Thursday, March 28, 2013
Wednesday, March 6, 2013
Upgrading an Active Directory Domain from Windows Server 2008 or Windows Server 2008 R2 to Windows Server 2012
Upgrading an Active Directory Domain from Windows Server 2008 or Windows Server 2008 R2 to Windows Server 2012
!!!NEVER START BEFORE HAVING CREATED AND TESTED A BACKUP OF YOUR DOMAIN/DATA/MACHINE!!!
A new OS Domain Controller installation should always start with use from the support tools to check the Domain and Domain Controllers for errors that must be resolved before. The following command line tools and programs will help you to verify if some problems exist within your Domain and the Domain Controllers.
Dcdiag /v /c /d /e /s:DCName >c:\dcdiag.log [please replace DCName with your Domain Controller name]
Repadmin /showrepl dc* /verbose /all /intersite >c:\repl.log ["dc* is a place holder for the starting name of the DCs if they all begin the same (if more than one DC exists)]
Dnslint /ad /s "DCipaddress" [use http://support.microsoft.com/kb/321045 for download and instructions]
ADREPLSTATUS: http://www.microsoft.com/en-us/download/details.aspx?id=30005
--------------------------------------------
On the old server open DNS management console and check that you are running Active directory integrated zones, which is recommended also from Microsoft.
--------------------------------------------
The Schema must be updated for the new OS Domain Controller, so even if the update is done automatically you may check it before. Therefore you can use the following command:
"Dsquery * cn=schema,cn=configuration,dc=domain,dc=local -scope base -attr objectVersion" without the quotes in a command prompt [please replace “dc=domain,dc=local” with your Domain Name]. The output number is the Schema objectVersion:
13 = Windows 2000 Server
30 = Windows Server 2003
31 = Windows Server 2003 R2
44 = Windows Server 2008
47 = Windows Server 2008 R2
56 = Windows Server 2012
--------------------------------------------
If the first installed Domain Controller in the domain should be removed or replaced with another one, doesn’t matter if new or same OS version, assure that you export the recovery agents EFS certificate private key from the Domain Controller BEFORE you demote/retire it. Details on how to do this are listed in (http://support.microsoft.com/kb/241201) and (http://technet.microsoft.com/en-us/library/cc755157(WS.10).aspx). If you don’t save it, you will not be able to encrypt data in case of problems.
--------------------------------------------
I recommend installing the new machine as a member server in your existing domain before promoting to Domain Controller. Configure a fixed ip address and set the preferred DNS server to one existing DC/DNS server only. Do not change anything with IPv6, as also recommended from Microsoft in http://technet.microsoft.com/en-us/magazine/2009.07.cableguy.aspx
Do NOT use the new server as DNS server on the NIC until all DNS information is replicated from one existing DC/DNS. If you do it with other DNS servers on the NIC I often have seen that the SYSVOL and NETLOGON shares are not correct created.
--------------------------------------------
As this article applies in most steps to Windows Server 2008 32bit/64bit and Windows Server 2008 R2, I’ll start with the difference on Windows Server 2008 32bit preparation.
To install a new OS Domain Controller adprep is required and located in the Windows server 2012 installation disk …\support\adprep folder. Here you can also find the schema files. You will realize that there is ONLY adprep.exe and not adprep32.exe anymore. This belongs to the reason that adprep process on earlier OS domains is done automatically during promotion to DC.
If you run adprep.exe on the 32bit OS Domain Controller you will see an error message:
So on Windows Server 2008 32bit you have to prepare the forest/domain with the new way remote from Windows Server 2012.
With the 64bit version from adprep you can still work on Windows Server 2008 64bit and Windows Server 2008 R2 DCs for the Schema update.
So both options are possible, from the command line on Windows Server 2008 R2 or during promotion process from the Windows Server 2012.
--------------------------------------------
The minimum functional level must be at least Windows Server 2003, so NO lower functional levels are allowed anymore.
Please control that the Domain functional level is set to Windows Server 2003, in AD Domains and Trusts right click the "Domain Name".
Also control that the Forest functional level is set to Windows Server 2003, in AD Domains and Trusts right click “Active Directory Domains and Trusts”.
--------------------------------------------
If you run as known before DCPROMO on a new Windows Server 2012 you will get an error message as this is not longer the way to promote a DC. Now the promotion to Domain Controller is done via Server Manager.
--------------------------------------------
In this article I will focus on the new remote way with using the Windows Server 2012, as this is much more error free and comfortable to use.
Assure to use an account that is member of the Enterprise Admins and install the new Windows Server 2012 as Domain Member Server if not done already. Now start the Server Manager and choose “Add roles and features”, in “Before you begin” click next, in the “Installation Type” use “Role-based or feature-based installation” and click Next.
Choose the required Server and click Next
Now check the Active Directory Domain Services and in the upcoming window click the “Add features” button.
Choose Next and add additional features if required.
Click Next.
Click Next and then choose Install.
It may take some time, depending on the hardware.
If the installation is done be aware of the “Promote this server to a domain controller” option in the result pane
Again a new window opens to configure the DC with all requirements
Here choose Select and provide the domain credentials or use the already shown account. If you have the need using a smart card, then the server MUST be joined to the domain BEFORE.
Select the domain from the list and click OK.
Click Next.
The Domain controller Options appear and here choose DNS and GC and fill in the DSRM Restore mode password. Then choose Next.
In this step the DNS delegation warning can be ignored, as the Domain Controller is for the already existing domain.
Choose Next and either use the default or select a preferred DC to replicate from. Even IFM (Install from media) is possible at this step.
Do NOT store the Active Directory database, log files, or SYSVOL on a data volume formatted with Resilient File System (ReFS), this is new with Windows Server 2012. Database, Log file and SYSVOL folder paths must be stored on NTFS data volumes in this window and then choose Next.
Information about forest, schema and domain update is shown where you also choose Next.
Review your settings, even possible to export as Windows PowerShell script for future use and click Next.
Prerequisite checks will be done.
Review the Check and click Install.
Results are listed/shown
The server automatically reboots after installation/promotion.
--------------------------------------------
After adding a Windows Server 2012 Domain Controller to an existing domain you should also transfer the FSMO roles to the newest Domain Controller
In this case 6 new security groups are created in the BUILTIN container in AD UC:
- Access Control Assistance Operators
- Hyper-V Administrators
- RDS Endpoint Servers
- RDS Management Servers
- RDS Remote Access Servers
- Remote Management Users
And 1 new security group in the Users container in AD UC:
- Cloneable Domain Controllers
--------------------------------------------
You can see in the event viewer (Directory service log) that the FSMO roles are transferred, EVENT ID 1458 with the source ActiveDirectory_DomainService for each FSMO role.
--------------------------------------------
After the transfer from the PDCEmulator FSMO it is required to reconfigure the time service on the old and new PDCEmulator, so a recommended external time source is used:
"w32tm /config /manualpeerlist:PEERS /syncfromflags:manual /reliable:yes /update”
where PEERS will be filled with the ip address or server (time.windows.com) and on the OLD PDCEmulator run:
"w32tm /config /syncfromflags:domhier /reliable:no /update”
and stop/start the time service on the old one. All commands run in an elevated command prompt without the quotes.
--------------------------------------------
If not done on earlier OS version upgrades run ONLY the adprep /domainprep /gpprep, to enable the RSOP planning mode, manual as this is NOT involved in the automated process.
--------------------------------------------
Reconfigure the DNS configuration on your NIC of the Windows Server 2012 machine, preferred DNS itself, secondary another Domain DNS server and as recommended from DNS BPA the loopback ip address (127.0.0.1) as 3rd entry.
--------------------------------------------
Windows 8 Keyboard Shortcut-
There are some many Windows 8 Keyboard Shortcuts.
1. Windows Key + C: Brings up Charms menu
2. Windows Key + X: Brings up a menu of advanced system options
3. Windows Key + I: Brings up the settings menu for current application
4. Windows Key + Q: Brings up the apps search menu
5. Windows Key + D: Brings up desktop mode.
6. Windows Key + Tab: Brings up Task Switcher
7. Windows Key + H: Brings up Share menu for current application
8. Windows Key + M: Brings up desktop mode and minimizes all other windows.
9. Windows Key + W: Brings up universal search menu
10. Windows Key + F: Brings up universal search menu and allows you to search files
11. Windows Key + R: Brings up Run menu
12. Windows Key + E: Brings up File Explorer
13. Windows Key +Number Key (1-9): Brings up to desktop mode and allows you to make the nth application on the task bar active. N will be the number key you will hit.
14. Windows Key +. (Period key): Allow you to dock current Windows 8-style app left/ right
15. Windows Key + Z: Brings up app menu
1. Windows Key + C: Brings up Charms menu
2. Windows Key + X: Brings up a menu of advanced system options
3. Windows Key + I: Brings up the settings menu for current application
4. Windows Key + Q: Brings up the apps search menu
5. Windows Key + D: Brings up desktop mode.
6. Windows Key + Tab: Brings up Task Switcher
7. Windows Key + H: Brings up Share menu for current application
8. Windows Key + M: Brings up desktop mode and minimizes all other windows.
9. Windows Key + W: Brings up universal search menu
10. Windows Key + F: Brings up universal search menu and allows you to search files
11. Windows Key + R: Brings up Run menu
12. Windows Key + E: Brings up File Explorer
13. Windows Key +Number Key (1-9): Brings up to desktop mode and allows you to make the nth application on the task bar active. N will be the number key you will hit.
14. Windows Key +. (Period key): Allow you to dock current Windows 8-style app left/ right
15. Windows Key + Z: Brings up app menu
**********
Folder Lock Without Using Any Software :-Folder Security Hide and Lock
Folder Lock Without Using Any Software
Lock your personal Folder with out using any Software; Its Batch (*.bat ) File Trick
Exactly Copy paste it In Note pad and save it as a Batch File
cls @ECHO OFF title Folder Locker if EXIST "Control Panel.{21EC2020-3AEA-1069-A2DD-08002B30309D}" goto UNLOCK if NOT EXIST Locker goto MDLOCKER :CONFIRM echo Are you sure u want to Lock the folder(Y/N) set/p "cho=>" if %cho%==Y goto LOCK if %cho%==y goto LOCK if %cho%==n goto END if %cho%==N goto END echo Invalid choice. goto CONFIRM :LOCK ren Locker "Control Panel.{21EC2020-3AEA-1069-A2DD-08002B30309D}" attrib +h +s "Control Panel.{21EC2020-3AEA-1069-A2DD-08002B30309D}" echo Folder locked goto End :UNLOCK echo Enter password to Unlock folder set/p "pass=;" if NOT %pass%== type your password here goto FAIL attrib -h -s "Control Panel.{21EC2020-3AEA-1069-A2DD-08002B30309D}" ren "Control Panel.{21EC2020-3AEA-1069-A2DD-08002B30309D}" Locker echo Folder Unlocked successfully goto End :FAIL echo Invalid password goto end :MDLOCKER md Locker echo Locker created successfully goto End :End |
- Exactly Copy paste it In Note pad and save it as a Batch File
Save as Locker.bat(Save as OPtion choose all files -filename.bat) - Double click on batch file you have created and you will see a new folder on your desktop or saved location called “Locker”
- Now add the files you want to be locked in that folder.
- Double click on batch file you have created again, and it will ask you if you want to hide the folders
- Type Y For Yes. The folder will be locked and hidden.
- To unhide, double click batch file you have created , type in your password and press enter…
Monday, March 4, 2013
How to Join Domain using djoin -Offline Mode
Join a Client PC to Domain -Offline Mode-
how to Join Domain using djoin -Offline
Windows Server 2008 R2 and Windows 7 introduce a new option for joining computers to a domain, called offline domain join.
As the name of the feature suggests, offline domain join allows you to join a server or client to the domain even if the computer does not
have network connectivity or cannot currently contact a domain controller.
have network connectivity or cannot currently contact a domain controller.
the syntax of djoin is
djoin.exe /provision /domain DomainDNSName /machine ComputerName /savefile Filename
On Domain Controller open a command prompt and type the following command
djoin.exe /provision /domain MYDOMAIN.COM /machine PC-1 /savefile test.txt
copy the saved file to client machine and run the following command in client machine (open command prompt as run as administrator)
djoin.exe /requestODJ /loadfile test.txt /windowspath %SystemRoot% /localos
where:
blob. This is the file that you created by using Djoin.exe /provision.
Windows is installed. Alternately, you can use the variable %WinDir%.
computer.
How to block some applications using group policy
How to block some applications using group policy(*.exe block)
Domain Controller Level Blocking
Start-- Run
Gpmc.msc
Expand User configuration
Click System
On right side open “Don’t run specified windows application”
Click “Enable” then add the specified applications
DoubleClick -Dont Run Specific Windows Apps--
can Add any .exe files like portable ultrasuft some version is -u1210.exe so this will not work . like winword.exe/EXCEL.exe any...
Click System
On right side open “Don’t run specified windows application”
Click “Enable” then add the specified applications
DoubleClick -Dont Run Specific Windows Apps--
can Add any .exe files like portable ultrasuft some version is -u1210.exe so this will not work . like winword.exe/EXCEL.exe any...
How to use GPO to Allow or Block Website or URL- Domain Controller Group Policy
we will be using Windows Server 2008 server, the procedure that you are about to read will be similar to Windows Server 2003 R2 and Windows Server 2012 GPOs.
Open up the Group Policy Management Editor
RUN--> GPMC.MSC
(Click on Start and typeGroup Policy Management in search program files box, click on the top item) and locate the Organizational Unit (OU), expand User Configuration, expand Windows Settings, expand Internet Explorer then click on Security and double click Security Zones and Content Ratings.
On Security and Privacy Settings properties, under Content Ratings select Import the current Content Ratings settings, then click on Modify Settings, click on OK to save.
On Content Advisor properties, click on Approved Sites tab, in Allow this website you may select Always, to Allow a website, click on OK to save.
or choose Never to block a website then click on OK to save.
Subscribe to:
Posts (Atom)