Exchange Active Directory Consultant

Press any key to continue using Powershell

noreply@blogger.com (Navdeep) — Thu, 14 Jun 2012 14:04:00 +0800

Hi,

This is the code in powershell that can be used as function where you want to repeat the tasks or present user with some kind of choice.

# Clear screen to clear the trash off the screen
clear-host

# Using here string to display Menu
$menu = @"
Menu
--------------------
Select your options
1
2
3
4
5
6
7
8
0 : Press 0 to Exit

"@

write-host $menu
Function Pause ($Message = "Press any* key to continue . . .Well I don't mean all :) ") {
    If ($psISE) {
        # The "ReadKey" functionality is not supported in Windows PowerShell ISE.

        $Shell = New-Object -ComObject "WScript.Shell"
        $Button = $Shell.Popup("Click OK to continue.", 0, "Script Paused", 0)

        Return
    }

    Write-Host -NoNewline $Message

    # Secret codes :) you don't want to continue when press shift key alt etc etc

    $Ignore =
        16, # Shift (left or right)
        17, # Ctrl (left or right)
        18, # Alt (left or right)
        20, # Caps lock
        91, # Windows key (left)
        92, # Windows key (right)
        93, # Menu key
        144, # Num lock
        145, # Scroll lock
        166, # Back
        167, # Forward
        168, # Refresh
        169, # Stop
        170, # Search
        171, # Favorites
        172, # Start/Home
        173, # Mute
        174, # Volume Down
        175, # Volume Up
        176, # Next Track
        177, # Previous Track
        178, # Stop Media
        179, # Play
        180, # Mail
        181, # Select Media
        182, # Application 1
        183 # Application 2

    While ($KeyInfo.VirtualKeyCode -Eq $Null -Or $Ignore -Contains $KeyInfo.VirtualKeyCode) {
        $KeyInfo = $Host.UI.RawUI.ReadKey("NoEcho, IncludeKeyDown")
    }

    Write-Host
}

# using do while loop to do switch case annoyance

do {

if($a)
{
    clear-variable a
}
$a = read-host "Select your option"

switch ($a)
    {

        1 {write-host -ForegroundColor RED "The color is red."; Pause;}
        2 {write-host -ForegroundColor DARKBLUE "The color is blue."; Pause;}
        3 {write-host -ForegroundColor GREEN "The color is green."; Pause;}
        4 {write-host -ForegroundColor YELLOW "The color is yellow."; Pause;}
        5 {write-host -ForegroundColor DarkYellow "The color is orange."; Pause;}
        6 {write-host -ForegroundColor Magenta "The color is purple."; Pause;}
        7 {write-host -ForegroundColor Cyan "The color is pink."; Pause;}
        8 {write-host -ForegroundColor Gray "The color is brown."; Pause;}
        0 {write-host "Exiting..."; Exit;}
default {"The color could not be determined."; Pause;}
     }
    }
     while(!($a -eq 'null'))

Hope this will be helpfully in some ways.

Regards,

Navdeep [v-2nas]

www.ExchangeADTech.com

What's running on that port?

noreply@blogger.com (Navdeep) — Fri, 11 May 2012 11:07:00 +0800

At times we may run an internal or external scan on your server and we finds that there is port xxxxx open. You are not aware of that port or any application that is using that port. Well weird...? How to find what's running on that port.

The first though to do telnet
telnet IP_Address portno
you get a blank screen... now what next, it doesn't give any clue what is running on that port, which service which process etc.

So here are some cool tips to quickly find out what is running on unknown port, lets say 32456.
Step 1: Fireup the command prompt
Step 2: netstat -ano | findstr /i "listening"
TCP 0.0.0.0:32456 0.0.0.0:0 LISTENING 1100
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 888
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:4105 0.0.0.0:0 LISTENING 424
TCP 0.0.0.0:4728 0.0.0.0:0 LISTENING 424

Look for your port in the result and identify the PID,. The PID is listed at extreme right hand side.

Step 3: tasklist /svc /fi "PID eq 1100"

Image Name PID Services
========================= ======== ==========================

==================
svchost.exe 1100 Appinfo, AppMgmt, BITS, Browser,
gpsvc, IKEEXT, iphlpsvc, LanmanServer,
ProfSvc, Schedule, ShellHWDetection,
Themes, Winmgmt, wuauserv

Image Name is basically your process in taskmanager

Now you have the names of the services running under the svchost.exe, you can use google to perform quick search what services are for.

Hope that would be helpful.

Regards,
Navdeep [v-2nas]

Step By Step Installing AD LDS on Windows 2008 Member Server.

noreply@blogger.com (Navdeep) — Tue, 1 May 2012 10:36:00 +0800

In this post we will be installing Active Directory Lightweight Directory Services, previously known as ADAM.

Member Server of hostname DL-LDS is joined to fictitious domain resrc.vrnmyp.net. The forest root domain is vrnmyp.net

We have used resrc\Administrator account to install AD LDS on DL-LDS server. A service account can be used instead of Administrator account of domain resrc.vrnmyp.net. By default AD LDS use the following port for its operation.

Port 389 for LDAP and 636 for secure LDAP, these ports can be changed however you need to get necessary ports open on windows server and firewall wall.

To start with let’s begin with installation of AD LDS. The document is created using screenshots which are quite self-explanatory. The process has been simplified however detail information can be found on technet.microsoft.com if required.

1. Click on Start > Administrative Tools > Server Manager.

2. Select Roles and Click on Add Roles

3. Under Roles select Active Directory Lightweight Directory Services. If you don’t have .net framework 3.5 installed then you will be prompted to add .net framework 3.5. Click on Add Required Features.

4. Click on Install to proceed.

5. AD LDS will be installed and will be available under Start > Administrative Tools> Active Directory Lightweight Directory Services Setup Wizard. This wizard helps to create AD LDS instances.

6. Specify an instance name and its description. A service by the name of ADAM_InstanceName will be available under windows services console. This service will be used to start/stop AD LDS instance.

7. The default ports will be populated by itself, update the port numbers if you want to use a different port.

8. To better manager AD LDS we will create Application Partition. Specify the distinguished Name of application partition

9. Here you have choice to use service account and it will be granted administrative permissions over AD LDS instance that we are creating. We have used domain\Administrator account instead in this example.

10. Click on Next, now we are presented with Importing LDIF Files. These are default LDIF files which come along with AD LDS binaries. Each LDIF file contains Classes and Attributes which will be imported into the schema of AD LDS. In this scenario we have selected all of the LDIF files except MS-AzMan.LDF. Click on Next twice to trigger the installation.

Below is the brief description about function of each LDIF file.

.ldf file	User classes	Import this file if ...
MS-ADAM-DisplaySpecifiers-0409.LDF	o Not applicable	You want to use an Active Directory snap-in (such as Active Directory Sites and Services) with AD LDS.
MS-AdamSyncMetadata.LDF	o Not applicable	You want to use adamsync to synchronize AD LDS with Active Directory Domain Services (AD DS).
MS-AZMan.LDF	o Not applicable	You want to use Windows Authorization Manager with AD LDS.
MS-InetOrgPerson.LDF	o Person o Organizational-Person o User o inetOrgPerson	You want to create user objects in the AD LDS directory, and you want to create users of the InetOrgPerson class (as defined in RFC 2798). MS-InetOrgPerson.LDF is a sample file that you can modify to meet your particular requirements.
MS-User.LDF	o Person o Organizational-Person o User	You want to create user objects in the AD LDS directory, but you do not want to create users of the InetOrgPerson class (as defined in RFC 2798). MS-User.LDF is a sample file that you can modify to meet your particular requirements.
MS-UserProxy.LDF	o User-Proxy	You want to create simple proxy objects in AD LDS for use in bind redirection. MS-UserProxy.LDF is a sample file that you can modify to meet your particular requirements.
MS-UserProxyFull.LDF	o User-Proxy-Full	You want to create complete proxy objects in AD LDS for use in bind redirection. To use this file, you must also import MS-InetOrgPerson.LDF or MS-User.LDF. MS-UserProxyFull.LDF is a sample file that you can modify to meet your particular requirements.

Custom ADM template for GPO Windows Server 2003

noreply@blogger.com (Navdeep) — Sun, 15 Apr 2012 21:55:00 +0800

Hi All, Today we will look into how to write custom adm template to use with GPO and manage finer configuration of software or windows server. We will use a sample ADM template to understand and write ADM template. Quick and Fast here is the sample ***************************************** ; CLASS MACHINE CATEGORY “SYSTEM” CATEGORY “McafeeEP” POLICY “Configure ExemptNetwork Regsitry key” KEYNAME “System\CurrentControlSet\Services\Sbce” EXPLAIN !!Explain_1 VALUENAME “ExemptNetwork” VALUEON NUMERIC 1 VALUEOFF NUMERIC 0 END POLICY POLICY “Allow Relaxed Removable Media Definition” KEYNAME “System\CurrentControlSet\Services\Sbce” EXPLAIN !!Explain_2 VALUENAME RelaxedRemovableMediaDefinition VALUEON NUMERIC 1 VALUEOFF NUMERIC 0 END POLICY POLICY “Define AutoDomain” KEYNAME “Software\Safeboot International\Safe Boot Device Encryption\AutoDomain” EXPLAIN !!Explain_3 VALUENAME InstallPath VALUEON “C:\Program files\McAfee\Endpoint Encryption\Autodomain” VALUEOFF “Null” END POLICY POLICY “Define SBTools” KEYNAME “SOFTWARE\Microsoft\Windows\CurrentVersion\Run” EXPLAIN !!Explain_4 VALUENAME SBTools VALUEON “C:\Program files\McAfee\Endpoint Encryption\Autodomain” VALUEOFF “Null” END POLICY END cATEGORY END CATEGORY [strings] Explain_1=”Allows you to set ExemptNetwork Dword value to 1 or 0 when set to Enable or Disable. ExemptNetwork key is modified under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Sbce. If the key doesn’t exist a new key will be written to the registry” Explain_2=”Allows you to set RelaxedRemovableMediaDefinition Dword value to 1 or 0 when set to Enable or Disable. RelaxedRemovableMediaDefinition key is modified under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Sbce. If the key doesn’t exist a new key will be written to the registry “ Explain_3=”Set InstallPath to REG_SZ value of C:\Program files\McAfee\Endpoint Encryption\Autodomain when configured to Enable and NULL on disable. InstallPath is modified under HKEY_LOCAL_MACHINE\Software\Safeboot International\Safe Boot Device Encryption\AutoDomain. If the key doesn’t exist a new key will be written to the registry” Explain_4=”Set SBTools to REG_SZ value of C:\Program files\McAfee\Endpoint Encryption\Autodomain when configured to Enable and NULL on disable. SBTools is modified under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. If the key doesn’t exist a new key will be written to the registry” ***************************************** ; is for comments CLASS keyword defines which registry hive will be read/modified CATEGORY defines sub section under Administrative template if the category doesn’t exist, a new category will be created when GPO is imported into the GPO MMC POLICY “Configure ExemptNetwork Regsitry key” ; The name of the entry under GP KEYNAME “System\CurrentControlSet\Services\Sbce” ; registry to query, if reg don’t exist a new reg key will be created EXPLAIN !!Explain_1 ;description about the GP, it’s using a variable which is called from ; strings section VALUENAME “ExemptNetwork” ; The regkey VALUEON NUMERIC 1 ; value when GP is enabled VALUEOFF NUMERIC 0 ; value when GP is disabled END POLICY ; Policy closed You can still do more than basic when using custom GP. More details can be found on technet. http://technet.microsoft.com/en-us/library/cc779567%28v=ws.10%29.aspx I hope this would be helpful.

Food for Thought

noreply@blogger.com (Navdeep) — Thu, 5 Jan 2012 13:10:00 +0800

"Computers are incredibly fast, accurate and stupid; humans are incredibly slow, inaccurate and brilliant; together they are powerful beyond imagination." -- Albert Einstein

Appending members to Existing Group’s Membership

noreply@blogger.com (Navdeep) — Fri, 5 Aug 2011 08:12:00 +0800

Hi All,

I got a request from my old good friend. He has contacts which are member of various groups and now this contact’s group membership needs to be added to another Group membership. There are about 40k contacts how to do this using powershell script and without overwriting the group’s existing membership. So here how we did it.
I used questad cmdlets with powershell.

Get-QadObject -identity Contact | Get-QADMemberOf | Add-QADGroupMember -identity Group

With the help of Quest the code has been made really really short. Although the same could have been done using pure powershell but it would require some grey matter which is in short

Difference between Exchange 2007 and Exchange 2010

noreply@blogger.com (Navdeep) — Mon, 25 Jul 2011 01:52:00 +0800

Hi All,

Today we will go through a major difference and enchancements in Exchange 2010 over Exchange 2007.
High Availablilty:
Exchange 2010 comes with new high availability concepts of DAG [Database Availablity Group] which incooperates features of CCR, SCR clustering on Exchange 2007 into single entity. Exchange 2010 don't use CCR, SCR terms but rather user DAG for high availability within site and for site resilence.

CAS Array In Exchange 2010, by design mapi clients now connect to the Client Access RPC service that runs on cas server. High Availability of CAS servers can be achieved with using CAS Array with load balancers. CAS Array means that we can combine all the cas servers in single site as one server to which clients will connect. Then request will automatically be proxied over to the appropriate cas servers.

Storage Groups have been removed and database are no longer associated with particular storage group or server rather they are moved to Org level.
Permission Functionality:
Permission model has been resived in Exchange 2010. With Role Based Access control also spelled as RBAC, you can define extermly broad or extremely precise permissions model based on the roles of your administrators and users.
You can grant users with the rights to change their own personal information, contact information, DL group membership hence delegating most common administrative tasks to the end users itself.
Transport and Routing Functionality:
        Shadow redundancy   Messages that are submitted to an Exchange 2010 Hub Transport server are stored in the transport database until the next hop reports successful delivery of the message. If the    next hop doesn't report successful delivery and it fails, the message is resubmitted for delivery.
        Moderated transport   Exchange 2010 provides an approval workflow for sending messages to recipients. When you configure a recipient for moderation, all messages sent to that recipient must go        through an approval process.
        End-to-end message tracking With Exchange 2010 End users are given ability to track messages.
        Incremental EdgeSync In Exchange 2010, the EdgeSync process has been changed to keep track of synchronized information and only synchronize the changes since the last replication cycle. This significantly reduces network traffic and greatly improves synchronization efficiency.
        Message throttling improvements   In Exchange 2010, you can configure a Receive connector to monitor the rate of message submissions by users, IP addresses, or both. If you configure a Receive        connector to monitor the message submission rate for users, it ensures that a specific user doesn't exceed the message rate that it's allowed, regardless of the IP address the connections are coming from. The default client Receive connector created on the Hub Transport servers is configured this way.
Mailbox and Recipient Functionality
        Ability for users to share information, such as calendar free/busy information and contacts with users who reside in a different organization
        Ability to move a mailbox while the end user is still accessing it
        Ability to appoint a moderator to regulate the flow of messages sent to a distribution group
Messaging and Complaince
        Personal Archive feature to provide users with online archive mailboxes and help eliminate .pst files
These are the major changes in Exchange 2010 over Exchange 2007. For comprehensive listing please refer to technet Artcile.
http://technet.microsoft.com/en-us/library/dd298136.aspx

Accessing Internet through RRAS

noreply@blogger.com (Navdeep) — Fri, 8 Jul 2011 04:11:00 +0800

RRAS [Routing and Remote Access Service] provides Multiprotocol LAN-to-LAN, LAN-to-WAN, virtual private network [VPN], Dial-up and NAT [network address translation] service.

We would use RRAS server to give internet access to our internal clients sitting on private network.
The RRAS server would be in a workgroup with two NIC. One is connected to Public Interface or internet facing NIC and second Private NIC connecting to the Private Network where our rest of the machines are present.

In this setup we have an internet Modem connected to Router which is NATting the IP address. The external NIC on RRAS server will have private IP address although it can be used to access internet and hence called Internet facing NIC.

We would be statically assigning the IP address to the Internal and External NIC on RRAS server.

1. Under Hyper-v manager, make sure Gateway Hyper-v machine is shutdown.

2. Make a right click on the Gateway Hyper-V and click on settings. Click on Add Hardware and on right hand side select Network Adapter and click Add.

3. Select the Network Adapted that is just added. From Network drop down select the External Switch and specify the static MAC address. The MAC address will populate itself. Click Apply and Ok.

4. Make Right click on Gateway Hyper-V and Click Start to turn on Hyper-V machine.

5. Login to the Hyper-V machine. If the hostname hasn’t been configured earlier, configure it now. You can do it via Server Manager.

6. Click on Start > Administrative Tools > Server Manager

7. Select Server Manager at Top. On right hand side, click on Change System Properties to change the Hostname of the server.

8. Click on View Network connections. For better understanding rename the network adapters to Private and Public. Select the network adapter, right click and select rename.

9. Assign Static IP address to Public and Private IP address. Select the Public NIC, right click, properties. Select Internet Protocol Version 4 (TCP/IPv4), click on properties and set the address

Public [the address can be different based on your environmnet]
IP: 10.0.0.198
Netmask: 255.0.0.0
Default Gateway: 10.0.0.1
DNS: 10.0.0.1

Private [NIC connecting to Internal private network]

IP: 192.168.0.1
Netmask: 255.255.255.0
Leave Default Gateway and DNS blank, click on Ok and Apply. Ignore the warning messages.
Installing and Configuring RRAS Role

1. Click on Start > Administrative Tools > Server Manager

2. Select Roles, Click on Add Roles, Select Network Policies and Access Services [RRAS is present under NPAS], Click Next

3. Click Next on Information Page and Select Routing and Remote Access Services

4. Click on Next, Click on Install and Click on Finish.

5. Click on Start > Administrative Tools > Routing and Remote Access. This will bring RRAS console

6. Select the server [hostname(local)]. Notice that Server has red down arrow which means that RRAS is not enabled and configured. Make a right click on it and Select Configure and Enable Routing and Remote Access. This will launch wizard. Click on Next

7. Select Custom Configuration, click Next.

8. Select LAN Routing and NAT and click Finish. Click on Start Service when prompted. This will configure the RRAS server and start the RRAS service. Notice that RRAS server will have a green up arrow denoting that server is enabled and configured.

9. Expand IPv4, Select NAT, make a right click on it and select New Interface. Select Public and click OK.

10. You will be prompted to Select Interface type. Select Public Interface connected to Internet and Select Enable NAT on this Interface. Click OK.

11. We are done now. Now our machines on Private NIC will be able to access Internet using RRAS server as a Gateway.

Exchange Masters --- By experts-exchange.com

noreply@blogger.com (Navdeep) — Sun, 22 May 2011 04:10:00 +0800

PowerShell Script to update metadata of MP3 files

noreply@blogger.com (Navdeep) — Mon, 9 May 2011 01:42:00 +0800

Recently I have downloaded over 100 mp3 narrations on Pastimes and Activities of Supreme Personality of Godhead. However these mp3 files have a generic filename i.e. canto_chapter_index name. Now when load it my iPhone i would see the names as title and there is no why to tell which no. describes which pastime. So i googled for a while and yes got few tips and created following PS script. The script reads csv file with corresponding title and based on actual name match found it updates the title of the file, also writes Artist and Album metadata. For this script you need .netframework library called TagLib.

*****************************************************
$TagLib = "D:\Temp\taglib-sharp-2.0.4.0-windows\Libraries\taglib-sharp.dll"

[System.Reflection.Assembly]::LoadFile($TagLib) | Out-Null

$KrsnaBook = import-csv C:\Users\user\Downloads\KrsnaBook.csv

cd C:\Users\user\Downloads\Krsna

foreach($fileName in Dir)
{
Foreach($Name in $KrsnaBook)
{

if($fileName.Name -eq $Name.Name)
{

Write-Host $Name.Title
$Media = [TagLib.File]::Create("C:\Users\user\Downloads\Krsna\" + $fileName.Name.ToString())
$Media.Tag.Title = $Name.Title
$Media.Tag.Artists = "Srila Prabhupada"
$Media.Tag.Album = "Krsna Book"
$Media.Save()
}

}
}
**********************************************

So now you can also use the the above ps code to update titles based on the filename.

Navdeep

How Terminal Services Licensing Works

noreply@blogger.com (Navdeep) — Sun, 8 May 2011 07:30:00 +0800

All communication during the licensing process occurs between the client and the terminal server, and between the terminal server and the license server. The terminal server client never communicates directly with the license server.

When a client device attempts to connect to a terminal server in Per Device mode, the terminal server determines if the client has a license token. Terminal server clients store license tokens in the following registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\MSLicensing

If a client has no license token, the terminal server attempts to contact a license server from its list of discovered license servers. If no contact is made, the terminal server restarts the discovery process. If no license server responds, the device can not connect to the terminal server unless it is operating within the terminal server grace period.

When a license server responds, the terminal server requests a temporary token for the device because this is the first time the device has connected to a terminal server. The terminal server then pushes this temporary token to the device. After a user has provided valid credentials resulting in a successful logon, the terminal server instructs the license server to mark the issued temporary token as validated.

The next time a user attempts to connect to a terminal server in Per Device mode from this device, the terminal server requests a Windows Server 2003 TS Device CAL token for this device. If the license server has available TS Device CAL tokens, the license server removes one token from the available pool, marks it as issued to the device, logs the device name, the user name of the device, and the date issued, and then pushes this TS Device CAL token to the device.

If the license server has no TS Device CAL tokens, it will first look to any other license server in its domain, workgroup, or site. License servers maintain information about where other accessible license servers exist, and if they have license tokens. If another license server is accessible that does have inventory, the first license server will request a license token from the second license server and deliver it to the terminal server, which then passes the token to the client device. If there are no available TS Device CAL tokens, the device will continue to connect with the temporary token.

Temporary tokens allow devices to connect for 90 days, and will then expire. TS Device CALs, while representing perpetual licenses, are set to expire 52-89 days from the date they are issued. The terminal server always attempts to renew these tokens 7 days prior to their expiration. The purpose of this system is to recover TS Device CAL tokens that are lost due to events such as hardware failure or operating system reinstallation.

Client License Distribution Per User
When a terminal server is configured in Per User mode, the terminal server must be able to locate a license server after the grace period has expired. While it is possible to install TS Per User CAL tokens on a license server, there is currently no method of assigning a TS Per User CAL token to a particular user account.

Setting up Secure FTP with FTP 7.5

noreply@blogger.com (Navdeep) — Mon, 11 Apr 2011 11:23:00 +0800

Hi,

Secure FTP also known as FTPS or to be particular FTPES [Explict SSL]. Recently I have done a project for one of the clients helping him setup FTPES.

Following is the download-able word document specifying
How To Setup FTPES

Expert Exchange Certified - Masters in AD

noreply@blogger.com (Navdeep) — Mon, 11 Apr 2011 11:12:00 +0800

Expert Exchanges Hall of Fame [Yearly]

noreply@blogger.com (Navdeep) — Mon, 11 Apr 2011 11:10:00 +0800

Got my name in Yearly Hall of Fame... Now i can say at least once my name reflected there. :)

My AD Lab

noreply@blogger.com (Navdeep) — Tue, 15 Mar 2011 22:44:00 +0800

Just created few weeks ago my Active Directory cross forest lab using visio 2010. The whole lab is set up on my lappie running on Quad Core i7 Processor, 16GB DDR3 Dual Channel RAM, what else oh ! HDD running 500GB WDC @ 5400 RPM but soon em gonna upgrade it with 7200k for better I/O thru put.

Network Load Balance Clusters in Windows Server 2008 R2

noreply@blogger.com (Navdeep) — Tue, 15 Mar 2011 20:37:00 +0800

Today we going to look setup Network Load Balanced Clusters in Windows Server 2008 R2. NLB provides high availabilty and scability for IP based traffic for TCP, UDP and GRE (General Routing Encapsulation). In server 2008 you can build NLB cluster with two node/host with max upto 32 nodes/hosts.

The four basic Network Load Balancing modes are as follows:

· Unicast with Single Network Adapter - The MAC address of network adapter is disabled and the cluster MAC address is used. Traffic is received by all nodes in the cluster and filtered by the NLB driver. Nodes in the cluster are able to communicate with addresses outside the cluster subnet, but node to node communication within cluster subnet is not possible.

· Unicast with Multiple Network Adapters - The MAC address of the network adapter is disabled and the cluster MAC address is used. Traffic is received by all nodes in the cluster and filtered by the NLB driver. Nodes within the cluster are able to communicate with each other within the cluster subnet and also with addresses outside the subnet.

· Multicast with Single Network Adapters - Both network adapter and cluster MAC addresses are enabled. Nodes within the cluster are able to communicate with each other within the cluster subnet and also with addresses outside the subnet. Not recommended where port rules are configured to direct significant levels of traffic to specific cluster nodes.

· Multicast with Multiple Network Adapters - Both network adapter and cluster MAC addresses are enabled. Nodes within the cluster are able to communicate with each other within the cluster subnet and also with addresses outside the subnet. This is the ideal configuration for environments where there are significant levels of traffic directed to specific cluster nodes.

Now Lets start building our NLB. Install Network Load Balancing Feature using Server Manager.
Once the feature is installed we would be adding Nodes to the clusters

Add Cluster IP

Client affinity involves the tracking of both destination port and source IP address information to optionally ensure that all traffic to a specific port from a client is directed to the same server in the cluster. The available Client affinity settings are as follows:

Single - Requests from a single source IP address are directed to the same cluster node.
Network - Requests originating from within the same Class C network address range are directed to the same cluster node.
None - No client affinity. Requests are directed to nodes regardless of previous assignments.

Additional considerations
Multicast—Multicast mode allows communication among hosts because it adds a Layer 2 multicast address to the cluster instead of changing the cluster. Communication among hosts is possible because the hosts retain their original unique media access control (MAC) addresses and already have unique, dedicated IP addresses. However, the address resolution protocol (ARP) reply that is sent by a host in the cluster (in response to an ARP request) maps the cluster’s unicast IP address to its multicast MAC address. Some routers do not support the resolution of unicast IP addresses to multicast MAC addresses, and they discard the ARP reply.

As a result, an administrator must add a static ARP entry in the router, mapping
the cluster IP address to its MAC address.

The cluster operation mode parameters specify whether a multicast media access control (MAC) address should be used for cluster operations. If multicast is enabled, NLB converts the cluster MAC address for the cluster adapter into a multicast address. It also ensures that the cluster's primary IP address resolves to this multicast address as part of the Address Resolution Protocol (ARP). The adapter can now use its original, built-in MAC address that was disabled in unicast mode.

You must first enable multicast support before enabling Internet Group Management Protocol (IGMP) support. IGMP support can also be enabled on the network adapter.

The IGMP multicast check box enables IGMP support for limiting switch flooding by limiting traffic to "Network Load Balancing ports" only. That is, enabling IGMP support ensures that traffic intended for an NLB cluster passes through only those ports serving the cluster hosts and not all switch ports.

Additional Consideration for the NLB cluster

When you create an NLB cluster, NLB is automatically bound to each of the network adapters in the cluster.

When you add additional hosts after the first host is added, the subsequent hosts will automatically inherit the cluster port rules from the initial host.

The new cluster host will not immediately be in a running state in the cluster. The new host settings must first be circulated through all cluster hosts.

DC GC Service Records

noreply@blogger.com (Navdeep) — Mon, 14 Mar 2011 17:58:00 +0800

Domain Controller-Specific Records

Mnemonic        Type    DNS Record
LdapIpAddress   A       <DnsDomainName>
Ldap    SRV     _ldap._tcp.<DnsDomainName>
DcByGuid        SRV     _ldap._tcp.<DomainGuid>.domains._msdcs.<DnsForestName>
Kdc     SRV     _kerberos._tcp.dc._msdcs.<DnsDomainName>
Dc      SRV     _ldap._tcp.dc._msdcs.<DnsDomainName>
Rfc1510Kdc      SRV     _kerberos._tcp.<DnsDomainName>
Rfc1510UdpKdc   SRV     _kerberos._udp.<DnsDomainName>
Rfc1510Kpwd     SRV     _kpasswd._tcp.<DnsDomainName>
Rfc1510UdpKpwd SRV     _kpasswd._udp.<DnsDomainName>

Global Catalog-Specific Records

Mnemonic        Type    DNS Record
Gc      SRV     _ldap._tcp.gc._msdcs.<DnsForestName>
GcIpAddress     A       gc._msdcs.<DnsForestName>
GenericGc       SRV     _gc._tcp.<DnsForestName>

Displaying Folder/Sub Folder Permission and Inheritance

noreply@blogger.com (Navdeep) — Mon, 14 Mar 2011 17:57:00 +0800

Hi All,

How to quickly check where inheritance is messed up and who has what permission on different level in Folder Structure.

If just want to check on Single file or Folder use the following command
Get-Acl -Path C:\windows | FL Path, AccessToString

For Bulk use this
Now run the following command to get folder path

get-childitem P:\folderName -recurse | foreach {$_.directoryName} | Get-Unique

You can either copy from the console or redirect it to a csv file

get-childitem P:\folderName -recurse | foreach {$_.directoryName} | Get-Unique | Out-File -FilePath P:\Temp\inheritance.txt

Open the File, Add FolderName (can be anything) as header, rename the extension to .csv

Now

import-csv -path P:\temp\inheritance.csv | %{Get-Acl $_.FolderName} | FT Path, AreAccessRuleProtected, AccessToString -Wrap

Upgrade Path to Exchange 2010

noreply@blogger.com (Navdeep) — Tue, 1 Mar 2011 11:51:00 +0800

Hi,

Recently I was invited to Exchange Upgrade path from program for Exchange 2003/2007 to Exchange 2010 at Microsoft, Singapore. The presentation was nice and covers almost all the aspects for transistioning to Exchange 2010.

I have linked Transistion Presentation which was shared during the discussion.
Exchange 2010 Upgrade

Where are the GPO logs?

noreply@blogger.com (Navdeep) — Wed, 2 Feb 2011 03:20:00 +0800

Client Log Files
Log files can be generated by the core client engine (Userenv) and by every CSE except the Scripts CSE. Scripts processing is logged in the Application log on the client with source=UserInit. Use Event Viewer to view the Application log on the client, or look for these entries on the Policy Events tab of the Group Policy Results report.
The Policy Events tab in Group Policy Results reports generated in GPMC displays the Group Policy–related events that you would see if you used Event Viewer to view these events in the Application log on the client for which you generated the report.
The following table lists several log files you can generate at the client that relate to Group Policy troubleshooting.
Client Log Files for Troubleshooting Group Policy

Note The UserEnv logs entries pertaining to profiles as well as Group Policy core processing and registry (.adm) processing on the client. The entries pertaining to profiles are intermingled with the Group Policy entries and not easily distinguished from them. Use Wilogutl.exe to analyze the Windows Installer log files. For more information, see Wilogutl.exe on the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkID=16156).
Server Log Files
You can enable logging of events generated by the Group Policy Object Editor on the Server. There are two different log files, one for events relating to core Group Policy processing and the registry CSE, and another for events relating to all other CSEs.
The following table lists several log files you can generate at the server that relate to Group Policy troubleshooting.

Userenv Logging
Because Userenv tracks the Group Policy engine and registry-based Group Policy, it is the most frequently used log file for Group Policy troubleshooting. Userenv is especially useful in a Windows 2000 environment because you don't have the benefit of using Resultant Set of Policy (RSoP). Most of the questions that RSoP answers, are in the userenv log.
To use userenv.log you need to first enable verbose logging.
To enable verbose logging

Log onto the client computer as the administrator and run Regedit.
Locate the following key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon.
Right click Winlogon, select New, and then click DWORD Value.
Enter the following name for the DWORD Value: UserEnvDebugLevel.
Enter 30002 as the hexadecimal value. This writes the userenv into userenv.log, located in the \%windir%\debug directory.
Run "gpupdate /force" to ensure a full listing of total Group Policy processing.

Setting up Cross Forest Trust between W2K3 R2 and W2K8 R2

noreply@blogger.com (Navdeep) — Wed, 26 Jan 2011 04:15:00 +0800

Hi All,

Today we will be looking into Setting Up Cross Forest Trust between Top-level domains in two different forest. Before we start we need start we need to get some components in place so that we can successfully setup Cross Forest Trust.

Name Resolution : We must be able to resolve names across forest for that Purpose we need to setup our DNS so that it will be able resolve. There are multiple ways in which you can setup your DNS to do Name Resolution

1. Conditional Forwarders
2. Secondary Zone Transfers
3. Stub Zone

The benefit of using a conditional forwarder is that it is much easier to configure and troubleshoot than a zone transfer. The process of configuring a conditional forwarder is straightforward: all you need to know is the DNS domain name of the domain that houses the DNS server that you are configuring to forward requests and the IP address of the target DNS server.

However, a conditional forwarder is not an efficient way to keep a DNS server that hosts a parent zone aware of the authoritative DNS servers for a child zone. If you use a conditional forwarder, whenever the authoritative DNS servers for the child zone change, the conditional forwarder setting on the DNS server that hosts the parent zone must be configured manually with the IP address for each new authoritative DNS server for the child zone.

Using a secondary zone with zone transfers enabled is beneficial because this configuration maintains a list of all the authoritative DNS servers for the secondary copy of the zone, and the list is updated as DNS servers are added and removed from the target forest or domain. Secondary zones also host a full copy of the DNS zone.

The drawbacks to using secondary zones with zone transfers enabled are that this configuration is much more complicated to configure and maintain and you do not have the direct, point-to-point contact with a DNS server in the target forest or domain as you do with a conditional forwarder. In addition, with secondary zones you expose hosts to IP address mappings for all hosts in the zone. This can expose the domain or forest to security risks due to unauthorized access.

DNS Resource Records That Are Required for Secondary Zones

There are two DNS resource records that must be registered properly on the DNS server that hosts the secondary copy of the trusted domain or forest:

* Service (SRV) resource record (_ldap._tcp.dc._msdcs.<computer account domain>)

* Host (A) resource record

To test the name resolution use the following command
Nltest /dsgetdc:domainNameOfSpecifiedForest

Issue this command from target domain to check the name resolution.

There are other considerations like Firewall port opening at perimeter network to establish a cross forest trust.

Creating Forest Trust

Following are the types of Trust Relationship found

1. External Trust
2. Forest Trust
3. Relam Trust
4. Shortcut Trust
5. Tree-Root

I will not be going into creation of each Trust type however will provide you with common steps across all the trusts.
Lets say you manage IT Infra of Company A and Company B is acquired and a One way Trust needs to be created to access resources in Forest B (Domain B, Company B) however IT Functions are still not streamlined (you don't have access over IT resources) In that case you need to create One way Incoming Forest Trust and The other side has to create One Way Outgoing Trust before One way trust can fully work.

Authentication can be set to Forest Wide, Domain Wide and Selective Authentication. If you proceed with Selective Authentication that you need to give right "Allow user to be authenticated" on computer object of the server which you want to access. Forest Wide and Domain Wide are pretty much automated

Trust can be transistive between two forest but that doesn't imply that it will be automatically transistive with another forest for example A Trust B Trust C and B Trust A that doesn't mean that A trust C. This is not true in case of forest trust.

To create a one-way, incoming, forest trust for one side of the trust

1. Open Active Directory Domains and Trusts.
2. In the console tree, right-click the domain node for the domain that you want to establish a trust with, and then click Properties.

3. On the Trusts tab, click New Trust, and then click Next.
4. On the Trust Name page, type the Domain Name System (DNS) name (or network basic input/output system (NetBIOS) name) of the domain, and then click Next.

   5. On the Trust Type page, click Forest trust, and then click Next.
   6. On the Direction of Trust page, click One-way: incoming, and then click Next.
      For more information about the selections that are available on the Direction of Trust page, see the section "Direction of Trust" in Appendix: New Trust Wizard Pages.

7. On the Sides of Trust page, click This domain only, and then click Next.
For more information about the selections that are available on the Sides of Trust page, see the section "Sides of Trust" in Appendix: New Trust Wizard Pages.

   8. On the Trust Password page, type the trust password twice, and then click Next.
   9. On the Trust Selections Complete page, review the results, and then click Next.
10. On the Trust Creation Complete page, review the results, and then click Next.
11. On the Confirm Incoming Trust page, do one of the following:
          * If you do not want to confirm this trust, click No, do not confirm the incoming trust.

* If you want to confirm this trust, click Yes, confirm the incoming trust, and then supply the appropriate administrative credentials from the specified domain.

12. On the Completing the New Trust Wizard page, click Finish.

Similary You can create One way outgoing trust from other side. Once created you can validate trusts using Active Directory domains and trusts.

If you have admin credentials for Forest/Domain B then you can create Two way Trust in one step.

For more info check the TechNet Link
http://technet.microsoft.com/en-us/library/cc740018%28WS.10%29.aspx

Windows cann't verify that user name is unique

noreply@blogger.com (Navdeep) — Mon, 17 Jan 2011 04:04:00 +0800

Hi All,

While create a user in another domain tree of same forest. I came accross the following warning message.

Although the server is DC and GC as well the reason for this error is due to that name resolution to forest root dc or other dc was failing due to which the this warning is generate although user will be create it won't be able to logon using other DC.

In order to resolve this you can either create conditional forwards or stub zone to parent root or other domains which have gc present. You need to keep this in mind when you create stub zone and save it to all dns servers in Active Directory domain x (your domain) then it has be done using Enterprise Admin Account otherwise DNS Application partition will not be created alternatively if you are only using AD intergrated DNS you can save this on all DC in active directory domain x.

PowerShell Script To Create OU Structure and Test Users for Lab Env

noreply@blogger.com (Navdeep) — Mon, 17 Jan 2011 03:04:00 +0800

Hi All,

The following is the powershell code to create test users and default ou structure. It's quite basic script. But works wells. Requires little modification. However if you like you can put various controls and make it more intelligent. I will try to put more controls latter but right now it just serves the purpose for which i created this script.

################################
#PowerShell Script To Create OU Structure and Test Users for Lab Env
# By v-2nas v 0.1
################################
Clear
$StrOUName = Read-Host "Enter SiteName for Creating Default Organizational Unit (OU) Structure"
$objDomain = [ADSI]"ldap://dc=brs,dc=glk,dc=net/"
$objOU = $objDomain.Create("OrganizationalUnit", "OU=" + $StrOUName)
#$objOU = $objDomain.Create("OrganizationalUnit", "ou=" + $StrOUName)
$objOU.SetInfo()
Write-Host $StrOUName "OU Has Been Created."
write-host "Now creating Default OU Structure........."

#### Default OU Structure
$objDomain1 = [ADSI]"ldap://ou=$StrOUName,dc=brs,dc=glk,dc=net/"
$objOu1 = $objDomain1.Create("OrganizationalUnit", "ou=" + "Accounts")
$objOu1.SetInfo()
$objDomain2 = [ADSI]"ldap://ou=$StrOUName,dc=brs,dc=glk,dc=net/"
$objOu2 = $objDomain2.Create("OrganizationalUnit", "ou=" + "Computers")
$objOu2.SetInfo()
$objDomain3 = [ADSI]"ldap://ou=Accounts,ou=$StrOUName,dc=brs,dc=glk,dc=net/"
$objOu3 = $objDomain3.Create("OrganizationalUnit", "ou=" + "Users")
$objOu3.SetInfo()
$objDomain4 = [ADSI]"ldap://ou=Accounts,ou=$StrOUName,dc=brs,dc=glk,dc=net/"
$objOu4 = $objDomain4.Create("OrganizationalUnit", "ou=" + "Groups")
$objOu4.SetInfo()
$objDomain5 = [ADSI]"ldap://ou=Computers,ou=$StrOUName,dc=brs,dc=glk,dc=net/"
$objOu5 = $objDomain5.Create("OrganizationalUnit", "ou=" + "MemberServer")
$objOu5.SetInfo()
$objDomain6 = [ADSI]"ldap://ou=Computers,ou=$StrOUName,dc=brs,dc=glk,dc=net/"
$objOu6 = $objDomain6.Create("OrganizationalUnit", "ou=" + "Workstation")
$objOu6.SetInfo()
Write-Host "Creating Test User Account......"
# Create Users
$users = import-csv usersData.csv
$container = [ADSI] "ldap://OU=Users,ou=Accounts,ou=$StrOUName,dc=brs,dc=glk,dc=net/"
$users | foreach {
    $UserName = $_.UserName
    $newUser = $container.Create("User", "cn=" + $UserName)
    $newUser.Put("sAMAccountName", $UserName)
    $newUser.SetInfo()
    $newUser.psbase.InvokeSet('AccountDisabled', $false)
    $newUser.SetInfo()
    $newUser.SetPassword("xxxxx")
$newUser.put("description","Test User Account for lab testing")
$newUser.put("givenName", $userName)
$newUser.SetInfo()
}

Introducing Windows Server 2008 DC in Windows 2003 Forest

noreply@blogger.com (Navdeep) — Mon, 13 Dec 2010 10:23:00 +0800

Hi All,

Today we will be looking into the process of Introducing Windows Server 2008 DC into Windows Server 2003 Forest.

To achieve this we need to prepare our forest and domain to accommodate new W2K8 DC.
Few items to keep in mind.Minimum Forest Functional Level and Domain Function level needs to be Windows 2000 Native.

You need to run adprep using an account that is a member of Schema Admin Groups and Enterprise Admin.
It's not recommended that you disable replication on the schema master before you run Adprep.exe. Adprep.exe skips redundant updates. Conflicting updates such as the introduction of duplicate object identifiers, causes adprep.exe to stop until an administrator reconciles the conflicts. You can stop and restart adprep.exe. It resumes from where it's left.

Before you perform adprep /forestprep make sure you must have a health system statebackup for disaster recovery.

Adprep performs the following tasks
1. Updates the Active Directory Schema
2. Improves default Security descriptors
3. Upgrades display specifiers
4. Adjust ACL on Active Directory objects and on files in the SYSVOL shared folder to allow domain controller access. Anonymous user group is no longer a included in everyone
    group.
5. Create new objects that are used by application such as COM+ and WMI
6. Creates new containers in Active Directory that are used to verify that preparation was successful
Insert Server 2008 DVD on W2K3 domain controller

Go to x:\support\adprep>adprep /forestprep
To verify that adprep /forestprep completed successfully
   1. Log on to an administrative workstation that has ADSIEdit installed. ADSIEdit is installed by default on domain controllers that run Windows Server 2008 or Windows Server
        2008 R2.

2. Click Start, click Run, type ADSIEdit.msc, and then click OK.

3. Click Action, and then click Connect to.
4. Click Select a well known Naming Context, select Configuration in the list of available naming contexts, and then click OK.

5. Double-click Configuration, and then double-click CN=Configuration,DC=forest_root_domain
    where forest_root_domain is the distinguished name of your forest root domain.
6.Double-click CN=ForestUpdates.

7. Right-click CN=ActiveDirectoryUpdate, and then click Properties.

8. If you ran adprep /forestprep for Windows Server 2008 R2, confirm that the Revision attribute value is 5, and then click OK.
   If you ran adprep /forestprep for Windows Server 2008, confirm that the Revision attribute value is 2, and then click OK.
9. Click ADSI Edit, click Action, and then click Connect to.

10. Click Select a Well known naming context, select Schema in the list of available naming contexts, and then click OK.
11. Double-click Schema.
12. Right-click CN=Schema,CN=Configuration,DC=forest_root_domain, and then click Properties
     where forest_root_domain is the distinguished name of your forest root domain.
13. If you ran adprep /forestprep for Windows Server 2008 R2, confirm that the objectVersion attribute value is set to 47, and then click OK.
     If you ran adprep /forestprep for Windows Server 2008, confirm that the objectVersion attribute value is set to 44, and then click OK.

run x:\support\adprep>adprep /domainprep in all the domains where you are planning to introduce W2K8 DC. Make sure that you can logon to infrastructure master server with an account that is a member of domain admin

To verify that adprep /domainprep completed successfully

   1. Log on to an administrative workstation that has ADSIEdit installed. ADSIEdit is installed by default on domain controllers that run Windows Server 2008 or Windows Server
      2008 R2.

2. Click Start, click Run, type ADSIEdit.msc, and then click OK.

3. Click Action, and then click Connect to.

4. Click Select a well known Naming Context, select Default naming context in the list of available naming contexts, and then click OK.

5. Double-click Default naming context, double-click the container that is the distinguished name of the domain, and then double-click CN=System.

6. Double-click CN=DomainUpdates, right-click CN=ActiveDirectoryUpdate, and then click Properties.

7. If you ran adprep /domainprep for Windows Server 2008 R2, confirm that the Revision attribute value is 5, and then click OK.
      If you ran adprep /domainprep for Windows Server 2008, confirm that the Revision attribute value is 3, and then click OK.

run x:\support\adprep>adprep /gpprep

Running adprep /gpprep adds inheritable access control enteries on Group Policy Objects in the SYSVOL share folder. The additional ACEs give Enterprise Domain Controller read access permissions on GPOs. These permissions are required to support Resultant Set of Policy functionality (modeling) for the site based policy.
Run adprep /gpprep during off production hours because it can generate substansial replication traffic because each GPO would be updated
For optimal performance, make sure the Default Domain and Default Domain Controller policy is located on Infrastructure master role server.
If you running a Anti virus on server from where you would be running adprep /gpprep make sure to disable it as it may cause interfance
Once you finish running adprep /gpprep you can verify that the operation added the Read permission for the Enterprise Domain Controllers group on all GPOs

RODC Staged Installation

noreply@blogger.com (Navdeep) — Mon, 6 Dec 2010 02:13:00 +0800

RODC in Remote Branch Office

RODC is a new feature added in Windows Server 2008. For remote branch office,poor network connectivity, less secure location, low user base we can use RODC. RODC can be run on Windows Server 2008 Core Installation with least requirements like memory,HDD, processor. A low end server would be enough for this kind of setup hence proving to be cost effective.

We would be doing a Staged Installation of RODC. In this type of installation There are two stages.

Before we begin lets take a look at prerequistives.

Forest Functional Level and Domain functional level must be windows server 2003 or higher.
At least one writeable windows server 2008 Domain Controller.
Adprep /rodcprep must be run. Running this will give update permission on all DNS servers and allow them to be replicated by RODC which are running DNS as well.

Verifying rodcprep success

To verify that adprep /rodcprep completed successfully
   1. Log on to an administrative workstation that has ADSIEdit installed. ADSIEdit is installed by default on domain controllers that run Windows Server 2008 or Windows Server 2008 R2.
   2. Click Start, click Run, type ADSIEdit.msc, and then click OK.
   3. Click Action, and then click Connect to.
   4. Click Select a well known Naming Context, select Configuration in the list of available naming contexts, and
       then click OK.
   5. Double-click Configuration, and then double-click CN=Configuration,DC=forest_root_domain
      where forest_root_domain is the distinguished name of your forest root domain.
   6. Double-click CN=ForestUpdates.
   7. Right-click CN=ActivedirectoryRodcUpdate, and then click Properties.
   8. Confirm that the Revision attribute value is 2, and then click OK.

To install RODC there are 3 options available.

Running directly using dcpromo /adv setup
Install from Media
Staged Installation

As mentioned earlier we would be doing RODC using staged installation

First: member of domain admin adds necessary computer accout information, site info, dns, gc.

Steps for creating Pre Staged RODC installation account

To create an RODC account by using the Windows interface

Click Start, click Administrative Tools, and then click Active Directory Users and Computers.
Double-click the domain container, then you can either right-click the Domain Controllers container or click the Domain Controllers container, and then click Action.
Click Pre-create Read-only Domain Controller account, as shown in the following figure.

On the Welcome to the Active Directory Domain Services Installation Wizard page, if you want to modify the default the Password Replication Policy, select Use advanced mode installation, and then click Next.
On the Network Credentials page, under Specify the account credentials to use to perform the installation, click My current logged on credentials, as shown in the following figure, or click Alternate credentials, and then click Set. In the Windows Security dialog box, provide the user name and password for an account that can install the additional domain controller. To install an additional domain controller, you must be a member of the Enterprise Admins group or the Domain Admins group. When you are finished providing credentials, click Next.

On the Specify the Computer Name page, type the computer name of the server that will be the RODC.
On the Select a Site page, select a site from the list or select the option to install the domain controller in the site that corresponds to the IP address of the computer on which you are running the wizard, and then click Next.
On the Additional Domain Controller Options page, make the following selections, as shown in the following figure, and then click Next:

DNS server: This option is selected by default so that your domain controller can function as a DNS server. If you do not want the domain controller to be a DNS server, clear this check box. However, if you do not install the DNS server role on the RODC and the RODC is the only domain controller in the branch office, users in the branch office will not be able to perform name resolution when the WAN to the hub site is offline.
Global catalog: This option is selected by default. It adds the read-only directory partitions of the global catalog to the domain controller, and it enables global catalog search functionality. If you do not want the domain controller to be a global catalog server, clear this option. However, if you do not install a global catalog server in the branch office or enable universal group membership caching for the site that includes the RODC, users in the branch office will not be able to log on to the domain when the WAN to the hub site is offline.
Read-only domain controller. When you create an RODC account, this option is selected by default and you cannot clear it.

If you selected the Use advanced mode installation check box on the Welcome page, the Specify the Password Replication Policy page appears. By default, no account passwords are replicated to the RODC, and security-sensitive accounts (such as members of the Domain Admins group) are explicitly denied from ever having their passwords replicated to the RODC.

To accept the default setting, click Next.

-or-

To add other accounts to policy, click Add. If you want the accounts to be allowed to have their passwords replicated to the RODC, click Allow passwords for the account to replicate to this RODC. If you want the accounts to be denied from having their passwords replicated to the RODC, click Deny passwords for the account from replicating to this RODC. Then, click OK. When you are done adding other accounts, click Next.

When you install the first RODC in a domain, domain group accounts that are required for RODCs to function are created. Depending on your replication topology, the wizard might return an error indicating that these group accounts are not available when you try to install another RODC in the domain. In this case, wait for replication to complete before you install the additional RODC.

In Select Users, Computers, and Groups, type the names of the accounts that you want to add to the policy, and then click OK.
On the Delegation of RODC Installation and Administration page, type the name of the user or the group who will attach the server to the RODC account that you are creating, as shown in the following figure. You can type the name of only one security principal.

To search the directory for a specific user or group, click Set. In Select Users, Computers, or Groups, type the name of the user or group. We recommend that you delegate RODC installation and administration to a group.

This user or group will also have local administrative rights on the RODC after the installation. If you do not specify a user or group, only members of the Domain Admins group or the Enterprise Admins group will be able to attach the server to the account.

When you are finished, click Next.

On the Summary page, review your selections. Click Back to change any selections, if necessary.

To save the settings that you selected to an answer file that you can use to automate subsequent AD DS operations, click Export settings. Type a name for your answer file, and then click Save.

When you are sure that your selections are accurate, click Next to create the RODC account.

On the Completing the Active Directory Domain Services Installation Wizard page, click Finish.

After you create the account for the RODC, the user or group to whom you delegated installation and administration of the RODC (in step 11 in the previous procedure) can run the Active Directory Domain Services Installation Wizard on the server that will become the RODC to complete the RODC installation. Make sure that the server is not joined to the domain before you start the wizard.

To attach a server to an RODC account using the Windows interface

Log on as local Administrator to the server that will become the RODC, and then open a command prompt.
Type the following command, and then press ENTER:

dcpromo /UseExistingAccount:Attach

On the Welcome to the Active Directory Domain Services Installation Wizard page, click Next, or, if you want to install from media or identify the source domain controller for AD DS replication, select the Use advanced mode installation check box.
On the Network Credentials page, type the name of any existing domain in the forest where you plan to install the additional domain controller, as shown in the following figure. Under Specify the account credentials to use to perform the installation, click Alternate credentials, and then click Set. In the Windows Security dialog box, provide the user name and password for an account that was delegated the ability to install and administer the RODC when the RODC account was created. When you are finished providing credentials, click Next.

On the Select Domain Controller Account page, confirm that the wizard has found an existing RODC account that matches the name of the server, and then click Next.
On the Location for Database, Log Files, and SYSVOL page, type or browse to the volume and folder locations for the database file, the directory service log files, and the system volume (SYSVOL) files, and then click Next.

Windows Server Backup backs up the directory service by volume. For backup and recovery efficiency, store these files on separate volumes that do not contain applications or other nondirectory files.

On the Directory Services Restore Mode Administrator Password page, type and confirm the restore mode password, and then click Next. This password is used to start AD DS in Directory Service Restore Mode for tasks that must be performed offline. The password complexity and length must comply with the domain security policy.
On the Summary page, review your selections. Click Back to change any selections, if necessary.

Part B

I have installed RODC on Windows core installation.

You will need to create an answer file in order for RODC setup to be successfully completed.

You need to use command line or you can use CoreConfigurator to finish RODC.

dcpromo /unattend /UseExistingAccount:Attach /ReplicaDomainDNSName: contoso.com /UserDomain:contoso.com /UserName:contoso\da1 /password:* /databasePath:"e:\Windows\ntds" /logPath:"e:\Windows\ntds" /sysvolpath:"e:\Windows\sysvol" /safeModeAdminPassword:FH#3573.cK /rebootOnCompletion:yes

The contents of answer file are as follows

I have used CoreConfiguration to generate answerfile. It can them be modified as per needs.

I hope this post would be informational for you.