Metadata cleanup over GUI

 

Sometimes we have problem with broken Domain Controller(s) within our environment. Then we do not think about consequences from removing failed DC from network. We just shut it down and replace with the new one, because mostly we have no system state backup of the old Domain Controller. Everything looks fine for us, we have no failed DC in a network. But Active Directory still knows about it and uses that DC for AD data replication which can cause errors.

To prevent replicating data between broken DC and the rest, you need to perform metadata cleanup.

This can be done using ntdsutil as I showed you some time ago in this article Metadata cleanup for broken Domain Controller or over graphical console – using Active Directory Users and Computers.

You still need to have Domain Admin account to do that and at least one Windows Server 2008 Domain Controller.

I will show you how to do that using Windows Server 2012 R2 Domain Controller but this is exactly the same procedure on previous servers.

To remove metadata about non-existing Domain Controller, log on to Windows Server 2008 or newer DC and open Active Directory Users and Computers console.

Click right mouse button (RMB) on start tile and choose “Run”

Execute run box

Execute run box

and type dsa.msc to open Active Directory Users and Computers console

Opening Active Directory Users and Computers console

Opening Active Directory Users and Computers console

Now, you need to go into main menu and search for “View -> Advanced features” option and select it

<a href="http://kpytko.pl/wp-content/uploads/2015/01/0031 go to this site.png”>Selecting advanced features for ADUC console

Selecting advanced features for ADUC console

Now, go to “Domain Controllers” organizational unit and select Domain Controller for which you want to do metadata cleanup

Selection of Domain Controller to remove

Selection of Domain Controller to remove

Click on it RMB and choose “Properties

Properties of broken Domain Controller

Properties of broken Domain Controller

You need to check if this computer object is not protected by accidental deletion from domain environment. To see that, select “Object” tab. Looks if “Protect object from accidental deletion” is set. If so, uncheck it and apply changes.

Protect from accidental deletion check

Protect from accidental deletion check

Unchecking accidental deletion protection

Unchecking accidental deletion protection

Now, go back to Active Directory Users and Computers console to Domain Controllers OU and select this DC once again

Click RMB on it and choose “Deleteoption

Deleting broken Domain Controller from domain

Deleting broken Domain Controller from domain

Confirm that you are sure and you want to delete this object from the domain

Removing object from the domain

Removing object from the domain

You will get information that you are trying to remove Domain Controller from the domain without appropriate removal process

Domain Controller removal warning

Domain Controller removal warning

you are sure that this Domain Controller does not exists anymore and you wish to delete it anyway, so select this checkbox and confirm deletion

Confirm DC removal

Confirm DC removal

if your server was acting as Global Catalog, you need to confirm once again that you wish to delete it from the domain

Confirm DC removal

Confirm DC removal

There is one more place you need to visit to completely clean up your environment. Open Active Directory Sites and Services console and locate Site in which removed DC was authenticating objects

Sites and Services - removed DC

Sites and Services – removed DC

as you can see, this Domain Contoller has no NTDS Settiings object associated. Just click RMB on it and remove it

Removing DC from Sites and Services

Removing DC from Sites and Services

Confirm that you wnat to delete this object and that’s all!

Confirm DC object removal

Confirm DC object removal

You removed easily metedata of broken Domain Controller from your domain!

Author: Krzysztof Pytko

Seizing FSMO roles with PowerShell

 

I wrote some time ago an article about Seizing FSMO roles. That was a little bit painful method and it required to use ntdsutil command which is inconvenient in use. Especially for unexperienced administrators.

Now, when Microsoft released PowerShell 3.0 with Windows 8 Remote Server Adminisration Tools and Windows Server 2012 we have new Active Directory module for PowerShell. It allows to use dedicated PowerShell cmd-let for that.

When your Domain Controller holding any FSMO role is down and cannot be brought up again you need to seize that/there role(s) to the new one.

You would be able to use PowerShell cmd-let

Move-ADDirectoryServerOperationMasterRole

Hey, this exactly the same cmd-let as for transferring FSMO roles, am I right? Yes, you are. The only one difference is that you have to specify at the end of the cmd-let -Force switch which tells that role must be seized not transferred!

Of course to be able to use this feature some prerequisites are required:

  • At least one Windows Server 2008R2 Domain Controller
  • Access to Active Directory Web Services (9389/tcp port unblocked)
  • Server or client machine with PowerShell 3.0 or newer
  • Imported PowerShell 2.0  or newer module for Active Directory

 To get an overview of this command let’s see its help by typing

Get-Help Move-ADDirectoryServerOperationsMasterRole
Move-ADDirectoryServerOperationMasterRole help

Move-ADDirectoryServerOperationMasterRole help

In this case 3 parameters are required:

  • target Domain Controller name
  • FSMO role(s) name to seize
  • -Force switch

Important! When you are seizing any FSMO role, you need to know that Domain Controller which held this role previously, cannot be brought up on-line! This machine may be reused, but first it must be reinstalled!

To get an overview of transferring FSMO roles with PowerShell please read an article on my blog showing how to do that. The article is available at this link.

You are allowed to seize one specific FSMO role or set of FSMO roles. This can be done once as this operation requires old Domain Controlller reinstallation. please be aware of that, there is no place for mistake! 🙂

Seizing specific FSMO role

Active Directory contains five unique FSMO roles:

  • Schema Master
  • Domain Naming Master
  • PDC Emulator Master
  • RID Master
  • Infrastructure Master

if any of these roles where held by your broken Domain Controller, you need to seize it to the new one. Just do this like you would be transferring them but at the end of cmd-let place -Force switch

Move-ADDirectoryServerOperationMasterRole -Identity <TargetDomainController> -OperationMasterRole <FSMORoleName> -Force

this will seize specified operation master role to selected Domain Controller. It would take some time as cmd-let tries to connect to the previous DC and check if there is possible role transfer instead of seize.

Move-ADDirectoryServerOperationMasterRole -Identity DC01 -OperationMasterRole InfrastructureMaster -Force

 Seizing specified FSMO role

Seizing specified FSMO role

to seize other role than this one, replace its name with  one of those below

  • SchemaMaster
  • DomainNamingMaster
  • PDCEmulator
  • RIDMaster
  • InfrastructureMaster

Information! When you transfer PDC Emulator role, you need to remember that you should introduce new time server within your environment. If you wish, you may follow steps described in the article on my blog at Advertising new time server in domain environment

and remember, when you are seizing any FSMO role, you need to know that Domain Controller which held this role previously, cannot be brought up on-line! This machine may be reused, but first it must be reinstalled!

Seizing set of FSMO roles

This works exactly the same way as for transferring FSMO roles. You just need to specify operation master role name(s) separated by comma (,) and put -Force switch at the end. All provided FSMO roles will be seized to the selected Domain Controller.

To seize roles use below syntax

Move-ADDirectoryServerOperationMasterRole -Identity <TargetDomainControllerName> -OperationMasterRole <FSMORoleName1>, <FSMORoleName2>, ...<FSMORoleNameN> -Force

and these operation master roles will be seized.

Commonly used scenarios are related with seizing forest-wide, domain-wide or all FSMO roles. Let’s see  how to do that

Seizing forest-wide FSMO roles:

Move-ADDirectoryServerOperationMasterRole -Identity DC01 -OperationMasterRole SchemaMaster, DomainNamingMaster -Force

Seizing domain-wide FSMO roles:

Move-ADDirectoryServerOperationMasterRole -Identity DC01 -OperationMasterRole PDCEmulator, RIDMaster, InfrastructureMaster -Force

Seizing all FSMO roles:

Move-ADDirectoryServerOperationMasterRole -Identity DC01 -OperationMasterRole SchemaMaster, DomainNamingMaster, PDCEmulator, RIDMaster, InfrastructureMaster -Force
Seizing all FSMO roles

Seizing all FSMO roles

It would take some time as cmd-let tries to connect to the previous DC and check if there is possible roles transfer instead of seize.

Information! When you transfer PDC Emulator role, you need to remember that you should introduce new time server within your environment. If you wish, you may follow steps described in the article on my blog at Advertising new time server in domain environment

and remember, when you are seizing any FSMO role, you need to know that Domain Controller which held this role previously, cannot be brought up on-line! This machine may be reused, but first it must be reinstalled!

To verify if operation master roles were seized to selected Domain Controller, execute

for forest-wide FSMO roles:

Get-ADForest | Select SchemaMaster, DomainNamingMaster | Format-List
Veryfying forest-wide FSMO roles

Veryfying forest-wide FSMO roles

and for domain-wide FSMO roles use this one:

Get-ADDomain | Select PDCEmulator, RIDMaster, InfrastructureMaster | Format-List
Veryfying domain-wide FSMO roles

Veryfying domain-wide FSMO roles

At the end, you should do metadata cleanup for that broken Domain Contoller, and that’s all!

If you wish you may follow other articles on my blog, showing how to do metadata cleanup of broken Domain Controller

Author: Krzysztof Pytko

Transferring FSMO roles with PowerShell

 

Some time ago, I introduced on my blog two articles about

and

They are still valid but some new options appeared when Windows Server 2012 and PowerShell 3.0 were released.

From now, you can simply use PowerShell cmd-lets to do that very quick and simple. This not requires any snap-ins registration on a server or machine, just simply run PowerShell and execute dedicated cmd-let with appropriate syntax.

Of course to be able to use this feature some prerequisites are required:

  • At least one Windows Server 2008R2 Domain Controller
  • Access to Active Directory Web Services (9389/tcp port unblocked)
  • Server or client machine with PowerShell 3.0 or newer
  • Imported PowerShell 2.0  or newer module for Active Directory

If above prerequisites are met, you can use this cmd-let

Move-ADDirectoryServerOperationMasterRole

its name is really long but don’t worry it is really simple in use.

To get an overview of this command let’s see its help by typing

Get-Help Move-ADDirectoryServerOperationsMasterRole
Move-ADDirectoryServerOperationMasterRole help

Move-ADDirectoryServerOperationMasterRole help

as you can see, there are two parameters required to successfully initiate FSMO roles transfer

  • target Domain Controller name
  • FSMO role(s) name

 Active Directory contains five unique operation master roles.

Two from them are unique at forest level

  • Schema Master
  • Domain Naming Master

to check where they are currently located, you need to use Get-ADForest cmd-let

Get-ADForest | Select SchemaMaster, DomainNamingMaster | Format-List

You will get a list of server(s) which hold forest-wide FSMO roles

List of forest-wide FSMO roles

List of forest-wide FSMO roles

and three are unique at domain level. That means, every domain in the forest has its own set of FSMO roles. These roles are:

  • PDC Emulator
  • RID Master
  • Infrastructure Master

to check where they are currently located, you need to use Get-ADDomain cmd-let

Get-ADDomain | Select PDCEmulator, RIDMaster, InfrastructureMaster | Format-List
List of domain-wide FSMO roles

List of domain-wide FSMO roles

In case you have multiple domains and you would like to check FSMO roles location there, you need to specify -Server switch and put there DNS domain name which you want to check

Get-ADDomain -Server testenv.devel | Select PDCEmulator, RIDMaster, InfrastructureMaster | Format-List
List of FSMO roles for selected domain

List of FSMO roles for selected domain

Note! Global Catalog is a Domain Controller role not Operation Master role!

To start transferring Operation Master roles to other Domain Controller, you need to specify role name within -OperationMasterRole switch.

Available role names are:

  • SchemaMaster
  • DomainNamingMaster
  • PDCEmulator
  • RIDMaster
  • InfrastructureMaster

all you have to do is put single role name or multiple role names separated by comma (,), in example:

-OperationMasterRole PDCEmulator

or

-OperationMasterRole SchemaMaster, DomainNamingMaster

specified role(s) would be transferred to other Domain Controller.  Hey, but which one? You need to put DC’s name under -Identity switch.

General syntax for that is:

Move-ADDirectoryServerOperationMasterRole -Identity <DomainControllerName> -OperationMasterRole <FSMORoleName>

An example for transfer Infrastructure Master operation master role is:

Move-ADDirectoryServerOperationMasterRole -Identity DC06 -OperationMasterRole InfrastructureMaster

You need to confirm operation by answering “Y yes” or “A yes to all” to the question, and role(s) are transferring.

Transferring single FSMO role

Transferring single FSMO role

To transfer more than one FSMO role in single run, you need to put FSMO roles separated by comma (,) sign

Move-ADDirectoryServerOperationMasterRole -Identity <DomainControllerName> -OperationMasterRole <FSMORoleName1>,<FSMORoleName2>,..<FSMORoleNameN>

Let’s see cmd-let full syntax for transferring InfrastructureMaster and RID Master

Move-ADDirectoryServerOperationMasterRole -Identity DC06 -OperationMasterRole InfrastructureMaster, RIDMaster

Press “A yes to all” and you do not have to confirm every transferring role separately

Transferring multiple FSMO roles

Transferring multiple FSMO roles

OK, so let’s see 4 commonly used actions in productive environments:

  • transferring single FSMO role
  • transferring forest-wide FSMO roles
  • transferring domain-wide FSMO role
  • transferring all FSMO roles

Transferring single FSMO role

As it was shown above, you need to only know to which Domain Controller are you going to migrate the role and its name. So, below syntax may be used in this case

Move-ADDirectoryServerOperationMasterRole -Identity DC06 -OperationMasterRole InfrastructureMaster
Transferring single FSMO role

Transferring single FSMO role

Just replace InfrastructureMaster role name with this one you would like to transfer and that’s all.

Information! When you transfer PDC Emulator role, you need to remember that you should introduce new time server within your environment. If you wish, you may follow steps described in the article on my blog at Advertising new time server in domain environment

Transferring forest-wide FSMO roles

As it was introduced above, there are 2 forest-wide roles:

  • Schema Master
  • Domain Naming Master

to transfer them, use this below’s simple command specifying target Domain Contoller’s name and forest-wide role names

Move-ADDirectoryServerOperationMasterRole -Identity DC06 -OperationMasterRole SchemaMaster, DomainNamingMaster
Transferring forest-wide FSMO roles

Transferring forest-wide FSMO roles

and your forest-wide roles are transferred!

Transferring domain-wide FSMO role

You also know these roles, they were introduced above and there are 3 domain-wide FSMO roles:

  • PDC Emulator Master
  • RID Master
  • Infrastructure Master

to transfer them, use this below’s simple command specifying target Domain Contoller’s name and domain-wide role names

Move-ADDirectoryServerOperationMasterRole -Identity DC06 -OperationMasterRole PDCEmulator, RIDMaster, InfrastructureMaster
Transferring domain-wide FSMO roles

Transferring domain-wide FSMO roles

and they are transferred!

Information! When you transfer PDC Emulator role, you need to remember that you should introduce new time server within your environment. If you wish, you may follow steps described in the article on my blog at Advertising new time server in domain environment

Transferring all FSMO roles

You know all FSMO roles, so you may wish to transfer them all from the old Domain Controller to the new one. Below syntax does it smoothly

Move-ADDirectoryServerOperationMasterRole -Identity DC06 -OperationsMasterRole SchemaMaster, DomainNamingMaster, PDCEmulator, RIDMaster, InfrastructureMaster
Transferring all FSMO roles

Transferring all FSMO roles

and voila! All FSMO roles are transferred!

Information! When you transfer PDC Emulator role, you need to remember that you should introduce new time server within your environment. If you wish, you may follow steps described in the article on my blog at Advertising new time server in domain environment

Well done! You have already transferred all your FSMO rles to the other Domain Controller.

Author: Krzysztof Pytko

Setting default domain password policy

 

Every domain environment needs a default domain password policy.

You have it, am I right?

Even if you don’t know, default password policy is available in your domain. By default, you will find all its settings within “Default Domain Policy“. This policy is applied at domain level.

Default Domain Policy

Default Domain Policy

To start with domain password policy, please read the article I published some time ago: Domain Password Policy

The question is: did you review password policy settings and considered password requirements for your environment?

Or just like the most administrators: “Hey, I was hired to this company much more later when password policy was in-place. I did not need to touch it!

Oh really?! Do you know that you (as a domain administrator) are responsible for password security? Yes, you are! So, let’s take closer look at those settings and what you can configure as reasonable default password policy.

 Default password settings

When you deploy new domain, you don’t have to configure password policy from the scratch. There are default values set up.

Default password settings

Default password settings

Of course, password settings should be adjusted to your company needs. Leaving the defaults might not be appropriate and I would strongly recommend to do that.

Let’s see what we can configure there. You will find password policies in two nodes under

Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Account Policies

These nodes are:

  • Password Policy
  • Account Lockout Policy

In Password Policy node you can configure:

  • Enforce password history
  • Maximum password age
  • Minimum password age
  • Minimum password length
  • Password must meet complexity requirements
  • Store passwords using reversible encryption

and in Account Lockout Policy node are these options:

  • Account lockout duration
  • Account lockout threshold
  • Reset account lockout counter after

Above options are responsible for building good password policy – default domain password policy.

Let’s see what they mean and what you can set up there.

Password Policy settings

This is really important node where you can define how the password would be built and how much secure it is. You need to remember that you are setting default password policy for your domain. All those settings will be applied to every domain account.

Password Policy settings

Password Policy settings

Remember! Users may complain about password setting but only then if you will force them to use very long passwords and if it will expire to often.

Enforce password history

To start building password policy you need to consider how many unique passwords user must set, before it would be possible to go back and use the oldest one.

For that “Enforce password history” setting is responsible. You need to define value, how many unique passwords are required to be set by user, before allowing him to use previous passwords.

Enforce password history explanation

Enforce password history explanation

Allowed value is between 0 (no password history) and 24 (maximum)

For default domain password policy I would suggest to set value of 10.

Changed enforce password history setting

Changed enforce password history setting

This is quite secure and allow much more simple calculation for other setting showed a little bit later in this article.

In this case, the setting means that user must set 10 unique passwords before he can go back and use first from the previous list of passwords.

There is slight chance that user would not reuse his passwords 🙂

Maximum password age

Another important setting in the policy is how often users must change their password.

Maximum password age explanation

Maximum password age explanation

Maximum password age value must be between 0 and 998 days.

Setting value of 0 causes that password expires every 0 days! That means in reality – password never expires

You definitively should avoid of using this value in productive environments! Especially that this is not easy to find out, because password never expires flag is not modified and you cannot see this directly in Active Directory Users and Computers console. Password never expires checkbox is NOT selected then!

Note! Good practice shows that password should be changed in range of 30 – 90 days.

When you set this value up too short, users would complain that they have to change password too often. This might cause a problem with “yellow sticks” around computer where users write their passwords!

For default domain password policy 90 days look reasonable and users are not complaining too much.

Maximum password age setting

Maximum password age setting

I would recommend of setting this value for the maximum password age. Password change once per 3 months is acceptable and no one should complain.

Minimum password age

This is really important setting and as I can see many administrators are afraid of setting this value to custom time.

Information! Minimum password age policy is responsible for controlling how often user is allowed to change the password.

Mostly, in the environments I see one of these two values:

  • 0 days
  • 1 day

By the default, you can find 1 day as minimum password age setting.

This means that user can change the password and in if he wants to do that again, he needs to wait 1 day before it would be possible again.

Minimum password age explanation

Minimum password age explanation

OK, but what’s wrong in this setting?

User is allowed to change the password once per day. That means, user can repeat this procedure every day to go back to his first (favourite) password.

At current stage, you defined 10 unique passwords, so after 10 days, user would be able to reuse his previous password again and use it for the next 80 days until system will force its change!

The situation looks even worse if the setting contains 0 days as a value.

There is no restriction to password change time limit for user! This means, user can simply go back to the previous password within the same day!

Setting strength options in other policies does not make sense as you can see, user would be able to have always the same password, all the time.

That’s why this setting is really important!

So, how should I set up this value?

I was wondering how to adjust this value in different environments and I figured it out.

I invented a formula to calculate appropriate value. Because password policies vary in every environment, I needed some common way to achieve this.

To simply calculate this value I used:

  • Enforce password history count
  • Maximum password age
Minumum password age formula

Minumum password age formula

This is really secure and reasonable value. You may be sure that user would not be able to reuse the first password during one password life cycle.

Hey, but users start complaining that they cannot change password on demand!

No, they would not! Believe me 🙂

The number of regular users, who are changing their passwords before forced by the system, is less than 1% in every environment.

Even administrator would not do that themselves 😀

Besides, they are allowed to change their password, but not every day.

That would help you to find out what is going on in your domain when some users will call IT department or HelpDesk too frequenty and request password change. Maybe an account is shared between other users? 🙂

Relying on this formula Minimum password age value is 10 days

Minimum password age

Minimum password age

and put calculated minimum password age into policy

Minimum password age setting

Minimum password age setting

Minimum password length

Ok, password life cycle is defined but we need to set up its length. You know that above settings would be nothing if you allow to use too simple password, rigth?

The setting should be chose wisely as enforcing users to set very long password might cause an issue with forgoten passwords or account lockouts. Sometimes it might be worse, they would use “yellow sticks” where password is written.

Possible values for this setting are between 1 and 14 characters.

Minimum password length explanation

Minimum password length explanation

When you set this up to 0 characters then password would not be required. Of course this is strongly not recommended!

Setting it between 8 -12 charactes is good enough and no one should complain.

Minimum password length setting

Minimum password length setting

Password must meet complexity requirements

Another important password policy setting.

If you do not use this option, your password policy would be weak.

Thanks to this setting you have to use 3 types of different characters out of 4 groups:

  • uppercase characters [A – Z]
  • lowercase characters [a – z ]
  • digits [0 – 9]
  • special characters [!@#$%^&*()-=_+]

This policy may be enabled or disabled. When it’s enabled, password is much more secure and of course I would recommend to have it enabled.

Password must meet complexity requirements explanation

Password must meet complexity requirements explanation

Store passwords using reversible encryption

That setting should never be enabled in default domain password policy unless you really need it and you have Windows Server 2000/2003 Domain Functional Level where Fine-Grained Password Policies are unavailable.

Enabling this setting causes that password is unsafe as it is stored like it would be saved in plain text!

Store passwords using reversible encryption explanation

Store passwords using reversible encryption explanation

That’s all about defined password policy strength.

Now it’s time to configure policies responisble for account lockout behavior.

Account Lockout Policy settings

Policies located under this node are responsible for locking account if user types password incorrectly few times in a row.

By default, they are unconfigured and account is not locking at all!

So, if this is not configured should I take care of it? If you are asking me – yes, always!

This should be configured in every domain environment. Even if you think that it is not necessary, turn it on.

Just set up Account lockout threshold value to something really high like 50. That’s quite enough failed logon attempts for users and still prevents infinite password guess by hackers or other dangerous stuff.

Let’s take a look at those policies and try to configure them reasonably.

Account lockout threshold

As mentioned above, if you think that you do not need this policy, turn it on and specify high number like 50 attempts

That’s quite enough failed logon attempts for users and still prevents infitite password guess by hackers or other dangerous stuff.

Account lockout threshold explanation

Account lockout threshold explanation

In other case when you would like to implement this feature in your environment, please follow below formula

Account lockout threshold formula

Account lockout threshold formula

This would allow your users to check every password used in the past and gives them extra 2 tries if some typo would appear in the password box. After that they will call IT or HelpDesk team 🙂

Based on that formula, current value is 12 failed logon attempts before account is locked out

Account lockout threshold value

Account lockout threshold value

Just set this up in the policy and 2 other option would activate

Account lockout threshold setting

Account lockout threshold setting

When you apply changes, another windows with 2 other settings appear filled with deafult values

Account lockout options

Account lockout options

Account lockout duration

Account lockout duration policy is responsible for locking a domain account for specified duration of time. When failed attempt logon count is reached, this policy locks temporarily the account.

When specified time passes, the account is unlocked and user may try to logon again using his credentials. To logon sooner, user needs to contact with IT or HelpDesk department and request manual account unlock.

Account lockout duration time explanation

Account lockout duration time explanation

Default value for this policy is reasonable. 30 minutes of account lockout is acceptable, after that time user is able to try to logon again.

If you need much more control when account is locked out, set up 0 as a value. Then account must be always unlocked by administrator.

Reset account lockout counter after

This setting must be less or equal to Account lockout duration time. It defines after what time failed logon attempt is reset and user may try to logon once again.

The setting gives user one more chance and if password is provided inproperly, account is locked out again for time specified in Accout lockout duration policy.

Reset account lockout counter after explanation

Reset account lockout counter after explanation

I would strongly recommend leaving the value with the same time as in Account lockout duration. Then users would not try to experiment with their password and do not extend lockout period.

When you implement all those setting in your password policy, take a look at its summary

New password policy summary

New password policy summary

it looks much better and much more secure than the deafult one and maybe better than your previous policy 🙂

Now, you need to only refresh password policy on your Domain Controllers and test if it is working fine for the next password change.

On Windows Server 2003, 2008 and 2008R2 open command line and type

gpudate /force
gpupdate /force

gpupdate /force

to start refreshing group policies

GPOs refreshed

GPOs refreshed

On Windows Server 2012 and 2012R2 use PowerShell cmd-let for that

Invoke-GPUpdate
Invoke-GPUpdate cmd-let

Invoke-GPUpdate cmd-let

to get the same result as above.

And that’s all. Your default domain password policy is wisely implemented.

If you wish to deploy other password policies for other group of users and you have at least Windows Server 2008 Domain Functional Level please read these articles on my blog how to do that.

Fine-Grained Password Policy in Windows Server 2008/2008R2

Fine-Grained Password Policy in Windows Server 2012/2012R2

Author: Krzysztof Pytko

Active Directory reporting – version 2

 

It took me some time to publish this post but finally, I did it.

My previous post about Active Directory Reporting using PowerShell script was published almost one year ago! Since that time a lot of new features were implemented within the script.

I was in contact with Daniel Petri, he suggested a lot of new features and we added them to the script. You may also wish to visit his great blog at  http://www.petri.com/

Today, I would like to introduce this script to you. I hope it would be useful for many of you. Let’s start with its description.

Have you ever consider how to simplify an Active Directory reporting for new AD environments? I decided to prepare PowerShell script which check a lot of Active Directory configuration settings and brings them on screen. This option reduces time required to gather some basic and a little bit more advanced information about Active Directory forest and domain(s) configuration.

AD environments mostly have at least one Windows Server 2008 R2 Domain Controller where Active Directory Web Services are running. This is mandatory prerequisite to be able to execute the script.

You can simply execute it on:

  • Domain Controller
  • Domain member server with PowerShell 2.0 installed
  • Domain member workstation with RSAT installed

for domain member machines you need to be sure that Active Directory Web Services port in available from location where you are running. By default it is 9389/tcp

The script requires only authenticated domain user to work properly if no custom delegation control is configured.

You can simply run it within PowerShell console without any parameter and its start scanning currently logged on forest with all its domain. When you specify a parameter – it must be DNS forest name – the scan is performed for the specified forest.

You don’t have to worry when executing the script because this is run in read-only mode, so no changes are done in the environment.

Below you may find some screen-shots from the script execution. This comes from multi-site, single domain test environment.

The output color (red) related with scanned data does not refer to an error! This is only to emphasise the setting on which you should pay attention.

Let’s see what settings are being checked when script is executed.

At forest level:

  • Forest name
  • Schema version
  • Forest Functional Level
  • List of trusts
  • Active Directory Recycle Bin enablement
  • Check of Exchange version
  • Check of Exchange Organization name
  • Check of Lync version
  • Tombstone lifetime period
  • Enumerate all partitions
  • All domains in the forest
  • Global Catalog servers in the entire forest
  • Site and Subnets information
  • Site link(s) configuration
  • UPN suffixes
  • Forest FSMO roles holders
  • Check members for Enterprise and Schema Administrator groups
  • Domain Controller(s) details
  • SYSVOL replication method
  • SYSVOL size for DFS-R replication method

at domain level:

  • Domain name
  • NetBIOS domain name
  • Domain Functional Level
  • List of Domain Controllers
  • List of Read-Only Domain Controllers
  • Global Catalog servers for the domain
  • SYSVOL replication method
  • Orphaned objects check
  • Lingering objects check
  • Conflict replication objects check
  • Default domain computer objects location
  • Default domain user objects location
  • Total no. of Organizational Units
  • Total no. of computers
  • Total no. of computers with particular operating system version
  • Total no. of users
  • Active users
  • Inactive users
  • Locked out users
  • Users with no password required
  • Users with password never expires
  • Total no. of groups
  • Global, Universal and Local groups check
  • Check for existance of default domain policies
  • Total no. of Domain Administrators
  • Built-in Domain Administrator account details
  • Domain FSMO roles holders
  • Default Domain Password policy details
  • Total no. of Fine-Grained Password Policies

So, please take a look at the screen-shot output from multi-site single domain environment below

Script execution screen-shot

Script execution screen-shot

Script execution screen-shot

Script execution screen-shot

Script execution screen-shot

Script execution screen-shot

Script execution screen-shot

Script execution screen-shot

Script execution screen-shot

Script execution screen-shot

and at this moment, that’s all. I hope in the future the script would be developed. I am going to add the results export into formatted HTML format.

Or maybe, you would like to participate with its future development? If so, please let me know and we’ll do that!

OK, and this is a script which you can download. After downloading, please remove –v2.doc extension and leave only .ps1

Active Directory Reporting v0.2 script

Author: Krzysztof Pytko

Active Directory reporting

 

Have you ever consider how to simplify an Active Directory reporting for new AD environments? I have recently played with new multi domain environment and I had to check many things manually with built-in consoles. This is nothing difficult but needs some time and when I have done the environment recognition, I decided to prepare PowerShell script. It reduces time required to get some basics information about Active Directory forest and domain(s) configuration.

Today, many Active Directory environments have at least one Windows Server 2008 R2 Domain Controller where Active Directory Web Services are running. The script is written for at least PowerShell 2.0 with Active Directory module.

You can simply run it within PowerShell console without any parameter and its start scanning currently logged on forest with all its domain. When you specify a parameter – it must be DNS forest name – the scan is performed for the specified forest.

You don’t have to worry when executing the script because this is run in read-only mode, so no changes are done in the environment.

Below you may find some screen-shots from the script execution. Unfortunately, I have only access to single forest, single domain enviropnment at this time and you will get short overview of the script. But i will try to put additional screen-shots from multi-domain environment in the nearest future.

Oh, and one more thing. The output color (red) related with scanned data does not refer to an error! This is only to emphasise the setting on which you should pay attention.

That’s all, let’s see how the results are looking.

Script executed without a parameter

Script execution screen-shot

Script execution screen-shot

Script execution screen-shot

Script execution screen-shot

Script execution screen-shot

Script execution screen-shot

and script execution with forest name as a parameter

Script execution screen-shot

Script execution screen-shot

unfortunatelly, the output is exactly the same as for previous execution but I will replace screen-shots as soon as I will do thet in my multi-domain test environment.

Script execution screen-shot

Script execution screen-shot

Script execution screen-shot

Script execution screen-shot

Script execution screen-shot

Script execution screen-shot

OK, what is scanned by the script? Just take a look at the list below

At the forest level:

  • Forest name
  • Schema version
  • Forest Functional Level
  • Active DIrectory Recycle Bin enablement
  • All domains in the forest
  • Site names
  • Global Catalog servers in the entire forest
  • UPN suffixes
  • Forest FSMO roles holders

At domain level (each domain):

  • Domain name
  • NetBIOS domain name
  • Domain Functional Level
  • List of Domain Controllers
  • List of Read-Only Domain Controllers
  • Global Catalog servers for the domain
  • Default domain computer objects location
  • Default domain user objects location
  • Total no. of Organizational Units
  • Total no. of computers
  • Total no. of users
  • Total no. of groups
  • Total no. of Domain Administrators
  • Built-in Domain Administrator account details
  • Domain FSMO roles holders
  • Default Domain Password policy details
  • Total no. of Fine-Grained Password Policies

 

UPDATE

 

It took me some time to update this post but finally, I did it. A lot of new features were added into script check.

I was in contact with Daniel Petri, he suggested a lot of new features and we added them to the script. You may also wish to visit his great blog at  http://www.petri.com/

Please take a look at new features on forest level, implemented in the new script version:

  • List of trusts
  • Check of Exchange version
  • Check of Exchange Organization name
  • Check of Lync version
  • Tombstone lifetime period
  • Enumerate all partitions
  • Site and Subnets information
  • Site link(s) configuration
  • Check members for Enterprise and Schema Administrator groups
  • Domain Controller(s) details
  • SYSVOL replication method
  • SYSVOL size for DFS-R replication method

Also new features at domain level were added:

  • SYSVOL replication method
  • Orphaned objects check
  • Lingering objects check
  • Conflict replication objects check
  • Total number of computers with particular operating system version
  • Active users
  • Inactive users
  • Locked out users
  • Users with no password required
  • Users with password never expires
  • Global, Universal and Local groups check
  • Check for existance of default domain policies

So, please take a look at the output from multi-site single domain environment below

Script execution screen-shot

Script execution screen-shot

Script execution screen-shot

Script execution screen-shot

Script execution screen-shot

Script execution screen-shot

Script execution screen-shot

Script execution screen-shot

Script execution screen-shot

Script execution screen-shot

and at this moment, that’s all. I hope in the future the script would be developed. I am going to add the results export into formatted HTML format.

Or maybe, you would like to participate with its future development? If so, please let me know and we’ll do that!

OK, and this is a script which you can download. After downloading, please remove –v2.doc extension and leave only .ps1

Active Directory Reporting v0.2 script

Author: Krzysztof Pytko

Authoritative SYSVOL restore (DFS-R)

 

In my previous article “Non-authoritative SYSVOL restore (DFS-R)” I showed you, how to do a non-authoritative restore of SYSVOL based on DFS Replication. Today it is time to do an authoritative SYSVOL restore. If you have bigger mess in your domain or you need to restore SYSVOL from backup and replicate to other Domain Controllers.

This action affects all of your Domain Controllers in the entire domain. In the first case (non-authoritative) you only touch SYSVOL on one DC at the time. The rest of your Domain Controllers are running and sharing SYSVOL for users.

The second case (authoritative) is much more visible for users. All of Domain Controllers do not run and share SYSVOL where Group Policies and logon scripts are located. When you decide to do authoritative SYSVOL restore, you need to inform all administrators to not create/modify Group Policies during that time. All other domain services are running except access to SYSVOL. So, this action should be performed out of office business hours.

How to start authoritative SYSVOL restore? What do you need to do first?

You should identify which Domain Controller is holding PDC Emulator operation master role. As you know, one of its functions is to manage and maintain GPOs. When you create or modify existing GPO, it is done directly on this Domain Controller.

If you need to restore SYSVOL from backup, it should also be done directly on PDC Emulator operation master role holder, from which you will initiate authoritative SYSVOL restore.

So, let’s see, how we can do that.

Log on to PDC Emulator FSMO role holder. If you do not know, which Domain Controller holds this role, run in command-line/elevated command-line on any of your DCs

net dom query fsmo
Finding PDC Emulator role holder

Finding PDC Emulator role holder

or type in PowerShell (Windows Server 2012/2012R2)

Import-Module ActiveDirectory
Get-ADDomain | Select PDCEmulator
Finding PDC Emulator role holder

Finding PDC Emulator role holder

and you’ll see which DC is holding this role.

When you are logged on on this Domain Controller, you need to evaluate how many DCs are in your domain. The most simple way to check that is using Microsoft DS tools on a DC. Type in command-line

dsquery server -name * -limit 0 | dsget server -dnsname | find /v "dnsname" | find /v "dsget" >c:dcslist.txt

Collecting all Domain Controllers in a domain

Collecting all Domain Controllers in a domain

or type in PowerShell (Windows Server 2012/2012R2)

Import-Module ActiveDirectory
Get-ADDomainController -Filter * | Select Name | Out-File c:dcslist.txt
Collecting all Domain Controllers in a domain

Collecting all Domain Controllers in a domain

after you ran this command, on your DC’s C-Drive, you should find a text file named dcslist.txt Check its content, there are all Domain Controllers for your domain

Full list of Domain Controllers

Full list of Domain Controllers

On all of those Domain Controllers except PDC Emulator holder, you have to perform non-authoritative SYSVOL restore. But let’s start step-by-step.

You should initiate authoritative SYSVOL restore from a DC with PDC Emulator role. If you need to restore SYSVOL from backup, do it first before you initiate restore.

First of all, stop DFS Replication service. Type in elevated command-line

net stop DFSR
Stopping DFS Replication service

Stopping DFS Replication service

or in PowerShell

Stop-Service DFSR

or

Stop-Service "DFS Replication"
Stopping DFS Replication service

Stopping DFS Replication service

Important! All services relying on DFS Replication service will be affected!

Now, run ADSI Editor (adsiedit.msc) from Domain Controller on which you want to initiate non-authoritative SYSVOL restore. Type in run box

adsiedit.msc
Running ADSI Editor

Running ADSI Editor

Connect to domain partition (Default Naming Context). Click right mouse button (RMB) on root node in the console and select “Connect to

Connecting to Default Naming Context

Connecting to Default Naming Context

select a well known Naming Context and choose “Default Naming Context

Selecting Naming Context

Selecting Naming Context

Expand below location bt clicking on each node within a console

Default Naming Context -> DC=domain,DC=local -> OU=Domain Controllers -> CN=Domain Controller name -> CN=DFSR-LocalSettings -> Domain System Volume

where DC=domain,DC=local is a distinguished name of your domain and CN=Domain Controller name is DC name of PDC Emulator role holder on which you want to initiate authoritative SYSVOL restore.

Searching SYSVOL subscription node

Searching SYSVOL subscription node

and select “CN=SYSVOL Subscription” entry by RMB in the right pane, choose “Properties

Editing SYSVOL subscription entry

Editing SYSVOL subscription entry

This time you need to change two atrributes value

  • msDFSR-Enabled
  • msDFSR-Options

Search them on the list and edit

msDFSR-Enabled attribute edition

msDFSR-Enabled attribute edition

Change its state from TRUE to FALSE and accept the change

Modification of msDFSR-Enabled attribute

Modification of msDFSR-Enabled attribute

and accept changes to be applied

Accept attributes changes

Accept attributes changes

Now, search the second attribute msDFSR-Options and edit it

msDSFR-Options attribute edition

msDSFR-Options attribute edition

Change its state from not set to 1 and accept the change

Modification of msDFSR-Options attribute

Modification of msDFSR-Options attribute

and accept changes to be applied (do not close window, you will use it later)

Accept attributes changes

Accept attributes changes

REPETITIVE TASK

Now, on each of the rest Domain Controllers you need to change msDFSR-Enabled attribute state from TRUE to FALSE to initiate replication from authoritative Domain Controller with SYSVOL. This not need to be done directly on Domain Controllers, you can use ADSI Editor on the same DC on which you changed previous attributes. But this is important to do for evry remaining DC!

Below you can find all required steps. You need to repeat them on the rest of Domain Controllers

In ADSI Editor on Domain Controller where you changed previous attributes, close “Attribute Editor” window and go back to the console. Expand each DC to set up msDFSR-Enabled attribute

Changing SYSVOL subscription of the rest of Domain Controllers

Changing SYSVOL subscription of the rest of Domain Controllers

Search for the attribute

msDFSR-Enabled attribute edition

msDFSR-Enabled attribute edition

and edit it, changing TRUE to FALSE

Modification of msDFSR-Enabled attribute

Modification of msDFSR-Enabled attribute

and click OK to accept changes

Modify attribute and accept changes

Modify attribute and accept changes

and stop DFS Replication service on remote DC. Repeat these steps for EVERY remaining Domain Controller.

END OF REPETITIVE TASK

Now, on your PDC Emulator role holder start DFS Replication service, type in elevated command-line

net start DFSR
Starting DFS Replication service on PDC Emulator role holder DC

Starting DFS Replication service on PDC Emulator role holder DC

or type in PowerShell

Start-Service DFSR

or

Start-Service "DFS Replication"
Starting DFS Replication service on PDC Emulator holder Domain Controller

Starting DFS Replication service on PDC Emulator holder Domain Controller

In event log you should see event ID 4114

Event log review

Event log review

Modify msDFSR-Enabled attribute back to TRUE state

Changing msDFSR-Enabled attribute back to TRUE state

Changing msDFSR-Enabled attribute back to TRUE state

and accept changes

Accepting attribute changes

Accepting attribute changes

Start Active Directory replication on all of your Domain Controllers. Type in elevated command-line

repadmin /syncall /AdP
Replicating Active Directory

Replicating Active Directory

On your PDC Emulator Domain Controller in elevated command-line type

dfsrdiag PollAD
Sync with the global information store

Sync with the global information store

Note! When you ran dfsrdiag command and it was not recognized, you need to install DFS Management Tools from features!

Adding DFS Management Tools feature

Adding DFS Management Tools feature

In DFS Replication event log, you should see event ID 4602 That means, your authoritative SYSVOL restore is initiated

Event ID 4602

Event ID 4602

REPETITIVE TASK

Before you will start DFS Replication service, I would suggest to remove all content from those 2 folders

  • %WINDIR%SYSVOLdomainPolicies
  • %WINDIR%SYSVOLdomainScripts

Note! (by default, if you changed SYSVOL location during DC promotion, you need to refer to your own location)

Go to the another Domain Controller to which you want to replicate SYSVOL and start DFS Replication service, type in elevated command-line

net start DFSR
Starting DFS Replication service on PDC Emulator role holder DC

Starting DFS Replication service on PDC Emulator role holder DC

or in PowerShell

Start-Service DFSR

or

Start-Service "DFS Replication"
Starting DFS Replication service on PDC Emulator holder Domain Controller

Starting DFS Replication service on PDC Emulator holder Domain Controller

review DFS Replication event log and check if there is event ID 4114

Event log review

Event log review

Change back msDFSR-Enabled attribute to TRUE state

Changing msDFSR-Enabled attribute back to TRUE state

Changing msDFSR-Enabled attribute back to TRUE state

accept changes, clik “OK” button

Accepting attribute changes

Accepting attribute changes

and run dfsrdiag command to synchronize with the global information store

dfsrdiag PollAD
Sync with the global information store

Sync with the global information store

You should get SYSVOL replicated to this Domain Controller. Go to %WINDIR%SYSVOLdomainPolicies and check if data was replicated. You should see all Group Policies and scripts there

All Group Policies on DC with PDC Emulator role

All Group Policies on DC with PDC Emulator role

and go to one more location, %WINDIR%SYSVOLdomainScripts to check if scripts and other files from NETLOGON share were replicated

All scripts on DC where non-authoritative SYSVOL has been done

All scripts on DC where non-authoritative SYSVOL has been done

END OF REPETITIVE TASK

That’s all!

<<< Previous part

Author: Krzysztof Pytko

Non-authoritative SYSVOL restore (DFS-R)

 

Last time, I wrote an article about Non-authoritative SYSVOL restore (FRS) which was based on File Replication Service for SYSVOL. Now, I will show you a procedure for non-authoritative SYSVOL restore based on DFS Replication (DFS-R).

So, let’s look at the procedure for DFS-R.

When you are working in Active Directory environment you may fall into this problem, especially in case where you have many Domain Controllers. Sometimes you may figure out that one or more Domain Controllers are out of date with SYSVOL replication.

Each Domain Controller has its own folder where GPOs and scripts are saved. This folder is located under %WINDIR%SYSVOLdomain (by default, if you changed that location during DC promotion, you need to refer to your own location).

There are 2 folders:

  • Policies where Group Policies are saved (%WINDIR%SYSVOLdomainPolicies)
  • Scripts where logon scripts or other files are saved (%WINDIR%SYSVOLdomainScripts shared as NETLOGON)

If a DC does not replicate SYSVOL you can see that some Group Policies (GPOs) or scripts are not available on DC(s) in SYSVOLdomain folder on particular DC. Another symptom may be that all GPOs are in place but they are not updated.

When you notice one of these behaviors, you would need to do non-authoritative SYSVOL restore which re-deploys SYSVOL data from working Domain Controller (holding PDC Emulator operations master role).

How to be sure if you need non-authoritative SYSVOL restore? There is no simple answer because that depends on the size of your Active Directory and number of Domain Controllers.

When we can decide to start this kind of retore ?

  • one DC out of couple does not replicate SYSVOL
  • a few DCs out of many do not replicate SYSVOL
  • more than few but less than 50% of them do not replicate SYSVOL

above examples are typical scenarios for non-authoritative SYSVOL restore.

Let’s see how you to do that.

First of all, you need to find out which DC or DCs does/do not replicate SYSVOL. Then you have to start SYSVOL restore.

When you see an empty SYSVOL, this may suggest that Domain Controller initialization where not finished after server was promoted. Active Directory database was replicated but SYSVOL was not. In this case, you can simply perform non-authoritative restore and SYSVOL should be replicated.

Empty SYSVOL folder

Empty SYSVOL folder

Another case is when DC, is not up to date with SYSVOL. Some policies are missing and non-authoritative SYSVOL restore would be helpful

Missing Group Policies under SYSVOL

Missing Group Policies under SYSVOL

When you log on to Domain Controller with PDC Emulator operation master role, you should see that there are more policies than on those faulty Domain Controllers

All Group Policies on DC with PDC Emulator role

All Group Policies on DC with PDC Emulator role

So, you can see that those Domain Controllers need SYSVOL restore to have all data up-to-date.

OK, let’s start non-authoritative restore of SYSVOL. This procedure is a little bit different than for FRS, you do not set up anything in registry. All changes (which can be compared to D2 BurFlags value) are done with ADSI Editor console. You need to run adsiedit.msc from Domain Controller on which you want to initiate non-authoritative SYSVOL restore. Type in run box

adsiedit.msc
Running ADSI Editor

Running ADSI Editor

Connect to domain partition (Default Naming Context). Click right mouse button (RMB) on root node in the console and select “Connect to

Connecting to Default Naming Context

Connecting to Default Naming Context

select a well known Naming Context and choose “Default Naming Context

Selecting Naming Context

Selecting Naming Context

Expand below location bt clicking on each node within a console

Default Naming Context -> DC=domain,DC=local -> OU=Domain Controllers -> CN=Domain Controller name -> CN=DFSR-LocalSettings -> Domain System Volume

where DC=domain,DC=local is a distinguished name of your domain and CN=Domain Controller name is DC name on which you want to initiate non-authoritative SYSVOL restore.

Searching SYSVOL subscription node

Searching SYSVOL subscription node

and select “CN=SYSVOL Subscription” entry by RMB in the right pane, choose “Properties

Editing SYSVOL subscription entry

Editing SYSVOL subscription entry

In the “Attributes Editor” windows, search for msDFSR-Enable attribute and edit it

msDFSR-Enabled attribute edition

msDFSR-Enabled attribute edition

Change its state from TRUE to FALSE and accept the change

Modification of msDFSR-Enabled attribute

Modification of msDFSR-Enabled attribute

and accept changes to be applied (do not close window, you will use it later)

Accept attributes changes

Accept attributes changes

I would suggest to remove all content from SYSVOL folders before starting non-authoritative restore:

  • %WINDIR%SYSVOLdomainPolicies
  • %WINDIR%SYSVOLdomainScripts

Note! (by default, if you changed SYSVOL location during DC promotion, you need to refer to your own location)

Now, you need to start Active Directory replication in a domain. Start elevated command prompt

Running elevated command prompt

Running elevated command prompt

and type a command to initiate AD replication (you need to have at leatd domain administrator’s privileges) and wait for its end

repadmin /syncall /AdP
Replicating Active Directory

Replicating Active Directory

and run dfsrdiag command to synchronize with the global information store

dfsrdiag PollAD
Sync with the global information store

Sync with the global information store

Note! When you ran dfsrdiag command and it was not recognized, you need to install DFS Management Tools from features!

Adding DFS Management Tools feature

Adding DFS Management Tools feature

Please check DFS Replication event log, if you can see event ID 4114 which indicates that SYSVOL is no longer replicated

Event log review

Event log review

OK, let’s set up msDFSR-Enabled attribute to TRUE state and accept changes (use that previous window, you haven’t closed)

Changing msDFSR-Enabled attribute back to TRUE state

Changing msDFSR-Enabled attribute back to TRUE state

and click OK to accept changes

Accepting attribute changes

Accepting attribute changes

again, start Active Directory replication

repadmin /syncall /AdP
Replicating Active Directory

Replicating Active Directory

run dfsrdiag command one more time to synchronize with the global information store

dfsrdiag PollAD
Sync with the global information store

Sync with the global information store

go back to DFS Replication event log and check if you can see these two event IDs:

  • 4614
  • 4604
4614 event ID

4614 event ID

4604 event ID

4604 event ID

go to %WINDIR%SYSVOLdomainPolicies and check if data was replicated. You should see all Group Policies and scripts there

All Group Policies on DC with PDC Emulator role

All Group Policies on DC after non-authoritative SYSVOL restore

and go to one more location, %WINDIR%SYSVOLdomainScripts to check if scripts and other files from NETLOGON share were replicated

All scripts on DC where non-authoritative SYSVOL has been done

All scripts on DC where non-authoritative SYSVOL has been done

That’s all! Everything you need to do is to repeat all those steps on each Domain Controller which does not replicate SYSVOL volume.

Done!

Next part >>>

Author: Krzysztof Pytko

Moving Active Directory database

 

Sometimes, you may need to move Active Directory database from one location to another. This location may be a different folder or different drive. When you need to do that, you are not allowed to use standard copy/move option within Windows operating system.

This kind of action is not supported when Active Directory services/Active Directory:Domain Services are running!

You need to use a tool named: ntdsutil

This is command-line tool which allows to move Active Directory database to another location.

Important! When you are moving AD database, specified location must exists! You cannot move database to non-existing drive or folder!

To move Active Directory database, you need to evaluate on which operating system version this particular Domain Controller is running

Windows Server 2003

In Windows Server 2003 you need to restart Domain Controller into Directory Services Restore Mode which is accessible when you press F8 key, during Windows system startup. Choose this mode from the list and press “enter” to run it

DSRM mode startup

DSRM mode startup

Warning! Remember, when you do that, your Domain Controller does not support Active Directory authentication and other roles/services are unavailable for users! Be aware in locations/Sites where you have only single DC, because during this operation, DC and all its roles ( i.e. DNS, DHCP) are not working!

Wait until logon screen will appear

DSRM mode logon screen

DSRM mode logon screen

Press “CTRL+ALT+DEL” and provide Directory Services Restore Mode administrator password.

Note! This password may be different (and it should be) than standard domain administrator password! If you did not change it since DC promotion, then you need to find it in your documentation before you can proceed.

DSRM mode administrator password

DSRM mode administrator password

You will be informed that server is running in Safe mode

Safe mode warning

Safe mode warning

Now, you need to start command-line where you will execute ntdsutil tool

Running command-line

Running command-line

To run ntdsutil type in command prompt

ntdsutil
Running ntdsutil tool

Running ntdsutil tool

and check if desired folder structure is available before you will move AD database. If not, create it or attach the drive into system.When you do not create a folder, it is created by ntdsutil automatically during database move process.

Warning! You cannot use removable disk to store Active Directory database. Disk needs to be NTFS formatted partition. AD DB does not support FAT/FAT32/ReFS file systems!

Veryfying target folder for AD database

Veryfying target folder for AD database

now, you need to go into files context of ntdsutil tool where you are allowed to operate on AD database files (DB and logs)

ntdsutil - file maintenance context

ntdsutil – file maintenance context

there are few options for file maintenance but in this article only 2 options are interesting for us:

  • Move DB to Path-to-the-new-location
  • Move logs to Path-to-the-new-location
File maintenance options

File maintenance options

so, let’s move Active Directory database to the new location (in this example E:ADDB)

Put this syntax into command prompt window

move DB to E:ADDB
Moving AD database

Moving AD database

and wait some time, while AD DB is being moved to the new location

AD DB is moving

AD DB is moving

As you could see in the screen above, AD DB was move with built-in command move while Active Directory services/Active Directory:Domain Services are not running!

Let’s verify if Active Directory database was moved to specified location. Just check that using Windows Explorer and go to that location

AD database new location

AD database new location

or type in command prompt inside of ntdsutil

info
AD database new location

AD database new location

ok, Active Directory database was moved and I strongly suggest to move also its log files to the same location. For that you need to use the option

move logs to E:ADDB

where E:ADDB is a folder on your server

Moving AD logs to the new location

Moving AD logs to the new location

and wait some time, while logs are being moved to the new location

AD logs are moving

AD logs are moving

OK, let’s verify if Active Directory logs were moved to specified location. Just check that using Windows Explorer and go to that location

AD logs new location

AD logs new location

All logs are in the same location as AD database. You can also verify that within ntdsutil typing

info
AD logs new location

AD logs new location

Now, you need to schedule System State backup of your Domain Controller to have an up-to-data backup with AD database and its logs in the new location.

That’s all, you may close ntdsutil by typing quit twice and close command-line window

Leaving ntdsutil

Leaving ntdsutil

Reboot server into its regular mode and you’re done!

Windows Server 2008/2008R2

With Windows Server 2008/2008R2 this process is much more quick than with previous Microsoft OSes. Windows Server 2008 introduced for the first time Active Directory role as a service. This improvement allows you to simply stop the service without rebooting a server into Directory Services Restore Mode.

What are the main benefits of this solution?

  • You do not waste time required for server reboot
  • Other services are still available for users
  • Even DNS or DHCP servers are still runnig while at least one Domain Controller is available!

Note! Please remember, when you have single Domain Controller and you stop Active Directory Domain Services service, DC will not provide services as it was in Windows Server 2003 DSRM mode!

So, how can you do that in Windows Server 2008/2008R2? The same way as in Windows Server 2003 except server reboot into DSRM mode. Just simply stop Active Directory Domain Services service and run from elevated command-line ntdsutil tool.

First of all, you have to stop Active Directory Domain Services service, run elevated command-line

Running elevated command prompt

Running elevated command prompt

and type below command to stop Active Directory Domain Services (NTDS) service

net stop ntds
Stopping Active Directory: Domain Services service

Stopping Active Directory: Domain Services service

confirm you are sure that follwing services also will be stopped by typing Y and pressing enter

Stopping dependent services

Stopping dependent services

Now, you can start ntdsutil tool to initite Active Directory database move process. Type in command-line

ntdsutil
Executing ntdsutil tool

Executing ntdsutil tool

and check if desired folder structure is available before you will move AD database. If not, create it or attach the drive into system.When you do not create a folder, it is created by ntdsutil automatically during database move process.

Warning! You cannot use removable disk to store Active Directory database. Disk needs to be NTFS formatted partition. AD DB does not support FAT/FAT32/ReFS file systems!

Target folder verification

Target folder verification

and before you are allowed to execute files context, you have to set up active AD DB instance. To do that type

activate instance NTDS
Activating NTDS instance

Activating NTDS instance

now, you can go into files context of ntdsutil tool where you are allowed to operate on AD database files (DB and logs). Type

files
ntdsutil - files maintenance

ntdsutil – files maintenance

there are few options for file maintenance but in this article only 2 options are interesting for us:

  • Move DB to Path-to-the-new-location
  • Move logs to Path-to-the-new-location
Files maintenance options

Files maintenance options

so, let’s move Active Directory database to the new location (in this example E:ADDB)

Put this syntax into command prompt window

move DB to E:ADDB
Moving AD DB to the new location

Moving AD DB to the new location

and wait some time, while logs are being moved to the new location

AD DB moved

AD DB moved

As you could see in the screen above, AD DB was move with built-in command move while Active Directory services/Active Directory:Domain Services are not running!

Let’s verify if Active Directory database was moved to specified location. Just check that using Windows Explorer and go to that location

AD DB new location

AD DB new location

or type in command prompt inside of ntdsutil

info
Active Directory database new location

Active Directory database new location

ok, Active Directory database was moved and I strongly suggest to move also its log files to the same location. For that you need to use the option

move logs to E:ADDB

where E:ADDB is a folder on your server

Moving AD log files

Moving AD log files

and wait some time, while logs are being moved to the new location

Moving AD logs

Moving AD logs

OK, let’s verify if Active Directory logs were moved to specified location. Just check that using Windows Explorer and go to that location

All logs are in the same location as AD database. You can also verify that within ntdsutil typing

info
Active Directory logs new location

Active Directory logs new location

Now, you need to schedule System State backup of your Domain Controller to have an up-to-data backup with AD database and its logs in the new location.

That’s all, you may close ntdsutil by typing quit twice

Leaving ntdsutil

Leaving ntdsutil

and now it’s time to start Active Directory Domain Services service, type in command-line

net start NTDS
Starting AD DS service

Starting AD DS service

just verify if these services were also started with AD DS service (should be ran automatically)

  • File Replication Service (NtFRS)
  • Kerberos Key Distribution Center (KDC)
  • Intersite Messaging (IsmServ)
  • DNS Server (DNS)

if so, you’re done!

Windows Server 2012/2012R2

In Windows Server 2012/2012 R2 this procedure is exactly the same as for Windows Server 2008/2008R2. All steps described for previous Microsoft operating system version apply to these two new operating systems too.

Let’s see how this procedure looks like on Windows Server 2012/2012R2

Note! Please remember, when you have single Domain Controller and you stop Active Directory Domain Services service, DC will not provide services as it was in Windows Server 2003 DSRM mode!

So, how can you do that in Windows Server 2012/2012R2? The same way as in Windows Server 2008. Just simply stop Active Directory Domain Services (NTDS) service and run from elevated command-line ntdsutil tool.

First of all, you have to stop Active Directory Domain Services service, run elevated command prompt

Running elevated command prompt

Running elevated command prompt

and type below command to stop Active Directory Domain Services (NTDS) service

net stop ntds
Stopping NTDS service

Stopping NTDS service

confirm you are sure that follwing services also will be stopped by typing Y and pressing enter

Dependent services to be stopped

Dependent services to be stopped

Now, you can start ntdsutil tool to initite Active Directory database move process. Type in command-line

ntdsutil
Executing ntdsutil

Executing ntdsutil

and check if desired folder structure is available before you will move AD database. If not, create it or attach the drive into system.When you do not create a folder, it is created by ntdsutil automatically during database move process.

Warning! You cannot use removable disk to store Active Directory database. Disk needs to be NTFS formatted partition. AD DB does not support FAT/FAT32/ReFS file systems!

Target folder verification

Target folder verification

and before you are allowed to execute files context, you have to set up active AD DB instance. To do that type

activate instance NTDS
Setting NTDS instance

Setting NTDS instance

now, you can go into files context of ntdsutil tool where you are allowed to operate on AD database files (DB and logs). Type

files
Files maintenance context

Files maintenance context

there are few options for file maintenance but in this article only 2 options are interesting for us:

  • Move DB to Path-to-the-new-location
  • Move logs to Path-to-the-new-location
Active Directory database and logs move options

Active Directory database and logs move options

so, let’s move Active Directory database to the new location (in this example E:ADDB)

Put this syntax into command prompt window

move DB to E:ADDB
Moving Active Directory database

Moving Active Directory database

and wait some time, while logs are being moved to the new location

Moving Active Directory database

Moving Active Directory database

As you could see in the screen above, AD DB was move with built-in command move while Active Directory services/Active Directory Domain Services are not running!

Let’s verify if Active Directory database was moved to specified location. Just check that using Windows Explorer and go to that location

New Active Directory database location

New Active Directory database location

or type in command prompt inside of ntdsutil

info
New Active Directory database location

New Active Directory database location

ok, Active Directory database was moved and I strongly suggest to move also its log files to the same location. For that you need to use the option

move logs to E:ADDB

where E:ADDB is a folder on your server

Moving Active Directory logs

Moving Active Directory logs

and wait some time, while logs are being moved to the new location

Moving Active Directory logs

Moving Active Directory logs

OK, let’s verify if Active Directory logs were moved to specified location. Just check that using Windows Explorer and go to that location

New Active Directory logs location

New Active Directory logs location

All logs are in the same location as AD database. You can also verify that within ntdsutil typing

info
New Active Directory logs location

New Active Directory logs location

Now, you need to schedule System State backup of your Domain Controller to have an up-to-data backup with AD database and its logs in the new location.

That’s all, you may close ntdsutil by typing quit twice

Leaving ntdsutil

Leaving ntdsutil

and now it’s time to start Active Directory Domain Services service, type in command-line

net start NTDS
Starting Active DIrectory Domain Services service

Starting Active DIrectory Domain Services service

just verify if these services were also started with AD DS service (should be ran automatically)

  • File Replication Service (NtFRS)
  • Kerberos Key Distribution Center (KDC)
  • Intersite Messaging (IsmServ)
  • DNS Server (DNS)

if so, you’re done!

Author: Krzysztof Pytko

Authoritative SYSVOL restore (FRS)

 

In my previous article “Non-authoritative SYSVOL restore (FRS)” I showed you, how to do a non-authoritative restore of SYSVOL.

What if you have bigger mess on your Domain Controllers with SYSVOL?
What if the most of DCs do not replicate SYSVOL or its changes?

What can you do, if you want to restore SYSVOL from a backup and you prefer it as a replication source?  Then you have another option, authoritative SYSVOL restore.

Today, I will show you, how to do that.

But, first of all. What is the basic difference between non-authoritative and authoritative SYSVOL restore?

In the first case (non-authoritative) you only touch SYSVOL on one DC at the time. The rest of your Domain Controllers are running and sharing SYSVOL for users. Only this particular DC has disabled SYSVOL during non-authoritative restore procedure.

The second case (authoritative) is much more visible for users. All of Domain Controllers do not run and share SYSVOL where Group Policies and logon scripts are located. When you decide to do authoritative SYSVOL restore, you need to inform all administrators to not create/modify Group Policies during that time. All other domain services are running except access to SYSVOL. So, this action should be performed out of office business hours.

How to start authoritative SYSVOL restore? What do you need to do first?

You should identify which Domain Controller is holding PDC Emulator operation master role. As you know, one of its functions is to manage and maintain GPOs. When you create or modify existing GPO, it is done directly on this Domain Controller.

If you need to restore SYSVOL from backup, it should also be done directly on PDC Emulator operation master role holder, from which you will initiate authoritative SYSVOL restore.

So, let’s see, how we can do that.

Log on to PDC Emulator FSMO role holder. If you do not know, which Domain Controller holds this role, run in command-line/elevated command-line on any of your DCs

netdom query fsmo
Finding PDC Emulator role holder

Finding PDC Emulator role holder

and you’ll see which DC is holding this role.

When you are logged on on this Domain Controller, you need to evaluate how many DCs are in your domain. The most simple way to check that is using Microsoft DS tools on a DC. Type in command-line

dsquery server -name * -limit 0 | dsget server -dnsname | find /v "dnsname" | find /v "dsget" >c:dcslist.txt
Collecting all Domain Controllers in a domain

Collecting all Domain Controllers in a domain

after you ran this command, on your DC’s C-Drive, you should find a text file named dcslist.txt Check its content, there are all Domain Controllers for your domain

All Domain Controllers in a file

All Domain Controllers in a file

On all of those Domain Controllers, you have to stop File Replication Service before you will be able to initiate authoritative SYSVOL restore, type in command prompt

net stop ntfrs
Stopping File Replication Service

Stopping File Replication Service

When you are sure that all of Domain Controllers have stopped FRS service, you can start restore.

You need to run registry editor on your PDC Emulator operation master role holder

Executing registry editor

Executing registry editor

and go to BurFlags value location

HKEY_LOCAL_MACHINESystemCurrentControlSetServicesNtFrsParametersBackup/RestoreProcess at Startup
BurFlags value location

BurFlags value location

to be able to modify BurFlags value, double-click on it and put D4 (hexadecimal) as a value

Setting BurFlags value

Setting BurFlags value

This sets Domain Controller as an authoritative source for SYSVOL replication. All other DCs will pull SYSVOL content from this server.

Now, you have to start File Replication Service on PDC Emulator role holder DC. Type in command-line

net start ntfrs
Running File Replication Service

Running File Replication Service

Refresh (F5 key) registry editior and you should see that BurFlags value is reset to 0

BurFlags value reset

BurFlags value reset

Check File Replication Service event log and search event IDs

  • 13566
  • 13516

If both of them are available then authoritative restore is configured.

Now, you need to log on to the rest of Domain Controllers and set up D2 BurFlags value to initialize non-authoritative restore of SYSVOL from specified server.

BurFlags value should be changed in the same location as for the previous DC, but instead od D4 value you have to specify D2

Location of this value is

HKEY_LOCAL_MACHINESystemCurrentControlSetServicesNtFrsParametersBackup/RestoreProcess at Startup
BurFlags value location

BurFlags value location

Double-click the value and set up D2 (hexadecimal)

Changing BurFlags value

Changing BurFlags value

Before you will start FRS service, I would suggest to delete content of these 2 folders

  • %WINDIR%SYSVOLdomainPolicies
  • %WINDIR%SYSVOLdomainScripts

Note! (by default, if you changed SYSVOL location during DC promotion, you need to refer to your own location)

Warning! When you set up D2 BurFlags value, you need to know that during restoration time, your DC is prevent to be a Domain Controller! So, you need to be careful in locations/Sites where you have only single DC or you are going for authentication over WAN-link!

Now, you need to run File Replication Service and wait a while for SYSVOL replication.

After you ran FRS service, you should notice that BurFlags entry was reset to 0

BurFlags value reset

BurFlags value reset

From time to time, refresh File Replication Service event log and check for event ID 13516

When you see this event ID that SYSVOL replication is finished and your Domain Controller is ready to share SYSVOL for users.

SYSVOL re-initialized

SYSVOL re-initialized

When you see event ID 13520 that means, you did not remove content of policies and scripts folders. Do not worry they were moved to another folder which may be removed after all

SYSVOL content moved

SYSVOL content moved

All you need to complete the authoritative SYSVOL restore is to log on to EVERY Domain Controller and perform D2 BurFlags set up

Information! Microsoft does not recommend doing more than 15 concurrent non-authoritative restores to prevent performance issues. Remember that when you are doing authoritative restore in bigger Active Directory environments!

And that’s all! You fixed your broken SYSVOL share.

<<< Previous part

Author: Krzysztof Pytko