TechBlog

What is the Network and Sharing Center in Windows?

noreply@blogger.com (Anonymous) — Mon, 23 Feb 2015 16:39:00 +0000

In many of our tutorials about networking in Windows 7, Windows 8 and Windows 8.1, you will see that we mention quite often the Network and Sharing Center. This panel is the entrance point to many networking tasks. Therefore, in this article I will show you what is the Network and Sharing Center, how to launch it and which are the main tasks that can be performed starting from here.

What is the Networking and Sharing Center?

Simply put, the Network and Sharing Center is the control panel from where most of networking settings and tasks can be launched in Windows 7, Windows 8 and Windows 8.1.

Tasks which are Launched from Networking and Sharing Center

Let’s start with Windows 7: the Network and Sharing Center window is split in two. On the left side there is a column with shortcuts to tasks such as: managing your wireless networks, changing settings for all network adapters and changing network sharing settings. On the bottom left side there are shortcuts to the HomeGroup settings panel, to the Internet Optionspanel and to the Windows Firewall control panel.

On the right there is a big white area split in two parts. The upper-side shows you basic information about your current network connection: the name of the active network, access type and the HomeGroup to which your computer belongs. The lower-side contains links towards wizards which help you do the following: setup a new connection or network, connect to another network, change HomeGroup and sharing settings and troubleshoot problems.

In Windows 8 and Windows 8.1, the panel looks almost the same, with some minor differences. For example, the "Connect to a network" link is gone because its wizard is the same as "Set up a new connection or network".

The "Choose homegroup and sharing options" link is also gone, because the same Homegroupsettings can be accessed via the Homegroup link on the left column.

On the left column, you won’t find the "Manage wireless networks" link, not even on laptops or tablets. That's because the management of wireless networks connections is done differently in Windows 8 and Windows 8.1. More details about it can be found in thes guides:

How to Start the Networking and Sharing Center?

The Network and Sharing Center can be launched using several methods. One way is to launch the Run window by pressing the Windows key + R, type "control.exe /name Microsoft.NetworkAndSharingCenter" and click OK. This works in all versions of Windows that include this feature.

A second alternative, that works only in Windows 7, is to click on the network icon on the right side of the taskbar and then on "Open Network and Sharing Center".

In Windows 8 and Windows 8.1 you must right-click the network icon, on the right side of the taskbar, then click on "Open Network and Sharing Center".

The third way is to go to "Control Panel -> Network and Internet -> Network and Sharing Center". This works in all versions of Windows.

In Windows 8 you can also search for the words "network sharing" and click the appropriate search result under Settings.

In Windows 8.1, search works the same. The only difference is that you do not need to filter the search results. Its shortcut is displayed immediately.

The same search can be done also in Windows 7's Start Menu search box.

How to Reset Windows Password Without an Install CD

noreply@blogger.com (Anonymous) — Tue, 23 Dec 2014 21:56:00 +0000

If you’ve forgotten your Windows password and you don’t have an install CD laying around, there’s no need to worry. Not only are there half a dozen complicated ways to reset the password, you can do it easily with the Offline Windows Password editor.

Of course, if you do have a Windows CD, you can reset your password the easy way with a simple trick.

Note: this should work on all versions of Windows, but if you are running Windows 8 or 8.1 andalso using a Microsoft Account to login to your computer, you’ll need to reset your Microsoft Account password using a web browser on their web site.

Create the Boot Disk.

You will need to create a boot disk using another PC. First, you’ll need to download the boot disk from here:

Download the Offline NT Password & Registry Editor

Then download and launch ImgBurn, which is a really simple piece of software that helps you burn an ISO image to a disk.

Note: if you have some other application for burning an ISO image, you can use that instead.

Choose the Source, click the burn button, and create the boot disk.

You could also create a bootable USB drive instead if you’d like, the instructions are on the Offline NT download site.

Resetting Your Windows Password.

Boot your PC from the boot disk (you might have to adjust the BIOS to allow booting from the CD). You’ll be prompted at a couple of screens, which you can generally just hit the Enter key at. For
instance, this screen asks if you want to select the first partition, and [1] is already selected, so just hit Enter.

The same thing happens at the next step, where you have to choose the path to your registry. The default is fine, so hit Enter.

Next you can choose whether to use password reset or some other thing, so just hit Enter for password reset.

Next you’ll be prompted whether you want to edit users or the registry. You want to edit user passwords, so hit Enter again.

And now, the first screen where you’ll need to do something other than hit the Enter key. In this case, you’ll want to type the username that you want to reset. In my case, this was “geek”, so I just typed that (without the quotes). Then hit Enter.

Now you’ll want to probably just blank the password, which is already selected, so hit the Enter key again (you can always change it once you’re back in Windows).

And now, you’ll have to save what you just did. So type an exclamation point to quit (or the “!” symbol), then type the letter “y” to save.

At this point it should say “EDIT COMPLETE”, and you can reboot your computer. You should be able to login without any problems now.
Note: Make sure you go and set a new password.

Steps to Create a Self Signed Security (SSL) Certificate and Deploy it to Client Machines.

noreply@blogger.com (Anonymous) — Tue, 23 Dec 2014 21:11:00 +0000

Developers and IT administrators have, no doubt, the need the deploy some website throughHTTPS using an SSL certificate. While this process is pretty straightforward for a production site, for the purposes of development and testing you may find the need to use an SSL certificate here as well.

As an alternate to purchasing and renewing a yearly certificate, you can leverage your WindowsServer’s ability to generate a self signed certificate which is convenient, easy and should meet these types of needs perfectly.

Creating a Self Signed Certificate on IIS

While there are several ways to accomplish the task of creating a self signed certificate, we will use the SelfSSL utility from Microsoft. Unfortunately, this doesn’t ship with IIS but it is freely available as part of the IIS 6.0 Resource Toolkit (link provided at the bottom of this article). Despite the name “IIS 6.0″ this utility works just fine in IIS 7.

All that is required is to extract the IIS6RT to get the selfssl.exe utility. From here you can copy it to your Windows directory or a network path/USB drive for future use on another machine (so you don’t have to download and extract the full IIS6RT).

Once you have the SelfSSL utility in place, run the following command (as the Administrator) replacing the values in <> as appropriate:

selfssl /N:CN=<your.domain.com> /V:<number of valid days>

The example below produces a self signed wildcard certificate against “mydomain.com” and sets it to be valid for 9,999 days. Additionally, by answering yes to the prompt, this certificate is automatically configured to bind to port 443 inside the Default Web Site of IIS.

While at this point the certificate is ready to use, it is stored only in the personal certificate store on the server. It is a best practice to also have this certificate set in the trusted root as well.

Go to Start > Run (or Windows Key + R) and enter “mmc”. You may receive a UAC prompt, accept it and an empty Management Console will open.

In the console, go to File > Add/Remove Snap-in.

Add Certificates from the left side.

Select Computer account.

Select Local computer.

Click OK to view the Local Certificate store.

Navigate to Personal > Certificates and locate the certificate you setup using the SelfSSL utility. Right-click the certificate and select Copy.

Navigate to Trusted Root Certification Authorities > Certificates. Right-click on the Certificates folder and select Paste.

An entry for the SSL certificate should appear in the list.

At this point, your server should have no problems working with the self signed certificate.

Exporting the Certificate.

If you are going to be accessing a site which uses the self signed SSL certificate on any client machine (i.e. any computer which is not the server), in order to avoid a potential onslaught of certificate errors and warnings the self signed certificate should be installed on each of the client machines (which we will discuss in detail below). To do this, we first need to export the respective certificate so it can be installed on the clients.

Inside of the console with the Certificate Management loaded, navigate to Trusted Root Certification Authorities > Certificates. Locate the certificate, right-click and select All Tasks > Export.

When prompted to export the private key, select Yes. Click Next.

Leave the default selections for the file format and click Next.

Enter a password. This will be used to protect the certificate and users will not be able to import it locally without entering this password.

Enter a location to export the certificate file. It will be in PFX format.

Confirm your settings and click Finish.

The resulting PFX file is what will be installed to your client machines to tell them that your self signed certificate is from a trusted source.

Deploying to Client Machines.

Once you have the created the certificate on the server side and have everything working, you may notice that when a client machine connects to the respective URL, a certificate warning is displayed. This happens because the certificate authority (your server) isn’t a trusted source for SSL certificates on the client.

You can click through the warnings and access the site, however you may get repeated notices in the form of a highlighted URL bar or repeating certificate warnings. To avoid this annoyance, you simply need to install the custom SSL security certificate on the client machine.

Depending on the browser you use, this process can vary. IE and Chrome both read from the Windows Certificate store, however Firefox has a custom method of handling security certificates.

Important Note: You should never install a security certificate from an unknown source. In practice, you should only install a certificate locally if you generated it. No legitimate website would require you to perform these steps.

Internet Explorer & Google Chrome – Installing the Certificate Locally

Note: Even though Firefox does not use the native Windows certificate store, this is still a recommended step.

Copy the certificate which was exported from the server (the PFX file) to the client machine or ensure it is available in a network path.

Open the local certificate store management on the client machine using the exact same steps as above. You will eventually end up on a screen like the one below.

On the left side, expand Certificates > Trusted Root Certification Authorities. Right click on the Certificates folder and select All Tasks > Import.

Select the certificate which was copied locally to your machine.

Enter the security password assigned when the certificate was exported from the server.

The store “Trusted Root Certification Authorities” should be prefilled as the destination. Click Next.

Review the settings and click Finish.

You should see a success message.

Refresh your view of the Trusted Root Certification Authorities > Certificates folder and you should see the server’s self signed certificate listed in the store.

One this is done, you should be able to browse to an HTTPS site which uses these certificates and receive no warnings or prompts.

Firefox – Allowing Exceptions

Firefox handles this process a bit differently as it does not read certificate information from the Windows store. Rather than installing certificates (per-se), it allows you to define exceptions for SSL certificates on particular sites.

When you visit a site which has a certificate error, you will get a warning like the one below. The area in blue will name the respective URL you are trying to access. To create an exception to bypass this warning on the respective URL, click the Add Exception button.

In the Add Security Exception dialog, click the Confirm Security Exception to configure this exception locally.

Note that if a particular site redirects to subdomains from within itself, you may get multiple security warning prompts (with the URL being slightly different each time). Add exceptions for those URLs using the same steps as above.

Conclusion

It is worth repeating the notice above that you should never install a security certificate from an unknown source. In practice, you should only install a certificate locally if you generated it. No legitimate website would require you to perform these steps.

To download IIS visit bellow link provided:

Download IIS 6.0 Resource Toolkit (includes SelfSSL utility) from Microsoft

Import a Trusted Root Certification Authority In Windows 7/Vista/XP.

noreply@blogger.com (Anonymous) — Tue, 23 Dec 2014 20:29:00 +0000

1. Start Microsoft Management Console (MMC) Tool

Click Start -> Run -> Enter 'MMC' and click 'OK'

2. Click File -> Add/Remove Snap-In...

3. Add Certificate.

Select 'Certificates' in left panel and click 'Add' to move to right panel , Then Click 'OK'

4. Select 'Computer Account' option and click 'Next'

5. Click 'Finish'

6. Click 'OK'.

7. Start to import Trusted Root Certificate.

A. Expand Certificates Node;
B. Right click Trusted Root Certificates -> All Tasks -> Import.

8. Click Next.

9. Select downloaded Certificate file
Click 'Browse' to select correct Certificate file and click Next

10. Click Next.

11. Click Finish.

12. Done.

HOW TO RESTORE OFF A MOUNTED SLAVE DISK ON REDHAT + CPANEL (CRASH/HACK/BAD KERNEL)

noreply@blogger.com (Anonymous) — Fri, 21 Nov 2014 20:34:00 +0000

How to Restore off a mounted slave disk on Redhat + Cpanel (crash/hack/bad kernel)

Warning: This is not to be done by the unexperienced admins bad things could happen. Hire someone.

Sometimes if you get hacked or boot with a bad kernel you need to have the datacenter mount your old drive, and install a new one with a fresh installation of redhat. First things first lets make sure you have an updated kernel, we will do it with up2date for ease of use:

up2date -f kernel

check the grub.conf /or lilo config to ensure the settings are right. (if using lilo run this command aswell /sbin/lilo -v -v and check for errors)

Now reboot the server

shutdown -r now
I. Mount the backup Drive

First check to see if there are any drives mounted.

df -h

You should get something simular to this if it isent mounted yet:

[root@localhost root]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/hda2 37G 1.4G 33G 4% /
/dev/hda1 101M 7.7M 88M 9% /boot
none 125M 0 125M 0% /dev/shm
[root@localhost root]#

if it is mounted you will see something like this:

-bash-2.05b# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/hda3 53G 31G 20G 62% /
/dev/hda1 99M 14M 80M 15% /boot
none 248M 0 248M 0% /dev/shm
/dev/hdc3 53G 31G 20G 61% /mnt/old
-bash-2.05b#

as you can see hdc3 is the old drive, and it is mounted as /mnt/old. Yours will be diffent possibly. But keep in mind you need to know the mount point for the backup drive for the following steps.

Lets mount if not already mounted.

fdisk -l

check for additional drives, in this tutorial we will use /dev/hdc3.

mount /dev/hdb3 /mnt/old

now that the drive is mounted you can browse files like:

ls /mnt/old/home

II. Rsync the files

Do these commands one by one,

rsync -vrplogDtH /mnt/old/usr/local/apache/conf /usr/local/apache
rsync -vrplogDtH /mnt/old/var/named /var
rsync -vrplogDtH /mnt/old/home/* /home
rsync -vrplogDtH /mnt/old/usr/local/cpanel /usr/local
rsync -vrplogDtH /mnt/old/var/lib/mysql /var/lib
rsync -vrplogDtH /mnt/old/var/cpanel /var
rsync -vrplogDtH /mnt/old/usr/share/ssl /usr/share
rsync -vrplogDtH /mnt/old/var/ssl /var
rsync -vrplogDtH /mnt/old/usr/local/cpanel/3rdparty/mailman /usr/local/cpanel/3rdparty
rsync -vrplogDtH /mnt/old/var/log/bandwidth /var/log
rsync -vrplogDtH /mnt/old/usr/local/frontpage /usr/local
rsync -vrplogDtH /mnt/old/var/spool/cron /var/spool

Next Step – Get some important files from etc:

cd /mnt/old/etc
rsync -vrplogDtH secondarymx domainalias valiases vfilters exim* proftpd* pure-ftpd* passwd* group* *domain* *named* wwwacct.conf cpupdate.conf quota.conf shadow* *rndc* ips* ipaddrpool* ssl /etc

Now would be a good time to change your password for root:

passwd

III. Updating software and restarting services

/scripts/upcp
/scripts/updatenow
/scripts/sysup
/scripts/fixeverything
/scripts/exim4
/scripts/easyapache
/scripts/securetmp

This is needed to update cpanel information. Please note, sshd might fail and not start after running fixeverything. You have to login to whm, and go to the rpm installer and “FORCE” install opensshd-server, opensshd, opensshd-client and then restart sshd from whm.

IV. Restarting services

/scripts/restartsrv httpd
/scripts/restartsrv cpanel
/scripts/restartsrv mysql
/scripts/restartsrv named
/scripts/restartsrv exim

After you are pleased that everything is working fine, restart the entire server.

This tutorial works 100% on redhat, 7.3, 8.0, 9.0 and fedora. it has been tested on those boxes. But remember, if you dont know what your doing them hire someone to check your server out.

HOW TO INSTALL CACTI ON LINUX

noreply@blogger.com (Anonymous) — Fri, 21 Nov 2014 20:30:00 +0000

Cacti is a complete network graphing solution designed to harness the power of RRDTool's data storage and graphing functionality. Cacti provides a fast poller, advanced graph templating, multiple data acquisition methods, and user management features out of the box. All of this is wrapped in an intuitive, easy to use interface that makes sense for LAN-sized installations up to complex networks with hundreds of devices. For More information http://www.cacti.net/what_is_cacti.php

first login as root to the server. please note this should have "yum" install already. my recommendation is to use standalone server or virtual server for monitoring . its depend on your network size.

# yum install mysql-server mysql php-mysql php-pear php-common php-gd php-devel php php-mbstring php-cli php-snmp php-pear-Net-SMTP php-mysql httpd

Configure MySQL server

# mysqladmin -u root password NEWPASSWORD

Create cacti MySQL database

# mysql -u root -p -e 'create database cacti'

Create a user called cacti with a password called 123456, enter:

# mysql -u root –p mysql> GRANT ALL ON cacti.* TO cacti@localhost IDENTIFIED BY '123456'; mysql> FLUSH privileges; mysql> \q

Install snmpd

yum install net-snmp-utils php-snmp net-snmp-libs

Configure snmpd

# mv /etc/snmp/snmpd.conf /etc/snmp/snmpd.conf.org vi /etc/snmp/snmpd.confadd line rocommunity public and save the file. ( wq!)

Turn on snmpd service:

# /etc/init.d/snmpd start # chkconfig snmpd on

Install cacti

# rpm –Uvh http://download.fedora.redhat.com/pub/epel/5/i386/epel-release-5-4.noarch.rpm # yum install cacti

Install cacti tables

# rpm -ql cacti | grep cacti.sql # mysql -u cacti -p cacti < /usr/share/doc/cacti-0.8.7d/cacti.sql

Configure cacti

# vi /etc/cacti/db.php

Make changes as follows:

$database_type = "mysql"; $database_default = "cacti"; $database_hostname = "localhost"; $database_username = "cacti"; $database_password = "123456";$database_port = "3306";

Configure httpd

# vi /etc/httpd/conf.d/cacti.conf # # Cacti: An rrd based graphing tool # Alias /cacti /usr/share/cacti <Directory /usr/share/cacti/> Order Deny,Allow Allow from all </Directory>

restart apache

# service httpd restart

Setup cacti cronjob

# vi /etc/cron.d/cacti

Uncomment

*/5 * * * * cacti /usr/bin/php /usr/share/cacti/poller.php > /dev/null 2>&1

Run cacti installer

http://your.example.com/cacti/ please follow the instruction to complete the installation. after that you can go in add the devices you like to monitor. this is very usefully when you need to monitor bandwidth on switch etc. Hope this help you guys.

WHY READ-ONLY DOMAIN CONTROLLERS (RODC) ?

noreply@blogger.com (Anonymous) — Fri, 21 Nov 2014 20:12:00 +0000

In enterprise level network its common to have HQ(Head Quarters)-Branch Office network. These branch offices may required to connected with HQ resources for its operations. Most of the time this kind of setup uses WAN links to connect branch Offices with HQ network. Let's assume we have company called ABC and its HQ is located in Canada Toronto. Due to the Expansion its need branch office open in London, UK. So the requirement is more complicated as its 2 different countries.

The users in London office still need to authenticate the company domain environment and access the resources. Let's Look in
to some of the difficulties, challenges faces with typical this kind of setup.

Lack of Resources

To connect HQ with branch site its required secure, reliable connection. But these connections typically comes with high $$$$ cost. Even though its cost mostly these links will be with speed of 128kb, 256kb, 512kb etc. If users in branch site is authenticating company AD it will use WAN link for the all the authentication, resources access etc. if the number of users increase in branch site the link utilization just for the AD activities will increased. Also since its between different geographical locations, different ISP, many facts will affect the reliability of the link as well. what happen if the WAN link went down on critical business day ? so solution is to deploy AD in branch site and it will be opening whole different range of concerns, problems.

Security Risks

Even though branch office dc will increase the authentication and resource access process its open potential security risks to the network. some companies will have fully secure datacenter facilities in branch sites as well but majority cant afford such investments. As we know regular DC is keeping critical data about users, resource authentications etc. what if these branch office dc get compromised or stolen?. It will affect entire company network operations and some time this kind of issue can cause millions of dollars lost to the company.

Management

If we host a branch site DC, typically it will required maintenance time to time. it may be to deploy fail over dc, upgrade hardware, site-link changes, user credential changes etc. So some time company may need to keep a IT department running on branch office which will increase the company operation cost. Also since its integrated directly with main domain environment, any changes triggers in branch office DC will also directly affect entire domain environment.

So what is the answer then ?

With windows 2008 server Microsoft introduce the Read-Only domain controller feature to specially address these difficulties company face in this kind of branch site scenario.

Read-Only!!!!

As its name says its by default Read-only copy of the company main DC. So the changes making on branch site RODC will not affect DC operations. So basically its keep all the info about the DC attributes in Branch-DC as read-only copy and once its receive request for authentication it directs the request to the RODC instead going via WAN link.

Password Replication Policy (PRP)

We can also control this "credential caching" in detail level by using Password Replication Policy. what it does is we can define which users, group need the credential caching on that particular RODC. For example let's assume we have another branch in India. The users in India office will not login from London office anyway. so why we should cache credential info for India office users in London office RODC ? Also in this way it improve security of dc more. So if one of branch office RODC compromised it will only hold limited data about the DC.

In windows 2012 server to configure we can use 2 security groups it creates with RODC setup. According to Microsoft its as following,

Allowed RODC Password Replication Group : Members of this group are placed in the Allow list of the Password Replication Policies of all RODCs by default. This group has no members when Windows Server 2012 is first installed.
Denied RODC Password Replication Group: Members of this group are placed in the Deny list of the Password Replication Policies of all RODCs by default. Some of the groups include Administrators, Server Operators, Backup Operators, Account Operators, and Denied RODC Password Replication Group.
Local Administrators Group

Some time the branch offices need some IT support for their users. It may have local IT staff or outsourced IT company for this. In typical DC environment to do the maintenance a particular user need to have domain admin rights or delegated permissions. But in RODC we can define Local administrator accounts which will give full control over the RODC environment and it still will not affect the parent DC setup.

In next post will look in to the configuration of a RODC.

PASSWORD REPLICATION IN RODC

noreply@blogger.com (Anonymous) — Fri, 21 Nov 2014 20:07:00 +0000

In RODC environment one of the great feature is the password replication. in RODC environment we can determine which passwords need to be cache in RODC and which accounts still need to be authenticate via writable domain controller. As example domain administrator accounts do not need to be cached on RODC. its always safe if it can be authaticate via routable DC for security purposes. so if a domain administrator login from a RODC enviornment, we can set system to forward the authtication request or service ticket to the writable domain controller.

Microsoft made this easy by introducing password replication policy (PRP) to RODC environment. by default system create domain-wide password replication policy two domain local security groups.

Allowed RODC Password Replication Group : Members of this group will allow to cache passwords in RODC. by default this group do not have any members.

Denied RODC Password Replication Group: Members of this group are deny to cache passwords in RODC. Some of the groups which are security critical are member of this group by default such as Administrators, Server Operators, Backup Operators, Account Operators.

One of the biggest mistakes administrator do is only allow/deny user accounts. But computers it self also uses authatication and service tickets requests. so make sure you add computer accounts also in to these lists.

How to configure RODC password replication policy(PRP) ?

4) Click to select the RODC you need to configure PRP. Then right click and click on properties.

5) In the properties window click on "Password Replication Policy" tab

6) In there we can see the 2 groups i mentioned above.

7) We can add users to these groups. to add users/computers to those double click on the group. in here i will use "Allowed RODC Password Replication Group"

8) To add users/computers to group click on members tab and click on add.

9) Once users/computers added click on "OK" to apply changes.

Policy Usage Reports and Pre-Populate Credential Caching

Microsoft provided a easy method of reporting where we can check the status of password replication. in order to use this facility need to follow following steps.

1) Login to a writable domain controller with domain administrator account
2) Open "Active Directory Users and Computers" snap in by Server Manager > Tools > Active Directory Users and Computers
3) Go to "Domain Controllers" OU
4) Click to select the RODC you need to configure PRP. Then right click and click on properties.
5) In the properties window click on "Password Replication Policy" tab
6) Click on "Advanced" button

7) In here drop-down list there is 2 options listed

Accounts Whose Passwords Are Stored On This Read-Only Domain Controller: This option will list all the user accounts/computer accounts which are currently cached password on RODC.

Accounts That Have Been Authenticated To This Read-Only Domain Controller: This option will list the user accounts/computer accounts which were forwarded to writable domain controller for authentication and service tickets process. This is good place to identify the user accounts/ computer accounts which will still need to add to allow list for password caching.

In PRP lets assume we allowed USER A to cache his credentials in RODC. But it will not cache it right away. it will cache credential once user made first authentication request to the RODC. but microsoft given opertunity where we can pre-populate the caching. so when user login first time his password is already been cached on RODC.

In order to use this feature click on "Pre-Populate Passwords…" button in same advance window.

It will open up window where you can select the accounts you need. once its selected it will pop-up following information window. click on yes to accept the changes.
before do this make sure you have already allow that user/computer account in Allow list of password caching.

if you have any questions please feel free to contact me on rebeladm@live.com

STEP-BY-STEP GUIDE TO INSTALL READ-ONLY DOMAIN CONTROLLER (RODC)

In previous post i have explain what is RODC and the benefits of it. If you not read it yet you can find it in here.

Before install a RODC in a domain environment it need to meet the following requirements,

Forest function level should be windows 2003 server or higher
Needs at least one writable domain controller running windows server 2008 or higher

If forest have any DC running windows server 2003 we need to adjust permissions on DNS application directory partition to allow them to replicate to RODC. It can be done by running adprep /RODCprep from windows 2012 server installation disk \support\adprep folder.

In my demo setup i do have a domain called contoso. Before start lets check the forest function level.

To do that, log in to the DC as domain admin and open "Server Manager"
Then from tools click on "Active Directory Domains and Trust"

Right click on domain and select "Properties"

As we can see here its runs with windows server 2012 R2 so we do not need to prepare domain with adprep /RODCprep

To install RODC i have a fresh installed windows 2012 R2 server and its already added to the domain. (Here i do not going to explain how to add it to domain as in previous in my posts i explain how to add server to a domain)

To begin the setup first make sure you login as a domain administrator to the server.
Open "Server Manager" and from dashboard window click on "Add roles and features"

It will open up the wizard and click on "next" to continue.

In next window select "Role-based or feature-based installation" and click next

In next window by default it select the current server and click next to continue

In next window click on "Active Directory Domain Service" and it will pop up with the features. click on "add features" to continue and then "next"

In next window will let it run with default features. click on next to continue

In next window it will gives brief description about the AD DS and click next to continue

Next window it will ask for confirmation and click ok "install" to begin the service installation

Once installation done open "Server Manager" and click on "AD DS"

Then in right hand side panel click "More" as in image

Then it will open up the wizard and click on option "Promote this server to a domain…"

It will open up the configuration wizard. in here we will keep the default selection and click on next to continue

In next window make sure to select option "Read only domain controller(RODC)" and then also type a password for restore. click on next to continue

In next window we can select what groups/users allowed for the password caching, what group/users denied for caching and also delegated admin accounts. in here for now we will keep the default selection.

in next window we can define from which DC we need replication done.

In next window it gives option to change the folder paths. in here we keep default. click next to continue.

In next window it gives option to review the installation selection and click next to continue.
In next window system will check if its meet all the prerequisites for the installation. click on Install to begin the installation

Once installation done system will automatically reboot.

This completes the installation of RODC in domain. in next post we will look in to configuring RODC with different policies.

WHY READ-ONLY DOMAIN CONTROLLERS (RODC) ?

In enterprise level network its common to have HQ(Head Quarters)-Branch Office network. These branch offices may required to connected with HQ resources for its operations. Most of the time this kind of setup uses WAN links to connect branch Offices with HQ network. Let's assume we have company called ABC and its HQ is located in Canada Toronto. Due to the Expansion its need branch office open in London, UK. So the requirement is more complicated as its 2 different countries.
The users in London office still need to authenticate the company domain environment and access the resources. Let's Look in
to some of the difficulties, challenges faces with typical this kind of setup.

Lack of Resources

Security Risks

Management

So what is the answer then ?

With windows 2008 server Microsoft introduce the Read-Only domain controller feature to specially address these difficulties company face in this kind of branch site scenario.

Read-Only!!!!

Password Replication Policy (PRP)

In windows 2012 server to configure we can use 2 security groups it creates with RODC setup. According to Microsoft its as following,

In next post will look in to the configuration of a RODC.

APPLOCKER PART 2

This is the Part 2 of the AppLocker series. If you still not read the Part 1 you can find it in here.

In Part 1 i have explain what is "AppLocker" and use of it. Lets look in to furthure in to this nice feature.

As explain in part 1 in group policy applocker container there are four nodes called executable rules, windows installer rules,script rules and packaged app rules. in each of these containers we can allow or block applications based on 3 criteria.

Publisher: Using this criteria we can block or allow applications based on its digital signature publish by the software publisher.
Path : Using this criteria we can block or allow applications based on the specific folder or file path. This type of rules kind of risky as if we given a folder path, any files in that particular folder affects from this rule.
File Hash: This criteria is apply to allow or block applications which is not digitally signed. it works based on digital fingerprint of the application and it will work even name or the location of the application change.

Before AppLocker rules get to work you need to make sure "Application Identity" service is running. by default it is not. so make sure you start the service and set its startup type to "Automatic"

Default Rules

By default Applocket will block every package, file and script except the stuff which is allowed using rules. But as we know windows system it self need files, applications, scripts etc. to run by default. it is not practicle to create rules manually for each of these. Microsoft made this easier by introdusing "Default Rules". by creating default rules in each of four containers will create the required rules which system needs it self. These rules can simply create by using following steps,

1. Right click on each container.
2. Click on option "Create Default Rules" from the list

Automatically Generate Rules Wizard

One of the grate option of applocker is its allow you to generate rules using wizard automatically. once you specify a folder path, permission groups it will automatically analyze the selection and generate the rules. then it will give you ability to review them and change them if required before create the rules.

This wizard can open using,

1. Right click on each container.
2. Click on option "Automatically Generate Rules.."

Create Rules Manually
We can also create rules manually as per our requirement. I will explain the procedure with the example. In network i have WinRAR application installed in path "C:\Program Files\WinRAR". I need to block this application using APPLocker rule.

To do that i will be using the "Executable Rules" container rules.

To start the process

1. Right click on "Executable Rules" container
2. Select "Create New Rule…" Option

3. It will open the wizard, click next to continue

4. In next window i need to select the rule type and permissions. since i need to "deny" access the action will be "deny" and i will apply it to everyone in network

5. In next window i need to select the condition. here i will be using "Path" option.

6. In next window it allows you to select the file or the folder. in here click on "Browse Folders" to select the path. once selection is done click on next to continue.

7. In next window it allows to add exception but here i will not do any modifications

8. In next window it ask for name and we can define name to it. then once you click on create it will generate the rule.

9. Now i will try to execute the application in a pc in network which attached to the domain.
10. As soon as i double click on application shortcut it gives following error

As we can see its done the trick.

This is the end off the Applocker series.

APPLOCKER PART 1

It’s been quite some time from my last post. I have been involved with a large data center migration project for last month and gave me little time to involve with the blog.

In a company environment sometime you may have requirements where you need to block certain software access, software application install. In windows xp and windows vista Microsoft introduce Software Restriction Policies (SRP) where administrators can define rules and enforce application control policies. but it’s quite been a management burden for the administrators as these rules based on "Hash rules". Hash value is a digital fingerprint which remains valid even the name or location of the executable file change. But every time software is updated new values need to be created.

With windows 7 Applocker, Microsoft gave more control over the software restriction. This is part 1 of the series of posts which explain the AppLocker and the use of it.

According to Microsoft (http://msdn.microsoft.com/en-us/library/dd548340%28v=ws.10%29.aspx) Applocker can mainly use for following,

Prevent unlicensed software from running in the desktop environment if the software is not on the allowed list
Prevent vulnerable, unauthorized applications from running in the desktop environment, including malware
Stop users from running applications that needlessly consume network bandwidth or otherwise affect the enterprise computing environment
Prevent users from running applications that destabilize their desktop environment and increase help desk support costs
Provide more options for effective desktop configuration management
Allow users to run approved applications and software updates based upon policies while preserving the requirement that only users with administrative credentials can install or run applications and software updates
Help to ensure that the desktop environment is in compliance with corporate policies and industry regulations

System Requirement

Applocker can use with operating systems after Windows 7. It can be used in standalone workstations as well as in AD environment. In AD environment we can use it Group Policy to define the AppLocker rules.

Concerns

Applying application restriction rules can be a overhead for the administrators. Most of time administrators block all apps and then allowing only the required app. But you should not forget that operating system itself use different executables, scripts for its functions. If you not planned this properly it can lead in to chaos.
In AD if you going to define applocker rules, the rules are located in GPO > Policy Name > Computer Configuration > Policies > Windows Settings > Security Settings > Application Control Policies > AppLocker

In the container there are four nodes as you can see, those are contains the different type of rules.

Executable Rules : This will contains the rules which apply with executable files. usually those apply to application files with extension .exe and .com
Windows Installer Rules : This contains the rules which apply for the windows installer packages with .msi and .msp extensions
Script Rules : This contains rules which apply to scripts files with .ps1, .cmd, .vbs, .bat, .js extensions.
Packaged App Rules : This contains rules which apply to apps which purchased through windows store.

This is the end of part 1 of the AppLocker post series.

THE DS COMMANDS – DSMOVE

In today post lets look in to another DS command which we can use to administer active directory. Today command is "DSMOVE". This is very similar to the object move from right clicking and selecting "Move" option in AD users and computers snap-in. It allows to move object from one container to another.

The common syntax will be like

dsmove objectDN -newparent targetOUDN

In here objectDN refers to the DN of the object which will need to move. targetOUDN refers to the DN of the new parent OU it will need to move in to.

The help file will be able to open using dsmove /? and these commands need to be run using administrator privilege in DC server.

the command i will use to demonstrate this will be dsmove "CN=John Smith,OU=Sales Department,DC=contoso,DC=com" -newparent "OU=HR Department,DC=contoso,DC=com" , it will move the user John Smith from Sales Department OU to HR Department OU. Lets check the object before move.

Lets run the command and see.

So according to it were able to successfully move the object from one OU to another.

This is the end of this post and lets look in to another DS command in next post.

THE DS COMMANDS – DSRM

In today post lets look in to another DS command which we can use to administer active directory. Today command is "DSRM". This command is using to delete object/objects from active directory. when use this command need to be extra careful because when it deletes the object. The new dsrm utility (server 2012) ask for the confirmation before it delete objects. but before it was very dangerous before as it doesnt ask for confirmations.

The command syntax for the command is

dsrm objectDN

Note that dsrm command doesn't takes the object type. it need full DN path for the object. it is actually good as it prevent the data lose that can happen, if we take dsquery if you just enter the command with object type it will list all the records related to that object type. if its same with dsrm it may delete all the objects related to given type. but still we need to be careful when using the DN even specially when you define the containers. if you submit the command with container (OU) it will also delete all the objects inside it and OU it self as well. there for double check the command before you press enter.

DSRM command help file can open using dsrm /? This commands needs to run as administrator in DC server.

Lets look in to some sample commands to use with this command.

As demo i will use dsrm "CN=Sales A,OU=Sales Department,DC=contoso,DC=com" This will remove the User account called "Sales A". lets confirm the object is there before execute the command for verifications.

Lets run the command

As you can see it ask if you are wish to delete this object. type "y" and enter to accept the object removal.

It confirms the object removal. lets go and see if the object is gone from AD.

This confirms its been removed from AD.

DSRM also can pipe with other DS command such as DSquery to run a query and deletes its outcome. for example if i do not know the DN path i can query for user account using dsquery command and then tell it to remove the result objects it gives.

This is the end of this post and lets look in to another DS command in next post.

THE DS COMMANDS – DSMOD

In today post lets look in to another DS command which we can use to administer active directory. Today command is "DSMOD". This command is use to modify the attributes of a object. For example lets assume we need to edit the attributes like Display name, Department of an object or a group of object. This command can easily use for the task.

Another advantage of this command is you can use it combine with DSQuery command. so you can simply search the object and modify the attributes of results it passes.

The common syntax for the command is

dsmod objecttype "ObjectDN" -attribute "New Value"

in here objecttype describe the type of the object. for example if its user account the object type will be user. ObjectDN defines the DN of the object which going to modify. attribute defines the attribute which will be modify.

The help file of the command can be open using dsmod /? and these command need to be run as administrator on DC server.

Lets look in to some of examples using this command.

The first command i am using is dsmod user "CN=Sales B,OU=Sales Department,DC=contoso,DC=com" -email "SalesB@contoso.com" in here i am going to edit the "Email" attribute of the user Sales B and add email address SalesB@contoso.com. before run the command lets check and verify the existing attribute values.

as we ca see it is empty. lets run the command now and see the outcome.

as we can see it successfully updated the attribute.

Also as i mentioned earlier in the post we can use this command along with the DSquery command. lets look how we can use it.

as per demo i will be using dsquery user -name "Sales*" | dsmod user -dept "Sales Department". on this command it will first query all the users who starts the name with text "Sales" and modify the department attribute of all of them and add Sales Department

According to above it successfully modify 5 user objects and we can see its applied on user account Sales C as expected.

This is the end of this post and lets look in to another DS command in next post.

THE DS COMMANDS – DSGET

In today post lets look in to another DS command which we can use to administer active directory. The command is "DSGET" it is also use to query about AD objects.

What is different between DSQUERY and DSGET ?

When you run DSquery you can get set of objects as results. for example if you need to list all the users starts name with "Sales" you can use DSquery command to list similar objects and find the exact object you need. but DSget use to list properties of a object. for example if you need to fine email address of user "Sales A" you can use DSget command for it. But to do that you need to know Distinguish Name (DN) of the object. So this is the reason why this command less popular among engineers.

DSGET Hlp file can open using dsget /? This commands need to be run as administrator on DC server.

Lets look in to some of examples,

The first sample command i will use is dsget user "CN=Sales A,OU=Sales Department,DC=contoso,DC=com" -email. in here dsget user defines that the query is going to based on object type Users. so in this i am trying to find email address of the Sales Auser. CN=Sales A,OU=Sales Department,DC=contoso,DC=com is the DN for the user Sales A.

As it is showing on the above it is display the email address of the user as the result.

The next sample command is dsget group "CN=Sales Leads,OU=Groups,DC=contoso,DC=com" -members, This is for list all the members of the Ad user group called "Sales Leads" , in command dsget group defines the object type as group and CN=Sales Leads,OU=Groups,DC=contoso,DC=com is the DN for the user group.

According to the command it list down the 2 users in the group successfully.

This is the end of this post and lets look in to another DS command in next post.

THE DS COMMANDS – DSQUERY

In last few posts i have explained different tools, techniques which can use to query about AD objects. in there mostly we used GUI tools. But there is a command line utility which can use to perform almost all tasks which you can do using Active Directory Users and Computers Snap-in. But some one may think why its needed to use complex commands to do such while you having GUI tools. But this command line utility is giving more control over the AD tasks. you can execute few tasks together which you may have to do by few steps in GUI. For example you can search for a object and same time can edit info in search results. Most of commands use for this begins with letter "DS" so these are more often refer as "DS commands".

DSQuery – This is works similar to "Find" function in AD users and computers snap-in. It can use to query objects based on the parameters which is provided and list the matching objects.

The help file of the command can view by passing dsquery /? This command have to run as administrator in AD server.

The basic form of the command is

dsquery objecttype

Object type can be : user,computer,group,ou

by default search scope is the entire domain but this can be change by defining the container.

-limit specifies the number of results it returns. the default value is 100 entries. if you pass value 0 means return all values. in queries it allows to use wildcard (*)

lets look in to few of examples.

as first query i am going to use dsquery user -name "Sales*" This will search for the all the user names which starts with text "Sales" and list them all.

It has list down all the info in Distinguished Name (DN) format. This listed all the users who starts with name "Sales" we also can specify the exact data as well. for example dsquery user -name "Sales A" This will search for the exact value and list it down. if its cannot find it it will pass empty line.

As i mentioned before by default the search run against entire domain. but we can still define the container it should run against.

dsquery user "OU=Sales Department,dc=contoso,dc=com" -name "Sales*" in this query its define the search scoop and it will only run it against OU=Sales Department,dc=contoso,dc=com

This is the end of this article and in next few articles i will explain other DS commands which can use.

Guide To Install Read-Only Domain Controller (RODC)

noreply@blogger.com (Anonymous) — Fri, 21 Nov 2014 20:01:00 +0000

Before install a RODC in a domain environment it need to meet the following requirements,

Forest function level should be windows 2003 server or higher
Needs at least one writable domain controller running windows server 2008 or higher

In my demo setup i do have a domain called contoso. Before start lets check the forest function level.

To do that, log in to the DC as domain admin and open "Server Manager"
Then from tools click on "Active Directory Domains and Trust"

Right click on domain and select "Properties"

As we can see here its runs with windows server 2012 R2 so we do not need to prepare domain

with adprep /RODCprep

To begin the setup first make sure you login as a domain administrator to the server.
Open "Server Manager" and from dashboard window click on "Add roles and features"

It will open up the wizard and click on "next" to continue.

In next window select "Role-based or feature-based installation" and click next

In next window by default it select the current server and click next to continue

In next window click on "Active Directory Domain Service" and it will pop up with the features. click on "add features" to continue and then "next"

In next window will let it run with default features. click on next to continue

In next window it will gives brief description about the AD DS and click next to continue

Next window it will ask for confirmation and click ok "install" to begin the service installation

Once installation done open "Server Manager" and click on "AD DS"

Then in right hand side panel click "More" as in image

Then it will open up the wizard and click on option "Promote this server to a domain…"

It will open up the configuration wizard. in here we will keep the default selection and click on next to continue

In next window make sure to select option "Read only domain controller(RODC)" and then also type a password for restore. click on next to continue

In next window we can select what groups/users allowed for the password caching, what group/users denied for caching and also delegated admin accounts. in here for now we will keep the default selection.

in next window we can define from which DC we need replication done.

In next window it gives option to change the folder paths. in here we keep default. click next to continue.

In next window it gives option to review the installation selection and click next to continue.
In next window system will check if its meet all the prerequisites for the installation. click on Install to begin the installation

Once installation done system will automatically reboot.

This completes the installation of RODC in domain. in next post we will look in to configuring RODC with different policies.

How to Configure VPN? Part 3

noreply@blogger.com (Anonymous) — Fri, 21 Nov 2014 19:48:00 +0000

This is the part 3 of the series of articles which explains complete setup of VPN in windows serverenvironment.

Configure Logs

To maintain the security and the monitor the issues involve with the remote access it’s important to configure proper logs. NPS keeps separate logs for this process. In below I will demonstrate how to configure these logs.

1. Open the network policy server mmc.
2. In the console click accounting.

3. In the detail panel click configure local file logging. Then local file logging box will open.

4. On the log file tab, it is possible to define the directory the log files should store. Also by selecting “database-compatibility” the files will be save on IAS format which allow to open it from database level.

Also there we can define the log intervals such as daily, weekly or monthly. Also the log file size, what to do if log is full etc. allow to adjust. Then click ok to apply new changes.

For monitor the VPN connections can use the “Routing and Remote Access” mmc. In their clicking on “Remote Access Clients” will list down the active VPN connections.

Setup VPN Client

So far I have configured all the server side configurations which required for VPN connection. Now it’s time to look how to setup a client pc to connect with VPN. Following demo explains how to do this on windows 7 client pc.

1. Go to network sharing center by Start > control Panel > Network Sharing Center

2. Under change your networking settings section click “set up a new connection or network”. Then in choose connection option click connect to a work place and then click next.

3. In the connection to workplace dialog box, select the use my internet connection(VPN) option. When prompt select “I’ll setup internet connection later”

4. In the next window specify the ip address of the public interface I assign for the public interface of the VPN server and click create.

5. Then go back to network sharing center > change adapter settings. Then right click on the new VPN called “Greenwich VPN” which is created and click connect.

6. In the authentication window need to provide the login details of a user account allowed for the VPN. ( due to practice issues with public ip address cannot demonstrate it further )

So this is the end of long 3 parts post which explain complete setup of VPN server in windows server environment. if you have any question please send email to rebeladm@live.com

HOW TO CONFIGURE VPN ? PART 1

This article is part 1 for explaining the setup of the VPN on windows server environment. This demo is done using windows 2008 R2 but the theory will be same for windows 2012.

In this set of article i will be doing the following,

1. configure inbound and outbound VPN connections
2. configure remote access policies to control the access of various groups via RRAS
3. configure a RADIUS server to log all accounting
4. monitor remote access

To do the setup it needs the following,
•    A server with windows 2008 / R2 which is connected to the company domain
•    Two NIC configured for local network access and public access
•    IP address allocation
•    Authentication provider ( Network policy server, RADIUS )
•    DHCP relay agent
•    User account with domain administrator privileges.

In this setup I will be using Network Policy Server as the authentication provider. Before start on setup it’s important to know the use of it. According to Microsoft (http://technet.microsoft.com/en-us/library/cc732912.aspx)
Network Policy Server (NPS) allows you to create and enforce organization-wide network access policies for client health, connection request authentication, and connection request authorization. In addition, you can use NPS as a Remote Authentication Dial-In User Service (RADIUS) proxy to forward connection requests to a server running NPS or other RADIUS servers that you configure in remote RADIUS server groups.

NPS allows you to centrally configure and manage network access authentication, authorization, and client health policies with the following three features:

• RADIUS server . NPS performs centralized authentication, authorization, and accounting for wireless, authenticating switch, remote access dial-up and virtual private network (VPN) connections. When you use NPS as a RADIUS server, you configure network access servers, such as wireless access points and VPN servers, as RADIUS clients in NPS. You also configure network policies that NPS uses to authorize connection requests, and you can configure RADIUS accounting so that NPS logs accounting information to log files on the local hard disk or in a Microsoft SQL Server database.

• RADIUS proxy . When use NPS as a RADIUS proxy, can configure connection request policies that tell the NPS server which connection requests to forward to other RADIUS servers and to which RADIUS servers you want to forward connection requests. You can also configure NPS to forward accounting data to be logged by one or more computers in a remote RADIUS server group.

• Network Access Protection (NAP) policy server . When configure NPS as a NAP policy server, NPS evaluates statements of health (SoH) sent by NAP-capable client computers that want to connect to the network. NPS also acts as a RADIUS server when configured with NAP, performing authentication and authorization for connection requests. You can configure NAP policies and settings in NPS, including system health validators (SHVs), health policy, and remediation server groups that allow client computers to update their configuration to become compliant with your organization's network policy.

We can configure NPS with any combination of the preceding features. For example, you can configure one NPS server to act as a NAP policy server using one or more enforcement methods, while also configuring the same NPS server as a RADIUS server for dial-up connections and as a RADIUS proxy to forward some connection requests to members of a remote RADIUS server group for authentication and authorization in another domain.

Let’s move in to the configuration as next step,
For the setup I log in to a server which is connected to the company network. It is running windows 2008 standard version.

Before we start for a selected server in domain we need to add 2 nic interfaces. One will be to serve for LAN and other NIC will have a public ip address.

For the server I already add 2 nic and configured the ip address as following,
For LAN Interface
Ip address : 192.168.20.2
Subnet : 255.255.255.0
Default Gateway : none
DNS servers : none

As we know in a same machine we cannot deal with different default gateways. There for we no need to put gateway here.

For Public Interface
Ip address : 10.0.0.2
Subnet : 255.255.255.0
Default Gateway : 10.0.0.1
DNS servers : 8.8.8.8 ( public dns from ISP )

This used public ip info is just for demo purposes and these are not real public ip from ISP. But in real setup you need to fill that info with the details provided by the ISP.

In the server I have renamed the 2 interfaces according to ip as “private” and “public” for easy identification.

Install Network Policy and Access Service role

1. To start the server manager Start > administrative tools > Server Manager

2. In the Server manager windows right click on the “Roles” and click on “Add Roles”

3. Then add doles wizard will appears. Click next to continue.

4. On the select server roles page, select “Network policy and access services” and click next.

5. In “Network policy and access service introduction” page, click Next.

6. On the select role service page, select the “network policy server” and “routing and remote access services” check boxes and click next.

7. On the confirmation page click “Next” to continue.

8. On the installation result page, verify the “installation succeeded” appears in the detail pane then click close to complete.

Configure VPN Server

1. To start “Routing and Remote Access” mmc, click on start > administrative tools > routing and remote access.

2. In the mmc, click on the server name, right click on it and from options click on “Configure and enable routing and remote access”

3. Click next on welcome page to continue. On the configuration page, leave default “Remote access (dial-up or VPN) selected and click Next.

4. On the remote access page, select the “VPN” check box and click next.

5. On the VPN connection page, select the “Public” interface and then click next.

6. On the IP address assignment page, select “From a specified range of addresses” and then click next.

7. In the address range assignment page, click new and in the “start ip address” box, type the value of 10.0.0.5. in the “number of addresses” box type the value of 75 and click ok, then click next to continue.

8. On the managing multiple remote access servers page, leave the default selection “No, use routing and remote access to authenticate connection requests” and click next, and then Finish.

9. In the routing and remote access dialog box, click ok.

10. In next dialog box about DHCP relay agent click Ok too.

WHY VPN ?

When most business grows it mostly will expand in to different branches in different geographical locations. It may be expanding its sales to different areas even to different countries. It creates new situations to apply appropriate networking technology solutions which help for company operations. The branch offices will need to be part of the cooperate network to access company data and continue on operations. There can be sales peoples who conducts demonstrations from remote locations which also need to access cooperate network time to time. Since “virtual office” concept is growing there can be employees who works remotely which also need to be part of the cooperate network.

The old and traditional way of doing this setup is to use “Leased Lines”. In this solution each branch office, sales peoples, remote workers will connect to the cooperate network via dedicated communication links. The connection is almost will be physical connections using cable media and the link will be fully dedicated for communication between those selected points (ex- Cooperate office to Branch office). The connection will be secure and runs with high bandwidth.

Even though it’s reliable, high bandwidth secure lines there are some issue involves applying this solution for most of the modern day requirements. Let’s examine few of the issues in details.

Issue	Description
Cost	The main particle issue on using these is cost. To create dedicated line between two locations it need more man power, resources. There for the cost for getting such connection is very high. When the distance between locations and required bandwidth increase, the line cost also increases. If it’s between countries it will involves with many different ISP (internet Service providers) which increases implementation and operational cost.
No Mobility	Sometime sales representatives, management staff can be traveling in to different locations for business presentations, training etc. stay on those locations can be temporally for few hours or days. If they need to get access to cooperate network with leased line it’s impossible. You can’t bring lease line to any place you go. Leased line will be permanent physical connection to particular location and will not support for mobile use.
Implementation Complexity and Time	The implantation of leased lines can be more complex. Some time you may need to work with few different ISP in different geographical areas. Some time it can take months to perform a lease connection between two locations. It will defiantly effect on company operations. Also let’s say there is manager who is in business trip for certain product presentations. He wants to connect cooperate network to get some data. It is obviously not practical to get leased line for it. Even it’s possible it will not be instant, can take days, weeks to do it.
Service Provider Dependency	Once leased line in place between branch offices and cooperate network, let’s assume it get connection issues. To get it fixed you have to get the service provider who provided the link. Even though it’s too critical for operations you have to wait till they fix it. You can’t simply connect through different service provider. Even you switch service providers it can take days, weeks to get them to lay new leased line.

Is there any other solution than lease line which can use without these types of issues? Yes it is we called it as VPN (Virtual Private Network). Its simply creates “virtual” private network similar to leased line over public network. So there is no physical leased line, but it creates secure tunnel between two locations over Internet. This we can also call as virtual leased line. Most of ISP, provides VPN solutions which will suite your requirement but you also can create your own VPN solutions based on VPN appliance or based on software such as windows routing and remote access.

Even Though its make connection over the internet it is secure tunnel which transfer only encrypted data. There are many security protocols that VPN can configure with.

•    IPSec ( IP Security )
•    L2TP ( Layer 2 tunneling Protocol )
•    PPTP ( Point to Point tunneling Protocol )
•    SSL/TLS ( Secure Socket Layer/Transport Layer Security)

First 3 methods are works on OSI network layer. When use this most of the time it will need a VPN client install on the host to connect to the VPN server or appliance.

The SSL/TSL is works on OSI Transport layer. So it will be working on industry standard SSL port 443 and no need to use custom ports for VPN connections. The connection setup from client end is easy as it can be perform via web browser.

One of the main advantage of VPN is the low implantation and operation cost. If you have public ip with proper internet connection you can simply setup your on VPN server and allow the clients to dial in to it. You do not need to spend money on additional hardware, services, and resources for it. The operation cost also will be very low or null. For ex Microsoft Remote Access solution is comes with the windows server operating system in built. To set it up all you need to do is add the role and configure it. It will not involve any license cost, monthly fees, maintains fees or services charges like we do have with leased connections.

The other beauty of VPN is that it support for mobility. As we discussed it do not have any physical connection between the locations. If you have internet connection you can use VPN to connect to cooperate network from anywhere in the world. It can be via your mobile, smart phone, pad, laptop etc. This is very best solution for mobile sales peoples, management staff which travels on business matters. All they need is working internet connection. It doesn’t matter if you in hotel, road, airport, bus stop if you connected to VPN you will be part of corporate network.

One of another advantage of using VPN is it will not have dependency on service providers. There are certain situations such as cooperate site-to-site VPN solutions which may use via service provider but majority of the VPN connection solutions are not depend on the service provider. In leased line if you got connection from particular ISP you always have to depend on that service provider to get connected. If line has issues you have to wait till they fix it. But in VPN solutions all you need is working internet connection. It doesn’t matter which ISP you connects from. For ex- In home office let’s assume you using VPN connection to connect to office network. While you working, the DSL connection you using as primary internet connection starts to drop. But you have mobile internet connection from another service provider. You can simply plug in the dongle and connect to VPN via and continue your work. You will not need to change any VPN connection settings to do it.

If you take a leased line solution some time it may be a combination of different ISP, different technologies. There for to maintain/troubleshoot it will take time and complex routine. But on a VPN it’s easier to maintain and troubleshoot. Mostly it will be due to failure of internet connections. Other than that very rarely it involves any complex troubleshooting routine specially because no physical connection.

Considering all these facts it’s obviously VPN is the best solution to use for remote access.

There are different solutions such as Remote desktop Services, Terminal services, Citrix Solutions which can use for the remote access. All those have different pros and cons but here I only compare the leased line solution and the VPN solution.

GUIDE TO MIGRATE FSMO ROLES FROM WINDOWS 2003 SERVER TO WINDOWS 2012 R2 SERVER

noreply@blogger.com (Anonymous) — Fri, 21 Nov 2014 18:03:00 +0000

Even its been over decade after windows server 2003 release , It’s no wonder that still organizations using windows server 2003 / windows server 2003 R2 as their domain controllers. Microsoft has announced that windows server 2003 / windows server 2003 R2 supports ends on 2015, July 14th (http://support2.microsoft.com/lifecycle/search/default.aspx?sort=PN&alpha=Microsoft+Windows+Server+2003&Filter=FilterNO). So the day has come to plan out for the upgrades if you still running those versions in infrastructure.

This guide will explain how we can transfer DC FSMO roles from windows server 2003 to windows server 2012 R2 which is latest. In Windows DC environment FSMO roles holds all the information about DC and its necessary to have all this 5 roles working correctly to maintain proper DC environment. The 5 FSMO roles as following,

•    Schema master
•    Domain naming master
•    RID master
•    PDC emulator
•    Infrastructure master

You can find more information about this roles from http://support.microsoft.com/kb/197132

For the demonstration I am using the following setup

Server Name	Operating System	Server Roles
canitpro-dc2k3.canitpro.local	Windows server 2003 SP2 x86	Active Directory FSMO roles, DNS
CANITPRO-DC2K12.canitpro.local	Windows server 2012 R2 x64	Additional Domain Controller, DNS

So in here I already added windows 2012 r2 server to domain and make it additional domain controller. Currently it do not hold any FSMO roles. My plan is to migrate all the FSMO roles in to windows 2012 r2 server.

Note : In before if we adding windows 2008 server to windows 2003 environment, first we need to prepare the forest and domain schema by running adprep \forestprep and adprep \domainprep from windows 2008 source files \ support \ adprep. But in windows 2012 you do not need to worry about it when adding 2012 as additional domain controller. When you run the dcpromo it will automatically update it in windows 2003 remotely.

Transfer RID master, PDC emulator, Infrastructure master Roles

As the first step let’s look how we can transfer these 3 roles over to new server.

• Log in to the windows 2012 R2 server as domain administrator
• Click on Server Manager > Tools > Active Directory Users and Computers

• In MMC, right click on the domain name > click on “Operation Masters”

• In next window it will show the 3 FSMO roles. The default is “PDC”. In there it shows the current PDC holder. Then it is asking if need to change it to new windows 2012 r2 server click on change. There for lets go ahead and click on “Change”

• Then it’s asking for confirmation. Click yes to continue.

• Once its confirm as operation completed we can see the window shows the current PDC role holder as new windows 2012 r2 server.

• Please repeat the same steps to transfer the RID master and Infrastructure master Roles

Transfer domain naming master role

• Log in to the windows 2012 R2 server as domain administrator.
• Click on Server Manager > Tools > Active Directory Domains and Trusts.

• In MMC right click on Active Directory Domains and Trusts > click on Operation Master.

• In here it shows the current domain naming master role holder (canitpro-dc2k3.canitpro.local) and its asking if we need to move it to windows server 2012 R2 (CANITPRO-DC2K12.canitpro.local). Click on change to move the role over.

• Then it’s asking for confirmation and click yes to continue.

• Once its confirm about task completion we can see current domain naming master is windows server 2012 R2 (CANITPRO-DC2K12.canitpro.local).

Transfer schema master role

• Log in to the windows 2012 R2 server as domain administrator.
• Open “Run” window in server (Windows key + R) and type regsvr32 schmmgmt.dll and press enter.

• It will give the confirmation message and click on ok to continue.

• Then again open “Run” window and type mmc and click ok

• Then in mmc window click on File > Add-Remove snap-in

• Then from snap in select “Active Directory Schema” and click on “Add” button

• Then click on Ok button to continue

• Then right click on “Active Directory Schema” and click on “Change Active Directory Domain Controller”

• In Next window select the windows server 2012 R2 DC (CANITPRO-DC2K12.canitpro.local) and click ok.

• It will give information message and click ok to continue.

• Then right click on “Active Directory Schema” and click on “Operation Master”

• In here it shows the current schema master role holder (canitpro-dc2k3.canitpro.local) and its asking if we need to move it to windows server 2012 R2 (CANITPRO-DC2K12.canitpro.local). Click on change to move the role over.

• Then it’s asking for confirmation and click yes to continue.

• Once it’s confirm about task completion we can see current schema master is windows server 2012 R2 (CANITPRO-DC2K12.canitpro.local).

Now we successfully move all 5 fsmo roles over to new windows server 2012 R2. To confirm it open command prompt in new server and type command netdom query fsmo and press enter.

Yipeeee!!! Its shows as all fsmo roles moved successfully.

It will take some time to move all the data over. After that it’s safe to demote the DC role from the windows 2003 server.
Once its demote 2003 DC make sure you raise the forest functional level and domain functional level in to windows server 2012 R2 to experience new changes.

GUIDE TO MIGRATE ACTIVE DIRECTORY CERTIFICATE SERVICE FROM WINDOWS SERVER 2003 TO WINDOWS SERVER 2012 R2.

noreply@blogger.com (Anonymous) — Fri, 21 Nov 2014 17:56:00 +0000

Microsoft has already announced that windows server 2003 / windows server 2003 R2 versions support is coming to end in 14th July 2015 (http://support2.microsoft.com/lifecycle/search/default.aspx?sort=PN&alpha=Microsoft+Windows+Server+2003&Filter=FilterNO). It’s no wonder that some organizations still uses windows server 2003 versions in production environment.

If you still not plan for migration from legacy windows server versions, well time has come!!

This guide will explain how we can migrate AD CS from windows server 2003 to windows server 2012 R2.

In this demonstration I am using following setup.

Server Name	Operating System	Server Roles
canitpro-casrv.canitpro.local	Windows Server 2003 R2 Enterprise x86	AD CS ( Enterprise Certificate Authority )
CANITPRO-DC2K12.canitpro.local	Windows Server 2012 R2 x64	-

Backup windows server 2003 certificate authority database and its configuration

• Log in to Windows 2003 Server as member of local administrator group
• Go to Start > Administrative Tools > Certificate Authority

• Right Click on Server Node > All Tasks > Backup CA

• Then it will open the “Certification Authority Backup Wizard” and click “Next” to continue

• In next window click on check boxes to select options as highlighted and click on “Brows” to provide the backup file path location where it will save the backup file. Then click on “Next” to continue

• Then it will ask to provide a password to protect private key and CA certificate file. Once provided the password click on next to continue

• In next window it will provide the confirmation and click on “Finish” to complete the process

Backup CA Registry Settings

• Click Start > Run and then type regedit and click “Ok”

• Then expand the key in following pathHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc

• Right click on “Configuration” key and click on “Export”

• In next window select the path you need to save the backup file and provide a name for it. Then click on save to complete the backup

Now we have the backup of the CA and move these files to the new windows 2012 R2 server.

Uninstall CA Service from windows server 2003

Now we have the backup files ready and before configure certificate services in new windows server 2012 r2, we can uninstall the CA services from windows 2003 server. To do that need to follow following steps.

• Click on Start > Control Panel > Add or Remove Programs

• Then click on “Add/Remove Windows Components” button

• In next window remove the tick in “Certificate Services” and click on next to continue

• Once its completed the process it will give the confirmation and click on “Finish”

With it we done with windows server 2003 CA services and next step to get the windows server 2012 CA services install and configure.

Install windows server 2012 R2 Certificate Services

• Log in to windows server 2012 as Domain Administrator or member of local administrator group

• Go to Server Manager > Add roles and features

• It will open up “Add roles and feature” wizard and click on next to continue

• Then next window select “Role-based or Feature-based installation” and click next to continue

• From the server selections keep the default selection and click on next to continue

• In next window click on tick box to select “Active Directory Certificate Services” and it will pop up with window to acknowledge about required features need to be added. Click on add features to add them

• Then in features section will let it run with default. Click next to continue

• In next window, it will give brief description about AD CS. Click next to continue

• Then it will give option to select roles services. I have selected Certificate Authority and Certification Authority Web Enrollment. Click next to continue

• Since Certification Authority Web Enrollment selected it will required IIS. So next window it will give brief description about IIS

• Then in next window it gives option to add IIS role services. I will leave it default and click next to continue

• Next window will give confirmation about service install and click on “Install” to start the installation process

• Once installation completes you can close the wizard.

Configure AD CS

In this step will look in to configuration and restoring the backup we created.

• Log in to server as Enterprise Administrator
• Go to Server Manager > AD CS

• In right hand panel it will show message as following screenshot and click on “More”

• It will open up window and click on “Configure Active Directory Certificate Service ……”

• It will open role configuration wizard, it gives option to change the credential, in here I already log in as Enterprise administrator so I will leave the default and click next to continue

• In next window it asking which service you like to configure. Select “Certification Authority”, “Certification Authority Web Enrollment” options and click next to continue

• It will be Enterprise CA so in next window select the Enterprise CA as the setup type and click next to continue

• Next window select “Root CA” as the CA type and click next to continue

• The next option is very important on the configuration. If its new installation we will only need to create new private key. But since it’s a migration process we already made a backup of private key. So in here select the options as highlighted in screenshot. Then click on next to continue

• In next window click on “Import” button

• In here it will give option to select the key we backup during the backup process from windows 2003 server. Brows and select the key from the backup we made and provide the password we used for protection. Then click ok

• Then it will import the key successfully and in window select the imported certificate and click next to continue

• Next window we can define certificate database path. In here I will leave it default and click next to continue

• Then in next window it will provide the configuration confirmation and click on configure to proceed with the process

• Once its completed click on close to exit from the configuration wizard

Restore CA Backup

Now it’s comes to the most important part of the process which is to restore the CA backup we made from windows server 2003.

• Go To Server Manager > Tools > Certification Authority

• Then right click on server node > All Tasks > Restore CA

• Then it will ask if it’s okay to stop the certificate service in order to proceed. Click ok

• It will open up Certification Authority Restore Wizard, click next to continue

• In next window brows the folder where we stored backup and select it. Then also select the options as I did in below. Later click next to continue

• Next window give option to enter the password we used to protect private key during the backup process. Once its enter click next to continue

• In next window click “Finish” to complete the import process

• Once its completed system will ask if it’s okay to start the certificate service again. Please proceed with it to bring service back online

Restore Registry info

During the CA backup process we also backup registry key. It’s time to restore it. To do it open the folder which contains the backup reg key. Then double click on the key.
Then click yes to proceed with registry key restore.

Once completed it will give confirmation about the restore.

Reissue Certificate Templates

We have done with the migration process and now it’s time to reissue the certificates. I had template setup in windows 2003 environment called “PC Certificate” which will issue the certificates to the domain computers. Let’s see how I can reissue them.

• Open the Certification Authority Snap-in
• Right click on Certificate Templates Folder > New > Certificate Template to Reissue

• From the certificate templates list click on the appropriate certificate template and click ok

Test the CA

In here I already had certificate template setup for the PC and set it to auto enroll. For the testing purposes I have setup windows 8 pc called demo1 and added it to canitpro.local domain. Once it’s loaded first time in server I open certification authority snap in and once I expanded the “Issued Certificate” section I can clearly see the new certificate it issued for the PC.

So this confirms the migration is successful.

GUIDE TO MIGRATE DHCP FROM WINDOWS SERVER 2003 TO WINDOWS SERVER 2012 R2 USING WINDOWS SERVER MIGRATION TOOLS

noreply@blogger.com (Anonymous) — Fri, 21 Nov 2014 17:45:00 +0000

Microsoft has already announced that windows server 2003 / windows server 2003 R2 versions support is coming to end in 14th July 2015

It’s no wonder that still organizations using windows server 2003 / windows server 2003 R2 in their infrastructure with different server roles.

With windows server 2008 R2 Microsoft has introduce new great feature called “Windows Server Migration Tools” which will allow administrators to migrate server roles, features, configuration settings seamlessly from one system to another(ex- windows server 2003). Windows server 2012 also includes this feature and in this article I will demonstrate how we can use it to migrate DHCProle to windows server 2012 r2.

Please note, To use this method we need to install this feature in both source and destination servers.

For the demonstration I am using following setup

Server Name	Operating System	Server Roles	Networks
dhcp-2k3.canitpro.local	Windows Server 2003 R2 Enterprise x86	DHCP	Network A – 10.10.10.0 Network B – 172.16.25.0 Network C – 192.168.148.0
CANITPRO-DC2K12.canitpro.local	Windows Server 2012 R2 x64	-	-

Before start the migration process it’s important to consider on following.

1)    To migrate the roles you need to log in to source and destination servers as “Domain Administrators”.
2)    Before start the migration process make sure source and destination servers’ runs with latest updates and service packs.
3)    If the source server runs with multiple network, multiple NIC make sure the destination server also have same number of NIC so it can be server with same network setup.

dhcp-2k3.canitpro.local server currently setup with 3 additional NIC to represent network A,B and C. those have configured with static ip addresses to match with relevant network it belongs to. The DHCP server host different DHCP scopes for each network.
Before we start the process we need to install the following software in windows server 2003(dhcp-2k3.canitpro.local) if it’s not there already.

1) .Net Framework 3.5 (http://www.microsoft.com/en-us/download/details.aspx?id=21)
2) Windows PowerShell 2.0 (http://support2.microsoft.com/kb/968929/en-us)

Install Windows Server Migration Tools in windows server 2012

1) Log in to the Windows server 2012 as Domain Administrator
2) Go to Server Manager > Add Roles and Features

3) It will open the Add roles and features Wizard and click next to start the process
4) In next window, for the installation type select “Role-based or feature-based installation” then click next to continue

5) In next window keep the default server selection and click next to continue

6) Then it will give option to select server roles but we need to install only a feature. So keep the default selection and click next to continue.

7) Then in features selection, select “Windows Server Migration Tools” and click next to continue

8) In next window it will give the confirmation window and click on install to begin the installation process

9) Once installation is completed click on close to exit from the wizard

Prepare windows server migration tools for windows server 2003

1) Log in to the Windows server 2012 as Domain Administrator
2) Go to Server Manager > Tools > Windows Server Migration Tools > Windows Server Migration Tools

3) It will open up the command prompt and then type cd ServerMigrationTools

4) Now we need to create migration deployment package for windows server 2003. To save the files I have create folder “C:\WIN2K3MIG”. Now type the command .\SmigDeploy.exe /package /architecture x86 /os ws03 /path C:\WIN2K3MIG and press enter

5) This creates the package as following

6) Now we need to copy the folder C:\WIN2K3MIG\SMT_ws03_x86 to windows server 2003 which host the DHCP role

Prepare windows server 2003 (DHCP Source) for the migration

1) Log in to the Windows server 2003 as Domain Administrator
2) Go to Start > All Programs > Accessories > Windows PowerShell > Windows PowerShell

3) Then type “Net stop “DHCP Server”” and enter

4) This will stop the running DHCP server. Then open the folder copied from windows server 2012 R2 and then open the file called “SmigDeploy.exe”

5) Then it will open up the command window. Then type Get-SmigServerFeature and press enter

6) This will examine the roles running on this server and provide list of roles which we can migrate over to windows server 2012 R2
7) Now it’s time export the DHCP data using the tool. Before do it we need to prepare a share folder in network which will have access from both DHCP Source Server and DHCP Destination Server. I have create folder called “DHCPShare” in windows server 2012 and share it with read and write NTFS permissions.

8) Type the command Export-SmigServerSetting -featureID DHCP -User All -Group -path \\Canitpro-dc2k12\DHCPShare -Verbose and press enter to export the DHCP data. In here featureID define the server role. Once enter the command it will ask a password to protect the data.

9) Now in the share we can see it created the backup file.

With this step it will successfully exports the DHCP data.

Remove DHCP roles from windows server 2003 R2

Since we no longer need DHCP role running on this server we can go ahead and uninstall the DHCP service.

1) Log in to the windows server 2003 as member of administrator group
2) Start > Control Panel > Add or Remove Programs

3) Then click on “Add/Remove Windows Components”

4) In next window select “Networking Services” and click on details

5) From next window de-select the DHCP option and click ok

6) Then click next to uninstall the DHCP service

It will uninstall the DHCP role from the windows 2003 server.

Install DHCP Role in windows 2012 R2 server

1) Log in to the windows server 2012 as member of administrator group
2) Open Server Manager > Add Roles and Features

3) It will open the wizard and click next to continue
4) For the installation type select “Role-based or feature-based installation” and click next

5) Let the default selection run on server selection and click next to continue

6) For the server roles select DHCP and it will prompt to add relevant features. Click on “Add features” to add them and next to continue

7) For the features let it run with default. Click next to continue
8) Then it will give brief description about DHCP server role and click next to continue

9) Next window it will give the confirmation and click on install to continue

This will install the DHCP server role in the new server.

Import DHCP server data in to windows server 2012 R2

1)    Log in to the Windows server 2012 as Domain Administrator
2)    Open Windows Powershell using Server manager > Tools > Windows Powershell
3)    Type “Net stop “DHCP Server”” and press enter

4) Then type Add-PSSnapin microsoft.windows.servermanager.migration and press enter to use the migration tools command set.

5) Now to import DHCP data type Import-SmigServerSetting -featureID DHCP -Force -path C:\DHCPShare -Verbose (Note: Here I didn’t import the users or groups as its domain controller I am importing to but if necessary you can do it using –Users and Group command) and press enter. Here C:\DHCPShare is the folder path where we save the DHCP data from windows server 2003. It will ask the password to enter which we have define during the export DHCP server data process.

6) Then type Start-Service DHCPServer and press enter to start the DHCP server

7) Then authorize the DHCP server with command Netsh DHCP add server CANITPRO-DC2K12.canitpro.local 38.117.80.124

Note : If the source DHCP server had multiple NIC with Multiple networks make sure the new server also match the same config. Assign the static ip address to those interfaces to match the configuration. This also can automated during the import process. You can get more info about command option in http://technet.microsoft.com/en-us/library/dn495425.aspx

Now we completed with the restore process and I already can see its issues IP addresses.

Share and Enjoy:

GUIDE TO MIGRATE DHCP FROM WINDOWS SERVER 2003 TO WINDOWS SERVER 2012 R2

noreply@blogger.com (Anonymous) — Fri, 21 Nov 2014 17:37:00 +0000

Microsoft has already announced that windows server 2003 / windows server 2003 R2 versions support is coming to end in 14th July 2015 (http://support2.microsoft.com/lifecycle/search/default.aspx?sort=PN&alpha=Microsoft+Windows+Server+2003&Filter=FilterNO ).

It’s no wonder that still organizations using windows server 2003 / windows server 2003 R2 in their infrastructure with different server roles. In last few post I have covered up how we canmigrate different server roles from windows server 2003 to latest windows server 2012. This article also a part of the same series and it will explain how we can migrate DHCP server role.

For the demonstration I am using following setup

Server Name

Operating System

Server Roles

Networks

dhcp-2k3.canitpro.local

Windows Server 2003 R2 Enterprise x86

DHCP

Network A – 10.10.10.0

Network B – 172.16.25.0

Network C – 192.168.148.0

CANITPRO-DC2K12.canitpro.local

Windows Server 2012 R2 x64

-

-

dhcp-2k3.canitpro.local server currently setup with 3 additional NIC to represent network A,B and C. they have configured with static ip addresses to match with relevant network it belongs to. The DHCP server host different DHCP scopes for each network.

Backup DHCP configuration in windows server 2003 R2

1)    Log in to the windows server 2003 as member of administrator group
2)    Load the DHCP server console Start > Administrative Tools > DHCP

3)    In here we can see the configured DHCP scopes

4)    Now it’s time to back up the config. To do that open the command prompt using start > run > type cmd and then enter
5)    Then type netsh dhcp server export C:\DHCPbk\dhcpbk.txt all and press enter. In hereC:\DHCPbk\dhcpbk.txt is the file path which backup will save in to. It can change according to your requirement.

6)    Now please move file C:\DHCPbk\dhcpbk.txt in to CANITPRO-DC2K12.canitpro.localserver which will be configured as new DHCP server ( windows server 2012 R2)

Remove DHCP roles from windows server 2003 R2

Since we no longer need DHCP role running on this server we can go ahead and uninstall the DHCP service.

1)    Log in to the windows server 2003 as member of administrator group
2)    Start > Control Panel > Add or Remove Programs

3)    Then click on “Add/Remove Windows Components”

4)    In next window select “Networking Services” and click on details

5)    From next window de-select the DHCP option and click ok

6)    Then click next to uninstall the DHCP service

It will uninstall the DHCP role from the windows 2003 server.

Install DHCP Role in windows 2012 R2 server

1)    Log in to the windows server 2012 as member of administrator group
2)    Open Server Manager > Add Roles and Features

3)    It will open the wizard and click next to continue
4)    For the installation type select “Role-based or feature-based installation” and click next
5)    Let the default selection run on server selection and click next to continue
6)    For the server roles select DHCP and it will prompt to add relevant features. Click on “Add features” to add them and next to continue

7)    For the features let it run with default. Click next to continue
8)    Then it will give brief description about DHCP server role and click next to continue

9)    Next window it will give the confirmation and click on install to continue

This will install the DHCP server role in the new server.

Restore DHCP configuration

1)    Log in to the windows server 2012 as member of administrator group
2)    Open Command prompt with Run > cmd
3)    Type netsh dhcp server import C:\DHCPbk\dhcpbk.txt all and press enter. In hereC:\DHCPbk\dhcpbk.txt is the backup file we copied from windows 2003 server.

4)    Go to Server manager > tools > DHCP

5)    Right click on the server name > All Task > Restart

6)    Once Restart done we can see all the scopes are visible which was in 2003 server.

7)    We still need to authorize the dhcp server, to do it again right click on server name and select authorize

Now we completed with the restore process and I already can see its issues IP addresses.

I hope this will help you guys, work on it.

GUIDE STEPS TO SETUP ACTIVE DIRECTORY ON WINDOWS SERVER 2008

noreply@blogger.com (Anonymous) — Fri, 21 Nov 2014 16:49:00 +0000

This tutorial will explain how to install AD on server 2008,as well as for windows 2008 R2.

Requirement:

Minimum: Single processor with 1.4 GHz (x64 processor) or 1.3GHz (Dual Core)

Minimum: 512 MB RAM

Minimum: 32 GB or greater

The first step is to assign a ip to the server that you going to deploy the AD. Its nessary to install it as DNS server too. So its better to have fixed ip it doesn't mean you cannot install AD without fixed ip address but it will solve lot of issues if you used fixed ip.

In here the server ip is 10.0.0.14. Since we going to make it as DNS server too you should use the

same ip as the preferred DNS server.

Next step is to install the Active directory roles. Unlikely the older version of windows servers Microsoft highly recommend to use server manager option to install roles before you run dcpromo.

Click on start menu and select the Server Manager

Select the roles from the right hand panel and click on add roles option.

From the roles list select the "Active Directory Domain Services" role and Click "Next"

Review the confirmation and click on "Next"

Review the installation confirmation and click on "Next"

It will take few minutes to complete and when its done you will get this confirmation. And then click on "Close"

After that you will need to do a reboot.

After reboot please open up the "server Manager" again. And then click on "Roles" there you will see the "Active Directory Domain Services" is successfully installed in there. click on it then you will get a window like below.

In their please pay attention to the message

So please click on that link and it will start the DCPROMO wizard.
So next step to go through the DC promo wizard.
To start the installation click on "Next"

Click on "Next"

Since we going to install New domain Controller in new forest please select the option "Create a new domain in new forest" option and click on "Next"

Now we have to provide the name for our domain controller. It must be FQDN. In our case I used rebeladmin.com as the domain. Please click "Next" after it.

In this window it will ask to select forest function level. If you going to add server 2003 domain controller to your forest later don't select the function level as server 2008. If you going to use full features of 2008 Ad you must select forest function level as server 2008. In my case I used server 2008. Click on "Next" after the select.

In next window since it's the first DC we should make it as DNS server too. Leave the default selection and click on "Next"

If the wizard cannot create a delegation for the DNS server, it displays a message to indicate that you can create the delegation manually. To continue, click "Yes"

In next window it will show up the database location. It its going to be bigger AD its good if you can keep NTDS database in different partition. Click on "Next" after changes.

In next window its asking to define a restore mode password. Its more important if you had to do a restore from backup in a server crash. Click on "Next" after filling it.

Next window is giving you a brief of the installation. Click on "Next"

Then it will start the installation of the AD. It will take some time to complete. After complete of the installation perform a server reboot.

After the reboot now you can login to the domain. Please use the login as following example

User name : your domain\administrator

Password : XXXXXXXX

Now its done and you can view the active directory options on administrative tools menu

Hope this will help you guys a lot. t

Adding A Floating Drop Down Menu With Search Box in Blogger.

noreply@blogger.com (Anonymous) — Sun, 16 Nov 2014 08:04:00 +0000

A drop down menu is something that contains navigation URl's of your blog and making it easier to find the content users are looking for.
A floating element is something that sticks to your blog at the place you post it and scrolling doesn't affects it position.
Below is drop down menu for blogger with search box.

Adding Floating DropDown menu.

Adding Floating DropDown menu.
Login to your blogger dashboard.
Select your blog.
Select Template .
Click Edit HTML.
Add this code just above the body tag, <body>

--------------------------------------------------------------------------------

<style>
#naviopdropcont{
width:100%;
height:45px;
display:block;
padding:0;
margin:0 0 20px 0;
z-index:100;
top:0px;
left:0px;
position:fixed;
box-shadow:2px 2px 5px #444444;
-moz-box-box-shadow:2px 2px 5px #444444;
-web-kit-box-shadow:2px 2px 5px #444444;
-goog-ms-box-shadow:2px 2px 5px #444444;
background:#000;
}
#naviopdropnav{
float:left;
width:800px;
height:40px;
display:block;
padding:0;
margin-left:40px;
}
#naviopdropnav ul{
float:left;
margin:0;
padding:0;

}
#naviopdropnav li{
float:left;
list-style:none;
line-height:40px;
margin:0;
padding:0
background:#180000;
}
#naviopdropnav li a, #naviopdropnav li a:link{
color:#fff;
display:block;
margin:0;
font:16px georgia, verdana;
padding:10px;
text-decoration:none;
}
#naviopdropnav li a:hover, #naviopdropnav li a:active, #naviopdropnav .current_page_item a {
color:#fff;
padding:10px;
background:#007acc;}
#naviopdropnav li li a, #naviopdropnav li li a:link, #naviopdropnav li li a:visited{
font-size: 12px;
background:#180000;
color: #fff;
width: 150px;
margin: 0;
padding: 0px 10px;
line-height:30px;
position: relative;
}
#naviopdropnav li li a:hover, #naviopdropnav li li a:active {
color: #fff;
background:#007acc;
}

#naviopdropnav li ul{
z-index:9999;
position:absolute;
left:-999em;
height:auto;
width:170px;
margin:0px;
padding:0px
}

#naviopdropnav li:hover ul, #naviopdropnav li li:hover ul, #naviopdropnav li li li:hover ul, #naviopdropnav li.sfhover ul, #topnaviopdropnav li li.sfhover ul, #topnaviopdropnav li li li.sfhover ul{
left:auto
}

#naviopdropnav li:hover, #naviopdropnav li.sfhover{
position:static;
}
</style>
<style>.
-webkit-border-radius: 2em;
-moz-border-radius: 2em;
border-radius: 2em;

-webkit-box-shadow: 0 1px 0px rgba(0,0,0,.1);
-moz-box-shadow: 0 1px 0px rgba(0,0,0,.1);
box-shadow: 0 1px 0px rgba(0,0,0,.1);

background: #f1f1f1;
background: -webkit-gradient(linear, left top, left bottom, from(#fff), to(#ededed));
background: -moz-linear-gradient(top, #fff, #ededed);
filter: progid:DXImageTransform.Microsoft.gradient(startColorstr='#ffffff', endColorstr='#ededed'); /* ie7 */
-ms-filter: progid:DXImageTransform.Microsoft.gradient(startColorstr='#ffffff', endColorstr='#ededed'); /* ie8 */
}
.searchform input {
font: normal 12px/100% Arial, Helvetica, sans-serif;
}
.searchform .searchfield {
background: #fff;
padding: 6px 6px 6px 8px;
width: 202px;
border: solid 1px #bcbbbb;
outline: none;

-webkit-border-radius: 2em;
-moz-border-radius: 2em;
border-radius: 2em;

-moz-box-shadow: inset 0 1px 2px rgba(0,0,0,.2);
-webkit-box-shadow: inset 0 1px 2px rgba(0,0,0,.2);
box-shadow: inset 0 1px 2px rgba(0,0,0,.2);
}
.searchform .searchbutton {
color: #fff;
border: solid 1px #000;
font-size: 11px;
height: 30px;
width: 30px;
text-shadow: 0 1px 1px rgba(0,0,0,.6);
-webkit-border-radius: 2em;
-moz-border-radius: 2em;
border-radius: 2em;
cursor:pointer;
background: #007acc;

}
</style>
<div id='naviopdropcont'>
<div id='naviopdropnav'>
<ul>
<li><a href=''>Home</a></li>
<li><a href='#'>About Us</a></li>

<li><a href='#'>Goods</a>
<ul>
<li><a href='#'>Item-1</a></li>
<li><a href='#'>Item-2</a></li>
<li><a href='#'>Item-3</a></li>
<li><a href='#'>Item-4</a></li>

</ul>
</li>
<li><a href='#'>Categories</a>

<ul>
<li><a href='#'>Category 1</a></li>
<li><a href='#'>Sub-category1</a></li>
<li><a href='#'>Sub-category2</a></li>
<li><a href='#'>Sub-category3</a></li>
<li><a href='#'>Sub-category4</a></li>
<li><a href='#'>drop down</a></li>
</ul>
</li>
<li><a href='#'>Contact Us</a>
</li>
<li style='float:right;padding:0px 0px ;margin:5px 18px 11px 40px;
'><form class="searchform" action="/search" method="get">
<input name="q" class="searchfield" type="text" value="Search..." onfocus="if (this.value == 'Search...') {this.value = '';}" onblur="if (this.value == '') {this.value = 'Search...';}" />
<input class="searchbutton" type="submit" value="Search" />
</form></li>
</ul>
</div>
</div>
----------------------------------------------------------------------------------

6. Now click save and you are done.

You have just successfully added a sticky drop down menu for blogger.

Add Floating Social Media to Blogger

noreply@blogger.com (Anonymous) — Sun, 16 Nov 2014 05:03:00 +0000

The floating social media is very popular widget on all the top blogs and this is the one of the ways to increase the number of times your post get shared on twitter,Facebook and other social networks icons.Your first top priority should always be Facebook, Google+, Twitter, Linkedin and Now Pinterest. All these sharing counters, play well in circulating your content over a wide range of visitors. Social Media is a non-stoppable engine, which, if driven correctly and properly can bring tons of valuable traffic each visitor worth a dollar. You should always encourage your readers to share, like, pin your post or articles.

Style #1

Click on Add gadget
And select HTML/JavaScript
Next Box of HTML/JavaScript will appear then add below codes

<a href='http://www.techiterian.com'><img alt='Floating Vertical Bar With Share Buttons widget by techiterian' src='https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhB0S22udlgkeynHlFD_9UjYnhFAcZSKWoONPNAt1QiYbSF6bNriBGnnwAhPWL408hu4LmDCLxo2ef3VluQ6D6VHM_-MSPgGWhC-uCh-qydplp7zDaGtRy0vQW3vmnMR_y2AyldpXG3Hone/s1600/best+blogger+tips.png'/></a>  <div class="addthis_toolbox addthis_floating_style" style="background: #98A2A7; border: 1px solid #000000;top:120px;left:50px;"> <div class="addthis_counter_style"><a class="addthis_button_facebook_like" fb:like:layout="box_count"></a> <a class="addthis_button_tweet" tw:count="vertical"></a> <a class="addthis_button_google_plusone" g:plusone:size="tall"></a> <a class="addthis_counter"></a></div> </div> <script type="text/javascript">var addthis_config = {"data_track_addressbar":true};</script> <script type="text/javascript" src="//s7.addthis.com/js/300/addthis_widget.js#pubid=ra-4e7d75dd1a411e95"></script>

Style #2

Click on Add gadget
And select HTML/JavaScript
Next Box of HTML/JavaScript will appear then add below codes.

<a href='http://www.techiterian.com'><img alt='Floating Vertical Bar With Share Buttons widget by techiterian' src='https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhB0S22udlgkeynHlFD_9UjYnhFAcZSKWoONPNAt1QiYbSF6bNriBGnnwAhPWL408hu4LmDCLxo2ef3VluQ6D6VHM_-MSPgGWhC-uCh-qydplp7zDaGtRy0vQW3vmnMR_y2AyldpXG3Hone/s1600/best+blogger+tips.png'/></a>  <div class="addthis_toolbox addthis_floating_style" style="background: #98A2A7; border: 1px solid #000000;top:120px;left:50px;"> <div class="addthis_32x32_style"><a class="addthis_button_preferred_1"></a> <a class="addthis_button_preferred_2"></a> <a class="addthis_button_preferred_3"></a> <a class="addthis_button_preferred_4"></a> <a class="addthis_button_compact"></a></div> </div> <script type="text/javascript">var addthis_config = {"data_track_addressbar":true};</script> <script type="text/javascript" src="//s7.addthis.com/js/300/addthis_widget.js#pubid=ra-4e7d75dd1a411e95"></script>

Now your done.*Thanks for reading this post, you can hare this post if you like this.

How to Add Numbered Navigation Page Widget to Blogger

noreply@blogger.com (Anonymous) — Sat, 15 Nov 2014 21:40:00 +0000

By default blogger navigation shows "Newer Posts" and "Older Posts" links in homepage, this default navigation is not much attractive and user friendly. In order to make navigation easily and attractive you can use Numbered Page Navigation System. The main advantage of this system is that the visitors can easily navigate to any page without wasting their time. You might have seen many Navigation Systems with their different styles. However the latest templates comes with this Navigation System but some old templates we have to install it. So, here designed a simple and attractive navigation system for you and bellow in this few steps will show you that How to Add Numbered Page Navigation Widget to Blogger.

Look for Page navigation

How to Add Numbered Page Navigation Widget to Blogger

Step 1. Log in to your Blogger Account

Step 2. Select your Blog and Go to Template >> Edit HTML and Search (Ctrl + F) for the following tag

]]></b:skin>

Step 3. Copy and Paste the following piece of code just above/before it

#blog-pager{clear:both;margin:30px auto;text-align:center; padding: 7px;}

.blog-pager {background: none;}

.displaypageNum a,.showpage a,.pagecurrent{padding: 5px 10px;margin-right:5px; color: #F4F4F4; background-color:#404042;border:4px solid #000;}

.displaypageNum a:hover,.showpage a:hover, .pagecurrent{background:#666666;text-decoration:none;color: #fff;}

#blog-pager .showpage, #blog-pager, .pagecurrent{font-weight:bold;color: #000;}

.showpageOf{display:none!important}

#blog-pager .pages{border:none;-webkit-box-shadow: 0px 5px 3px -1px rgba(50, 50, 50, 0.53);-moz-box-shadow:0px 5px 3px -1px rgba(50, 50, 50, 0.53);box-shadow: 0px 5px 3px -1px rgba(50, 50, 50, 0.53);}

Step 4. Now find (Ctrl + F) this tag

</body>

Step 5. And add the following script just above/before it

<b:if cond='data:blog.pageType != "item"'>

<b:if cond='data:blog.pageType != "static_page"'>

/*<![CDATA[*/

var perPage=6;

var numPages=6;

var prevText ='◄';

var nextText ='►';

var urlactivepage=location.href;

var home_page="/";

/*]]>*/

</script>

</b:if>

Modification for Code above:

var perPage=6; No. of posts to show perPage

var numPages=6; No. of pages to show in Navigation

var prevText ='◄'; Text to show for Previous Page button

var nextText ='►'; Text to show for Next Page button

Step 6. Press the Save Template button

And now you're done.

---------------------------done-------------------------------