IgNiTeD SoUL

Tips of User accounts and Groups in Server 2008

ignitedsoul — Tue, 03 Apr 2012 15:51:43 +0000

Three types of user accounts exist in Windows Server 2008: local user accounts, domain user accounts, and built-in user accounts. Local user accounts reside on a local computer and are not replicated to other computers by Active Directory. Domain user accounts are created and stored in Active Directory and replicated to all domain controllers within a domain. Built-in user accounts are automatically created when the operating system is installed and when a member server is promoted to a domain controller.
The Administrator account is a built-in domain account that serves as the primary supervisory account in Windows Server 2008. It can be renamed, but it cannot be deleted. The Guest account is a built-in account used to assign temporary access to resources. It can be renamed, but it cannot be deleted. This account is disabled by default and the password can be left blank.
Windows Server 2008 group options include two types, security and distribution, and three scopes, domain local, global, and universal.
Domain local groups are placed on the ACL of resources and assigned permissions. They typically contain global groups in their membership list.
Global groups are used to organize domain users according to their resource access needs. Global groups are placed in the membership list of domain local groups, which are then assigned the desired permissions to resources.
Universal groups are used to provide access to resources anywhere in the forest. Their membership lists can contain global groups and users from any domain. Changes to universal group membership lists are replicated to all global catalog servers throughout the forest.
The recommended permission assignment strategy places users needing access permissions in a global group, the global group in a universal group, and the universal group in a domain local group and then assigns permissions to the domain local group.
Group nesting is the process of placing group accounts in the membership of other group accounts for the purpose of simplifying permission assignments.
Multiple users and groups can be created in Active Directory using several methods. Windows Server 2008 offers the ability to use batch files, CSVDE, LDIFDE, and WSH to accomplish your administrative goals.

Server 2008 hangs at “Applying Computer Settings”

ignitedsoul — Tue, 03 Apr 2012 15:29:42 +0000

The problems described in the symptoms section occur because of a lock on the Service Control Manager (SCM) database. As a result of the lock, none of the services can access the SCM database to initialize their service start requests. To verify that a Windows computer is affected by the problem discussed in this article, run the following command from the command Prompt:

sc querylock

The output below would indicate that the SCM database is locked:

QueryServiceLockstatus – Success
IsLocked : True
LockOwner : .\NT Service Control Manager
LockDuration : 1090 (seconds since acquired)

There is no additional information in the Event Logs beyond those from the Service Control Manager indicating that Service startup requests have timed out. The underlying root cause is a deadlock between the Service Control Manager and HTTP.SYS.

Resolution

You can modify the behavior of HTTP.SYS to depend on another service being started first. To do this, perform the following steps:

Open Registry Editor
Navigate to HKLM\SYSTEM\CurrentControlSet\Services\HTTP and create the following Multi-string value: DependOnService
Double click the new DependOnService entry
Type CRYPTSVC in the Value Data field and click OK.
Reboot the server

NOTE: Please ensure that you make a backup of the registry / affected keys before making any changes to your system.

Server 2008 Hangs at “Applying User Settings”

ignitedsoul — Tue, 03 Apr 2012 15:23:51 +0000

Issue: We had a System running Server 2008 and when it would boot it would hang with “Applying User Settings”. When it would finally load, many of the services were not started.
Diagnosis: http://support.microsoft.com/kb/2004121 – This Microsoft Article explains the issue associated with the SCM database being locked:

sc querylock
The output below would indicate that the SCM database is locked:
QueryServiceLockstatus – Success
IsLocked : True
LockOwner : .\NT Service Control Manager
LockDuration : 1090 (seconds since acquired)
Resolution: You can modify the behavior of HTTP.SYS to depend on another service being started first. To do this, perform the following steps:

Open Registry Editor
Navigate to HKLM\SYSTEM\CurrentControlSet\Services\HTTP and create the following Multi-string value: DependOnService
Double click the new DependOnService entry
Type CRYPTSVC in the Value Data field and click OK.
Reboot the server

NOTE: Please ensure that you make a backup of the registry / affected keys before making any changes to your system.

How to troubleshoot user logon issues?

ignitedsoul — Tue, 03 Apr 2012 15:06:09 +0000

User logon problems are sometimes hard to troubleshoot. Have you checked the Application log on the machine in question? There might be (most likely) some errors in there from source Userenv (ID’s 1053, 1054).
Turning on Userenv debug logging will also help in troubleshooting user logon problems. You can do this by adding a Registry key:

- Key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
- Value: UserEnvDebugLevel
- Value Type: REG_DWORD
- Value Data: 10002 (Hex)

The log will be located in: %systemroot%\debug\usermode\userenv.log.

In the log you will exactly see what happens during logon at what time. If you see a large difference between times you’ll know what part of the logon process is causing the long delay.

DNS Record Keeping

ignitedsoul — Wed, 25 Jan 2012 14:00:21 +0000

DNS keeps track of Information in Zones. Essentially, a zone is a flat-file database for a particular domain, such as www.Google.com. The zone can contain different rexord types, all of which can be queried by clients:

> A : Which i a Host Address record – this resolves a single host name. suck as www, to an IP address.

> CNAME : or Alias – This resolves a name such as www to an actual host name, such as www1. think of it as a nickname for a computer -”www”, for example, is easier to remember and more standardized than a computer name like “w4salwin” which is what a Web Server’s real name might be.

> MX : or Mail Exchanger – This provides the name of the mail server for a Domain. Multiple MX records can be provided for fault tolerance or load balancing and a prioroty assigned to each. Clients, Such as sending mail servers, will attempt to contact the server in the MX record with the lowest-Numbered Priority.

> AAAA – This maps an IPv6 IP address to a host name.

> SRV: or Service – This provides the IP address of one or more servers providing a particular service. AD uses SRV records to allow clients to locate Domain Controllers, among other things.

> SOA: or Start of Authority – This Special record indicates that the DNS Server hosting the zone is authoritative for the zone and is the primary source of name resolution for hosts within that domain.

What is the SYSVOL folder?

ignitedsoul — Mon, 23 Jan 2012 18:00:00 +0000

All active directory data base security related information store in SYSVOL folder and it’s only created on NTFS partition.

In Microsoft Windows, the System Volume (Sysvol) is a shared directory that stores the server copy of the domain’s public files that must be shared for common access and replication throughout a domain. The term SYSVOL refers to a set of files and folders that reside on the local hard disk of each domain controller in a domain and that are replicated by the File Replication service (FRS). Network clients access the contents of the SYSVOL tree by using the NETLOGON and SYSVOL shared folders.

The Sysvol folder on a Windows domain controller is used to replicate file-based data among domain controllers. Because junctions are used within the Sysvol folder structure, Windows NT file system (NTFS) version 5.0 is required on domain controllers throughout a Windows distributed file system (DFS) forest.

ReplMon

ignitedsoul — Mon, 23 Jan 2012 17:47:49 +0000

ReplMon can do the following:

See when a replication partner fails.
Display changes that have not yet replicated from a given replication partner.
Trigger the Knowledge Consistency Checker (KCC) to recalculate the replication topology.
View the history of successful and failed replication changes for troubleshooting purposes.
Find all direct and transitive replication partners on the network.
View the properties of directory replication partners.
Display the metadata of an Active Directory object’s attributes.
Poll replication partners and generate individual histories of successful and failed replication events.
Create your own applications or scripts written in Microsoft Visual Basic Scripting Edition (VBScript) to extract specific data from Active Directory.
View a snapshot of the performance counters on the computer, and the registry configuration of the server.
Generate status reports that include direct and transitive replication partners, and detail a record of changes.
Display replication topology.
Force replication.
Display a list of the trust relationships maintained by the domain controller being monitored.

Recreating Service Console networking from the command line in ESX

ignitedsoul — Fri, 06 Jan 2012 09:34:50 +0000

Issue

The Service Console loses connectivity
Due to misconfiguration of service console, the network connection fails
An additional NIC is added to ESX host

Solution

To delete and recreate a virtual switch and Service Console from the command line:

Run the following command to list the name of the vswif adapter:
esxcfg-vswif -l
Run the following command to delete the vswif adapter:
esxcfg-vswif –del vswif0
Run the following command to list the name of the vSwitch:
esxcfg-vswitch -l
Run the following command to delete the vSwitch:
esxcfg-vswitch -d vSwitch0
Run the following command to create the vSwitch:
esxcfg-vswitch -a vSwitch0
Run the following commands to create default port groups for vSwitch:
esxcfg-vswitch -A “VM Network” vSwitch0
esxcfg-vswitch -A “Service Console” vSwitch0
Run the following command to create the vswif adapter:
esxcfg-vswif –add –portgroup “Service Console” –ip=nnn.nnn.nnn.nnn –netmask=255.255.255.0 vswif0
Run the following command to verify that the settings in the network file are correct:
cat /etc/sysconfig/network

NETWORKING=yes
GATEWAYDEV=vswif0
HOSTNAME=host.domain.com
GATEWAY=nnn.nnn.nnn.nnn
Run the following commands to list all of the network adapters and associate a vmnic which has a link status of up:
esxcfg-nics -l
esxcfg-vswitch -L vmnic1 vSwitch0
Run the following command to verify that the vmnic is associated with the vSwitch:
esxcfg-vswitch -l
Ping an IP address to check for network connectivity. If the ping fails, remove the previous vmnic from the vSwitch and try another adapter that has a link status of up.
esxcfg-vswitch -U vmnic1 vSwitch0
esxcfg-vswitch -L vmnic2 vSwitch0
Run the following command to change the vlan ID of a vSwitch:
[root@server root]# esxcfg-vswitch -p “VM Network 1″ -v 10 vSwitch0
If you make any manual changes to /etc/sysconfig/network, run the following command to restart the network service:
service network restart
Done

2011 in review

ignitedsoul — Tue, 03 Jan 2012 05:39:14 +0000

The WordPress.com stats helper monkeys prepared a 2011 annual report for this blog.

Here’s an excerpt:

The concert hall at the Syndey Opera House holds 2,700 people. This blog was viewed about 10,000 times in 2011. If it were a concert at Sydney Opera House, it would take about 4 sold-out performances for that many people to see it.

Click here to see the complete report.

VM Backup – Win Server 2008 R2 & Hyper-V

ignitedsoul — Fri, 16 Dec 2011 05:38:26 +0000

VM Backup – Backing up Virtual Machines with Windows Server 2008 R2 & Hyper-V

Overview

Virtual machines are basically made of files. They contain configuration files, virtual hard disks, snapshot files and saved state files. While running computers are virtual machines can benefit from virtualization, a lot of thought needs to be taken in order to protect the contents of the virtual machines and the VMs themselves, so that if something goes wrong, you can perform a pre-defined list of steps to successfully restore the VMs to a functional and running state.

Note: To install Windows Server Backup, log on to the computer by using the local Administrator account or another account with Administrator privileges. To perform backups or recoveries by using Windows Server Backup, you must be a member of the Administrators or Backup Operators groups.

Performing the backup

To perform the actual VM backup follow these steps:

1. Open Windows Server Backup from the Administrative Tools folder. In the Actions pane, click “Backup Once” (you can, of course, create a schedule for this backup).

2. In the “Backup Options” page, select “Different Options” and click Next.

3. In the “Select Backup Configuration” page, select “Custom” and click Next.

4. In the “Select Items for Backup” page, click “Add Items“.

5. In the “Select Items” window, click to select the volumes where the VM configuration files and VM hard disks are located. Also note that while it may look possible to select individual folders, do NOT select individual folders. Only select the entire volume. Failing to select the right volumes will result in a failure for the backup procedure and even if it will seem to you that all items were backed up, in fact you will not be able to restore your VMs. Click Ok.

6. Back in the “Select Items for Backup” page, click “Advanced Settings“.

7. In the “Advanced Settings” window, click to select “VSS Full Backup” and click Ok.

8. Back in the “Select Items for Backup” page, click Ok.

9. In the “Specify Destination Type” page, select the destination for the backup. I chose Local Drives, but you can also perform the backup on remote shares. Click Next.

10. In the “Select Backup Destination” page, use the drop-down list to select your destination. If you plan to backup on an external USB drive, make sure the computer recognizes it before you get to this spot. Also make sure that the destination volume contains enough free disk space for the backup to be place in. Remember that volume level backup are ALWAYS full, therefore if you’ve got 500 GB worth of VMs in one volume, you’ll need to have as much space as that (and preferably more) on your destination volume. Click Ok.

11. In the “Confirmation” page click Backup and let the backup procedure begin.

12. If you immediately switch to the Hyper-V management console, you’ll see that the VMs are being snapshotted. This is not equivalent to taking a Hyper-V snapshot, which in fact is not really a true snapshot and has nothing in relation to VSS snapshots. Because the VSS writer was registered, and because the Integration Services (Components) are installed and enabled on the VMs, they will be successfully backed up without being paused, saved or turned off. In addition, the ICs will inform the VMs that a backup procedure is taking place on the parent partition, so any VSS-aware application that is running inside the VM will also be triggered (which is very important for applications such as SQL, Exchange and so on).

13. Windows Server Backup begins to write the file(s) to disk.

14. When finished, click Close.

Summary

Backing up virtual machines can be a little different than backing up a traditional system. Because a virtual machine is nothing more than a collection of files, it is important to be especially mindful of the backup process. One oversight along the way can mean a failed VM backup. Hopefully this article has prepared you to backup your Virtual Machines with Hyper-V using Windows Server Backup.

Source: Petri