Jason Yoder, MCT

If you need to populate users or domain group in the built-in groups on your clients, you have 2 choices.  You can use restricted groups.  The problem with restricted groups is that they will remove any existing members of that group and prevent you from adding anymore without using Group Policy.  Another option is to your GPO preferences. Create a GPO to hold this GPO preference. Edit the policy and expand Computer Configuration / Preferences / Control Panel Settings . Click Local Users and Groups and then right mouse click it. Select New –> Local Group In the Action drop down list, ensure Update is selected.  The Update action will not remove the group if it already exists.  If it does not exist, the group will be created. In the Group Name field, type the name of the group that you want to add members to. Under Members , click Add. Click OK when completed. Apply this policy to the appropriate portion of Active Directory. Refresh ...

During a DFSR sysvol migration on Windows Server 2008, problems can occur with the migration of Read Only Domain Controllers. See the image below. The RODC is stuck trying to move to the Prepared state.  First go to the RODC and type Repadmin /SyncAll /AeD .   On the PDC Emulator, run dfsrmig /GetMigrationState . If the migration completed, continue on.  If not type dfsrmig /CreateGlobalObjects . This will manually create the global objects for DFS replication. On the PDC Emulator, run dfsrmig /GetMigrationState . You should be ready to move on to the next step in the migration process.

When it comes time to remove a zone from a DNS server, you can accomplish this task with PowerShell   We are going to remove a zone called Test.Contoso.com .   Log into your DNS server with an account that has the permissions to delete the zone.   Open PowerShell and type the following command.   Get-WMIObject –NameSpace “Root\MicrosoftDNS” –Class MicrosoftDNS_Zone | Where-Object {$_.Name –eq “Test.Contoso.Com”} | Remove-WMIObject   You may need to close and then reopen the DNS console to see the zone completely removed.

A new feature of Server 2008 R2 allows you to recover a server from a completely failed hard drive.  The Image restore capability is a combination of using Windows Server Backup and Windows Recovery Environment (WinRE). Windows Server Backup is utilized to create the image where WinRE is used to apply the image. To create the image, first install Windows Server Backup feature on your server. Open Server Manager Click Features . Click Add Features Scroll down the list and click Windows Server Backup Features and then click Install/Next until the installation completes. Next, create a bare metal recovery image Open Windows Server Backup Create a backup.  In this example, we are clicking Backup Once . Make sure Different options is selected and then click Next . For this demonstration, we are going to select Custom . Full Server will also work.  By using Custom , we can select Bare Metal recovery and take the minimum data required. In the Select Items...

Some attributes that you can pull from Active Directory may have a hyphen in them.  That makes them a bit difficult to work with in PowerShell.  When PowerShell sees the hyphen, it assumes that you just put a cmdlet in the wrong place.  To handle a hyphenated attribute, you need to rename that property.  For this example, I am going to use the msDS-ResultantPSO.  Take a look at the code below. $UserList = Get-AdUser -filter * -property msDS-ResultantPSO | Select name , @ { Name = "ResultantPSO" ;Expression = { $_ . "msDS-ResultantPSO" }} The @ symbol tells us we are about to rename a property.  In the first section inside double quotes, we declare the new name of the property.  In the Expression portion, we tell PowerShell what attribute we want to rename.  Notice we use the $_. to tell PowerShell to look at the current object passed to it for this attribute.  From here on out, this property is now referred to as msDsResultantPSO...

Below is a list of commands that I picked up from TechNet Magazine.  Remember that SCONFIG now replaces some of these in Server Core 2008 R2. Here are links to more information on SCONFIG How to open the firewall How to add a users to the Local Administrators group How to move a Server Core 2008 R2 from a domain to a workgroup Add Server Core to a domain Setting IP Addresses Change Windows Update settings Rename Server Core Enable Remote Desktop on Server Core     Control desk.cpl - View or set display settings. Control intl.cpl - View or set regional and language options, including formats and the keyboard layout. Control sysdm.cpl - View or set system properties. Control timedate.cpl - View or set the date, time, and time zone. Cscript slmgr.vbs –ato - Activate the operating system. DiskRaid.exe - Configure software RAID. ipconfig /all - List information about the computer’s IP address configuration. NetDom RenameComputer - Set the server’s name and ...

To test this out, I used NETDOM QUERY FSMO to make sure that all the FSMO roles were on the server that I was about to demote to a member server. When DCPromo was executed, the FSMO roles were transferred to another DC.

When a client boots on your network, it needs to bind to a domain controller for authentication and to receive Group Policy.  It is always a best practice to have at least DCs per AD site.  Both DCs will allow for a client to bind to them.  If you want one DC to be preferred over the other, you simply need to change one property in DNS.   On one of your DCs, open the DNS console. Expand Forward Lookup Zones Expand <Domain name> .  In this case Contoso.com Expand _Sites Expand <Site name .  In this case Default-First-Site-Name . Expand _TCP Double click the resource record of the server that you do not want as the primary domain controller for this site.   Change the priority to something other than zero.  Zero is the highest priority.  This will tell clients to attempt to bind to the other DC before attempting to bind to this one.  

It is rare these days that I use a DS command, but in this case it worked out well.  Use the command below do return the attributes that are currently stored on in the Global Catalog in your domain.  This command was executed with administrative level permissions on a Domain Controller.  Replace YourDomain with the correct LDAP information. dsquery * "cn=Schema,cn=Configuration,dc=YourDomain,dc=com" -filter "(&(objectCategory=AttributeSchema)(IsMemberOfPartialAttributeSet=TRUE))" -attr LDAPDisplayName -limit 0   The resulting list are the attributes in Active Directory that are also in the Global Catalog.

    PSO’s (Password Setting Objects) is another name for Fine Grain Password Policy.  A PSO allows an organization to have different password policies based on a security group.  That means that unlike in an Windows 2003 domain where all password meet the same rules, in a 2008 domain you can have multiple rules for your passwords.   The code below allows you two obtain a list of all user accounts that have a PSO assigned to and that PSO is.  It is designed to be used as a function or dot sourced into PowerShell.   <# . SYNOPSIS Returns a list of user names and there PSO . . DESCRIPTION Returns a list of user names and the Resultant PSO that is currently in effect on that user . . EXAMPLE Get - PSOUsers Returns a list to the pipeline of the username and the PSO currently in effect on the user account . . EXAMPLE Get - PSOUsers | Sort - Object PSO Returns a list...

In Hyper-V R1, we had the option to export out a VM and then later import it back in again.  For many in testing environments, this created large export files when only the VM with a specific snapshot was needed.  With Hyper-V R2 we can now create a new VM from a snapshot of another one.  This is advantageous because now you can create an entire new VM without all the extra files from other snapshots that you may not want.  Take a look at my screen shot below of my snapshot tree. Let’s say that I want to create a new VM from this one. Apply the snapshot that you want to use as the base for the new VM. Right click the VM and select Export.  Give it a location and click Export . One thing that I do not like about this process is that you will not see any progress bars or other indicators to let you know when the export is finished.  Your VMs will not be able to start until the export is completed.  If you look in the destination that you specified, ...

  This demo is tested on Windows 8 Server Developer Preview Server Core has been something that many Network Administrators shy away from due to the text based interface. Windows gain much of their market share by the graphical interface and pulled market share from Novel and Unix in the 90’s. Why did Microsoft go back? Well, look at it from my perspective:   Fewer updates mean less reboots. Without the extra code needed to generate the GUI, you have fewer vulnerabilities. Best of all, fewer resources required for the OS means more resources available to the applications.   In Windows Server Core 2008 R1, we had to execute many command lines and scripts to do basic tasks. With the R2 version, the sconfig menu driven interface relieved us of much of the memorizations of NETSH and scripts. We still needed to manually install roles and features through the text environment. We had the ability to manages those roles and features from a full installation of Win...

  This procedure is tested on the Developer Preview. Windows 8 Developer Preview has now been out for a few weeks.  I’ve given it a try on a touch device and thought that it work well.  I let my class try it out and they gave it positive comments.  Windows 8 Server Developer Preview is also out, but it is only available for MSDN subscribers.  Well this week we did an extra server installation exercise using Windows 8.  Following are a few of the screen shots from the installation   This installation is from a CD onto a virtual machine. First up came the “What language do you speak” screen. So far nothing different from Windows 2008 R2.  Click Install . Here is a hint at what is to come. Notice the Full and Server Core is still present.  The new one is Features On Demand .  Full Installation is selected for this demo. The usual license agreement. Since this is a fresh installation, we are going to select Custom . Still not...