Windows Tricks

Difference between windows 2003 and windows 2008

noreply@blogger.com (Ganesh) — Mon, 08 Aug 2011 04:20:30 PDT

In my earlier article I have been discussed about the difference between Active Directory 2003 and Active Directory 2008, DNS 2003 and DNS 2008, Group policy 2003 and Group policy 2008, I would like to discuss about the difference between windows 2003 and windows 2008

Difference between windows 2003 and windows 2008

Windows 2008 gives you two installation types, Full installation and Server Core installation, to know more
Windows server 2008 Installation is faster because it’s 32 bit where as 2003 it is 16 bit as well as 32 bit, to know more
Windows deployment services (WDS) instead of RIS in 2003 server
Services are known as role in windows server 2008, like Active Directory has been renamed to Active Directory DomainServices (AD DS)
Windows server 2008 Boot sequence is changed
Virtualization (Hyper-V) is the main difference between windows 2003 and windows 2008
PowerShell been fully supported, you can manage easily using PowerShell script and PowerShell commands
Difference between Group Policy 2003 and 2008, please see my previous article Group Policy 2008 Features
Group Policy slow link detection process change on windows server 2008
New power-saving features been introduced in windows server 2008. It includes updated support for Advanced Configuration and Power Interface (ACPI) processor power management (PPM) features, including support for processor performance states (P-states) and processor idle sleep states on multiprocessor systems. These features can be managed through Group Policies.
Security has been Improved, features like Bitlocker
IIS updated version
Difference between Active Directory 2003 and Active Directory 2008
Difference between Windows DNS server 2003 and 2008
Difference between Sysvol Replication in Windows 2003 and 2008
Difference between windows 2008 and r2
DirectAccess

Google plus invite free for Windows Tricks Followers

noreply@blogger.com (Ganesh) — Wed, 27 Jul 2011 10:20:18 PDT

Does Anyone Want a Google Plus Invite? I have decided to send invites freely to readers and followers of Windows Tricks

To get a free invite request you to put a comment with the correct email address

Install printer through group policy

noreply@blogger.com (Ganesh) — Thu, 21 Jul 2011 06:03:16 PDT

Deploying printers via group policy using Print Management console, if your not installed Print Management then Install Print Management by adding or updating the print server role through Manage Your Server

Deploying printers through GPO

o Open the Print Management console and select the printer you want to install.

o In the results pane, right-click the printer you want to install, then click Deploy with Group Policy

o Click Browse, and then choose a GPO (through which you going to deploy the printer)

o If you want to deploy this printer for user or computer select the appropriate option

o Select the The users that this GPO applies to (per user)
o Select the The computers that this GPO applies to (per machine).

o Click Add

To complete printer deployment on client we have to deploy a PushPrinterConnections.exe to the client computer so that the client can process the printer connection settings through GPO

Deploy PushPrinterConnections.exe file

We have add PushPrinterConnections.exe to logon script on GPO, so that it will deployed while the time of user log on

o Open a Gpmc.msc, right-click the GPO with your printer connections settings and click Edit, Add PushPrinterConnections.exe file

o For per-machine, go to Computer Configuration, Windows Settings, Scripts (Startup/Shutdown).
o For per-user, go to User Configuration, Windows Settings, Scripts (Logon/Logoff).

Ask user to logoff and logon, printer will get installed automatically through GPO, for per-machine ask user to restart the computer in order to apply updated GPO.

How to check tombstone lifetime value in your Forest

noreply@blogger.com (Ganesh) — Tue, 12 Jul 2011 02:27:21 PDT

How to check tombstone lifetime value in your domain/forest

Tombstone lifetime value different from OS to OS, for windows server 2000/2003 it’s 60 days, In Windows Server 2003 SP1, default tombstone lifetime (TSL) value has increased from 60 days to 180 days, again in Windows Server 2003 R2 TSL value has been decreased to 60 days, Windows Server 2003 R2 SP2 and windows server 2008 it’s 180 days

If you migrating windows 2003 environment to windows 2008 then its 60 day’s

you can use the below command to check/view the current tombstone lifetime value for your Domain/Forest

dsquery * "cn=directory service,cn=windows nt,cn=services,cn=configuration,dc=" –scope base –attr tombstonelifetime

Replace forestDN with your domain partition DN, for domainname.com the DN would be dc=domainname, dc=com

To know more about tombstone lifetime & lingering object

Source: http://technet.microsoft.com/en-us/library/cc784932(WS.10).aspx

Microsoft Cloud Services

noreply@blogger.com (Ganesh) — Mon, 11 Jul 2011 02:25:45 PDT

Microsoft entered in to Cloud computing with different services (like Office365
, Windows Azure, Windows Intune and Microsoft Dynamics CRM) to compete with Google apps, amazon cloud, Microsoft Cloud Services are designed for targeted market and customers to fulfill their needs, let’s see how Microsoft cloud can be used in real time

Office365

Through office365, Microsoft able to provide the cloud service for day to day office work, yes the application like Microsoft office(Ms word, excel and power point) email services (Microsoft Outlook), file server service (share point) and communicator (IM), these are the basic application require a day to day office work

No need to invest for high end servers and IT infrastructure in order to provide the basic services to your employee, even you can view and edit the Microsoft office documents from browser itself, no need to install MS office locally on your desktop and it can be access anywhere through the internet

Will discuss more on this in my up coming post, please check back

Windows Azure

Normally any application, runs on server in a data center and this can be accessible from internet or intranet and applications are built on some kind of platform. For
In-house applications, platform usually includes a programming language (.net), operating system (windows server 2008) and how it’s store data.

Applications running in the cloud need a similar foundation,

Windows Azure runs on servers in Microsoft data centers. Normally Microsoft provide
Software that you can install on your own computers, Windows Azure is a service, Customers use it to run applications and store data on Internet-accessible machines owned by Microsoft.

Using Windows Azure you can implement application on cloud and also migrate existing application to Windows Azure, through Windows Azure Microsoft able to provide Infrastructure as a Service (IaaS) and platform as a service (PaaS) like Amazon Web Services’ Elastic Compute Cloud (EC2)

You can create your own VM (virtual machine) on Windows Azure, it will only host applications running on two versions of Windows Server, it’s doesn’t support Linux or other operating systems, that’s why I call it windows as a services rather Infrastructure as a Service (IaaS), and also you can’t supply your own VM image for Windows Azure to run the application. Instead, the platform itself provides and maintains its own copy of Windows

Windows Intune

It’s a Cloud based PC monitoring software, you can monitor the domain based computers and workgroup based computers virtually from anywhere and even these computers not required to connect corporate network in order to get update and monitored, whether they are in the office or on the road, you can able to view the status, alerts, security policies, and more through the web console

Windows Intune client needs to be installed on the computers (require a Windows 7 system) in which you are going to monitor and require an internet connection, its best suite for small and medium environment.

Windowsserver Hyper-V

Windows server Hyper-V for Private cloud, using windows virtualization solution you can implement your own private cloud environment

Microsoft Dynamics CRM

Cloud based CRM integrated with Microsoft Office applications, you access anywhere through MS outlook

Probably emerging cloud technology might change the way we work in future, I will try to elaborate each in my up coming article, please check back

Active Directory Replication failed with “Target principal name is incorrect"

noreply@blogger.com (Ganesh) — Tue, 05 Jul 2011 00:23:43 PDT

If you have issue with the computer account of the domain controller then you may receive target principal name is incorrect or access denied error while the time of replication

To check the computer account run the below command from affected domain controller where you receive the error

net view file://dcname/

or

net use file://dcname/

If you receive access denied error then it’s confirm computer account issue, to resolve this issue, you have to reset the computer account, reset the secure channels between these domain controllers and the PDC

Run the below command to reset the computer account,

Before running this command, disables the Kerberos Key Distribution Center service (KDC).

And this command should be run from the domain controller in which you are going to reset the password, server_name should be PDC or the replication partner

netdom resetpwd /server:server_name /userd:domain_name\administrator /passwordd:administrator_password

More info: http://support.microsoft.com/kb/288167

Replication failed with “The destination server is currently rejecting replication requests” Error

noreply@blogger.com (Ganesh) — Thu, 30 Jun 2011 23:14:01 PDT

Also receive error “The source server is currently rejecting replication requests. This operation will not continue” in windows server 2008/2003 and Active Directory replication stopped working, possibly the inbound and outbound replication been disabled on the domain controller

Use the below repadmin command to check the inbound and outbound connection object status

repadmin /options DC name

You may receive the error similar like below, then the inbound and outbound connection object been disabled

"Current DC Options: IS_GC DISABLE_INBOUND_REPL DISABLE_OUTBOUND_REPL"

If it’s disabled then run the below command to enable the inbound and outbound connection object

repadmin /options DC Name -disable_inbound_repl
repadmin /options DC Name -disable_outbound_repl

If it’s been disabled automatically after some time (15 min) then it’s an issue with the Lingering Objects, you have to check the event viewer for the Event ID 1988

If your environment configured with Strict Replication Consistency, then the Inbound replication of the directory partition of the lingering object has been blocked on the destination domain controller.

You have to remove the Lingering Objects to resolve this issue
Also check Troubleshoot Active Directory Server Replication for other ad replication issues

Cloud Reliability

noreply@blogger.com (Ganesh) — Wed, 29 Jun 2011 04:41:41 PDT

Is Cloud reliable?
All most every tech magazines have an article on Cloud Computing and it’s been frequently used word in IT, yes Cloud is the emerging technology in IT world seeking to change the concept of personal computing and taking it to a new level of computing and it is a talk of the town recently however it Cloud reliable

Host your application on public cloud (Application like E-mail, Website, Database and other), every one planning to migrate locally hosted application to cloud and implement cloud based application, of course cloud has many advantages compare to locally hosted one

I have concerns over the cloud implementation; recently I have seen attacks against Gmail, Amazon's EC2 cloud service is down on Apr 2011 And I have lost all my mails from rediffmail.com, not only me it’s been affected many others, these incidence raise a question on Cloud reliability

The decision to migrate the services to a cloud should always be based on how well the provider can guarantee that the servers will deliver an adequate percentage of uptime. Of course it’s one thing to say that you assurance 99.9 percent uptime and quite another to deliver, so when a cloud provider makes a claim regarding availability you should have a data to validate and how inherently redundant and scalable

And you should have clearly defined SLA and other agreement to protect the data and service high availability, this will ensure the Cloud reliability and of course these features are only possible in paid cloud service

Issue managing IE configuration through GPO

noreply@blogger.com (Ganesh) — Wed, 22 Jun 2011 04:07:36 PDT

List of trusted sites went empty recently, yes the Trusted Sites list got empty, it says: "No sites are in this zone" how to resolve this issue

We had an issue like some one edited the default domain policy to update the trusted site list and we have lost entire IE configuration (Like trusted site list) because he used a different account to edit the group policy, it’s a known issue in Windows server 2003, why it’s clear the IE configuration? Let’s explore this…

Because Internet Explorer policy settings would change based on the policy settings enabled on the administrative workstation used to view the settings.

If you edit the Group policy to configure the internet Explorer settings, it will open the internet options from the system where you modifying the policy, let’s say you login with admin account and this account doesn’t linked to any policy including the default domain policy which has the IE configuration details like trusted sites, if you open and edit the policy to update the trusted site through GPMC, it should be empty because the admin account used to edit the GPO doesn’t linked to any policy

If you click ok then this empty setting will overwrite the policy settings and this will apply to entire users, trusted site will be empty for all the users in the domain

That’s why you have to use the admin account that should be linked to the policy you want to edit (only for IE configuration), while the time of logon the policy will apply and you can able to see the list of trusted sites and other IE configuration setting and able to append the IE settings without any issue

Thanks to Microsoft, in windows 2008 this behavior has been changed, you can change the Internet Explorer policy settings without affecting the policy configuration, because these settings are registry based settings unlike windows server 2003, more in fo about the GPO features

DNS Lookup Tool with GUI

noreply@blogger.com (Ganesh) — Thu, 16 Jun 2011 01:05:54 PDT

Free Nslookup Tool for Windows with GUI interface

It’s a normal Windows Nslookup tool, command line windows Nslookup tool been converted to user friendly GUI tool, this tool used to check the DNS entry and it has many customized features

Features of DNS Lookup Tool

• You can check the different record types (A, MX, NS, SOA, PTR, and SRV)

• You can enable the Debugging mode for better DNS troubleshooting

• You can change the DNS Query Type (Recurse, Iterative (non-recursive))

• Also you can able to specify the server from where you want to query the DNS entry (By default it’s a primary DNS server from the network card configuration)

• Easy to use and user friendly, no installation required you can directly run the tool.

DNS Lookup Tool

Nslookup tool query the A record

Nslookup tool query the MX record

Output of Nslookup tool query with Debugging mode Enabled

Download Nslookup Tool

For more info on NSLOOKUP and DNS troubleshooting

Exchange Recipient Types

noreply@blogger.com (Ganesh) — Tue, 14 Jun 2011 04:40:02 PDT

Exchange recipients are used to send and receive exchange mail, Active directory object or resources that send and receive messages are called Exchange recipient (like User object and Group object in Active Directory) in Exchange 2010 environment different types of Exchange recipient available and each recipient type is represented by a unique features

Most command recipient types

User
Group
Contact

Exchange 2010 recipient types

Dynamic distribution group
Equipment mailbox
Legacy mailbox
Linked mailbox
Mail contact
Mail forest contact
Mail user
Mail-enabled non-universal group
Mail-enabled public folder
Mail-enabled universal distribution group
Mail-enabled universal security group
Microsoft Exchange recipient
Room mailbox
Shared mailbox
User mailbox
Remote mailbox (New recipient type in Exchange 2010)
Linked user (New recipient type in Exchange 2010)

Active Directory Ports

noreply@blogger.com (Ganesh) — Wed, 08 Jun 2011 05:50:50 PDT

It’s been frequently asked question, list of ports used by Active Directory or list of Active Directory Ports for Active Directory replication and Active Directory authentication, this ports can be used to configure the Firewall

Active Directory replication- There is no defined port for Active Directory replication, Active Directory replication remote procedure calls (RPC) occur dynamically over an available port through RPCSS (RPC Endpoint Mapper) by using port 135

File Replication Services (FRS)- There is no defined port for FRS, FRS replication over remote procedure calls (RPCs) occurs dynamically over an available port by using RPCSS (RPC Endpoint Mapper ) on port 135

Other required ports for Active Directory

TCP 53 - DSN (DNS Download)
UDP 53 - DSN (DNS Queries)
TCP 42- WINS
UDP 42- WINS
TCP 3389- RDP (Remote Desktop)
TCP 135 - MS-RPC
TCP 1025 & 1026 - AD Login & replication
TCP 389 - LDAP
TCP 639 - LDAP over SSL/TLS
TCP 3268 -Global Catalog
TCP 3268 - Global Catalog over SSL/TSL
UDP 137 & 138 - NetBIOS related
UDP 88 - Kerberos v5
TCP 445 - SMB , Microsoft-ds
TCP 139 - SMB

Important windows ports

Group Policy slow link detection on windows server 2008

noreply@blogger.com (Ganesh) — Mon, 06 Jun 2011 04:27:33 PDT

Group Policy slow link detection process change on windows server 2008

You can see my earlier article on Group Policy slow link detection

Group Policy Processing over Slow Links in windows 2003(part1)

Group Policy Processing over Slow Links(Part2)

In windows server 2003, Group Policy slow link detection uses the ICMP ping to detect the network bandwidth. Most of the VPN networks have the issue with this because the clients communicate through a Firewall with the domain controller

This was a big problem in windows server 2003 because it uses the ICMP ping to detect the network bandwidth, some of the VPN sites ICMP ping might be disabled in firewall or the MTU size would be less then the required limit and also ping will increase the network traffic, to overcome this problems Microsoft come up with solution called NLA (Network Location Awareness)

Network Location Awareness is a service on client computer, it provide necessary information about the network and GPO uses this to apply the policy settings, most important it’s not using ICMP ping and very efficient compare to earlier process in Windows 2003.

String to GUID Converter

noreply@blogger.com (Ganesh) — Mon, 30 May 2011 03:45:30 PDT

Using Online String to GUID Converter Tool, you can convert a string formatted GUID to hexadecimal string format and vice versa (hexadecimal formatted GUID to string format)

If you extract the Active Directory object GUID from Domain Controller using ADSIEDIT you will get the hexadecimal formatted GUID and you have to convert this Hex format GUID to Normal usable string format because most of the windows commands and scripts require a string format GUID.

No need to download and install, it’s a online tool and can be used directly on our website, just click here Online String to GUID converter Tool

Sysvol Replication change in Windows 2008

noreply@blogger.com (Ganesh) — Thu, 26 May 2011 02:47:22 PDT

Group Policy replication change

Before I start the SYSVOL replication changes in windows server 2008, I would like to explain how the GPO has been replicated in windows server 2003 and earlier versions

Understanding SYSVOL/GPO replication

Group policy template (GPT) and group policy container (GPC) are two types of Group policy settings, Its stored in two different locations and uses different replication technology to replicate the changes, however both should be available up-to-date on domain controller to function properly

Group policy templates are stored in SYSVOL, it’s a folder structure in SYSVOL share on a domain controller, if you create a new Group Policy it will create a Group policy templates folder on SYSVOL share for the new policy that contain the group policy setting related to this policy, GPT folder name would be Globally Unique Identifier (GUID) of the GPO that you created, you can view all the GPT folders from the below Path (it’s a default GPT path)

C:\Windows\Sysvol\Sysvol\DomainName\Policies

Group Policy template (GPT) is replicated by SYSVOL through FRS, FRS uses state-based replication. As soon as there is a change to any file under the Sysvol folder structure, replication is triggered and entire file get replicated

Group policy containers are stored in Active Directory, mostly all the GPO setting are stored in GPT (Group policy templates), GPC only have the reference information of the corresponding GPO, like GPT path, GUID of the GPO, version information, WMI filter information, and a list of components that have settings in the GPO, you can view the GPC from Active Directory Users and Computers (ADUC)

\System\Policies

Group policy container (GPC) is replicated through Active Directory replication

Note: By default the Group Policy Management Editor console (GPME) uses the PDC Emulator so that all administrators can work on the same domain controller, if you want a different Domain controller you can change through Group Policy Management console (GPMC)

File Replication Services (FRS)

I will try to explain step by step, let say you modify the Policy A from Server001 and how this change get replicated to Server002 (Server002 is a downstream replication partner for server001)

• Once you modify the Policy A from server001, the corresponding GPT folder on SYSVOL gets updated on the server001 (also updates the Group policy containers in Active Directory on server001)

• NTFS will change the USN journal according to the file and folder change.

• FRS monitors the USN journal for changes on the SYSVOL folder

• FRS updates the inbound log on server001, FRS not only updates the local changes on inbound log, also updates the inbound log for the changes from entire upstream replication partner (all inbound partners)

• FRS creates a file in staging folder on server001 by using APIs (backup application programming interfaces) based on the change.

• This change has been updated on outbound log on server001 by FRS. And also send change notification to entire downstream replication partner about the change (all outbound partners)

• Server002 get the change notification from Server001 and store the change order in inbound log, Server002 copies the staging file from Server001 to the staging folder on Server002. Server002 then update outbound log so other outbound partners can pick up the change

• Using Restore APIs, Server002 reconstructs the file and folder in the preinstall folder, and then FRS renames the file or folder into the replica tree

In FRS replication process the entire changed file and folder get replicate to source to destination server

What is NTFS USN journal?

Logs all the changes to an NTFS volume, including file creations, deletions, and changes, Separate log on each NTFS volume and it has a size limit (Windows server 2003 SP2 & Windows server 2008 is 128 MB) if require you can increase the size up to 2 TB, however MS Recommends increasing by 128 MB for every 100,000 files/folders

What happens when the NTFS USN change journal fills up?

If the USN journal log fills up then NTFS will be overwrite the old entry’s, that’s why in some scenarios before the change get updated, NTFS delete the entries in USN journal log, it’s called journal_wrap

USN journal wrap Error

An error that occurs when large numbers of files change so quickly that the USN journal must remove the oldest changes (before FRS has a chance to detect the changes) to stay within the specified size limit, to resolve this issue you have to perform a non-authoritative restore also called D2

Morphed folder

Replication conflict will occur if identically named directories are created in different servers, to resolve this conflict FRS create a folder and this folder called morphed folder

Let’s say two identical directories are created in different replication members, FRS identifies the conflict during replication, and the receiving member protects the original copy of the folder and renames (morphs) the later inbound copy of the folder. The morphed folder names have a suffix of “_NTFRS_xxxxxxxx,” where “xxxxxxxx” represents eight random hexadecimal digits.

Version vector join (vvjoin)

Till now we are discussing about the SYSVOL replication, how the SYSVOL replication works for the newly added replication partner, newly added replication member doesn’t have any updates, and it should build the folder structure from the beginning, this process is called vvjoin, in which a downstream partner joins with an upstream partner for the first time.

Vvjoin is a CPU-intensive operation that can affect the performance of the server and increase the replication traffic

Distributed File System (DFS)

Now we are coming to the point, how the SYSVOL replicating using DFS and how it’s been improved to provide better replication performance, to use this feature you should have Windows Server 2008 domain functional level that means all the domain controller has to be Windows Server 2008

SYSVOL replication using DFS is called DFS-Replicated SYSVOL (DFSR)

DFSR is a multimaster replication engine and changes that occur on one of the replication member are then replicated to all of the other servers in the replication group

DFSR also monitors the NTFS for the update sequence number (USN) journal to detects changes on the volume, and then DFSR replicate the changes only after the file closed

And before sending or receiving a file, DFSR uses a staging folder to stage the file

If any changes in SYSVOL share, FRS replicate the entire file unlike the DFSR, DFSR replicates only the changes blocks and not the entire file, sounds like a attribute level Active Directory replication, it compare the source and destination file using remote differential compression (RDC), it reduce the SYSVOL replication traffic

Other improvements are… (Difference between DFRS and FRS)

• DFSR and Journal Wraps, DFSR also monitors the NTFS change journal, but DFSR always heals itself hence no Journal Wrap error

• Morphed files and folders automatically taken care of

• FRS silently fails if the volume SYSVOL resides on < 1GB of free space

• Copies the changes on files and folder not entire files and folder

• Uses Version Vector tables to confirm the changes, also to resolve the conflicts

• Support read-only replication on a particular members in which users cannot add or change files

• You can also make the changes to the SYSVOL folder of an RODC

• DFSR does not require the version vector join (vvjoin) operation

My previous article related to SYSVOL

Understand the sysvol folder structure

How to Force sysvol replication in AD

Online Subnet Calculator

noreply@blogger.com (Ganesh) — Mon, 06 Jun 2011 06:07:12 PDT

It’s a simple online IP Subnet Calculator, using this Subnet Calc you can calculate, Mask Bits, Start IP, End IP, Address Range, Subnet ID, Broadcast Address.

And this can be used to find the Subnet Mask for the given Mask Bit or find the Mask Bit for the given Subnet Mask.

No need to download and install, it’s a online tool and can be used directly on our website, just Click Here

Incoming search terms: subnet a subnet, subnet masks, subnet masking, subnet netmask, subnet 255, subnet and subnet mask , calculadora subnetting, subnet calculate, subnett calculator, subnet calcu, subnet calculation, subnets calculator, subnet calculators, subnet calculator, calculator subnet, calc ip, ip subnets, ip subnet, ip to subnet, ip and subnet, ip calculator, calculator ip, netmask, subnetting a subnet, subnet address, ip calc, ip subnet calculater, ipcalc,ip subnet calculation, ip subnet calculator, ip calculator subnet, subnet ip calculator

Online Windows Timestamp Converter

noreply@blogger.com (Ganesh) — Thu, 26 May 2011 01:16:44 PDT

Online Tool to Convert Windows Timestamp to readable format

If you extract the Lastlogon and Lastlogontimestamp attribute value from CSVDE tool or ADSIEDIT, attribute value would not be readable format and you can’t understand the format, you can use this Online Tool to convert Timestamp to readable format

No need to download and install, it’s a online tool and can be used directly on our website, just click here

Our Previous Article Related to lastlogon

In Excel itself you can Convert lastlogon and lastlogontimestamp

How to extract lastlogontime in CSVDE

SYSVOL Folder Structure

noreply@blogger.com (Ganesh) — Wed, 27 Apr 2011 01:05:24 PDT

About each folder under the SYSVOL share in Domain Controller

SYSVOL folder used to store a copy of the domain’s public files like system policies, Group Policy settings and logon/logoff scripts, which are replicated to all other domain controllers in the Active Directory domain through File Replication Services (FRS), You can find many folders inside the SYSVOL share, I would like to explore and explain each folder by how it’s used in the process of SYSVOL replication.

SYSVOL Folder Structure

\Sysvol
|____
| |____Policies
| |____Scripts
| |____ DO_NOT_REMOVE_NtFrs_PreInstall_Directory
| |____ NtFrs_PreExisting___See EventLog
|
|____Enterprise
| |____Policies
| |____Scripts
|
|____Staging
| |____Domain
| |____Enterprise
|
|____Staging Areas
| |____Enterprise (junction> = Sysvol\Staging\Enterprise)
| |____Your Domain Name (junction> = Sysvol\Staging\Domain)
|
|____Sysvol
| |____Enterprise (junction> = Sysvol\Enterprise)
| |____Your Domain Name (junction> = Sysvol\Domain)

Before I discuss about the SYSVOL folder structure, we should know about the junction points,

Junction point: is a physical location on a hard disk that points to data that is located elsewhere on the hard disk or on another storage device. Junction points look like folders and behave like folders but they are not folders. A junction point contains a link to another folder. When a program opens it, the junction point automatically redirects the program to the folder to which the junction point is linked

If you open a \\%systemroot%\SYSVOL\sysvol, it actually opens the content in %systemroot%\SYSVOL\domain, you can also see this in command prompt, go to SYSVOL folder in command prompt and type DIR you can notice some of folder are shown as all are junction points

%systemroot%\SYSVOL\staging areas\domainnam pointing to %systemroot%\SYSVOL\staging\domain

%systemroot%\SYSVOL\sysvol pointing to %systemroot%\SYSVOL\domain

Staging Folder

When ever you change the GPO settings the corresponding policy folder in SYSVOL get updated and this change needs to be replicated to other replication members (Domain controller) how it’s happens? Staging folder acts like a queue for changed files and folders to be replicated to downstream partners.

FRS creates a file in staging folder by using APIs (backup application programming interfaces) based on the change and replicates to the downstream partners, downstream partners use restore APIs to reconstruct the staging files in the preinstall folder, full file get copied from staging folder to preinstall folder.

Preinstall folder

Preinstall folder is nothing but the DO_NOT_REMOVE_NtFrs_PreInstall_Directory. Folder located under the replica root (Domain folder). Files and folders are replicated from the upstream partner staging folder. After the file or folder is completely replicated, it is renamed to its target location in the replica tree. So that partially constructed files are not visible in the replica tree

Pre-existing folder

The pre-existing folder, named NtFrs_PreExisting___See EventLog, is an optional folder that is located under the replica root (Domain folder). It may not be available by default like others folders, If pre-existing folder is present on a replica member then mostly one of the below reasons.

• Active Directory Restore:
• SYSVOL Non-authoritative restore (also called D2):
• Server was pre-staged before it was added to the replica set

Mostly FRS moves existing data in the replica tree to the pre-existing folder and then receives the updated replica tree from one of the upstream partners and deletes the files inside the pre-existing folder after the successful completion of replication.

Policies Folder

Policy folder contains the list of folders for each policy, if you create a new Group Policy it will create a Group policy templates folder on SYSVOL share under policy, it will contain the group policy setting related to that policy, GPT folder name would be Globally Unique Identifier (GUID) of the GPO that you created.

Scripts Folder

Script Folder contains all the logon/logoff scripts which is used by the various policies

DNS Management Tool

noreply@blogger.com (Ganesh) — Wed, 13 Apr 2011 20:42:59 PDT

Using DNS Management tool you can check, create and delete DNS entry in Windows DNS server, it seems to be simple however in a large environment it’s not that simple, let’s say if you have multiple zones and every zone have huge DNS entry’s then it’s very difficult to check, create and delete the DNS entry

When you open the DNS console all the zones in that server will get loaded and you have to select the zone than all the entry’s in that zone will get loaded, it will be time consuming process then you have to filtered out to delete the corresponding entry

While creating the DNS entry you have to manually type the IP address, you can’t copy and paste, this may lead to typo error and you will created the DNS entry with wrong IP address, by using this tool you can avoid this and increase your productivity

And this can be done in a second, you can also check if the DNS entries are available before deletion or creation the DNS entry

If you have multiple requests and you have to do this one by one, then this tool perfectly match your requirement

Follow the below procedure to Manage DNS record in Windows DNS server

1. Enter Record Name
2. Record name should be FQDN(fully qualified name) like Server001.eur.windowstricks.in
3. Enter IP Address
4. If require you can copy and past the host name and IP address
5. If you want to create DNS record then Click Create button
6. This will create the DNS entry to the corresponding zone in the DNS server
7. You will get the result, if any issue to creating the record, then you will get the error message
8. If you want to check DNS record then Click check button
9. You can also Delete the DNS entry by clicking the Delete button

Check the Existing DNS Record:

Deleting the Existing DNS Record:

Checking the DNS Record:

Creating the DNS Record:

Requirement

This tool should be run from the DNS servers where you want to manage the DNS entries

And you should have DNSCMD tool installed and DNS admin rights.

Download

For bulk DNS record creation and deletion

Other Free Tools

Command to Create/Delete bulk DNS Record

noreply@blogger.com (Ganesh) — Wed, 06 Apr 2011 11:13:24 PDT

DNSCMD command line tool can be used to create DNS entry, I would like to explain how we can use DNSCMD to create and delete bulk DNS record from text file, creating and deletion bulk DNS entry it very simple if you use this procedure

How to create Bulk DNS record

First we will see the bulk DNS creation, we have to create the A record first (In forward zone) then corresponding PTR record for that A record (In reverse zone), before that we have to create input file, update the input file like below

RECORD_2_ADD;ZONE_WHERE_ADD_RECORD;IP_ADDRESS

Example:

Test001;eur.domainname.com;192.168.100.10

Command to create Bulk A record (host record)

for /f "tokens=1-3 delims=;" %a in (list.txt) do dnscmd Server Name /RecordAdd %b %a A %c

Command to create Bulk PTR record

for /f "tokens=1-3 delims=;" %a in (list.txt) do for /f "tokens=1-4 delims=." %e in ("%c") do dnscmd Server Name /recordadd %g.%f.%e.in-addr.arpa. %h PTR %a.%b

How to delete Bulk DNS record

Like creation, you have to delete both A as well as corresponding PTR records to completely delete the DNS entry, you can use the similar input file

Command to delete Bulk A record

for /f "tokens=1-3 delims=;" %a in (list.txt) do dnscmd Server Name /RecordDelete %b %a A /f

Command to delete Bulk PTR record

for /f "tokens=1-3 delims=;" %a in (list.txt) do for /f "tokens=1-4 delims=." %e in ("%c") do do dnscmd Server Name /RecordDelete %g.%f.%e.in-addr.arpa. %h PTR /f

Note: Change the server name with your DNS server name and You should run this command from where the input file (list.txt) there, and this command will check all the DNS names in the input file (list.txt)

No need to change the input file format, yes we can use same input file for all this commands, you can use our Free DNS tool to create a single DNS record

Why we can't edit/view windows 2008, Vista and windows 7 GPO settings from windows 2003

noreply@blogger.com (Ganesh) — Fri, 01 Apr 2011 04:23:34 PDT

Unable to edit/view Group policy settings from windows 2003

If you have mixed environment like Windows XP, Windows Vista and Windows 7 then some of the group policy changes need to be configure from windows server 2008 or Windows Vista & Windows 7, you can’t edit or see the policy settings from windows 2003/windows XP because windows server 2008 Group Policies using ADMX templates unlike the windows 2003 uses the ADM file

Group policy settings are configured through the ADM/ADMX files through the GPMC/GPOE (Group Policy Management Console / Group Policy Object Editor), Windows server 2003 uses the ADM file to edit the policy, and Windows server 2008 uses the ADMX file to edit the policy

Anyway it will not affect the client and group policy processing, only difference is the system which is used to edit the group policy, requires these ADM/ADMX files, Editing Group Policies using ADMX templates requires that the editing tools be run only on Microsoft Vista, Server 2008 and Windows 7. ADM templates can be edited on Windows XP or Server 2003

More new group policy settings has been added in windows server 2008 to manage the environment effectively, all this new settings can be configurable through Microsoft Vista, Server 2008 and Windows 7, to know more about the Group Policy 2008 Features

Exchange Replication

noreply@blogger.com (Ganesh) — Wed, 23 Mar 2011 04:08:38 PDT

Exchange 2007 Replication: Exchange 2007 has different types of High Availability features, I would like to discuss about how the data been replicated to various exchange server to provide High Availability, we know the LCR, CCR, SCR and SCC features from Exchange 2007, Will see how this features replicate the Exchange database to other Disk or other exchange server

LCR (Local Continuous Replication) and CCR (Cluster Continuous Replication) uses exchange built-in asynchronous log shipping and log replay technology to replicate database, actually speaking it will replicate Transaction log files not the database

SCR (Single Copy Clusters) will not replicate the Exchange database or log files because it uses the common storage to provide fault tolerance like a native Exchange cluster

SCC (Standby Continuous Replication): SCC is same like CCR & LCR and it uses the same Replication technology

Asynchronous log shipping and log replay: Exchange server was designed to write all transactions to transaction log files first and commit the changes to the databases from the transaction log files, changes are not directly written in to exchange database for better performance and checkpoint file know which part of transaction log are committed to the exchange database, transaction log files size is 1 megabyte (MB) in Exchange 2007

Transaction log file size in Exchange 2003 is 5 MB, it’s reduced to 1 MB in Exchange 2007 to reduce data loss, and how it will prevent the data loss? LCR and CCR use the transaction log files to replicate the changed data to the other disk in LCR, to other exchange server in CCR, copies the transaction log files from active note to passive node, replication mechanism is asynchronous to the online database

Replication is asynchronous Logs are not copied from active node to passive node, until they are closed and no longer used by the Mailbox server in active node, hence the passive node usually does not have a copy of every log file that exists on the active node (except a scheduled outage initiated by admin) because of reduced log file size (1 MB log file size) passive node has the most recent data and data loss is controlled

Transport dumpster can be used to recover the mails from the log files that are currently used by the Mailbox server in active node to reduce the mail loss from the asynchronous replication, Hub Transport servers maintain a queue of recently delivered mail, When a failover is experienced then clustered mailbox server automatically requests every Hub Transport server in the Active Directory site to resubmit mail from the transport dumpster queue, this queue has been used while the time of failover

How the transaction log files are replicating to passive node: The transaction log files folder on the active node is shared using standard Windows file share. The GUID (globally unique identifier) for the storage group is used for the share name, and a dollar sign ($) is added to the end of the share. The Microsoft Exchange Replication service on the passive node connects to the share on the active node and copies (pulls) the log files using the SMB (Server Message Block) protocol. The passive node then verifies the log file and replays it into the copy of the database on the passive node.

Group Policy 2008 Features

noreply@blogger.com (Ganesh) — Mon, 21 Mar 2011 06:45:24 PDT

Group Policy 2008 Features: I will discusses about the Group policy changes in windows 2008 server, Microsoft have made some of interesting changes and added new features in Group Policy 2008, first I will list the features and explain one by one

• New Administrative template files (ADMX)
• New Policy settings
    o Power options
    o Block device installation
    o Improved security settings
    o Internet Explorer settings management
    o Assign printers based on location
    o Delegate printer driver installation to users

• Group Policy slow link detection
• SYSVOL replication change
• SYSVOL uses DFS Replication service to replicate Group Policy object files to other domain controllers (In windows server 2003 uses FRS to replicate this)

Am very interested about the below changes because I have faced several issues related to this in windows 2003 group policy

• Group Policy slow link detection
• Internet Explorer settings management
• Blocking device installation
• SYSVOL replication change

New Administrative template files (ADMX)

In windows server 2003 and earlier versions, ADM file used to store registry based GPO settings, In Windows server 2008 ADMX file used to store registry based GPO settings, it’s a XML based and easy to manage registry based policy settings

ADMX format support Multilanguage, centralized datastore, and version control capabilities, policy can be edited in other language that was created in English language because Group Policy tools will adjust the user interface according to the administrator's configured language, you can also create a Central Store for Group Policy Administrative Templates to reduce the disk space, see article in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkId=122539)

New Policy settings

Power options: Now you can configure the power option through group policy

Configure power option through GPO:
Computer Configuration ->Administrative Templates -> System -> Power Management

Block device installation: In windows 2003 to block the device assess like USB and CD drive we have to import the customized ADM file, in windows 2008 it’s inbuilt yes now you can configure he device access through group policy

Configure Block device installation through GPO:
Computer Configuration ->Administrative Templates -> System -> Device Installation

Improved security settings: IPsec & firewall setting are combined to provide the enhanced security and avoid policy duplication

Configure security settings through GPO:
Computer Configuration -> Windows Settings -> Security Settings -> Windows Firewall with Advance Security

Internet Explorer settings management: We had an issue like some one edited the GPO to update the trusted sites and we have lost entire IE configuration because he used a different account to change the group policy, it’s a known concern in Windows server 2003 because Internet Explorer policy settings would change based on the policy settings enabled on the administrative workstation used to view the settings.

In windows 2008 this behavior has been changed, you can change the Internet Explorer policy settings without affecting the policy configuration

Configure Internet Explorer settings through GPO:
Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer
User Configuration -> Administrative Templates -> Windows Components -> Internet Explorer

Click here to Configuring trusted website and activex settings for IE7 or Vista and later versions using group policy

Assign printers based on location: Install the network printer based on the user location, it’s very useful for the roaming user because if the user login to the network other then the base location GPO will install the printer for the new location.

Assign printers based on location through GPO:
Computer Configuration -> Windows Settings -> Deployed Printers
User Configuration -> Windows Settings ->Deployed Printers

Delegate printer driver installation to users: Now user can install the printer on there system without admin access, it helps to reduce the security risk and admin effort.

Delegate printer driver installation through GPO:
Computer Configuration -> Administrative Templates -> System -> Driver Installation

Group Policy slow link detection

This was a big problem in windows server 2003 because it uses the ICMP ping to detect the network bandwidth, some of the VPN sites ICMP ping might be disabled in firewall or the MTU size would be less then the required limit and also ping will increase the network traffic to overcome this problems Microsoft come up with solution called NLA (Network Location Awareness)

Network Location Awareness is a service on client computer, it provide necessary information about the network and GPO uses this to apply the policy settings, most important it’s not using ICMP ping and very efficient compare to earlier process in Windows 2003, Check Group Policy Processing over Slow Links for Windows server 2003

SYSVOL Replication

In windows server 2003 FRS (File replication service) has been used to replicate SYSVOL folder changes, in windows server 2008 you can use the DFS (Distributed File System) to replicate changes on the SYSVOL folder, to use this feature you should have Windows Server 2008 domain functional level that means all the domain controller has to be Windows Server 2008

If any changes in SYSVOL share, FRS replicate the entire file unlike the DFS, DFS only replicate the change in the file, sounds like a attribute level Active Directory replication, it compare the source and destination file using remote differential compression (RDC)

If you are migrated from windows 2003 to windows server 2008, FRS is the default replication service for SYSVOL replication, you have to migrate the SYSVOL share to use the DFS

Compare to earlier version Group Policy settings has increased from approximately 2,400 in Windows Server 2008 to optimize the environment and support new features, more info from technet

Lastlogon and Lastlogontimestamp attribute value in CSVDE output

noreply@blogger.com (Ganesh) — Thu, 05 May 2011 06:57:26 PDT

Convert lastlogon timestamp to readable format using W32TM and Excel

Most of the active directory admin have received a request to extract the last logon time for the list of users and computers from AD, we can use the CSVDE command to extract the lastLogon attribute value however from CSVDE output the lost logon attribute value would not be the readable format or usuable date/time format, and you can’t understand the format because it’s a UTC format

You can convert lastlogontimestamp to readable date format using W32TM command

Syntax:

w32tm /ntte (lastLogon attribute value)

Example:

C:\>w32tm /ntte 127281844863301000

147316 22:48:06.3301000 - 5/5/2004 4:18:06 AM (local time)

It’s very difficult to use this command for bulk extract, we can convert this in Excel itself using below procedure.

You can use below formula to convert UTC format to normal readable format in Excel.

=IF(A1>0, DATE(1601,1,1) +A1 /600000000/1440,"")

A1 is the cell that contains the Timestamp.

Yes, in Excel itself you can convert lastlogon and lastlogontimestamp to a normal readable format no need for additional script and command, we can use this simple procedure to extract lastlogon timestamp from active directory without using a script, more about CSVDE

You can also use our online windows timestamp converter

Related Articles

How to extract bulk object from AD with the specific attributes (Part 1)

How to extract the user who has the option Password never expires in the OU

Force active directory replication

More useful commands

Reconfigure roaming profile folder and home folder permission for all the users

noreply@blogger.com (Ganesh) — Tue, 15 Feb 2011 04:53:01 PST

Reconfigure roaming profile folder and home folder permission for all the users

If you ever faced an permission issue on roaming profile folder and home folder, if not it may happen in future it’s better to have a solution for this, you know the profile folder and home folder have their respective user permissions ( that will be unique for each folder)

Its very difficult to resolve the permission issues if you have more folders, lets say by mistakenly you or someone else reset the root folder permission, checked the “Replace permission entries on all child objects with entries shown here that apply to child objects” on the root folder, this will reset all the sub folder permission, now all the sub folder (user folder) have lost their respective user permissions

All the user in that root folder will receive the access denied error, if its a roaming folder they will not able to log in with roaming profile

To resolve this issue use the below command

Run this command from the affected root folder, this command will check every folder with the user name in the Active Directory (same name as the folder name) and if the user available then this will provide the corresponding user permission, provide the modify permission to user folder for the user

for /f "tokens=1" %a in ('dir /b') do net user %a /dom | findstr /i /c:"The command completed successfully." >nul && subinacl /file %a /grant=%a=C

for /f "tokens=1" %a in ('dir /b') do net user %a /dom | findstr /i /c:"The command completed successfully." >nul && subinacl /sub %a\*.* /grant=%a=C

If you want to remove some permission from all the folder

for /f "tokens=1" %a in ('dir /b') do net user %a /dom | findstr /i /c:"The command completed successfully." >nul && subinacl /file %a\*.* /grant=useradmins=F /grant=%a=C /revoke=user

for /f "tokens=1" %a in ('dir /b') do net user %a /dom | findstr /i /c:"The command completed successfully." >nul && subinacl /sub %a\*.* /grant=useradmins=F /grant=%a=C /revoke=user

In the above example we have removing the domain user from all the folder and providing full access to useradmins group and providing modify access to folder owner

Note: you can customize this command for your requirement, change the group name and permissions, (F for full access and C for modify access) if you understand the above command you can resolve permission issue in any scenario

Related Articles

Roaming profile issues
Roaming profile will not work with the remote site (especially low bandwidth sites like VPN site)
GPO update failed in Slow Link VPN site with Event ID 1000 and 1054