IgNiTeD SoUL

Problem

You want to create a quota that will apply to any new folders created on a file server.

Solution

Using a graphical user interface

Using a command-line interface

The following command will create an auto-quota on the D:\ drive based on the “DefaultAutoQuota” template:

	> dirquota autoquota /path:d:\* /sourcetemplate:"DefaultAutoQuota"

Discussion

When you create a new disk quota, by default the quota will apply only to the individual folder that you specify. By using auto-templates, you can configure a quota that will automatically be applied to any subfolders that are created beneath the folder you named in the quota definition. This is a useful setting for many scenarios, such as specifying an auto-quota for a root folder that houses your users’ home folders or roaming profiles so that any new user will receive the auto-quota by default. Every time a new subfolder is created to which an auto-quota applies, a new quota entry will be automatically created that can be viewed within the File Resource Manager.

Problem

You want to create a disk quota on a file server.

Solution

Using a graphical user interface

Using a command-line interface

The following command will create a 100 MB soft disk quota entry on the D:\ drive:

	> dirquota quota add /path:d:\* /limit:100mb /type:soft

Using VBScript

	'---------SCRIPT CONFIGURATION------------------------
	strComputer = "<ComputerName>"   ' Use "." for local computer
	strDomain = "<DomainDN>"         ' e.g. RALLENCORP
	strUser = "<UsersAMAccountName>" ' e.g. jsmith
	strDeviceID = "<DriveLetter>"    ' e.g. D:
	'-----------------------------------------------------

	Set objWMIService = GetObject("winmgmts:" _
	    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2"

	Set objAccount = objWMIService.Get _
	    ("Win32_Account.Domain=strDomain,Name=strUser")
	Set objDisk = objWMIService.Get _
	    ("Win32_LogicalDisk.DeviceID=strDeviceID")
	Set objQuota = objWMIService.Get _
	    ("Win32_DiskQuota").SpawnInstance_

	objQuota.QuotaVolume = objDisk.Path_.RelPath
	objQuota.User = objAccount.Path_.RelPath
	objQuota.Limit = 10485760
	objQuota.WarningLimit = 8388608
	objQuota.Put_

Discussion

Once you’ve created one or more quota templates, you can specify actual disk quotas that apply to folders that reside on a particular hard drive. It’s a good idea to create quotas based on templates rather than specifying them manually, since this will simplify the administration of your file server. (For example, if you need to change a quota template after it is initially created, you can specify that those template changes should be automatically propagated to any quotas that are based on that template.) Otherwise you can create a quota manually, specifying the same information as is required when creating a quota template.

Problem

You want to create and manage disk quota templates on a Windows file server.

Solution

Using a graphical user interface

Discussion

While you can create disk quotas manually, disk quota templates allow you to create consistent quota settings for multiple quotas on a single server as well as on multiple servers. In addition to the space limitation that’s imposed by the quota, you can specify whether it is a hard or a soft quotathat is, whether a user is prohibited from saving files when they’ve gone over their quota (a hard quota), or just the OS makes note of the fact that a user has overrun his quota without preventing him from saving additional files. You can also specify what types of notifications (if any) will be generated when a user exceeds a defined quota threshold: sending an email to an administrator when a user exceeds 85 percent of her quota, generating an Event Viewer message when she exceeds 95 percent, etc. You can configure multiple notification thresholds for a single quota; no notifications are configured by default.

Problem

You want to restrict who can administer your DHCP servers in your domain.

Solution

Using a graphical user interface

Using a command-line interface

Add a member to a group with DSMod by passing the -addmbr option:

	> dsmod group "<GroupDN>" -addmbr "<MemberDN>"

To add a group member with AdMod, use the following syntax:

	> admod -b "<GroupDN>" member:+:"<MemberDN>"

Remove a member from a group with DSMod by passing the -rmmbr option:

	> dsmod group "<GroupDN>" -rmmbr "<MemberDN>"

To remove a group member with AdMod, use the following syntax:

	> admod -b "<GroupDN>" member:-:"<MemberDN>"

Replace the complete membership list with DSMod by passing the -chmbr option:

	> dsmod group "<GroupDN>" -chmbr "<Member1DN Member2DN … >"

To replace the membership of a group with AdMod, use the following two commands:

	> admod b "<GroupDN>" :-
	> admod -b "<GroupDN>" member++::"<Member1DN>;<Member2DN>;<Member3DN>"

Using VBScript

	' This code adds a member to the  
DHCP  
Administrators group.
	' ------ SCRIPT CONFIGURATION ------
	strGroupDN = "<GroupDN>" ' e.g. "cn= 
DHCP Administrators,cn=Users,<DomainDN>
	strMemberDN = "<MemberDN>" ' e.g. cn=jsmith,cn=users,dc=rallencorp,dc=com
	' ------ END CONFIGURATION --------

	set objGroup = GetObject("LDAP://" & strGroupDN)
	' Add a member
	objGroup.Add("LDAP://" & strMemberDN)

	' This code removes a member from the  
DHCP Administrators group.

	set objGroup = GetObject("LDAP://" & strGroupDN)
	objGroup.Remove("LDAP://" & strMemberDN)

Discussion

Windows Server 2003 is better than its predecessors about supporting role separation. Most roles can be assigned independently of one another rather than just making a user a Domain Admin or an Enterprise Admin. This is great for security administrators who want to ensure that users have only enough rights to perform their assigned tasks. For example, a user Fred might need to modify an enterprise-wide object. You could just add Fred to the Enterprise Admin groups to solve the problem. However, Fred now has access to virtually any object in the entire forest and could cause irreparable harm to your network, not to mention compromise all security in place. Instead, you can grant Fred access to just that object.

This can be done in separate ways. One method is the “Delegation of Control” wizard. Another way is that Windows has several built-in groups that are created and populated when specific services are installed. One such group is DHCP Administrators, which is created when the first DHCP server is brought up in a domain. You can control administrative access to the DHCP function of these servers through this group membership.

Problem

You want to permit (i.e., authorize) a DHCP server to process DHCP requests from clients. This is necessary only if the DHCP server is a member of an Active Directory domain.

Solution

Using a graphical user interface

1. Open the DHCP snap-in.
2. In the left pane, right-click on DHCP and select Add Server.
3. Type in the name of the DHCP server you want to target and click OK.
4. Click on the server entry in the left pane.
5. Right-click on the server and select Authorize.

Using a command-line interface

The following command authorizes a DHCP server in Active Directory:

> netsh dhcp add server <DHCPServerName> <DHCPServerIP>

This example shows how to authorize the DHCP server named dhcp01.rallencorp.com with IP 192.168.191.15:

> netsh dhcp add server dhcp01.rallencorp.com 192.168.191.15

Using VBScript

‘ The following script prints out the list of

‘ authorized DHCP Servers in Active Directory.

‘ —— SCRIPT CONFIGURATION ——

strForestRootDN = “<ForestRootDN>” ‘ e.g. dc=rallencorp,dc=com

‘ —— END CONFIGURATION ——–

set objCont = GetObject(“LDAP://CN=DhcpRoot,CN=NetServices,CN=Services,” & _

“CN=Configuration,” & strForestRootDN)

colDHCPServers = objCont.GetEx(“dhcpServers”)

for each strDHCPServer in colDHCPServers

Wscript.Echo strDHCPServer

next

Discussion

Windows 2000 and Windows Server 2003based DHCP servers that belong to an Active Directory domain must be authorized before they can give leases to clients. This feature helps reduce the danger of a rogue Windows 2000 or Windows Server 2003 DHCP server that an end user sets up, perhaps even unintentionally.

However, this still doesn’t prevent someone from plugging in a non-Windows DHCP server (e.g., a Linksys router with the DHCP server enabled) and causing clients to receive bad leases. A rogue DHCP server can provide incorrect lease information or deny lease requests altogether, ultimately causing a denial of service for clients on your network.

If the DHCP server service is enabled on a domain controller, it is automatically authorized. A DHCP server that is a member server of an Active Directory domain performs a query in Active Directory to determine whether it is authorized. If it is, it will respond to DHCP requests; if not, it will not respond to requests.

A standalone Windows DHCP server that is not a member of an Active Directory domain sends out a DHCPINFORM message when it first initializes. If an authorized DHCP server responds to the message, the standalone server will not respond to any further DHCP requests. If it does not receive a response from a DHCP server, it will respond to client requests and distribute leases.

DHCP servers are represented in Active Directory as objects of the dhcpClass class, in the cn=NetServices,cn=Services,cn=Configuratation,<ForestRootDN> container. The relative distinguished name of these objects is the IP address of the DHCP server. There is also an object in the same container named cn=dhcpRoot, which is created after the first DHCP server is authorized. It has an attribute named dhcpServers that contains all authorized servers. We enumerated this attribute in the VBScript solution to display all authorized servers.

By default, only members of the Enterprise Admins group can authorize DHCP servers. However, you can delegate the rights to authorize a DHCP server. Do the following to delegate the necessary permissions to a group called DHCP Admins:

1. Open ADSI Edit from the Support Tools while logged on as a member of the Enterprise Admins group.
2. In the left pane, expand the Configuration Container CN=Configuration CN=Services CN=NetServices.
3. Right-click on CN=NetServices and select Properties.
4. Select the Security tab.
5. Click the Advanced button.
6. Click the Add button.
7. Use the object picker to select the DHCP Admins group.
8. Check the boxes under “Allow for Create dHCPClass objects” and “Delete dHCPClass objects.”
9. Click OK until all dialog boxes are closed.
10. Back in ADSI Edit, right-click on CN=dhcpRoot (if you’ve previously authorized DHCP Servers) and select Properties.
11. Select the Security tab.
12. Click the Advanced button.
13. Click the Add button.
14. Use the object picker to select the DHCP Admins group.
15. Check the boxes under Allow for “Write for all properties.”
16. Click OK until all dialog boxes are closed.

Using a graphical user interface

You can quickly determine whether a DHCP server has been authorized by looking at its server node in the left pane of the DHCP snap-in. If the icon has a little red flag, it isn’t authorized; if the flag is green, it is authorized.

Using a command-line interface

To see the list of authorized servers using the command line, run the following command:

> netsh dhcp show server