Posts Tagged ‘Active Directory’

Metadata Cleanup of Domain Controllers

Posted: September 13, 2012 in Active Directory, Domain Controller, Server, Server 2003, Server 2008
Tags: , , , , , , ,
0

Metadata Cleanup of Domain Controllers

 

Note: You must try the below steps only when the Graceful demoting of the server fails from “DCPROMO”

Note: You may get a error while demoting if you have a forest with 2003 and 2008 mixed Domain Controllers.

          : Some of the errors will be like: LDAP Error 0x32<50<Insufficient rights> or: Win32 error returned is 0x5<Access is Denied>

          : There is a easy steps to demote if you have the error. (Will be posting it soon)

Scenario:

–          Server1 should be demoted from XYZ Domain.

–          ABC.XYZ.com is the primary Domain Controller in the Domain.

–          We have total of 3 sites in the whole network, Site1, Site2 & Site3

–          The plan is to Demote Server1 hosted in Site3

–          Login to any of the Domain Controllers and follow the below steps

Note: Words marked in BLUE are the entries which should be input by you.

Open the Command Prompt from the server and run the below commands:

C:\>ntdsutil

ntdsutil: metadata cleanup

metadata cleanup: connections

server connections: connect to server ABC

Binding to ABC …

Connected to ABC using credentials of locally logged on user.

server connections: quit

metadata cleanup: select operation target

select operation target: list domain

Found 1 domain(s)

0 – DC=XYZ,DC=com

select operation target: select domain 0

No current site

Domain – DC=XYZ,DC=com

No current server

No current Naming Context

select operation target: list sites

Found 3 site(s)

0 – CN=Site1,CN=Sites,CN=Configuration,DC=XYZ,DC=com

1 – CN=Site2,CN=Sites,CN=Configuration,DC=XYZ,DC=com

2 – CN=Site3,CN=Sites,CN=Configuration,DC=XYZ,DC=com

select operation target: select site 3

Site – CN=Site3,CN=Sites,CN=Configuration,DC=XYZ,DC=com

Domain – DC=XYZ,DC=com

No current server

No current Naming Context

select operation target: list servers in site

Found 2 server(s)

0 – CN=Server1,CN=Servers,CN=Site3,CN=Sites,CN=Configuration,DC=XYZ,DC=com

1 – CN=Server2,CN=Servers,CN=Site3,CN=Sites,CN=Configuration,DC=XYZ,DC=com

select operation target: select server 0

Site – CN=Site3,CN=Sites,CN=Configuration,DC=XYZ,DC=com

Domain – DC=XYZ,DC=com

Server – CN=Server1,CN=Servers,CN=Site3,CN=Sites,CN=Configuration,DC=XYZ,DC=com

DSA object – CN=NTDS Settings,CN=Server1,CN=Servers,CN=Site3,CN=Sites,CN=Configuration,DC=XYZ,DC=com

DNS host name – Server1.XYZ.com

Computer object – CN=Server1, OU=Domain Controllers,DC=XYZ,DC=com

No current Naming Context

select operation target: quit

metadata cleanup: remove selected server

Transferring / Seizing FSMO roles off the selected server.

Removing FRS metadata for the selected server.

Searching for FRS members under “CN=Server1, OU=Domain Controllers,DC=XYZ,DC=com”.

Removing FRS member “CN=Server1,CN=Domain System Volume (SYSVOL share),CN=File Replication Service,CN=System,DC=XYZ,DC=com”.

Deleting subtree under “CN=Server1,CN=Domain System Volume (SYSVOL share),CN=File

Replication Service,CN=System,DC=XYZ,DC=com”.

Deleting subtree under “CN=Server1, OU=Domain Controllers,DC=XYZ,DC=com”.

The attempt to remove the FRS settings on CN=Server1,CN=Servers,CN=Site3,CN=Sites,CN=Configuration,DC=XYZ,DC=com failed because “Element not found.”;

metadata cleanup is continuing.

“CN=Server1,CN=Servers,CN=Site3,CN=Sites,CN=Configuration,DC=XYZ,DC=com” removed from server “ABC”

metadata cleanup: quit

ntdsutil: quit

Disconnecting from ABC…

Now you should be able to see “ntdsutil” missing from the Active Directory Sites and Services from the particular Site.

Advertisement

Procedure to Restore the System State Backup

Posted: September 13, 2012 in Active Directory, Backup, Server, Server 2008
Tags: , , , ,
1

Procedure to Restore the System State Backup:

  1. Click Start, point to All Programs, point to Accessories, point to System Tools, and then click Backup. The Backup or Restore Wizard starts.
  2. Click Advanced Mode.
  3. Click the Restore and Manage Media tab.
  4. In the Items to restore box, expand the media that you want to restore, and then click to select the System State check box.
  5. In the Restore file tobox, specify the location where you want to restore the files by doing one of the following:
    • If you want to restore the files or folders to the same location in which they were when you backed up the data, click Original location, and then go to step 7.
    • If you want to restore the files or folders to a new location, click Alternate location.
      This option preserves the folder structure of the backed up data.
    • If you want to restore the files and folders to a single location, click Single folder.NOTE: If you do not designate an alternate location for the restored data, the restore operation erases the current system state data and replaces it with the information that you are restoring.
  6. If you selected Alternate location or Single folder, type the location in which you want the data to be restored, or click Browse and select the location.
  7. Click Start Restore.
  8. On the Confirm Restore page that appears, click Advanced if you want to set advanced restore options, and then click OK.
  9. Click OK to start the restore operation.

Role of Global Catalog Server in a Domain

Posted: September 10, 2012 in Active Directory, DNS, Domain Controller, Server, Server 2003, Server 2008
Tags: , , , , ,
0

By Default a Global Catalog is created automatically on the initial Domain Controller in the forest. It stores a full replica of all the objects in the directory for its host domain and a partial replica of all objects contained in the directory of every other domain in the forest. The replica is partial because it stores some, but not all, of the property values for every object in the forest.

The Global Catalog performs two key directory roles:

–  It enables network logon by providing universal group membership information to a domain controller when a logon process is initiated.

–  It enables finding directory information in the entire forest regardless of which domain in the forest actually contains the data.

When a user logs in to the network, the global catalog provides universal group membership information for the account sending the logon request to the domain controller. If there is only one domain controller in the Domain, the domain controller and the global catalog are the same server. If there are multiple domain controllers in the network, the global catalog is hosted on the domain controller configured as such. If a Global Catalog is not available when a user initiates a network logon process, the user is only able to log on to the local computer.

Note: If a user is a member of the Domain Admins group, then they will be able to log on to the network even when the Global Catalog is not available.

The Global Catalog is designed to respond to queries about objects anywhere in the forest with maximum speed and minimum network traffic, because a single Global Catalog contains information about objects in all domain in the forest, a query about an object can be resolved by a global catalog in the domain in which the query is initiated. Thus finding the information in the directory does not produce unnecessary query traffic across domain boundaries.

You can optionally configure any domain controller to host a global catalog, based on your Company’s requirements for servicing logon requests and search queries.

After Additional domain controllers are installed in the domain, you can change the default location of the global catalog to another domain controller using the Active Directory Sites and Services.

 

How do you view replication properties for AD partitions and DCs?

Posted: September 6, 2012 in Active Directory, Replication, Server, Server 2003, Server 2008
Tags: , , ,
0

 

By using replication monitor 

Go to start > run > type repadmin

Go to start > run > type replmon

The Replmon graphical user interface (GUI) tool is included when you install Windows Server 2003 Support Tools from the product CD or from the Microsoft Download Center

Replmon.exe: Active Directory Replication Monitor

This GUI tool enables administrators to view the low-level status of Active Directory replication, force synchronization between domain controllers, view the topology in a graphical format, and monitor the status and performance of domain controller replication.

The Replmon graphical user interface tool was removed from Windows Server 2008 and later. Repadmin is still available for troubleshooting replication.

Repadmin.exe: Replication Diagnostics Tool

This command-line tool assists administrators in diagnosing replication problems between Windows domain controllers.

Administrators can use Repadmin to view the replication topology as seen from the perspective of each domain controller. In addition, Repadmin can be used to manually create the replication topology, to force replication events between domain controllers, and to view both the replication metadata and up-to-date vectors.

Repadmin.exe can also be used for monitoring the relative health of an Active Directory forest. The operations replsummary, showrepl, showrepl /csv, and showvector /latency can be used to check for replication problems.

 

What Are Site Links?

Posted: August 28, 2012 in Active Directory, DNS, Replication, Server 2003, Server 2008
Tags: , , , , ,
0

Introduction

In order for two sites to exchange replication data, they must be connected by a site link. A site link is a connection that enables replication traffic to travel between sites. Site links represent the physical connections available between sites.

 

Why to create Site Link?

When you create additional sites, you must select at least one site link for each site. Unless a site link is in place, connections cannot be made between computers at different sites, and replication between sites cannot take place. Additional site links are not created automatically; you must use Active Directory Sites and Services to create them.

 

Default Site Link

When you create the first domain in a forest, a default site link named DEFAULTIPSITELINK is also created. It includes the first site, and is located in the IP container in Active Directory. The site link can be renamed.

 

Site link attributes

When you create a site link, you must select the transport protocol it will use, give it a name, and add two or more sites to it. The sites are then connected. The characteristics of this connection are determined by the site link attributes, which can be configured. The connection characteristics are configured on the link, so all sites connected by a single site link will use the same replication path and transport. Configuring site link attributes is one part of configuring replication between sites. Site link attributes determine the characteristics of the connection in terms of the cost, frequency of replication traffic, and the protocols used.

 

Site link cost

Site link cost is a dimensionless number that represents the relative speed, reliability and preference of the underlying network. The lower the site link cost, the higher the priority for that link. For example, your organization has a site in Denver and a site in Paris with two connections between them: a high-speed connection and a dial-up connection in case the high-speed connection fails. You would configure two site links, one for each connection. Because the high-speed connection is preferable to a dial-up connection, you would configure the site link representing it with a lower cost than the site link for the dial-up line. Because the site link representing the high-speed connection has a lower cost, it has a higher priority, and that site link will always be used if possible. Setting site link cost enables you to determine the relative priority for each site link. The default cost value is 100, with possible values from one to 99999.

 

Site link replication Schedule

Replication schedule is another site link attribute that can be configured. When you configure the link’s schedule, you specify the times when the link is available for replication. Often, replication availability is configured for times when there is little other network traffic, for example from 1:00 A.M. to 4:00 A.M. The fewer hours a link is available for replication, the greater the latency between sites that are connected by that link. The need to have replication occur at off-peak hours should be balanced against the need for up-to-date information at each site connected by the link.

 

Site link replication frequency

When you configure the frequency of replication, you specify how many minutes Active Directory should wait before using the link to check for updates. The default value for replication frequency is 180 minutes, and the value you choose must fall between 15 minutes and one week. Replication frequency only applies to the times when the link is scheduled to be available. Longer intervals between replication cycles reduce network traffic and increase the latency between sites. Shorter intervals increase network traffic and decrease latency. The need to reduce network traffic should be balanced against the need for up-to-date information at each of the sites connected by the link.

 

Site link transport protocols

A transport protocol is a common language shared by computers to communicate during replication. Within a single site, there is only one protocol used for replication. When you create a site link, you must choose to use one of the following transport protocols:

1. Remote procedure call (RPC) over IP. RPC is an industry standard protocol for client/server communications, and provides reliable, high speed connectivity within sites. Between sites, RPC over IP enables replication of all Active Directory partitions. RPC over IP is the best transport protocol for replication between sites.

2. Simple mail transfer protocol (SMTP). SMTP supports intersite and interdomain replication of the schema, configuration, and global catalog. This protocol cannot be used for replication of the domain partition. This is because some domain operations, for example Group Policy, require the support of the File Replication service (FRS), which does not support an asynchronous transport for replication. If you use SMTP, you must install and configure a certificate authority to sign the SMTP messages and ensure the authenticity of directory updates. Additionally, SMTP does not provide the same level of data compression that RPC over IP enables.

 

SITES in Active Directory

Posted: August 28, 2012 in Active Directory, Domain Controller, Server, Server 2003, Server 2008
Tags: , , , , , , , ,
2

Introduction

Replication ensures that all information in Active Directory is current on all domain controllers and client computers across your entire network. Many networks consist of a number of smaller networks, and the network links between these networks may operate at varying speeds. Sites in Active Directory enable you to control replication traffic and other types of traffic related to Active Directory across these various network links. You can use subnet objects, site links, and site link bridges to help control the replication topology when configuring replication between sites. An efficient, reliable replication topology depends on the configuration of site links and site link bridges.

 

What Are Sites and Subnet Objects?

 

Introduction

You use sites to control replication traffic, logon traffic, and requests to the Global Catalog server.

 

Sites

In Active Directory, sites help define the physical structure of a network. A site is defined by a set of Transmission Control Protocol/Internet Protocol (TCP/IP) subnet address ranges. Sites are used to define a group of domain controllers that are well-connected in terms of speed and cost. Sites consist of server objects, which contain connection objects that enable replication.

 

Subnet Objects

The TCP/IP subnet address ranges are represented by subnet objects that group computers. For example, a subnet object might represent all the computers on a floor in a building, or on a campus. Subnet objects are associated with sites and, because the subnet objects map to the physical network, so do the sites. For example, if you have three subnets that represent three campuses in a city, and these campuses are connected by high-speed, highly available connections, you could associate each of those subnets with the same site. A site can consist of one or more subnets. For example, on a network with three subnets in London and two in Boston, the administrator can create a site in London, a site in Boston, and then add the subnets to the respective sites.

 

Default Site

A default site is set up automatically when you install Windows Server on the first domain controller in a forest. This site is called Default-First-Site- Name. This site can be renamed. When you create your first domain in a forest it is automatically placed in the default site.

GLOBAL CATALOG SERVER

Posted: August 28, 2012 in Active Directory, DNS, Domain Controller, Server, Server 2003, Server 2008
Tags: , , , , ,
2

Introduction

A global catalog server is a domain controller that stores two forest-wide partitions, schema and configuration, a read/write copy of the partition from its own domain, and also a partial replica of all other domain partitions in the forest. These partial replicas contain a read-only subset of the information in each domain partition.

 

How does replication affect the global catalog server?

When a new domain is added to a forest, the information about the new domain is stored in the configuration partition, which is replicated to all domain controllers, including global catalog servers, through normal forest-wide replication. Then each global catalog server becomes a partial replica of the new domain by contacting a domain controller for that domain and obtaining the partial replica information. The configuration partition also contains a list of all global catalog servers in the forest and provides this information to the domain controllers. Global catalog servers register special DNS records in the DNS zone that correspond to the Forest Root domain. These records, which are registered only in the Forest Root DNS zone, help clients and servers locate global catalog servers throughout the forest.

Automatic Generation of Replication Topology

Posted: August 24, 2012 in Active Directory, DNS, Server, Server 2003, Server 2008
Tags: , , , , , , ,
0

Introduction

When you add domain controllers to a site, Active Directory uses the Knowledge Consistency Checker (KCC) to establish a replication path between domain controllers.

 

What is Knowledge Consistency Checker?

The KCC is a built-in process that runs on each domain controller and generates the replication topology for all directory partitions contained on that domain controller. The KCC runs at specified intervals (every 15 minutes by default) and designates replication routes between domain controllers that are the most favorable connections available at the time.

 

How KCC works?

To automatically generate a replication topology, the KCC evaluates information in the configuration partition on sites, the cost of sending data between these sites, any existing connection objects, and the replication protocols that can be used between the sites. Next, the KCC calculates the best connections for a domain controller’s directory partitions to other domain controllers. Additionally, if replication within a site becomes impossible or has a single point of failure, the KCC automatically establishes new connection objects between domain controllers to maintain Active Directory replication.

Sites and Directory Replications

Posted: August 24, 2012 in Active Directory, DNS, Server, Server 2003, Server 2008
Tags: , , , ,
4

Partitions:-

Introductions

The Active Directory database is logically separated into directory partitions, a schema partition, a configuration partition, domain partitions, and application partitions. Each partition is a unit of replication, and each partition has its own replication topology. Replication is performed between directory partition replicas. All domain controllers in the same forest have at least two directory partitions in common: the schema and configuration partitions. All domain controllers in the same domain, in addition, share a common domain partition.

 

Schema Partition:

There is only one schema partition per forest. The schema partition is stored on all domain controllers in a forest. The schema partition contains definitions of all objects and attributes that can be created in the directory, and the rules for creating and manipulating them. Schema information is replicated to all domain controllers in the forest, so all objects must comply with the schema object and attribute definitions.

 

Configuration Partition:

There is only one configuration partition per forest. The configuration partition is stored on all domain controllers in a forest. The configuration partition contains information about the forest-wide Active Directory structure, including what domains and sites exist, which domain controllers exist in each, and which services are available. Configuration information is replicated to all domain controllers in a forest.

 

Domain Partition:

There can be many domain partitions per forest. The domain partitions are stored on all of the domain controllers of the given domain. A domain partition holds information about all domain-specific objects created in that domain, including users, groups, computers, and organizational units. The domain partition is replicated to all domain controllers of that domain. All objects in every domain partition in a forest are stored in the Global Catalog with only a subset of its attribute values.

 

REPLICATIONS:

The replication process occurs between two domain controllers at a time. Over time, replication synchronizes information in Active Directory for an entire forest of domain controllers. To create a replication topology, Active Directory must determine which domain controllers replicate data with other domain controllers.

 

DNS Forwarders

Posted: July 6, 2012 in Active Directory, Domain Controller, Server 2003, Server 2008, System Information
Tags: , , , ,
1

If a DNS Server does not have an entry in its database for the remote host specified in a client request, it can respond to the client with the address of a DNS Server more likely to have that information, or it can query the other DNS server itself. This process can take place recursively until either the client computer receives the IP address or the DNS server establishes that the queried name cannot be resolved. DNS Servers to which other DNS Servers forward requests are known as Forwarders.

The Windows 2008 DNS Server service extends the standard forwarder configuration by using conditional forwarders. A Conditional Forwarder is a DNS Server that forwards DNS Query according to the DNS domain name in the query. For example, you can configure a DNS server to forward all the queries that it receives for names ending with Ignitedsoul.com to the IP address of one or more specified DNS Servers. This feature is particularly useful on extranets, where several organizations and domains access the same private internetwork.

Other Posts Related to DNS:

https://ignitedsoul.com/2012/01/25/dns-record-keeping/

 

Older Entries
Newer Entries