Shariq Sheikh | Port 389 » Windows Server 2008

Is there an Active Directory Visual Illustration/Diagram ?

Rick — Tue, 01 Sep 2009 16:18:43 +0000

A question was raised on ActiveDir, and I learned about an old TechNet Jigsaw on AD’s interworking.

Along with that, there was a new Windows Server 2008 AD Feature Components which I received at Tech-Ed 2007 and it illustrates the new and improved AD pieces introduced with Windows Server 2008. This poster covers ADLDS, ADFS, ADRMS, and RODCs.

And an additional poster on general new Windows Server 2008 Feature Components that covers TS, NAP, IIS 7.0, Virtualization, Server Core and BitLocker.

Both of the above illustrations and very good quality large size posters (30x20in) and are good to hang in your office/cube. Printing them on regular printer may distort the quality, so you may try the plotter . All three can be downloaded from the following links :

TechNet Magazine Active Directory Component Jigsaw Poster

Windows Server 2008 Component Posters (both)

P.S This is my first test post using WLW.

Share/Bookmark

How many DFL and FFL are there now ?

Rick — Thu, 20 Aug 2009 23:00:01 +0000

As named “domain modes” in Windows 2000 time, Domain Functional Level and Forest Functional Level (introduced in Windows Server 2003) list has grown with the inception of two new Windows Server 2008 functional levels. While Domain Functional Level limits the OS of the DCs, a raise to the Forest Functional Level (in a multi-domain environment) can only be achieved after all child domains’ DFL have been met. Both Functional Levels do not dictate the type of OS you can run on your member servers. They dictate which OS can run on a DC and introduce new functionality to AD as you move up the ladder. Such as, to be able to take advantage of AD Recycle Bin functionality all your DCs must be running Windows Server 2008 R2 and the FFL must be at 2008 R2.

There are now 6 different types of Domain Functional Levels;

1. Windows 2000 Mixed (supports NT4/2000/2003 DCs)
2. Windows 2000 Native (supports 2000/2003 DCs)
3. Windows Server 2003 Interim (supports NT4/2003 DCs)
4. Windows Server 2003 (supports only 2003 DCs)
5. Windows Server 2008 (supports only 2008 DCs)
6. Windows Server 2008 R2 (supports only 2008 R2 DCs)

And five forest functional levels:

1. Windows 2000 (supports NT4/2000/2003 DCs)
2. Windows 2003 Interim (supports NT4/2003 DCs)
3. Windows Server 2003 (supports only 2003 DCs)
4. Windows Server 2008 (supports only 2008 DCs)
5. Windows Server 2008 R2 (supports only 2008 R2 DCs)

See this for list of features for different Functional Levels.

Share/Bookmark

Exchange 2010 goes Release Candidate today !

Rick — Tue, 18 Aug 2009 12:56:29 +0000

You can get an evaluation copy here.

Scott Schnoll had a great post on how to install the beta, with all the gotchas and a long list of pre-reqs.

http://blogs.technet.com/scottschnoll/archive/2009/04/15/how-to-install-exchange-server-2010.aspx

As Exchange 2010 will only run on Windows Server 2008 (64bit only), there were some known issues with the beta version with the Windows Server 2008 R2 (mainly newer builds than 7000), due to PowerShell and WinRM stacks being incompatible. That issues is well discussed here and hopefully those issues are now resolved with the RC.

http://social.technet.microsoft.com/Forums/en-US/exchange2010/thread/e73ec63f-d5f6-4c2d-8d96-51537493a0ff

And here is the system requirements list.

http://technet.microsoft.com/en-us//library/aa996719(EXCHG.140).aspx

Share/Bookmark

No RIDs for you (the RODC) !

Rick — Thu, 30 Jul 2009 00:52:16 +0000

Says the RID Master FSMO to a RODC. If you recall the RID Master’s sole job is to make sure that duplicate SIDs are not issued by domain controllers. Whenever a DC needs to create a SID, it takes the next available value from its own RID pool to create the SID with a unique value. The default pool size is 500 RIDs. When we run the RID pool test on a RODC, the test skips due to the DC being RODC and not having anything to do with the creation of the new objects.

dcdiag /v /test:ridmanager

Here is how the test is supposed to report back with the remaining pool of the allocated RIDs.

Share/Bookmark

Creating and applying a PSO with QADPasswordSettingsObject cmdlets is a snap

Rick — Fri, 01 May 2009 04:39:59 +0000

Creating an additional Password Policy (known as Password Settings Object) in Windows Server 2008 is very easy with QAD Cmdlets. Create a PSO with New-QADPasswordSettingsObject for example as shown below,

[PS] C:\Windows\System32>New-QADPasswordSettingsObject -name "Traders-Password-Policy" ` >> -passwordhistorylength 9 ` >> -passwordcomplexityenabled $true ` >> -minimumpasswordlength 7 ` >> -minimumpasswordage 1 ` >> -maximumpasswordage 15 >> ...

Name Type DN ---- ---- -- Traders-Password-Policy msDS-Passwor... CN=Traders-Password-Policy,CN=Password Settings Container,CN=System,D...

To check what other password’s attributes can be defined, see help for New-QADPasswordSettingsObject. The -appliesto parameter lets you define the PSO for a Group or individual user as well from right within the cmdlet shown above, but you can also do this.

[PS] C:\Windows\System32>Add-QADPasswordSettingsObjectAppliesTo 'traders-password-policy' -AppliesTo joe.blow

Name Type DN ---- ---- -- Joe Blow user CN=Joe Blow,OU=Users,OU=Chicago,DC=techevan,DC=lab

Unfortunately, there is no Set-QADPasswordSettingsObject cmdlet yet that lets you modify an existing PSO. You can use ADSIEDIT.msc to do that. Launch ADSIEDIT, and go to \domain node\System\Password Settings Container. Find the relevant PSO and go to its properties and make your modifications.

If you log on as the user who we just applied this PSO to in our above example, you will be notified that your password expires in 14 days. Its a great feature in Windows 7.

For more information see these links :

http://technet.microsoft.com/en-us/library/cc753481.aspx#BKMK_2

http://windowsitpro.com/article/articleid/99929/use-powershell-to-manage-fine-grained-password-policies-in-windows-server-2008.html

Share/Bookmark

What Changes in Functionality From Windows Server 2008 to Windows Server 2008 R2

Rick — Tue, 28 Apr 2009 02:23:04 +0000

Here is a useful 55 page white-paper that describes the changes in Functionality From Windows Server 2008 to Windows Server 2008 R2

Share/Bookmark

Hyper-V as a guest VM will not run guest VMs within

Rick — Wed, 22 Apr 2009 03:50:07 +0000

As expected, and just like its counterpart you can’t run guest OS, (child partitions) within Hyper-V when Hyper-V itself is installed as a guest VM. Of course there are several tweaks out there that let you modify VMkernel and supposedly let you run guest VMs in ESX environment. I have yet to come across one that does the trick for Hyper-V. Perhaps its not possible due to some substantial differences how hypervisor of Hyper-V is different than hypervisor of ESX(i) that of VMware. Greg Sheilds recently wrote in length regarding correctly explaining the difference between two products.

Rich Brambley on the other hand installed Hyper-V R2 under VMware Workstation but didn’t proceed to install VM as a guest on it, which in my opinion was against the whole purpose. You can’t really begin to play around with its feature set until you have a hand full of workloads running on it.

I gave it a spin, and I came across the “No, No, you can’t do this” issue. I have Hyper-V R2 installed as a guest on VMware Workstation 6.5.2. As posted in last post, Hyper-V is being managed via Windows Server 2008′s Hyper-V Management feature.

Share/Bookmark

PowerShell gets a facelift in Windows Server 2008 R2

Rick — Sun, 12 Apr 2009 22:57:23 +0000

A long awaited PowerShell version 2 will be released with Windows Server 2008 R2 and Windows 7 (currently both in beta). As Microsoft intends to push PoSH as the management/interactive/command driven shell, you will find the PoSH short-cut in your quick launch toolbar. In addition to what PoSH v2 has to offer such as remote management capabilites, a notable difference is the number cmdlets over version 1. PoSH v2 will have total of 235 native cmdlets where version 1 only had 129.

Watch a quick (first) screencast I did on this.

Share/Bookmark

Demoting Windows Server 2008 Domain Controller

Rick — Sat, 24 Jan 2009 06:14:26 +0000

With Windows Server 2008 having role specific snap-ins installed for each role, if you have to demote a Windows Server 2008 DC thru normal “dcpromo” command. You will notice that the DC specific roles from within the Server Manager will not be uninstalled. Even though the DC has been fully demoted, Active Directory has been uninstalled, the Server has been rebooted but the snap-ins for roles such as AD and DNS are still there (in case your DC was also a DNS). It causes a bit of nuisance as its not as if these snap-ins will serve you like “adminpak” and you could manage AD from other DCs from this member server now. As of course for that you will need the RSAT tools. See the screenshots below to see the problem and error if you try to use the snap-in, and finally see the wizards to remove the lingering roles.

Share/Bookmark

Repadmin indicates Read-Only Domain Controller in Windows Server 2008

Rick — Tue, 19 Aug 2008 01:34:24 +0000

We are all aware how helpful the repadmin tool has become (available thru Windows Support Tools in Windows Server 2003 and earlier) for troubleshooting the replication issues. In Windows Server 2008, this tool along with others come pre-packaged within the OS. You no longer have to install the Support Tools to rein in the benefits of handy command line tools such as, dcdiag, netdiag, rendom and many others.

Here is one repadmin syntax I have become used to as it gives me a snapshot of source DCs and the Destination DCs and their replication status. The command is repadmin /replsum

In above scenario there are two DCs (both Windows Server 2008) showing their latest largest delta times. The Source DC is one that changes have gone out from, where as Destination DC is one who adopted changes from other DC, hence replicated.

What needs to be noticed here is under normal circumstances both DCs would show up under Source and Destination, but since the VM08-02 is a read-only domain controller it can only grab changes from other DC and can’t replicate changes out from it. It only shows up under Destination DC and shows that it was at the receiving end of applying changes to it in terms of Active Directory replication. While read-write domain controller (RWDC) shows changes replicated out from it i.e VM08-01.

The fail/total %% and error column comes very handy when somewhere out there one of your DC has stopped talking to others or hasn’t been talked to due to an issues such is incorrect firewall settings.

Repadmin is one handy tool that all AD Admins should invest a little time learning. For more information on repadmin /showrepl command, click here.

Share/Bookmark