, or click the Browse button and use the standard browsing interface to select the file share. For information about the requirements for the file share, see Requirements and recommendations for clusters using Node and File Share Majority.

Click Next. Use the confirmation page to confirm your selections, and then click Next.
After the wizard runs and the Summary page appears, if you want to view a report of the tasks that the wizard performed, click View Report.

Note

The most recent report will remain in the systemroot\Cluster\Reports folder with the name QuorumConfiguration.mht.

Changing the quorum configuration in a failover cluster for unequal node weight

In most failover clusters, each node gets one vote. In certain circumstances, you might want to install a hotfix that lets you select which nodes will have votes. This can be useful with certain multi-site clusters, for example, where you want one site to have more votes than other sites in a disaster recovery situation. Install the hotfix to all nodes (not just the node that will not have a vote). To download and install the hotfix, see http://support.microsoft.com/kb/2494036. To configure a node so that it does not have a vote, at the command prompt, type:

cluster . node <NodeName> /prop NodeWeight=0

This sets the NodeWeight property to 0. Similarly, to return the node to having a vote, set the NodeWeight property to 1.

After you have applied the hotfix described in this section, you might want to start a node but prevent it from achieving quorum and forming the cluster (to prevent a "split" situation with two competing instances of the cluster running). To do this, start the Cluster service with the /preventquorum option, which can be abbreviated as /pq, as shown in the following command:

net start clussvc /pq

Changing the quorum configuration in a failover cluster with asymmetric storage

In most failover clusters, the disk witness or quorum disk can be accessed by all nodes. In certain circumstances, you might want to configure a disk witness or quorum disk that can be accessed by a subset of nodes only (asymmetric storage). Before configuring this, if your cluster is running Windows Server 2008 R2, make sure that it has Service Pack 1. Similarly, if your cluster is running Windows Server 2008, make sure that it has Service Pack 2 and hotfix 976097, which is described at http://support.microsoft.com/kb/976097.

To configure the quorum in a failover cluster with asymmetric storage, first ensure that the disk that will be the disk witness or quorum disk is online and is in the Cluster Group (not in Available Storage). Then, at the command prompt, for a Node and Disk Majority (disk witness) configuration, type:

cluster <ClusterName> /quorum:"<DiskResourceName>"

For a No Majority: Disk Witness configuration, type the same command, but add /diskonly to the end of the command. With the No Majority: Disk Witness configuration, the cluster may be unable to start unless a node that can access the disk witness is available. If none of these nodes is available, it might be necessary to start the cluster service with the net start clussvc /forcequorum command.

Troubleshooting: how to force a cluster to start without quorum

When troubleshooting, you might be in a situation where the cluster is offline because it does not have quorum, but you want to bring it online. The first thing to understand is your quorum mode and why you no longer have quorum. This may provide some insight into how the cluster can achieve quorum and come online automatically. If you need to force the Cluster service to start, you can make all nodes which can communicate with each other begin working together as a cluster by running the net start clussvc command with an option for forcing quorum. The cluster will use the copy of the cluster configuration that is on the node on which you run the command, and replicate it to all other nodes. To force the cluster to start, on a node that contains a copy of the cluster configuration that you want to use, type the following command:

net start clussvc /fq

The command can also be typed as net start clussvc /forcequorum.

Forcing a cluster to start that does not have quorum may be especially useful in an unbalanced multi-site cluster. If you have a five-node multi-site cluster and three nodes at Site A fail, then the two nodes at Site B will go offline since they no longer have quorum. If there is a genuine disaster at Site A, then it may take a significant amount of time for the site to come online, and so you would likely want to force Site B to come online, even though it does not have quorum.

When a cluster is forced to start without quorum it continually looks to add nodes to the cluster and is in a special “forced” state. Once it has majority, the cluster moves out of the forced state and behaves normally, which means it is not necessary to rerun the cluster command without a startup switch. If the cluster then loses a node and drops below quorum, it will go offline again because it is no longer in the forced state. At that point, to bring it online again while it does not have quorum would require running net start clussvc /fq again.

In some situations, you might want to start a node but prevent it from achieving quorum and forming the cluster. For more information, see Changing the quorum configuration in a failover cluster for unequal node weight, earlier in this topic.

Additional references

For more information about disk witness recommendations, see:

http://go.microsoft.com/fwlink/?LinkId=115004 (Note that this is a Windows Server 2003 article, but the disk witness recommendations remain unchanged.)

For more information about file share witness recommendations, see:

For a list of technical documentation for failover clusters on the TechNet Web site, see:

http://go.microsoft.com/fwlink/?LinkId=68633

For information on Cluster Continuous Replication (CCR) in Microsoft Exchange Server 2007:

http://go.microsoft.com/fwlink/?LinkId=114542

For information about choosing and validating hardware for a failover cluster, see the TechNet Web site at:

http://go.microsoft.com/fwlink/?LinkId=115087

Active Directory Domain Services Groups Using Windows PowerShell

2012-10-14T04:23:00.001-07:00

How-To Administer Active Directory Domain Services Groups Using Windows PowerShell

Get-ADGroup
New-ADGroup
Remove-ADGroup
Get-ADGroupMember
Get-ADPrincipalGroupMembership
Add-ADGroupMember
Remove-ADGroupMember
Add-ADPrincipalGroupMembership
Set-ADGroup
Move-ADObject
RenameObjects
Rename-ADObject

Retrieving AD DS Groups

Get-ADGroup -LDAPFilter "(cn=*Sales*)"

Get-ADGroup “all staff” –properties *

Get-ADGroup “all staff” –properties GroupCategory,groupScope

Get-ADGroup -LDAPFilter "(cn=*Sales*)" -searchBase “OU=Toronto,DC=domain,dc=local”

Get-ADGroup -LDAPFilter "(cn=*Sales*)" -SearchBase “OU=Toronto,DC=domain,dc=local” -SearchScope Base

Creating AD DS Group Objects

New-ADGroup -Name Group1 -GroupScope Global

New-ADGroup -Name Group1 -GroupScope Global -GroupCategory Distribution

New-ADGroup -Name GroupA -path “OU=Toronto,DC=domain,DC=local” -SAMAccountName GroupA -ManagedBy JPOLICELLI -GroupCategory Security -Description “Test Group” -GroupScope Global

Deleting AD DS Group Objects

Remove-ADGroup “GroupName”

Retrieving AD DS Group Membership

Get-ADGroupMember “GroupName”

Retrieving the AD DS Groups that a Security Principal is a Member of

Get-ADPrincipleGroupMembership “administrator”

Managing AD DS Group Membership

Add-ADGroupMember Group1 Administrator

Add-ADGroupMember Group1 Member1,Member2,Member3,etc…

Remove-ADGroupMember Group1 Administrator

Modifying AD DS Group Objects

Set-ADGroup Group1 -GroupScope Universal (from Global to universal)

Set-ADGroup Group1 -GroupCategory Distribution ( security to distribution)

Top 10 powershell Commands

Get-Help -Name Get-Process

Set-ExecutionPolicy Unrestricted

Get-ExecutionPolicy

Get-Service

Get-Service | ConvertTo-HTML -Property Name, Status > C:\services.htm

Get-Service | Export-CSV c:\service.csv

Get-Service | Select-Object Name, Status | Export-CSV c:\service.csv (or p:\new.txt)

Get-EventLog -Log "Application"

Get-Process

Stop-Process -Name notepad

Stop-Process -ID 2668

Get-Process | Sort-Object ID

Restart-Computer “CHI-DC02”, “CHI-FP01” (-whatif -- if you would include this cmd you can see after what happen in after execute command)

Get-content c:\new.txt

Get-Process notepad | kill

Ps notepad –comp system2

Get-WmiObject win32_logicaldisk -filter “drivetype=3” | Out-File c:\Reports\Disks.txt

Get-diskutil system2 | ft –auto

$data | sort system2 | ft –auto

$data | export.csv c:\new.csv

Import-csv c:\new.csv

Start “websiteName”

Get-command

Get-help

Enable-PSRemoting

Disable-PSRemoting

Get-wmiobject win32bios |format-list *

Get-EventLog (-newest 5 –logname application)

Get-process notepad,winword | format-lest *

Get-service wmi*

Copy-item source –destination c:\new

Get-acl c:\newfolder

Group Policy 2008 Features

Group Policy 2008 Features: I will discusses about the Group policy changes in windows 2008 server, Microsoft have made some of interesting changes and added new features in Group Policy 2008, first I will list the features and explain one by one

• New Administrative template files (ADMX)
• New Policy settings
    o Power options
    o Block device installation
    o Improved security settings
    o Internet Explorer settings management
    o Assign printers based on location
    o Delegate printer driver installation to users

• Group Policy slow link detection
• SYSVOL replication change
• SYSVOL uses DFS Replication service to replicate Group Policy object files to other domain controllers (In windows server 2003 uses FRS to replicate this)

Am very interested about the below changes because I have faced several issues related to this in windows 2003 group policy

• Group Policy slow link detection
• Internet Explorer settings management
• Blocking device installation
• SYSVOL replication change

New Administrative template files (ADMX)

In windows server 2003 and earlier versions, ADM file used to store registry based GPO settings, In Windows server 2008 ADMX file used to store registry based GPO settings, it’s a XML based and easy to manage registry based policy settings

ADMX format support Multilanguage, centralized datastore, and version control capabilities, policy can be edited in other language that was created in English language because Group Policy tools will adjust the user interface according to the administrator's configured language, you can also create a Central Store for Group Policy Administrative Templates to reduce the disk space, see article in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkId=122539)

New Policy settings

Power options: Now you can configure the power option through group policy

Configure power option through GPO:
Computer Configuration ->Administrative Templates -> System -> Power Management

Block device installation: In windows 2003 to block the device assess like USB and CD drive we have to import the customized ADM file, in windows 2008 it’s inbuilt yes now you can configure he device access through group policy

Configure Block device installation through GPO:
Computer Configuration ->Administrative Templates -> System -> Device Installation

Improved security settings: IPsec & firewall setting are combined to provide the enhanced security and avoid policy duplication

Configure security settings through GPO:
Computer Configuration -> Windows Settings -> Security Settings -> Windows Firewall with Advance Security

Internet Explorer settings management: We had an issue like some one edited the GPO to update the trusted sites and we have lost entire IE configuration because he used a different account to change the group policy, it’s a known concern in Windows server 2003 because Internet Explorer policy settings would change based on the policy settings enabled on the administrative workstation used to view the settings.

In windows 2008 this behavior has been changed, you can change the Internet Explorer policy settings without affecting the policy configuration

Configure Internet Explorer settings through GPO:
Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer
User Configuration -> Administrative Templates -> Windows Components -> Internet Explorer

Click here to Configuring trusted website and activex settings for IE7 or Vista and later versions using group policy

Assign printers based on location: Install the network printer based on the user location, it’s very useful for the roaming user because if the user login to the network other then the base location GPO will install the printer for the new location.

Assign printers based on location through GPO:
Computer Configuration -> Windows Settings -> Deployed Printers
User Configuration -> Windows Settings ->Deployed Printers

Delegate printer driver installation to users: Now user can install the printer on there system without admin access, it helps to reduce the security risk and admin effort.

Delegate printer driver installation through GPO:
Computer Configuration -> Administrative Templates -> System -> Driver Installation

Group Policy slow link detection

This was a big problem in windows server 2003 because it uses the ICMP ping to detect the network bandwidth, some of the VPN sites ICMP ping might be disabled in firewall or the MTU size would be less then the required limit and also ping will increase the network traffic to overcome this problems Microsoft come up with solution called NLA (Network Location Awareness)

Network Location Awareness is a service on client computer, it provide necessary information about the network and GPO uses this to apply the policy settings, most important it’s not using ICMP ping and very efficient compare to earlier process in Windows 2003, Check Group Policy Processing over Slow Links for Windows server 2003

SYSVOL Replication

In windows server 2003 FRS (File replication service) has been used to replicate SYSVOL folder changes, in windows server 2008 you can use the DFS (Distributed File System) to replicate changes on the SYSVOL folder, to use this feature you should have Windows Server 2008 domain functional level that means all the domain controller has to be Windows Server 2008

If any changes in SYSVOL share, FRS replicate the entire file unlike the DFS, DFS only replicate the change in the file, sounds like a attribute level Active Directory replication, it compare the source and destination file using remote differential compression (RDC)

If you are migrated from windows 2003 to windows server 2008, FRS is the default replication service for SYSVOL replication, you have to migrate the SYSVOL share to use the DFS

Compare to earlier version Group Policy settings has increased from approximately 2,400 in Windows Server 2008 to optimize the environment and support new features, more info from technet

Recovering from a lost or corrupted quorum log

2012-10-14T04:22:00.002-07:00

Recovering from a lost or corrupted quorum log

Article ID: 245762 - View products that this article applies to.

System TipThis article applies to a different version of Windows than the one you are using. Content in this article may not be relevant to you. Visit the Windows 7 Solution Center

This article was previously published under Q245762

Expand all | Collapse all

SYMPTOMS

Important If this cluster is Windows 2000 Service Pack 4 (SP4)-based, and if the KB 872970 hotfix is installed, do not use the -ResetQuorumLog switch. Start the Cluster service normally.

Back to the top | Give Feedback

CAUSE

Back to the top | Give Feedback

RESOLUTION

248998 How to properly restore cluster information

Start the Services snap-in. (Click Start, point to Programs, click Administrative Tools, and then click Services.)
Right-click and select the properties of the Cluster service.
In the Start Parameters box, type:

-resetquorumlog

Then click the Start button.

Back to the top | Give Feedback

MORE INFORMATION

Back to the top | Give Feedback

REFERENCES

For more informationabout the KB 872970 hotfix, click the following article number to view the article in the Microsoft Knowledge Base:

872970 The quorum log file becomes corrupted in your Windows 2000 Advanced Server-based cluster environment

Check the server IP address from multiple servers

2012-09-29T03:32:00.002-07:00

Check the DC IP address from multiple DC's

Some time we have to check one server DNS IP address from many domain controllers, we can use this command, please enter the list of server in list.txt

for /f %a in (list.txt) do nslookup server name %a

exg:

for /f %a in (list.txt) do nslookup test0001 %a

This command will check the server IP adress from the list of DNS servers, some DNS server or DC have the wrong IP adress due to replication issue or DNS island issue, To resolve DNS island issue

I have used this command while the DNS island issue, to check the current registered DNS entry for the affected domain controller from other domain controllers, through this way you can confirm the correct DNS registration for that server, if you want to check the current registered server IP address from multiple servers than this command is very useful, for one or two servers you can check manually one by one.

Account lockout

2012-09-29T03:31:00.002-07:00

Account lockout

Account lockout is the most common issue in windows environment, I will discuss about the frequent account lock out issues and how to troubleshoot frequent account lockout issue

In a windows 2000/2003 domain environment if the password and account lockout policy enabled, then according to the lock out policy if the user wrongly type the password for more then 3 or 5 times, account will be lockout

It should be unlocked automatically another 30 min (depending on account lockout policy) for the frequent account lockout issue, follow the below account lockout troubleshoot steps

Use the below procedure for troubleshoot frequent account lockout issue

Syntex:

dsquery user –name username

Example:

dsquery user -name testuser

"CN=testuser,OU=Test,DC=test,DC=com"

Login to any one of Domain controller and using replmon utility and using the Full CN name, find the B server which has finally authenticated the Lockout of the User Account.

In replmon right click the server and select the “Show attribute meta-data for active directory object” copy the DN of the user then click OK

Or

Login to any one of Domain controller and use the below command to find the “lockout time” attribute change

Syntex:

Repadmin /showmeta “user DN”

Example:

Repadmin /showmeta "CN=testuser,OU=Test,DC=test,DC=com"

This will show the Meta data of the users, you can find the “lockout time” attribute change, from which Domain controller this attribute is changed, note the Domain controller name.

Or use the below command with find

Repadmin /showmeta "CN=testuser,OU=Test,DC=test,DC=com" | find /i "lockout time"

Login to the Domain controller and use the dumpel command to extract the latest events, or check event viewer manually on the DC

Dumpel -f c:\lockoutevents.txt -s test001 -l security -m security -e 6
44 642 529 539
Dump successfully completed.

Check the lockoutevents.txt file for the affected user; you will be able to find the account lockout event, you able to find the system from which the account has been lockout

Causes:

• Check if your user ID is being used to start/stop some services on affected system
• Check your user ID is being logging on to multiple computers
• Check any application using your old password on affected system
• Check Any Persistent drive mappings using your old password
• Check for TS session with old password

You can also use Microsoft ALTools to troubleshoot account lockouts

ALTools

Command to troubleshoot DNS issues (Nslookup Advance Usage)

2012-09-29T03:30:00.003-07:00

Command to troubleshoot DNS issues (Nslookup Advance Usage)

Nslookup is a command-line tool used to test and troubleshoot the DNS issues

Find the advance help for Nslookup

C:\>nslookup
Default Server: ns1chn.vsnl.com
Address: 202.54.6.60

> ?
Commands: (identifiers are shown in uppercase, [] means optional)
NAME - print info about the host/domain NAME using default server
NAME1 NAME2 - as above, but use NAME2 as server
help or ? - print info on common commands
set OPTION - set an option
all - print options, current server and host
[no]debug - print debugging information
[no]d2 - print exhaustive debugging information
[no]defname - append domain name to each query
[no]recurse - ask for recursive answer to query
[no]search - use domain search list
[no]vc - always use a virtual circuit
domain=NAME - set default domain name to NAME
srchlist=N1[/N2/.../N6] - set domain to N1 and search list to N1,N2, etc.
root=NAME - set root server to NAME
retry=X - set number of retries to X
timeout=X - set initial time-out interval to X seconds
type=X - set query type (ex. A,ANY,CNAME,MX,NS,PTR,SOA,SRV)
querytype=X - same as type
class=X - set query class (ex. IN (Internet), ANY)
[no]msxfr - use MS fast zone transfer
ixfrver=X - current version to use in IXFR transfer request
server NAME - set default server to NAME, using current default server
lserver NAME - set default server to NAME, using initial server
finger [USER] - finger the optional NAME at the current default host
root - set current default server to the root
ls [opt] DOMAIN [> FILE] - list addresses in DOMAIN (optional: output to FILE)
-a - list canonical names and aliases
-d - list all records
-t TYPE - list records of the given type (e.g. A,CNAME,MX,NS,PTR etc.)
view FILE - sort an 'ls' output file and view it with pg
exit - exit the program

Set All

command will display the current configuration settings; you can always change the settings using the same set command, but this setting only for the current session, this will change to default settings while to exit the command

> set all
Default Server: ns1chn.vsnl.com
Address: 202.54.6.60

Set options:
nodebug
defname
search
recurse
nod2
novc
noignoretc
port=53
type=A
class=IN
timeout=2
retry=1
root=A.ROOT-SERVERS.NET.
domain=
MSxfr
IXFRversion=1
srchlist=

Set type

To change the query type user the below command, by default type=A, this will only query the host record (A record) to query for the mail exchanger data, type the following:

> set type=mx
> google.com
Server: ns1chn.vsnl.com
Address: 202.54.6.60

Non-authoritative answer:
google.com MX preference = 10, mail exchanger = smtp4.google.com
google.com MX preference = 10, mail exchanger = smtp1.google.com
google.com MX preference = 10, mail exchanger = smtp2.google.com
google.com MX preference = 10, mail exchanger = smtp3.google.com

In this way you can use the different query type (A, ANY, CNAME, MX, NS, PTR, SOA, SRV).

any - displays all the records for that domain.
cname - CName (Canonical Name) is used for nicknames or aliases, it is used to redirect web address to another
mx - Mail eXchange (MX). Used to define which domain handles the email
ns - Look up the Name servers for this record
ptr - A record that points an IP address to a single name, unlike a name which can be associated with many IP addresses
soa - Start Of Authority
srv - Resource records

The first time a query is made for a remote name, the answer is authoritative, but subsequent queries are nonauthoritative. The first time a remote host is queried, the local DNS server contacts the DNS server that is authoritative for that domain. The local DNS server will then cache that information, so that subsequent queries are answered nonauthoritatively out of the local server's cache.

Set debug

Using this option you can turn on or off the debug display, nothing but the detailed lookup result, by default this option disabled (set nodebug) you can use the below command turn on the debug mode

> set debug
> google.com
Server: ns1chn.vsnl.com
Address: 202.54.6.60

------------
Got answer:
HEADER:
opcode = QUERY, id = 2, rcode = NOERROR
header flags: response, want recursion, recursion avail.
questions = 1, answers = 3, authority records = 4, additional = 4

QUESTIONS:
google.com, type = A, class = IN
ANSWERS:
-> google.com
internet address = 74.125.67.100
ttl = 235 (3 mins 55 secs)

AUTHORITY RECORDS:
-> google.com
nameserver = ns1.google.com
ttl = 170814 (1 day 23 hours 26 mins 54 secs)

ADDITIONAL RECORDS:
-> ns1.google.com
internet address = 216.239.32.10
ttl = 302197 (3 days 11 hours 56 mins 37 secs)
------------
Non-authoritative answer:
Name: google.com
Addresses: 74.125.67.100, 74.125.127.100, 74.125.45.100

We have querying “google.com, type = A, class = IN”

Normal query Nslookup will return only the IP address of google.com, in debug mode it will provide corresponding name server records and authority records which resolve to the IP addresses (Additional records)

So we came to know from where the host (google.com) getting resolved, able to find the corresponding IP address as well as holding DNS server (ns1.google.com)

Set d2

Using this Option you can turn on or off the EXHAUSTIVE debug display. Retrieves the complete dump of what is sent and received via the DNS requests

Set norecurse

Before this you should know about Iterative(norecurse) and Recursive(recurse) Queries.
Please check the below link for more info:

DNS Query Types

This will display other domain name servers to query, if the default name server does not have the information.

Turn off recursion and then try to look up a name that is not cached locally. since our default name server does not have the entry, this will display other name servers that might know the answer

> set norecurse
> iit.co.in
Server: ns1chn.vsnl.com
Address: 202.54.6.60

Name: iit.co.in
Served by:
- b0.cctld.afilias-nst.org
199.254.60.1
co.in
- a0.cctld.afilias-nst.info
199.254.59.1
co.in
- a2.in.afilias-nst.info
199.249.117.1
co.in
- b2.in.afilias-nst.org
199.249.125.1
co.in
- d0.cctld.afilias-nst.org
199.254.62.1
co.in
- c0.cctld.afilias-nst.info
199.254.61.1
co.in
- a1.in.afilias-nst.in
203.119.49.201
co.in
- b1.in.afilias-nst.in
220.226.205.253
co.in

> iit.co.in b0.cctld.afilias-nst.org
Server: b0.cctld.afilias-nst.org
Address: 199.254.60.1

Name: iit.co.in
Served by:
- ns409.websitewelcome.com

iit.co.in
- ns410.websitewelcome.com

iit.co.in

> iit.co.in ns409.websitewelcome.com
Server: ns409.websitewelcome.com
Address: 74.54.42.226

Name: iit.co.in
Address: 74.54.189.219

In the above example I have using iit.co.in, if you query iit.co.in with set norecurse this will display other name servers that might know the answer, since our default name server does not. I have used b0.cctld.afilias-nst.org name server to look for the answer, this will lists the ns server that has the authoritive answer. Then have the Name server for one more time, iit.co.in ns409.websitewelcome.com and we will get the A record 74.54.189.219

This will help to troubleshoot the DNS related issues, able to find the problematic name servers and able to find trace the DNS issue.

> set recurse
> iit.com
Server: ns1chn.vsnl.com
Address: 202.54.6.60

Non-authoritative answer:
Name: iit.com
Address: 74.54.82.185

With set recurse we will get the direct answer

Set srchlis

Command to change search list and default Domain Name System (DNS) domain name

Set srchlist=N1[N2/../N6]

Specifies one or up to six domain names to be appended to unqualified host names when attempting to resolve the host name. Each domain name specified is tried in turn until a match is found.
This option also directs the default domain to be set to the first domain name specified in the search list. The minimum abbreviation for this option is srchl.

While querying the host name no need to provide the FQDN, only host name enough, domain from the Srchlist added to the given host name to make the FQDN

Examples

To set the DNS domain to test.com
set srchlist=test.com/test1.com
> set srchlist=test.com
> test0001
Server: ns1chn.vsnl.com
Address: 202.54.6.60

Non-authoritative answer:
Name: test0001.test.com
Address: 205.178.152.103

In the above example I have only provide the host name (test0001) but Nslookup able to query the FQDN (test0001.test.com) using the set srchlist=test.com command.

DOMAIN SERVER
Look up a given domain name (NAME1) using this name server (NAME2). See example below

> iit.co.in ns409.websitewelcome.com
Server: ns409.websitewelcome.com
Address: 74.54.42.226

Name: iit.co.in
Address: 74.54.189.219

set root

Changes the name of the root server to the name specified by the HOST parameter, The root server by default is defined to be "A.ROOT-SERVERS.NET"

set root=A.ROOT-SERVERS.NET

set retry

Changes the number of times to retry quering a name server, Default retries is 1.

set retry=2

Set timeout

Sets the initial time out value in seconds, Default timeout value is 2 seconds.

>set timeout=4

LS

Rerieve the zone list of this domain. Note: On almost all Name Servers this operation is restricted or turned off

Most of the time, when using this command you would get a query refused output.Options:-a - list canonical names and aliases-d - list all records-t TYPE - list records of the given type (i.e. cname, mx, ns etc.)

Lingering objects

2012-09-29T03:30:00.000-07:00

Lingering objects

When an object is deleted, Active Directory replicates the deletion as a tombstone object, which consists of a small subset of the attributes of the deleted object. By inbound-replicating this object, other domain controllers in the domain and forest become aware of the deletion. The tombstone is retained in Active Directory for a specified period called the tombstone lifetime. At the end of the tombstone lifetime, the tombstone is deleted from the directory permanently.
After the tombstone is removed permanently, the object deletion can no longer be replicated. Therefore, the tombstone lifetime defines how long domain controllers in the forest retain knowledge of a deleted object and thus the time during which a unique deletion must be received by all direct and transitive replication partners of the originating domain controller.

The default value of the tombstone lifetime depends on the version of the operating system that is running on the first domain controller that is installed in a forest, as follows:
Windows 2000 Server or Windows Server 2003: The default value is 60 days.
Windows Server 2003 with Service Pack 1 (SP1): The default value is 180 days

How Lingering Objects Occur

When conditions beyond your control cause a domain controller to be disconnected for a period that is longer than the tombstone lifetime, one or more objects that are deleted from Active Directory on all other domain controllers might remain on the disconnected domain controller. Such objects are called lingering objects. Because the domain controller is offline during the entire time that the tombstone is alive, the domain controller never receives replication of the tombstone.
When it is reconnected to the replication topology, this domain controller acts as a source replication partner that has an object that its destination partner does not have.
Replication problems occur when the object on the source domain controller is updated. In this case, when the destination attempts to inbound-replicate the update, the destination domain
controller responds in one of two ways:

If the destination domain controller has strict replication consistency enabled, it recognizes that it cannot update the object and locally halts inbound replication of the directory partition from that source domain controller.

If the destination domain controller has strict replication consistency enabled, it recognizes that it cannot update the object and locally halts inbound replication of the directory partition from that source domain controller.

Lingering objects can reside in writable or read-only partitions that are potentially replicated between domain controllers in the same or different domains in the same forest.

Causes of Long Disconnections

Indications That a Domain Controller Has Lingering Objects

• A domain controller is left in a storage room and forgotten, or shipment of a prestaged domain controller to its remote location takes longer than a tombstone lifetime.

• Replication fails and monitoring is not in place. Failures can occur as follows:

• A domain controller is started and connected to the corporate intranet but experiences inbound replication failure as a result of an underlying network connectivity failure, name resolution failure, or authentication failure that prevents replication from occurring.

• A bridgehead server is overloaded, and replication becomes backlogged. Excessively high replication load on a global catalog server, in combination with a short intersite replication interval, can result in updates not being replicated.

• Global catalog servers replicate read-only replicas of all domain directory partitions in the forest. The replication of read-only replicas has a lower priority than the replication of writable replicas. In addition, global catalog servers are often bridgehead servers, which adds to the replication load. If the replication load on global catalog servers acting as bridgehead servers is too high as a result of an extremely short replication interval, excessive numbers of concurrent outbound replication partners, or a combination of both, the replication queue can become backlogged. If the condition persists, read-only replicas can remain in the queue indefinitely. These conditions can result in lingering objects on a global catalog server.

• Wide area network (WAN) connections are unavailable for long periods. For example, a domain controller onboard a cruise ship might be unable to replicate because the ship is at sea for longer than the tombstone lifetime.

• The reported event is a false positive because an administrator shortened the tombstone lifetime to force tombstone deletion (garbage collection).

• The reported event is a false positive because the system clock on the source or destination domain controller is improperly rolled forward or back in time. Clock skews are most common following a system reboot and can have the following causes:

• System clock battery or motherboard problems.

• The time source for a computer is improperly configured, including a time source server configured with Windows Time service (W32time), third-party time servers, and network routers.

• The system clock is advanced or rolled back by an administrator attempting to extend the useful life of a system state backup or accelerate the garbage collection of deleted objects. Make sure that the system clock reflects the actual time and that event logs do not contain events from the future or invalid past.

Indications That a Domain Controller Has Lingering Objects
An outdated domain controller can store lingering objects with no noticeable effect as long as an administrator, application, or service does not update the lingering object or attempt to create an object with the same name in the domain or with the same user principal name (UPN) in the forest. However, the existence of lingering objects can cause problems, especially if the object is a security principal.
Symptoms Associated with Lingering Objects
The following symptoms indicate that a domain controller has lingering objects:

• A deleted user or group account remains in the global address list (GAL) on Exchange servers. Therefore, although the account name appears in the GAL, attempts to send e-mail messages result in errors.
• Multiple copies of an object appear in the object picker or GAL for an object that should be unique in the forest. Duplicate objects sometimes appear with altered names, causing confusion on directory searches. For example, if the relative distinguished name of two objects cannot be resolved, conflict resolution appends "*CNF:GUID" to the name, where * represents a reserved character, CNF is a constant that indicates a conflict resolution, and GUID represents the objectGUID attribute value.
• E-mail messages are not delivered to a user whose Active Directory account appears to be current. After an outdated domain controller or global catalog server becomes reconnected, both instances of the user object appear in the global catalog. Because both objects have the same e-mail address, e-mail messages cannot be delivered.
• A universal group that no longer exists continues to appear in a user’s access token. Although the group no longer exists, if a user account still has the group in its security token, the user might have access to a resource that you intended to be unavailable to that user.
• A new object or Exchange mailbox cannot be created, but you do not see the object in Active Directory. An error message reports that the object already exists.
• Searches that use attributes of an existing object incorrectly find multiple copies of an object of the same name. One object has been deleted from the domain, but it remains in an isolated global catalog server.

If an attempt is made to update a lingering object that resides in a writable directory partition, events are logged on the destination domain controller. However, if the only version of a lingering object exists in a read-only directory partition on a global catalog server, the object cannot be updated and this type of event will never be triggered.

Events that indicate that lingering objects are present in the forest

If a destination domain controller logs event ID 1388 or event ID 1988, a lingering object has been detected and one of two conditions exists on the destination domain controller:

• Event ID 1388: Inbound replication of the lingering object has occurred on the destination domain controller.

• Event ID 1988: Inbound replication of the directory partition of the lingering object has been blocked on the destination domain controller.

Event ID 1388

This event indicates that a destination domain controller that does not have strict replication consistency enabled has received a request to update an object that does not reside in the local copy of the Active Directory database. In response, the destination domain controller has requested the full object from the source replication partner. In this way, a lingering object has been replicated ("reanimated") to the destination domain controller.

Event ID 1988
This event indicates that a destination domain controller that has strict replication consistency enabled has received a request to update an object that does not exist in its local copy of the Active Directory database. In response, the destination domain controller has blocked replication of the directory partition containing that object from that source domain controller. The event text identifies the source domain controller and the outdated (lingering) object. An example version of the event text is as follows:

Event ID 2042

If a domain controller has not replicated with its partner for longer than a tombstone lifetime, it is possible that a lingering object problem exists on one or both domain controllers. When this condition occurs, inbound replication with the source partner is stopped on the destination domain controller and event ID 2042 is logged in the Directory Services event log. The event identifies the source domain controller and the appropriate steps to take to either remove the outdated domain controller or remove lingering objects and restore replication from the source domain controller.

How to find the domain controller that contains the lingering object

If we enable Strict Replication Consistency

Lingering objects are not present on domain controllers that log Event ID 1988. The source domain controller contains the lingering object

If we doesn’t enable Strict Replication Consistency

Lingering objects are not present on domain controllers that log Event ID 1388. Domain controller that doesn’t log Event ID 1388 and that domain controller contain the lingering object

You have a 100 Domain controllers which doesn’t enable Strict Replication Consistency, then you will get the Event ID 1388 on all the 99 Domain controllers except the one that contain the lingering object

Need to Remove Lingering Objects from the affected domain controller or decommission the domain controller

You can use Event Comb tool (Eventcombmt.exe) is a multi-threaded tool that can be used to gather specific events from the Event Viewer logs of different computers at the same time.

You can download these tools from the following location:
http://www.microsoft.com/downloads/details.aspx?FamilyID=9d467a69-57ff-4ae7-96ee-b18c4790cffd&DisplayLang=en

Windows 2008 installation types

2012-09-29T03:01:00.001-07:00

Windows 2008 gives you two installation options or installation types

Windows 2008 can be installed in two types,

1. Full installation
2. Server Core installation

Full installation

This option install the complete installation in windows server, this installation includes the entire user interface and support all the server roles, it’s a normal server installation like the windows 2003 server

Server Core installation

This is a new feature in the windows 2008 server, in the Server Core installation, which is a cut-down version of Windows without the Windows Explorer GUI. Because you don’t have the Windows Explorer to provide the GUI interface that you are used to,

You configure everything through the command line interface or remotely using a Microsoft Management Console (MMC). The Server Core can be used for dedicated machines with basic roles such as Domain controller/Active Directory Domain Services, DNS Server, DHCP Server, file server, print server, Windows Media Server, IIS 7 web server and Windows Server Virtualization virtual server.

We able to open some of the GUI application in the in the Server Core installation of windows 2008, notepad, task manager, Data and Time console, Regional Settings console and all other are managed through remote management

Windows 2008 DNS features

2012-09-29T02:44:00.004-07:00

Compare to windows 2003, Windows 2008 have more features and improvement, I will discuss the improvement related to DNS in this article, Microsoft done the improvement that really required for the IT environment, Windows 2008 DNS features are listed below

Background zone loading: If you are an administrator for an large environment you would have seen this issue, after the DNS server restart it take some time to load the DNS zones, till that time server will not respond to an DNS query from client (even server will not respond to the nslookup) you have to wait for the server to load the zones, this issue has been rectified in Windows 2008 DNS server, since zone data loaded in the background while the time of DNS server restart and DNS server respond to the client query very quickly.

IP version 6 support: The Windows 2008 DNS Server fully supports the longer addresses of the IPv6 specification.

Support for read-only domain controllers (RODCs): We able to modify the Primary DNS zone, what about the primary zone in read only domain controller, we can’t modify or update the primary zone on read only domain controller, yes Windows 2008 server provides primary read-only zones on RODCs.

Global single names: Not required to add DNS suffixes for the name resolution for the various domain names, GlobalNames zone provides single-label name resolution for large enterprise networks, if your environment doesn’t have WINS or planning on deploying IPv6-only in your environment then you Need to Deploy the GlobalNames Zone, it’s useful when using DNS name suffixes to provide single-label name resolution is not practical.

Global query block list: Clients of such protocols as the Web Proxy Auto-Discovery Protocol (WPAD) and the Intra-site Automatic Tunnel Addressing Protocol (ISATAP) that rely on DNS name resolution to resolve well-known host names are vulnerable to malicious users who use dynamic update to register host computers that pose as legitimate servers. The DNS Server role in Windows Server 2008 provides a global query block list that can help reduce this vulnerability.

DNS Security Extensions (DNSSEC): DNSSEC works by digitally signing these records for DNS lookup using public-key cryptography. The correct DNSKEY record is authenticated via a chain of trust, starting with a set of verified public keys for the DNS root zone which is the trusted third party.

The following DNSSEC related features are introduced in Windows Server 2008 R2:

The ability to sign a zone (that is, to provide the zone a digital signature)
The ability to host signed zones
New support for the DNSSEC protocol
New support for DNSKEY, RRSIG, NSEC, and DS resource records.

A key feature of DNSSEC is that it enables you to sign a DNS zone – which means that all the records for that zone are also signed.The DNS client can take advantage of the digital signature added to the resource records to confirm that they are valid. This is typical of what you see in other areas where you have deployed services that depend on PKI. The DNS client can validate that the response hasn’t been changed using the public/private key pair. In order to do this, the DNS client has to be configured to trust the signer of the signed zone.

The new Windows Server 2008 R2 DNSSEC support enables you to sign file-based and Active Directory integrated zones through an offline zone signing tool. I know it would have been easier to have a GUI interface for this. When configured with a trust anchor, a DNS server is able to validate DNSSEC responses received on behalf of the client. However, in order to prove that a DNS answer is correct, you need to know at least one key or DS record that is correct from sources other than the DNS. These starting points are called trust anchors.

Another change in the Windows 7 and Windows Server 2008 R2 DNS client is that it acts as a security-aware stub resolver. This means that the DNS client will let the DNS server handle the security validation tasks, but it will consume the results of the security validation efforts performed by the DNS server. The DNS clients take advantage of the NRPT to determine when they should check for validation results. After the client confirms that the response is valid, it will return the results of the DNS query to the application that triggered the initial DNS query.

DNS Cache Locking: Using the DNS Cache locking in Windows Server 2008 R2 enables you to control the ability to overwrite information contained in the DNS cache. If you turned on the DNS cache locking then DNS server will not allow cached records to be overwritten for the duration of the time to live (TTL) value. This helps protect your DNS server from cache poisoning.

Difference between Windows Server 2008 and Windows Server 2008 R2

2012-09-29T02:44:00.002-07:00

Windows Server 2008 and Windows Server 2008 SP2 are the same operating system, just at a different service pack level (Windows Server 2008 started at the SP1 level because it was released quite a bit after Windows Vista and SP1 was already out). As for as the windows 2008 and windows 2008 SP2 concern it’s uses the same OS kernel of windows vista, and in windows Server 2008 R2 has the same OS kernel of Windows7
Windows Server 2008 R2 is the server release of Windows 7, so it's version 6.1 of the OS. It introduces quite a lot of new features, because it's actually a new release of the system.

Windows Server 2008 is based on the 6.0 kernel, the same of Windows Vista, Windows Server 2008 R2 is based on the 6.1 one, the same of Windows 7, while versioning it as 6.1 to indicate its similar build to Vista and increase compatibility with applications that only check major version numbers, similar to Windows 2000 and Windows XP both having 5.x version numbers

There are also differences at the GUI level, because Windows Server 2008 R2 uses the same new GUI introduced with Windows 7

The single most important point: Windows Server 2008 R2 exists only for 64-bit platforms, there's no x86 version anymore.

Windows Server 2008 R2 has many features that are designed specifically to work with client computers running Windows 7. Windows 7 is the next version of the Windows operating system from Microsoft

Some of the features that only available when running Windows 7 client computers with server computers running Windows Server 2008 R2, compare to windows 2008 SP2 and windows 2008 R2, windows 2008 R2 have more Features, I will cover this in my upcoming article.

Active Directory 2008 features

2012-09-29T02:42:00.002-07:00

Whats new in windows 2008 Active Directory

As an Active Directory administrator very curies about the windows 2008 features compare to the earlier version like windows 2003, Windows 2008 comes with the whole bunch of features, and am going to discuss specific about the features of Active Directory server roles in Windows 2008

First I will list the features of windows 2008 Active directory and will discuss in detail of each in my upcoming article

Auditing

Now you can know the previous and present values for the changed attributes of the active directory object using the new auditing feature in windows 2008, as per the windows 2003 auditing you will only know the present values of the changed attribute

This is very useful features in windows 2008 since you can revert back the changes using the previous value of the attribute

Fine-Grained Passwords

By default in windows 2003 all the user account in the domain should use the same password policy configured in domain level, thats why we called domain is a security boundary, if you require a different password policy then you have to create new domain

In windows 2008 password policy can be configured for specific group of peoples with in the domain

Read-Only Domain Controller

Every one know about the BDC (backup domain controller) and it’s a same as the BDC but it only take the advantages from the BDC and it’s specifically designed for the today’s requirements like branch office setup and to managing the branch office

We all know how difficult to design and manage the domain controller from the branch office, some time it lead to the lingering object, but using the Read-Only Domain Controller
In the branch office where the physical security of the domain controller is in question, or domain controllers that host additional roles, requiring other users to log on and maintain the server

In any Active Directory environment if one Domain Controller not replicated with the partner Domain Controller more then one month, then it’s a very critical issue you have to rectify the replication problem as soon as possible or the Domain Controller needs to be decommissioned with in the tombstone lifetime, since its read-only domain controller no worries about the tombstone time.

Restartable Active Directory Domain Services

Hey good new, now no need to restart the domain controller for every time for the active directory maintenance.

In windows 2008 active directory is a services, you can stop or restart the services for maintenance without restarting the domain controller and restarting it in Directory Services Restore Mode is not required for most maintenance functions, however still some maintenance function require Directory Services Restore Mode

Database Mounting Tool

Active Directory Database mounting tool in Windows Server 2008 to create and view snapshots of data that is stored in Active Directory Domain Services, and no need to restart the domain controller. A snapshot is a shadow copy created by the Volume Shadow Copy Service, at different times so that you can better choose which data to restore after object deletion. This reduces the administrator time and no need to restore multiple backups to compare the Active Directory data.

Active Directory Database mounting tool can be called Snapshot Viewer, Snapshot Browser, and Active Directory data mining tool.

Active Directory Recycle Bin

You can restore the accidentally deleted Active Directory object, without Active Directory authoritative restore, this can be used for single object restore like a accidental deletion of user or OU and you can reduce the domain controller downtime

Active Directory module for Windows PowerShell

PowerShell available on windows 2003 itself, however it’s not fully supported for Active Directory, you can’t manage the Active Directive using the PowerShell in windows 2003

In windows 2008 Windows PowerShell provides command-line scripting for administrative, configuration, and diagnostic tasks

You can manage the Active Directory with Exchange Server, Group Policy, and other services and it’s very easy to use like a windows commands, you can easily pipe cmdlets to build complex operations

Active Directory Administrative Center

It’s new tool in windows 2008 R2 to manage active directory, we already have active directory users and computer to manage the active directory, using this new tool you can manage active directory in a new way

As an administrator you perform most of the task commonly that is daily, some how it’s hard to open an active directory user and computer and find the object and do the task, in this new tool Active Directory Administrative Center it’s very easy to do a common task like password reset and search the Active Directory object and others

Active Directory Best Practices Analyzer

This can be helped to identify and implement the best practices in the configuration of your active directory environment, this will scan your network and find the best practice violations,
Then you can correct that, to get the best out of Active Directory services in windows 2008.

Active Directory Web Services

Active Directory Web Services is give you the Web service interface to Active Directory domains and AD LDS instances (Active Directory Lightweight Directory Services)

Active Directory Database Mounting Tool uses the Active Directory Web Services as a front end, like that Windows PowerShell and Active Directory Administrative Center is used the Active Directory Web Services to access the directory service instances.

Offline domain join

Offline domain join makes to join a member server to the domain even the domain controller not reachable from the member server

And this can be very useful for bulk deployment, when the system starts, it will automatically joined to the domain, this will reduce the administrative effort

Managed Service Accounts

Normally applications and services uses the Local Service and Network Service and Local System accounts, it’s easy to configure and shared among multiple applications and services and cannot be managed on a domain level

You can use the domain account for the application (services), this can isolate the privileges for the application, but it’s very hard to manage these domain accounts like password management

We have two new types of accounts, Managed service accounts and virtual accounts in windows 2008, now you can easily manage the service principal names (SPNs), it will provide Automatic password management

Active Directory Management Pack

You can monitor the Active Directory service on windows 2008 using the Active Directory Management Pack (MOM, SCOM)

Designed specifically to monitor the performance and availability of Active Directory Domain Services (AD DS), also monitors the overall health of AD DS and alerts you to critical performance issues.

Am sure you also amused about the features of windows 2008 and I would like to explain in details of each of this features in my up-coming article and your feedbacks are welcome

New Active Directory Features in Windows Server 2008 R2

2012-09-29T02:37:00.002-07:00

September 03, 2009 12:00 AM

New Active Directory Features in Windows Server 2008 R2

AD capabilities will turn any admin into SuperAdmin

John Savill

Windows IT Pro

InstantDoc ID #102483

Rating: (1)

Windows Server 2008 R2 is known for its new Hyper-V implementation with zero down-time migration capabilities; however, changes to Active Directory (AD) in Server 2008 R2 are almost as compelling and hint at this important infrastructure’s future developments. The new AD features can be separated into two areas—manageability enhancements and "everything else," which includes some very useful capabilities.
Domain and Forest Functional Level Changes
Server 2008 R2 offers a new domain functional level, which you can enable after you have all Windows Server 2008 R2 domain controllers (DCs) in the domain. It adds support for the new authentication mechanism assurance features we will discuss shortly.

Server 2008 R2 also offers a new forest functional level. It requires all DCs in the entire forest to be running Server 2008 R2 and adds support for the new Recycle Bin feature. Unlike previous Windows Server domain and forest functional level changes, this operation isn’t one-way and can be reversed providing you haven’t activated any feature that requires the domain or forest level.

For example, if you’ve moved to the Server 2008 R2 forest functional level and haven’t enabled the Recycle Bin, you could drop the forest functional level back down to the Server 2008 functional level. After you move to a Server 2008 R2 functional level, you aren’t able to add Windows Server 2003 or Server 2008 DCs to the domain or forest. Before you can introduce a Windows Server 2008 R2 DC into a domain, you must perform a schema update as well as other tasks to be able to use certain new features in Server 2008 R2.

If you’re coming from a Windows 2003 domain as opposed to a domain already prepared for Server 2008, you’ll also need to update Group Policy objects (GPOs). In terms of co-existence, Windows 2000 SP4, Windows 2003 and Server 2008 DCs can exist in a domain with Server 2008 R2 DCs. Windows NT 4.0 BDCs aren’t supported in a domain with Server 2008 R2. Obviously as we start changing domain/forest functional modes we are restricted to the OS level of DCs to match our domain/forest level.
Managebility Features
Server 2008 started the big push for Windows PowerShell-based management across the OS and services, but not all components had PowerShell support (many, in fact, did not). Server Core’s new minimal installation mode with reduced footprint and attack surface didn't even support PowerShell because of the .NET dependency, which wasn’t available on Server Core.

Server 2008 R2 remedies many of these PowerShell omissions. Server Core now supports many components of .NET, which means PowerShell is supported on Server 2008 R2 Server Core installations, and many roles and features that previously didn't support PowerShell now do, including AD.

The AD PowerShell implementation includes 75 PowerShell cmdlets and a PowerShell provider with an additional 14 cmdlets. Microsoft estimates that around 70 percent of AD functions can be performed with direct AD cmdlets written specifically to address the actions. The other 30 percent of these actions can be accomplished with PowerShell but not with dedicated cmdlets; instead, combinations of cmdlets are used.
Active Directory Web Service
A new Active Directory Web Service (AD WS) is installed on Server 2008 R2 DCs; it operates over port 9389. The required firewall exception is enabled automatically as part of the role installation (including server core DCs); however, if you control firewall exceptions via Group Policy, you need to ensure you open this new port. Currently most tools connect using LDAP and remote procedure calls (RPCs).

However, offering a web service for AD access enables a superior developer experience and forms the first stage of a bigger objective, which is the enablement of AD for cloud and distributed service scenarios. AD PowerShell cmdlets use the interface provided by AD Web Service (ADWS). If a DC can’t be found offering the ADWS, then the AD PowerShell cmdlets won’t work.

It’s therefore very important you have a sufficient number of R2 DCs running ADWS across all domains that a PowerShell cmdlet might query. Although you can disable ADWS, it’s discouraged. Note that when Server 2008 R2 is released, an out-of-band update for Windows 2003 and Server 2008 will be released to add ADWS to these AD implementations.
Active Directory Administrative Center
Active Directory Administrative Center (ADAC) (see Figure 1) is a new interface designed to replace Active Directory Users and Computers. In future server versions, ADAC will also replace AD Domains and Trusts and AD Sites and Services, offering a single administrative interface for all AD management along with support for features that currently don't have any graphical interface, such as Recycle Bin and fine-grained password policies (FGPPs).

ADAC lets you manage users, groups, computers, and organizational units (OUs) and offers powerful and intuitive search and filter options. Within a single instance, it lets you manage multiple domains and even connect to multiple DCs simultaneously.

ADAC is built on PowerShell but currently doesn’t display the PowerShell commands that would be used to complete actions; this may be an option for a future version. ADAC consists of many layers; for example, it uses PowerShell, and PowerShell uses ADWS. ADAC’s many new components and dependencies on the new 2008 R2 capabilities actually give us a very rich platform for AD management.
Even More Great Management Features
In addition to the key features above, you’ll also find more components related to management. Each is extremely useful in its own right.

Active Directory Health Model. This is a single authoritative source for diagnostic information, which is used by the management packs and best practice analyzers. This health model can also be accessed by other third-party applications if necessary.
Best Practices Analyzer (BPA) for Active Directory. This is available through Server Manager and allows the installation of the selected DC to be validated against all the AD best practices. It’s a useful “quick access” check point to confirm configuration.
Management Pack for Server 2008 and Server 2008 R2. Although not an AD feature, a new System Center Operations Manager 2007 management pack monitors all features related to Server 2008 and Server 2008 R2 Active Directory implementations. See the Microsoft download page.
The Really Good Stuff
Server 2008 R2’s new management features give you many more options. However, the two most-sought after functions of Server 2008 R2 actually lie outside of management: Managed Service Accounts (MSAs) and the AD Recycle Bin.

Managed Service Accounts. Service accounts—dedicated AD accounts that run a server service—are the longest-standing security vulnerability in AD. Because services such as SQL Server and Exchange depend on these accounts, changing their passwords will interrupt the service.

To combat this problem, many installations opt to use built-in accounts such as the local system and network service accounts, which are then shared by many services. However, if one service is compromised, all the services using the same built-in account could be compromised. This has finally been fixed in R2 with MSAs.

Active Directory features

2012-09-29T02:35:00.001-07:00

New Active Directory features in Windows Server 2003 with Service Pack 1 (SP1)

The following list summarizes the Active Directory features that are new since the original release of Windows Server 2003.

Directory service backup reminders. A new event message, event ID 2089, provides the backup status of each directory partition that a domain controller stores, including application directory partitions and Active Directory Application Mode (ADAM) partitions. If halfway through the tombstone lifetime a partition has not been backed up, this event is logged in the Directory Service event log and continues daily until the partition is backed up.
Added replication security and fewer replication errors. Replication metadata for domain controllers from which Active Directory has been removed is no longer retained by default, although a waiting period can be configured. This change improves replication security and eliminates replication error messages that are caused by failed attempts to replicate with decommissioned domain controllers. For more information about preserving replication metadata, see How the Active Directory Replication Model Works.
Install from Media improvement for installing DNS servers. Install from Media improvements make it easier to create a new domain controller that is a Domain Name System (DNS) server by providing a new option to include application directory partitions in the backup media that is used to install the new domain controller. This option eliminates the requirement for replication of the DomainDNSZones and ForestDNSZones application directory partitions before the DNS server is operational.
Enhancements for replication and DNS testing. The Dcdiag.exe command-line tool, which is available in Windows Support Tools, provides new reporting on the overall health of replication with respect to Active Directory security. This test provides a summary of results, along with detailed information for each domain controller that is tested and a diagnosis of any security errors. Dcdiag.exe also has new DNS tests for connectivity, service availability, forwarders and root hints, delegation, dynamic update, locator record registrations, external name resolution, and enterprise infrastructure. These tests can be performed on one domain controller or on all domain controllers in a forest. For more information about using Dcdiag.exe, see Windows Support Tools Help.
Support for running domain controllers in virtual machines. On a single physical server that is running Windows Server 2003 and Microsoft Virtual Server 2005, you can install multiple Windows Server 2003 or Windows 2000 Server domain controllers in separate virtual machines. This platform is well suited for test environments. By using virtual machines, you can effectively host multiple domains, multiple domain controllers for the same domain, or even multiple forests on one physical server that is running a single operating system. Windows Server 2003 SP1 also provides protection against directory corruption that can result from improper backup and restore of domain controller images. For more information about running domain controllers in virtual machines, see Running Domain Controllers in Virtual Server 2005.
Operations master health and status reporting. If an operation that requires a domain controller that holds an operations master role (also known as flexible single-master operations (FSMO)) cannot be performed, events are now logged in the Directory Service event log. Events identify role holders that do not exist, exist but are not available, or are available but have not replicated recently with the contacting domain controller. For more information about operations masters, see How Operations Masters Work.
Extended storage of deleted objects. The default period that a copy of a deleted object is retained in Active Directory, called the tombstone lifetime, is extended from 60 days to 180 days. Longer tombstone lifetime decreases the chance that a deleted object remains in the local directory of a disconnected domain controller beyond the time when the object is permanently deleted from online domain controllers. The tombstone lifetime is not changed automatically when you upgrade to Windows Server 2003 with SP1, but you can change the tombstone lifetime manually after the upgrade. New forests that are installed with Windows Server 2003 with SP1 have a default tombstone lifetime of 180 days. For more information about tombstone lifetime, see How the Data Store Works.
Improved domain controller name resolution. In response to DNS name resolution failures that may be encountered during location of replication partners and global catalog servers, domain controllers running Windows Server 2003 with SP1 request other variations of the server name that might be registered, which results in fewer failures due to DNS delays and misconfiguration. For more information about DNS name resolution, see How DNS Support for Active Directory Works.
Improved server metadata removal. The Ntdsutil.exe command-line tool for managing the Active Directory database has new functionality that makes it easier to remove domain controller metadata. Preliminary steps, such as connecting to a server, domain, and site, are no longer required. You simply specify the server to remove. You can also specify the server on which to perform the deletion. Metadata removal is now more comprehensive: in addition to Active Directory replication metadata, the tool now removes File replication service (FRS) metadata and operations master metadata. If an operations master role is assigned to the server that is being removed, the tool attempts to transfer the role to an appropriate domain controller. For more information, see Delete extinct server metadata.
Improved security to protect confidential attributes. To prevent Read access to confidential attributes, such as a Social Security number, while allowing Read access to other object attributes, you can designate specific attributes as confidential by setting a search flag on the respective attributeSchema object. By default, only domain administrators have Read access to confidential attributes, but this access can be delegated. For more information about access to attributes, see How Security Descriptors and Access Control Lists Work.
Retention of SID history on tombstones. The sIDHistory attribute has been added to the set of attributes that are retained on an object tombstone when the object is deleted. If a tombstoned object is reactivated (undeleted), the sIDHistory attribute is now restored with the object. For more information about tombstones, see How the Data Store Works.
Adprep.exe improvements for Windows 2000 Server upgrades. The Adprep tool has been improved to reduce the impact of FRS synchronization that results from updating SYSVOL files during upgrade. Adprep is used to upgrade the Windows 2000 Server schema to the Windows Server 2003 schema and to update some forest- and domain-specific configuration, including SYSVOL, that is required for a Windows Server 2003 domain controller to be operational. The tool now allows performing SYSVOL operations in a separate step when the domain is prepared for upgrade. A new switch, /gpprep, has been added to accommodate the SYSVOL updates, which can be performed at a convenient time following the upgrade. The adprep /domainprep command, which formerly performed both directory and SYSVOL updates, now updates only the directory. Adprep also now detects third-party schema extensions that block an upgrade, identifies the blocking extensions, and recommends fixes. Microsoft Exchange schema objects are also detected so that the Exchange schema can be prepared appropriately to accommodate inetOrgPerson naming. For more information about Adprep.exe, see Adprep.
Improved authoritative restore. The authoritative restore option in Ntdsutil now locates backlinks for all objects that are authoritatively restored, including links that were created before implementation of the Windows Server 2003 or Windows Server 2003 interim forest functional level, in which linked-value replication (LVR) functionality was introduced. For example, suppose that a user object is restored and the user belongs to group G1, which was created before the forest functional level was raised, and the user also belongs to group G2, which was created after the forest functional level was raised. During authoritative restore of the user object, the member attribute of G2 is updated, but not the member attribute of G1. Ntdsutil now creates a text file that identifies the authoritatively restored objects and uses this file to create an LDAP Data Interchange Format (LDIF) file that can be used to restore all backlinks for pre-LVR groups in this domain. In the example, when this LDIF file is run after authoritative restore, the restored user is added to group G1. A new option in authoritative restore also allows you to generate an LDIF file that you can use to restore links in other domains in which a restored object has backlinks.

New Active Directory features in Windows Server 2003

With the new Active Directory features available in Microsoft® Windows Server® 2003, Standard Edition; Windows Server 2003, Enterprise Edition; and Windows Server 2003, Datacenter Edition, more efficient administration of Active Directory is available to you.
The following list summarizes the Active Directory features that are available by default on any domain controller running Windows Server 2003.

Multiple selection of user objects. Modify common attributes of multiple user objects at one time.
Drag-and-drop functionality. Move Active Directory objects from container to container by dragging one or more objects to a desired location in the domain hierarchy. You can also add objects to group membership lists by dragging one or more objects (including other group objects) to the target group.
Efficient search capabilities. Search functionality is object-oriented and provides an efficient search that minimizes network traffic associated with browsing objects. For more information, see Finding directory information.
Saved queries. Save commonly used search parameters for reuse in Active Directory Users and Computers. For more information, see Using saved queries.
Active Directory command-line tools. Run new directory service commands for administration scenarios. For more information, see Managing Active Directory from the command line.
InetOrgPerson class. The inetOrgPerson class has been added to the base schema as a security principal and can be used in the same manner as the user class. The userPassword attribute can also be used to set the account password. For more information, see User and computer accounts.
Application directory partitions. Configure the replication scope for application-specific data among domain controllers. For example, you can control the replication scope of Domain Name System (DNS) zone data stored in Active Directory so that only specific domain controllers in the forest participate in DNS zone replication. For more information, see Application directory partitions.
Ability to add additional domain controllers using backup media. Reduce the time it takes to add an additional domain controller in an existing domain by using backup media. For more information, see Using the Active Directory Installation Wizard.
Universal group membership caching. Prevent the need to locate a global catalog across a wide area network (WAN) when logging on by storing universal group membership information on an authenticating domain controller. For more information, see Global catalogs and sites.
Secure LDAP traffic. Active Directory administrative tools sign and encrypt all Lightweight Directory Access Protocol (LDAP) traffic by default. Signing LDAP traffic guarantees that the packaged data comes from a known source and that it has not been tampered with. For more information, see Connecting to domain controllers running Windows 2000.
Active Directory quotas. Quotas can be specified in Active Directory to control the number of objects a user, group, or computer can own in a given directory partition. Domain Administrators and Enterprise Administrators are exempt from quotas.

New domain- and forest-wide Active Directory features

New domain- or forest-wide Active Directory features can be enabled only when all domain controllers in a domain or forest are running Windows Server 2003 and the domain functionality or forest functionality has been set to Windows Server 2003. For more information about domain and forest functionality settings, see Domain and forest functionality.
The following list summarizes the domain- and forest-wide Active Directory features that can be enabled when either a domain or forest functional level has been raised to Windows Server 2003.

Domain controller rename tool. Rename domain controllers without first demoting them. For more information, see Renaming domain controllers.
Domain rename. Rename any Windows Server 2003 domain. You can change the NetBIOS name or DNS name of any child, parent, tree, or forest root domain. For more information, see Renaming domains.
Different location option for user and computer accounts. You can now redirect the default location for user accounts and computer accounts that are created by the following application programming interfaces (APIs): NetUserAdd, NetGroupAdd, and NetJoinDomain. You can redirect the location of the accounts from the Users and Computers containers to organizational units (OUs) where Group Policy settings can be applied. For more information, see Redirect the Users and Computers Containers.
Forest trusts. Create a forest trust to extend two-way transitivity beyond the scope of a single forest to a second forest. For more information, see Forest trusts.
Forest restructuring. Move existing domains to other locations in the domain hierarchy. For more information, see Renaming domains.
Defunct schema objects. Deactivate unnecessary classes or attributes from the schema. For more information, see Deactivating a class or attribute.
Dynamic auxiliary classes. Provides support for dynamically linking auxiliary classes to individual objects, and not just to entire classes of objects. In addition, auxiliary classes that have been attached to an object instance can subsequently be removed from the instance.
Global catalog replication improvements. Preserves the synchronization state of the global catalog when an administrative action results in an extension of the partial attribute set. This minimizes the replication traffic as a result of a partial attribute set extension by only transmitting attributes that were added. For more information, see Global catalog replication.
Replication enhancements. Linked-value replication allows individual group members to be replicated across the network instead of treating the entire group membership as a single unit of replication. For more information about linked-value replication, see How replication works. In addition, new spanning tree algorithms make replication more efficient, as well as more scalable across a larger number of domains and sites in both Windows 2000 and Windows Server 2003 forests. For more information, see Replication overview.
User access control to resources between domains or forests. Block users in a domain or forest from accessing resources in another domain or forest, and then allow selective access by setting the Allow to authenticate access control entry (ACE) on a local resource for the user or group object. For more information, see Accessing resources across domains or Accessing resources across forests.

New and updated features since Windows Server 2003 (without SP1)

Windows Server 2003 operating systems with Service Pack 1 (SP1) offer the following improvements (compared to Windows Server 2003 without SP1) that help provide increased levels of support for Active Directory:

Improved replication and DNS diagnostic testing capabilities: Active Directory® has been updated to provide automatic directory service backup reminders, improved protection against replication errors, improvements to Install from Media (to facilitate adding new domain controllers that are DNS servers), improved DNS diagnostic testing capabilities, and access to a new platform for running domain controllers in virtual machines under Microsoft® Virtual Server 2005. For more information about these and other new Active Directory features and enhancements, see New features for Active Directory.

New and updated features since Windows NT 4.0

The Windows Server 2003 family offers the following improvements (in comparison to Windows NT 4.0) that help provide increased levels of support for Active Directory:

Simplified user and network-resource management: Using Active Directory, you can build hierarchical information structures that make it easier for you to control administrative credentials and other security settings and that make it easier for your users to locate network resources, such as files and printers.

Flexible, secure authentication and authorization: Flexible and secure authentication and authorization services provide protection for data while minimizing barriers to doing business over the Internet. Active Directory supports multiple authentication protocols, such as the Kerberos V5 protocol, Secure Sockets Layer (SSL) v3, and Transport Layer Security (TLS) using X.509 v3 certificates, and security groups that span domains efficiently.

Directory consolidation: You can organize and simplify the management of users, computers, applications, and devices, and make it easier for users to find the information they need. You can take advantage of synchronization support through Lightweight Directory Access Protocol (LDAP)-based interfaces, and you can work with directory consolidation requirements specific to your applications.

Directory-enabled applications and infrastructure: Active Directory features make it easier for you to configure and manage applications and other directory-enabled network components.

Scalability without complexity: Active Directory scales to millions of objects per domain and uses indexing technology and advanced replication techniques to speed performance.

Use of Internet standards: Active Directory provides access through LDAP and uses a Domain Name System (DNS)-based namespace.

A powerful development environment: Active Directory provides a powerful development environment through Active Directory Service Interfaces (ADSI), which provides an object-oriented interface to Active Directory. ADSI makes it easy for programmers and administrators to create directory programs by using high-level tools such as Microsoft Visual Basic, Java, C, or Visual C++, without having to worry about the underlying differences between the different namespaces. For more information, see Programming interfaces.

Replication and trust monitoring: Active Directory provides Windows Management Instrumentation (WMI) classes to monitor whether domain controllers are successfully replicating Active Directory information and whether trusts are functioning properly.

Message Queuing distribution lists: Message Queuing (also known as MSMQ) enables you to send messages to distribution lists that are hosted in Active Directory.

New and updated features since Windows 2000

The Windows Server 2003 family offers several improvements (in comparison to Windows 2000) that help provide increased levels of support for and better management of Active Directory. For a list of the Active Directory features that are new in this release, see New features for Active Directory.

2008 R2 Features

2012-09-29T02:32:00.002-07:00

1. Active Directory Administrative Center

Windows Server 2008 R2 includes an enhanced Active Directory data management experience through the new Active Directory Administrative Center. The Active Directory Administrative Center, which is built on Windows PowerShell, uses a task-based administration model for managing users, groups, computers, organizational units and containers.
The key new features that the Active Directory Administrative Center provides are:

A customizable overview page that includes tiles featuring frequently performed administrative tasks
The ability to manage Active Directory objects across multiple domains
A more flexible navigation pane, which can be browsed using the tree view or the new list view
A breadcrumb bar you can use to navigate directly to the container you want to view
A redesigned object property page, which can be customized to your liking
The ability to perform query-building searches

2. Active Directory Module for Windows PowerShell

The Active Directory Module for Windows PowerShell, included in Windows Server 2008 R2, facilitates Active Directory administrative through Windows PowerShell. The Active Directory Module for Windows PowerShell is a collection of more than 75 Windows PowerShell cmdlets you can use to manage Active Directory Domain Services domains, Active Directory Lightweight Directory Services instances, and Active Directory Database Mounting Tool instances.

3. Active Directory Recycle Bin

Windows Server 2008 R2 provides the ability to undo accidental deletions of Active Directory objects through the new Active Directory Recycle Bin. The Active Directory Recycle Bin, which requires a forest functional level of Windows Server 2008 R2, must be enabled.
The Active Directory object life cycle is changed after the Active Directory Recycle Bin feature is enabled. One of the major differences is what happens when an object is deleted. In short, all of the object's link-valued and non-link-valued attributes are preserved, and the object is placed into a "logically deleted" state for a period of time. While an object is in this logically deleted state, it can be recovered using the Active Directory Recycle Bin feature.

4. Active Directory Best Practices Analyzer

Windows Server 2008 R2 includes a new Active Directory Best Practices Analyzer, which can be run using Server Manager and Windows PowerShell. The Active Directory Best Practices Analyzer can be used to scan one or more servers against a set of predefined best practices. Active Directory Best Practices Analyzer will report back whether each server is compliant or noncompliant with each best practice.
The Active Directory Best Practices Analyzer is installed automatically when the Active Directory Domain Services server role is installed. The Active Directory Best Practices Analyzer can be used to collect Active Directory Domain Services configuration information from Windows 2000, Windows Server 2003, Windows Server 2008, and Windows Server 2008 R2 domain controllers.

5. Active Directory Web Services

Windows Server 2008 R2 includes a new Windows service called Active Directory Web Services. Active Directory Web Services provides a web services interface to Active Directory Domain Services domains, Active Directory Lightweight Directory Services instances, and Active Directory Mounting Tool instances running on the same Windows Server 2008 R2 server as Active Directory Web Services.
Active Directory Web Services is automatically installed when the Active Directory Domain Services or Active Directory Lightweight Directory services are installed on a Windows Server 2008 R2 server. Active Directory Web Services is a prerequisite for a number of new client applications, such as the Active Directory Administrative Center and the Active Directory module for Windows PowerShell. If the Active Directory Web Services Windows service is stopped or disabled, these client applications will not be able to communicate with Active Directory.

6. Managed Service Accounts

Managed service accounts in Windows Server 2008 R2 facilitate the management of Active Directory Domain Services accounts. To leverage managed service accounts, you must prepare your current Active Directory schema for Windows Server 2008 R2. In addition, the functionality for managed service accounts varies depending on the operating system on your domain controllers.
If your domain controllers are running Windows Server 2008 R2, then you can use managed service accounts for both automatic password management and SPN management. If your domain controllers are running Windows Server 2008 or Windows Server 2003, then managed service accounts can be used for automatic password management but not for SPN management.

7. Offline Domain Join

Windows Server 2008 R2 includes a new process, called offline domain join, which allows you to join Windows 7 and Windows Server 2008 R2 computers to an Active Directory Domain Services domain without network connectivity.
With the new offline domain join feature, computers can be joined to the domain without contacting a domain controller over the network. Offline domain join reduces the time and effort required to complete a large-scale computer deployments.

Server Clusters: Security Best Practices

2012-09-29T02:21:00.002-07:00

Server Clusters: Security Best Practices, Windows 2000 and Windows Server 2003, General Assumptions

This topic has not yet been rated - Rate this topic

Updated: January 1, 2003
Applies To: Windows Server 2003 with SP1
Published: January 1, 2003

Also In This White Paper

Server Clusters: Security Best Practices, Windows 2000 and Windows Server 2003, Deployment and Operations

General Assumptions

There are a number of general assumptions and operational best practices that should be in place for the infrastructure to ensure a secure environment in which to run server clusters.

Servers and storage are in physically secure locations.
Practical security implementations to detect irregular traffic, such as firewalls, network probes and management tools, are in place.
Best practices/common sense in terms of security are adhered to in areas like administration, storage of logs, backup and restore etc.
Platform level security best practices are adhered to in terms of assigning administrative permissions, ACLing resources, and other housekeeping roles.
The network infrastructure services such as Active Directory, DNS, DHCP, WINS etc. must be secure. Any compromise of these infrastructure services can lead to a compromise of the cluster service itself.
The cluster administrator must ensure that applications that call the cluster APIs (ClusAPI) are run from trusted computers. Any compromise on the computers on which the applications are executing (that the cluster administrator runs) can compromise the cluster. For example, if there are untrusted users with elevated privileges on the workstation from where the administration tools are run, untrusted or malicious code can be run against the cluster by the cluster administrator without the cluster administrator realizing.
Access to the set of objects created and maintained by the cluster service must not be compromised by adjusting the default settings placed on these objects to a less restrictive setting. The cluster service utilizes a set of objects in the operating system such as files, devices, registry keys etc. These objects have a default security setting that ensures non-privileged users cannot impact the cluster configuration or the applications running on the cluster. Changing these security settings to less restrictive security settings can lead to the cluster being compromised and the application data being corrupted.

Server Quorum

2012-09-29T02:20:00.002-07:00

http://technet.microsoft.com/en-us/library/cc776624%28v=ws.10%29.aspx

Storage Topologies

1 out of 2 rated this helpful - Rate this topic

Updated: January 1, 2003
Applies To: Windows Server 2000, Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

There are two types of Storage I/O technologies supported in Server clusters: Parallel SCSI and Fibre Channel. With the release of Microsoft Windows Server 2003, support will be provided for SCSI interconnects and fibre channel arbitrated loops for two nodes only. For larger configurations (greater than two), you will need to use a switched fibre channel (fabric) environment.

Issues

Parallel SCSI
Only supported in Windows 2000 Advanced Server up to two-nodes
SCSI Adaptors and storage solutions need to be certified
SCSI cards that are hosting the interconnect should have different SCSI IDs normally (6 and 7). Ensure device access requirements are in-line with SCSI IDs and priorities
SCSI adaptor BIOS should be disabled
If devices are daisy-chained, ensure that both ends of the shared bus are terminated
Use physical terminating devices and do not use controller-based or device-based termination
SCSI hubs are not supported
Avoid the use of connector converters (e.g. 68-pin to 50-pin)
Avoid combining multiple device types (single ended and differential, etc.)
Fibre Channel
Fibre Channel Arbitrated Loops (FC-AL) supported up to two nodes
Fibre Channel Fabric (FC-SW) supported for all higher combinations
Components and configuration need to be in the Microsoft Hardware Compatibility List (HCL)
Multi-cluster environment
Fault tolerant drivers and components also need to be certified
Virtualization engines need to be certified.
The switch is the only component that is not currently certified by Microsoft and it is recommended that the end user get the appropriate interoperability guarantees from the switch vendor before implementing switch fabric topologies. In complicated topologies, where multiple switches are used and connected through ISLs, it is recommended that the customer work closely with Microsoft and the switch and storage vendors during the implementation phase to ensure that all of the components work well together.

Supported and Qualified Configurations

All server clusters must be qualified to be supported by Microsoft. A qualified configuration has undergone extensive testing using a hardware compatibility test, provided by Microsoft. All qualified solutions appear on the HCL, available at http://www.microsoft.com/whdc/hcl/default.mspx. Only cluster solutions listed on the HCL are supported by Microsoft. The complete cluster solution must be listed on the Cluster HCL list. The complete solution includes the servers, the storage adapters, the interconnect type, the storage controllers firmware and driver versions. All of the components must match exactly, including any software, driver or firmware versions, for the solution to be qualified. The HCL contains a set of qualified cluster components. A solution built from qualified components does NOT imply that the solution is qualified.
The cluster components lists have been a source of confusion in the past and Microsoft will be removing the cluster component lists (such as Cluster/RAID) from the HCL for Windows Server 2003.

Storage Interconnects

Ensure that all storage interconnects used in Server Clusters are in the HCL. This also applies for any additional software that is used to provide fault tolerant or load balancing features for adaptors and interconnects.
Multiple paths to the storage for high availability: This is a very common feature implemented by almost all storage vendors. This feature allows for users to implement multiple fabrics (normally two), and use them in fault tolerant or load balancing configurations. In the past, each vendor had their own implementations that varied greatly from one another and also required specific configuration/driver combinations. With the release of Windows Server 2003, Microsoft has developed and supplied vendors with a multi-path driver that will be used by them, in place of custom-made drivers. The driver will ship as part of the individual vendor product, but it is expected that all vendor products (that Microsoft will support) will incorporate this driver. If they insist on using their own driver, it will need to be certified and listed in the HCL.

Server Cluster and SANs

Storage Area Networks (SANs) are increasingly being used to host storage that is managed by server clustering. There are some specific requirements driven from the implementations of clusters and the fact that all storage on the SANs may not be owned by nodes in a cluster. Some issues that can be translated into best practices are:
Ensure that the SAN configurations are in the Microsoft HCL (multi-cluster section).
When configuring your storage the following must be implemented:
Zoning- Zoning allows users to sandbox the logical volumes that will be used by a cluster. Any interactions between nodes and storage volumes will be isolated to the zone and other members of the SAN will not be affected by the same. This feature can be implemented at the controller or switch level and it is important that users have this implemented before installing clustering
LUN masking- This feature allows users to express at the controller level, a specific relationship between a LUN and a host. In theory, no other host should be able to see that LUN or manipulate it in any way. However, various implementations differ in functionality and as such; one cannot assume that LUN masking will always work. Therefore, it cannot be used instead of zoning. One can combine zoning and masking however, to meet some specific configuration requirements.
Firmware and driver versions- Some vendors implement specific functionality in drivers and firmware and it is recommended that users pay close attention to what firmware/driver combinations are compatible with the installation they are running. This is valid not only when building a SAN and attaching host to it but also to the entire life span of the system (hosts and SAN components). Close attention should be paid to issues coming out of applying service packs or vendor specific patches and/or upgrades.
Hardware verses software zoning- Zoning can be implemented in hardware/firmware on controllers or on software on the hosts. It is recommended that controller-based zoning be used since this allows for uniform implementation of access policy that cannot be interrupted or compromised by node disruption or failure of the software component.
Hardware versus software LUN masking- Some vendors also offer software-based masking facilities. Please make sure that any such software that is closely attached to storage and is involved with the presentation of the storage to the operating system needs to be certified. For the same reasons mentioned above, this is also not considered to be a very good thing to do if one cannot guarantee the stability of the software component.
Boot from SAN- This is an increasingly demanded feature and will be supported by Microsoft in Windows Server 2003. Some factors to consider are :
Configurations require support from the Host Bus Adaptor (HBA) and storage vendors. The HBA driver needs to be a Storport driver. Storport drivers improve performance over SCSIPORT, both in terms of throughput and in terms of the system resources that are utilized. It also adds a manageability infrastructure for configuration and management of host-based RAID adapters and is a new implementation in Windows Server 2003. These features are required if the operating system is to successfully boot from a SAN, and more importantly, the vendors that have an implementation need to get them certified by Microsoft.
Such solutions have limited scaling capacities and any additional complexities such as storage replication, recovery mechanisms etc. need to be addressed by the hardware vendors.
Server clusters have enabled a feature that will allow the startup disk, pagefile disks and the cluster disks to be hosted on the same channel. There are other performance and operational implications that need to be considered before implementation.
Please also read KB article 305547 Support for Booting from a Storage Area Network (SAN) which discusses this feature.

Storage Configuration and Setup

If this is a fresh cluster installation, you need to ensure that you do not have applications running. When creating a cluster or adding nodes to a cluster, the Wizard enumerates all of the storage on the node and clusters all storage that is not somehow determined to be non-clusterable. Non-clusterable storage includes all drives on any storage bus that has any system file on it (boot, system, page file, crash dump, or hibernate file), LDM drives, and those drives that respond positively to the IOCTL IOCTL_SCSI_MINIPORT_NOT_QUORUM_CAPABLE.
If this is an existing cluster that is being upgraded, then all configuration settings are honored and rolling upgrade from Windows 2000 is a fully supported option.

Server Clusters and Fault-Tolerant Disks (RAID)

Creation of fault-tolerant volumes such as striped, mirrored, and RAID-5 volumes in Windows Server 2003 requires the volumes to be dynamic disks. Dynamic disks are not supported out-of-the-box in Server cluster, however Veritas has a product (Veritas Volume Manager) that allows for similar functionality and is supported. NTFS is supported as a format type. If disks are not configured as basic and formatted in NTFS, clustering will not recognize the disks and will not be able to manage them. Server clustering also does not support GPT (GUID Partition table) disks, which was introduced as part of the EFI initiative.
Clustering, however, supports hardware based fault-tolerant disks. This means that the configuration of physical disks into fault-tolerant sets (JBOD, RAID 5, RAID 0+1 etc.) is done at the controller level and the set can be made visible either as a whole or carved into smaller pieces (volumes) and made available to hosts. The hosts are completely unaware of the physical implementation and treat the volume as a disk. It is for this reason that we recommend that usage characteristics be taken into consideration before implementing FT sets. For example, if you think the logical volume will host data that is being read and updated constantly, you should perhaps implement the fault-tolerant set as a RAID 0+1 instead of a RAID 5. Another thumb rule to follow would be associating the logical volume size as closely as possible to the physical set size. So carving out fewer logical volumes generally helps contribute to performance.
Volume expansion is also a regular requirement since data growth is not often considered up-front. Cluster disks can be extended without rebooting if the controller supports dynamic LUN expansion. This feature allows for the physical expansion to be implemented without disruption and users can use tools (diskpart) provided by Microsoft to allow for the change to be seamlessly applied at the logical level as well. There are separate versions of diskpart for Windows 2000 and Windows Server 2003. The Windows 2000 version is available as a free download on the web and the Windows Server 2003 version is shipped on the distribution CD.

Handling Storage Cable Disconnects in a Cluster

This document has been written up to answer the various queries we get about Microsoft not supporting manual disconnection of storage cable as a valid test for testing failover mechanisms. Microsoft software fully supports the validity of the test but is not responsible for guaranteeing the results. The main reason for this is that the reactions of the concerned devices (HBAs, switches, Storage solutions etc.) are controlled by lower level device drivers that are written by third party vendors. Different vendors implement storage drivers in different ways and it is upto them to implement features that will allow for such tests to work. At the time of writing this document not all vendors have device drivers that support this test. You should check with your vendor (storage and adapter) to ensure that pulling the storage adapter cable is correctly handled by their device drivers. If the drivers are written to specification made available by Microsoft this issue will be handled cleanly and the tests should work.
This document is specific to Fibre Channel based storage and the issue of storage cables being disconnected or broken and has been created to clearly state the position of the cluster product team with regard to the same. One would see similar issues with SCSI bus implementations but since a majority of implementations these days are fibre channel based we will be scoping our discussion that type of storage network.
Essentially there are usually 2 sets of connections between servers and storage. Servers and storage solutions are connected to switches/hubs. As such there can be 2 places disconnects can occur, one between the server (HBA) and the switch, and the other between the storage solution and the switch. And since there are many cluster and non cluster components involved when such an event happens we will try and map the events to the components thus establishing clear areas of responsibilities.
To begin with Server clusters product team fully understand the fact that storage cable disconnects leading to disruption in host connectivity is a valid scenario and can happen at customer sites. The product (Server clusters), fully supports handling such events gracefully and failing over resources (disk and related). However there are set of events that need to happen before Server clusters can detect the event and failover resources. There is also an additional set of events that need to happen for the resources to fail back to the original node. These set of events depend on the behavioral characteristics of certain components (lower level device drivers) that are not part of the server cluster product. Unfortunately there is no standardization of the required characteristics of these drivers and as such the behavioral semantics might differ from configuration to configuration. But the basic behavior linked to a cable disconnect (that of a failure being detected causing the disks to fail over) should always work.
We will state some of the requirements and issues in this document so as to give the reader an understanding on how all this works together and what questions to ask of whom to ensure that their systems have this functionality.

Disconnecting storage cables (HBA to switch)

We will first address the issue of a storage cable between the server (HBA and the switch) being disconnected.
Here is a rough diagram of what the storage stack will look like on a server running Windows and Server clusters. The stack could include scsiport drivers supplied by Microsoft and miniport drivers supplied by the HBA vendor or a full port driver that complete functionality and replaces the scsiport drive:
Case 1
Case 2
In the first case when the cable is disconnected, if the HBA miniport drivers report the correct status (BusChangeDetected - This notification indicates that a target device might have been added or removed from a dynamic bus.) the scsiport drivers can do the right thing and the non availability (or availability) of disks is efficiently detected. If a device was reported as being not available PnP will do a scan and tear down all device objects that are not available) and the server cluster disk driver will get the required notifications. This will lead to the cluster service failing over the disk resources to another valid member of the cluster who has access to the devices in question.
If the HBA miniport driver instead reports a generic status (ResetDetected - all this indicates is that the HBA has detected a reset on the SCSI bus and after this notification, the HBA miniport driver is still responsible for completing any active requests). In such a case the cluster disk driver will eventually detect the fact that the disk is no longer available in the course of the monitoring tests (LooksAlive, IsAlive1) it perfumes on a periodic basis. This will cause to detect that the disks are no longer accessible leading it to fail over the disks to another member in the cluster that has valid access to the disks in question. The minimum time required to detect this is approximately three seconds when a reserve issued by clusdisk (the cluster disk driver) fails. The maximum time required is not quantifiable since that will depend on the behavioral and operational characteristics of the lower level device drivers. But the non availability of the disk will always be eventually detected causing the disks to fail over to a valid cluster node.
The frequency for running LooksAlive and IsAlive is tunable, meaning one can increase the frequency of the checks so has to have a smaller detection window but this has other (resource utilization) implications that needs to be carefully considered, especially in enterprise environments where server clusters might need to monitor a large number of resources.
The same is also valid if the out-of-the-box scsiport drivers are replaced by a vendor specific scsiport driver or of the SCSIport /Miniport combination is replaced by a monolithic Fullport driver as shown in Case 2. Such drivers are written by vendors to cater to specific requirements their storage solutions might have. Microsoft cannot guarantee the functionality of full port drivers Microsoft support will not be able to debug related issues if full port drivers are used.

Disconnecting storage cables (Switch to storage):

Here again the behavior depends on the implementations. Upon cable disconnect or device removal the HBA gets an RSCN from the switch and should notify the operating system of any changes it detects. Detection is a very complex operation and has a lot of external dependencies and may not always work correctly. In the worst case scenario the HBA may fail the IO or return BUSY. In such cases as well the worst case scenario applies which means that the LooksAlive/IsAlive checks will fail and the cluster service will wither failover the disks or fail them completely.

Reconnecting Storage Cables (HBA to switch):

Reconnecting the storage cables and expecting the resources to fail back is also a complicated issue. If the HBA miniport driver or the full port driver sends the right status then PnP will rescan the bus create device objects and allocate resources (such as I/O ports, memory addresses, and interrupts) for that device. These resources are supplied back to the miniport, which must then use these resources. In such cases reconnecting the storage cable is detected and is all that needs to be done to allow for the resources to fail back to the original node.
If the miniport driver or the full port driver does not implement the above then again fail back should just work because the physical device objects exist. If there are issues the user will need to initiate a manual scan (by going into Disk Management MMC and initiating a rescan of disks). Once this is done a failback should work

Reconnecting Storage Cables (Switch to storage controller):

Getting information (on cable reconnects) back from the switch is dependant on various conditions (have devices changed, has the name server detected this etc.) and does not always work as expected. A manual rescan should also work in such cases.
In either case the full functionality is provided by the miniport or the full port drivers (depending on what is being used) both of which are written by the storage or HBA vendor.
The above is also valid for fault tolerant solutions that implement features like multiple paths from servers to storage solutions. The behavior should be the same in event of both paths on a host failing. Single failure instances should be masked by the multi path driver and should not be visible to higher level subsystems.
To sum it up disconnecting storage cables will cause disks managed by server clusters to fail over to another member of a cluster no matter what driver types are used. Failing the disks back to the original node however is a feature that can only be guaranteed by HBA vendors for the simple fact that they own the drivers that incorporates the functionality that is primarily responsible for correctly handling this situation.
Adding new disks to a cluster- Adding new disks to a cluster does not require a rebooting nodes or restarting the cluster service post Windows 2000 SP3 and in Windows Server 2003. Any node can scan and mount the new disk to begin with and once it has been formatted to NTFS all that is required is the creation of a new physical disk resource using Cluster
The above is valid post Windows 2000 SP3 (2 hotfixes) and Windows Server 2003. The hotfixes are supplied by Microsoft Support.

other use full script

2012-08-18T02:35:00.001-07:00

dir *.avi* /q /s > C:\new\class1_avi.txt

RemoveAll.bat
dsrm -subtree -noprompt -c "OU=Sales,DC=worldwideimporters,DC=com"
dsrm -noprompt -c "CN=Marketing and Finance Data,CN=Users,DC=worldwideimporters,DC=com"
dsrm -noprompt -c "CN=Sales Users,CN=Users,DC=worldwideimporters,DC=com"
dsrm -noprompt -c "CN=Sales data,CN=Users,DC=worldwideimporters,DC=com"

AddUsers.bat
dsadd ou "OU=Sales,DC=worldwideimporters,DC=com"
dsadd ou "OU=Marketing and Finance,DC=worldwideimporters,DC=com"
dsadd user "CN=KimA,OU=Sales,DC=worldwideimporters,DC=com"
dsadd user "CN=SeanA,Ou=Sales,DC=worldwideimporters,DC=com"
dsadd user "CN=NeilC,Ou=Sales,DC=worldwideimporters,DC=com"
dsadd user "CN=AaronC,Ou=Sales,DC=worldwideimporters,DC=com"
dsadd user "CN=AndrewH,Ou=Sales,DC=worldwideimporters,DC=com"
dsadd user "CN=DonH,Ou=Marketing and Finance,DC=worldwideimporters,DC=com"
dsadd user "Cn=GarthF,Ou=Marketing and Finance,DC=worldwideimporters,DC=com"
dsadd user "CN=MarkH,Ou=Marketing and Finance,DC=worldwideimporters,DC=com"
dsadd user "CN=JoB,Ou=Marketing and Finance,DC=worldwideimporters,DC=com"
dsadd user "CN=ScottC,Ou=Marketing and Finance,DC=worldwideimporters,DC=com"
dsadd group "CN=Sales Users,CN=users,DC=worldwideimporters,DC=com" -scope g
dsadd group "CN=Marketing and Finance Users,CN=users,DC=worldwideimporters,DC=com" -scope g
dsadd group "CN=Sales Data,CN=users,DC=worldwideimporters,DC=com" -scope l
dsadd group "CN=Marketing and Finance Data,CN=users,DC=worldwideimporters,DC=com" -scope l
dsadd computer "CN=SALESWKSTN1,OU=Sales,DC=worldwideimporters,DC=com"
dsadd computer "CN=SALESWKSTN2,OU=Sales,DC=worldwideimporters,DC=com"
dsadd computer "CN=MAFWKSTN1,OU=Marketing and Finance,DC=worldwideimporters,DC=com"
dsadd computer "CN=MAFWKSTN2,OU=Marketing and Finance,DC=worldwideimporters,DC=com"

ModifyMembers.bat
dsmod group "CN=Marketing and Finance users,CN=users,DC=worldwideimporters,DC=com" -addmbr "CN=KimA,OU=Marketing and Finance,DC=worldwideimporters,DC=com"
"CN=SeanA,OU=Marketing and Finance,DC=worldwideimporters,DC=com" "CN=AaronC,OU=Marketing and Finance,DC=worldwideimporters,DC=com"
dsmod user "CN=KimA,OU=Marketing and Finance,DC=worldwideimporters,Dc=com" "CN=SeanA,OU=Marketing and Finance,DC=worldwideimporters,DC=com"
"CN=AaronC,OU=Marketing and Finance,DC=worldwideimporters,DC=com" -pwd Abcd123 -mustchpwd yes

MoveUsers.bat

dsmove "CN=KimA,OU=Sales,DC=worldwideimporters,DC=com" -newparent "OU=Marketing and Finance,DC=worldwideimporters,DC=com"
dsmove "CN=AaronC,OU=Sales,DC=worldwideimporters,DC=com" -newparent "OU=Marketing and Finance,DC=worldwideimporters,DC=com"
dsmove "CN=SeanA,OU=Sales,DC=worldwideimporters,DC=com" -newparent "OU=Marketing and Finance,DC=worldwideimporters,DC=com"ModifyMembers.bat

QueryUsers.bat

dsget user "CN=KimA,OU=Sales,DC=worldwideimporters,DC=Com" -memberof -expand >"c:\documents and Settings\All Users\Desktop\userinfo.txt"
dsquery user "OU=Sales,DC=worldwideimporters,DC=com" >>"c:\documents and Settings\All Users\Desktop\userinfo.txt"
dsquery user "OU=Marketing and Finance,DC=worldwideimporters,DC=com" >>"c:\documents and Settings\All Users\Desktop\userinfo.txt"
Notepad "c:\documents and Settings\All Users\Desktop\userinfo.txt"

Remove1.bat

dsrm -noprompt -c "cn=KimA,OU=Marketing and Finance,DC=worldwideimporters,DC=com"
dsrm -noprompt -c "CN=mafwkstn1,OU=Marketing and Finance,DC=worldwideimporters,DC=com"
dsrm -noprompt -c "CN=Marketing and Finance Users,CN=Users,DC=worldwideimporters,DC=com"
dsrm -subtree -noprompt -c "OU=Marketing and Finance,DC=worldwideimporters,DC=com"

RemoveAll.bat

dsrm -subtree -noprompt -c "OU=Sales,DC=worldwideimporters,DC=com"
dsrm -noprompt -c "CN=Marketing and Finance Data,CN=Users,DC=worldwideimporters,DC=com"
dsrm -noprompt -c "CN=Sales Users,CN=Users,DC=worldwideimporters,DC=com"
dsrm -noprompt -c "CN=Sales data,CN=Users,DC=worldwideimporters,DC=com"

robocopy.exe "i:\new\ne_folder" "j:\new1\new_folder2" /COPYALL /S /E /NP /zb /R:5 /W:1 /LOG+:C:\foit.txt

Run script add for excel on dos command work

2012-08-18T02:18:00.001-07:00

Function RunCommand(strCommand)
    Set objShell = CreateObject("WScript.Shell")
    Set objExec = objShell.Exec(strCommand)
    While objExec.Status = 1
        Application.Wait "00:00:01"
    Wend
    RunCommand = objExec.StdOut.ReadAll
End Function