Jason Yoder, MCT

In the lab exercise for module 10 of MOC 6416C, One of the custom claims appears to not be working.  It is in fact working.  There simply is not any data in the appropriate field.  To correct this, open Active Directory Users and Computer on LON-DC1.  Open the properties for Spencer Low .  Click the Organization tab and enter a value in for the Job Title property.  Below you can see that I entered Purchasing Agent .   Now log onto LON-CL1 as Spencer and try it again, you will see the title field has the correct data. The lab instruction are correct with the exception of adding data to the Job Title property.

Remote Desktop has allowed network administrators to remotely manage servers for years.  While studying Remote Desktop settings this past week, we were looking at the possible experience settings below. From these settings, you can control how much visual data is set from the target server to your remote session on your computer.  The question was is there a way to set the experience level on the target server and override what the user wants?  Using group policy, you can.  Take a look at the settings below that can be found at Computer Configuration \ Policies \ Administrative Templates \ Windows Components \ Remote Desktop Services \ Remote Desktop Session Host \ Remote Session Environment To demo the target override, I set the GPO to Enforce Removal of Remote Desktop Wallpaper . Here is a very annoying desktop background that I put on my server while logged in locally. Below is the same view while logged in using RDP.   My RDP settings were set to Al...

A starter GPO allows you to create a template of GPO settings that can be used as a base for new GPOs.  Starter GPOs are stored in a slightly different location.  Group Polices are stored in the SYSVOL folder on a domain controller in domainname\Policies\{GUID}   When you create the Start GPO folder in Group Policy Manager, the StarterGPOs folder is create in the SYSVOL.  Here is where you will find the starter GPOs.

There are two places that you can leave comments in group policy.  The first place is in the root of the GPO.  Right click the GPO in the Group Policy Management Editor and select Properties . Then select the Comment tab.   Also, if you open an individual GPO property, you can see a comment field.     The question is how much information can these fields hold? I field up one of these fields with as much text as I could.  I then copied that data into a text file called Data.txt I then opened a PowerShell session and executed the command: (Get-Content Data.txt).Length The answer is 4095 characters

FIPS stands for Federal Information Processing Standards.  FIPS defines how federal computers systems will be secured and how they will talk to each other.  Windows XP and later can be configured for FIPS compliance.  In my 6416C class in New York, this question came from a room full of government employees.  They had an obvious interest in making sure what they had just learned on Network Policy Server could be considered for usage in their organizations.  The two TechNet articles below outline how to do this and some considerations to follow. Configure Wireless Clients running Windows 7 and Windows Vista for PEAP-MS-CHAP v2 Authentication The effects of enabling the "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing" security setting in Windows XP and in later versions of Windows

This one through me for a loop in class.  While talking about what SYSPREP does to a client, one of the members of the class pointed me to a very interesting article.  I have always been taught that the SID of the computer account is what Windows looks at for assigning security access.  Well, take a minute to read this blog post from Mark Russinovich at Microsoft.   OK, let’s put this to the test.  I took a VM from class and created an image of it.  I then deployed this non syspreped image to another VM and started it up in the same environment as the original.  The original was logged off and I had no trouble logging in.  After taking snapshots of the new VM and the DC, I went ahead and renamed the VM to LON-CL3.  In AD Users and Computers, the account associated with the original was renamed.   OK, I reapplied the snap shots and brought both identical VMs online.  I was able to log in on both.  On the original, I’m renam...

Server core is an excellent platform to host your Hyper-V environment. With the removal of the GUI, you lose potential attack vectors and gain more hardware resources that would otherwise be consumed in supporting the GUI. Below are the steps to install Hyper-V on server core and manage it. Once we have confirmed that our Server Core can communicate on the network, add the Hyper-V role Type Start /w ocsetup Microsoft-Hyper-V and press Enter. The command is case sensitive. When prompted, click Yes . After the reboot, enable remote administration by entering this line: netsh advfirewall firewall set rule group=“Windows Management Instrumentation (WMI)” new enable=yes If you are running Server Core R2, you can use the SConfig command. Type Sconfig and press Enter Select option 4 Select option 1 At this point, you should be able to use a Windows 7 machine with RSAT installed to remotely manage your Hyper-V environment.

You will need to be logged in as an administrator (or elevate your privilege level) to complete this task. First you need to register your Schema snap in before we can use it. Click Start. Type cmd and press Enter . Type regsvr32 schmmgmt.dll and press Enter . Click OK when prompted. Type Exit and press Enter . Click Start , type MMC and press Enter . Click File and then click Add\Remove Snap-ins Click Active Directory Schema and then click Add Click OK Right click Active Directory Schema and then click Change Active Directory Domain Controller… Click  Type a Directory Server name[:port]here; Type the DNS name, NetBIOS name, or IP address of the server hosting the AD LDS instance.  In this example, the server name is MCT-1 . Now click on the enter you just made in the Change Directory Server window and then click OK . You can now view the classes and attributes of your AD LDS instance.

AD LDS allows you to provide directory services to applications that are free of the confines of Active Directory.  To list all the AD LDS instances on a server, follow this procedure: Log into the server in question Open a command prompt. Type dsdbutil and press Enter Type List Instances and press Enter . You will receive a list of the instance name, both the LDAP and SSL port numbers, the location of the database, and its status.

You can expand the functionality of the AD Recycle Bin to your Active Directory Lightweight Directory Services (AD LDS) deployments.  This example assumes that we have an AD LDS instance called ‘ App1 ’. It will be on a server called ‘ MCT-1 ’ in a domain called ‘ MCTNET.com ’. We can attach to it on port 53414.  The application partition is ‘ CN=App1,DC=MCTNET,DC=COM ’ On the server hosting the AD LDS instance, open PowerShell. First verify that your Forest functional level is Windows Server 2008 R2. Type Get AD-Forest and press enter.  You can see from the results below that we are at the correct forest functional level. Open a command prompt with administrative credentials. Change your directory to c:\Windows\Adam . Type Ldifde.exe –i –f MS-ADAM-Upgrade-2.ldf –s MCT-1:53414 –b administrator MCTNET Pa$$w0rd –j . –$ adamschema.cat For your environment replace:   MCT-1 with the name of your server. 53414 with the port number of the AD LDS instance ...

Active Directory Lightweight Directory Services allow you to create a directory service that allows applications to have access to user accounts, groups, and authentication similar to Active Directory Domain Services.  The big advantage here is that the schema of the directory service will not be bound by the rules of an Active Directory database.  Exchange 2007/2010, for example, use an instance of AD LDS on the Edge Transport Server to provide for user authentication from the internet.  Because your Active Directory database is not exposed to the internet, this is more secure. Applications will handle most of the dirty work should they require AD LDS.  You may want to make sure the database is being backed up and also have a restore plan in place.  Should the database become corrupt, the application that uses that database will fail.  This document will walk you through backing up and restoring an instance of AD LDS using the dsdbutil.exe command. Fi...

Deletion Protection is a feature that prevents an OU from being accidently deleted.  This is a feature of Windows Server 2008.  For those servers upgraded from Windows Server 2003, Deletion Protection is not turned on.  Until now the only way to turn on the Deletion Protection is manually.  Well, now you can use PowerShell V2 to take care of this for you. Windows PowerShell V2 comes installed on Windows 7 and Windows Server 2008 R2. For previous versions of Windows, you can download PowerShell V2 from here: http://support.microsoft.com/kb/968930 You will also need to make sure the Active Directory Module for Windows PowerShell is installed.  This can be found as a feature in the Remote Server Administrator Tools . The First step is to launch the PowerShell environment.  If you do not have an icon on the screen, you will find it is  Start \ All Programs \ Accessories \ Windows PowerShell \ Windows PowerShell Once the Shell loads, you need ...

A server baseline allows us to so how changes we make to our servers affect the performance of the server. it also allows us to be, dare I say “proactive” in managing our servers. Creating a baseline involves collecting data that could lead to a bottleneck. A bottleneck is a point in the path that data travels in which it has to wait. If your data is stuck, so are your users. The data the you need to collect for a baseline will vary depending on what you have on that server. This document covers just the basics. For a basic baseline, we need to look at 4 areas: Processor, Network Interface Card (NIC), RAM, and the hard drives. We will be using the Windows Performance Monitor to collect this information for us. A baseline is taken over a period of time. Because of this, we will be using the Data Collector Sets in the Performance Monitor to do our collection. To start the Performance Monitor, click Start , type Perfmon and press Enter Expand Data Collector Sets . Right ...

To set up the senerio for this question. A user had installed a DNS server on a Winodws Server 2008 Server Core installation and was managing it from a graphical interface on another server. When an attempt was made to look at the log files, the user received the error: Unable to complete the operation on “DNS Events”. The file size exceeds the limit allowed and cannot be saved. Upon further investigation, I found that the log file was actually empty. I also noticed that there were no zones configured for this DNS server. Once I created a forward lookup zone, I was able to open up the log.

According to Microsoft’s documentation , you can prevent the transfer of data by using AD RMS to restrict the Print Screen functionality. Here is an excerpt from that documentation: Microsoft Sharepoint is not required to install or use AD RMS. Using AD RMS with Microsoft Sharepoint can provide the following benefits: Helps to prevent an authorized viewer from copying, modifying, printing, faxing, or copying and pasting the content for unauthorized use Helps to prevent an authorized viewer from copying the content by using the Print Screen feature in Microsoft Windows Restricts access to content to a specified period of time, after which users must confirm their credentials and download the content again Helps to enforce corporate policies that govern the use and dissemination of content within your organization For additional information, see Microsoft Office SharePoint Server (MOSS)( http://go.microsoft.com/fwlink/?LinkId=154664 ).

Once you have activated your AD Recycle Bin, you can recover any deleted object from that point forward. To recover a deleted object, open the PowerShell Console with the AD modules. To do this on Server 2008 R2, Click Start \ Active Directory MOdule for Windows PowerShell . First we need to verify that the object is still in the AD Recycle bin. The account we are looking for in this example is User3 . Type the following line in the Windows PowerShell console: Get_ADObject – Filter {DisplayName –like “User*”} – IncludeDeletedObjects We can see the full name of the object that we need to recover, User3 . Now type: Get_ADObject – Filter {DisplayName –eq “User3”} – IncludeDeletedObjects | Restore-ADObject A quick check of Active Directory Users and Computers will show the restored object and all of its properties.

Active Directory Right Management Service (AD RMS) is a security tool that you can deploy to your users that allow them to determine what kind of access users or groups have to the content that a user generates. A very good question from class is how do you decrypt the data if you need to get access to it when you were not given AD RMS rights. The answer is with the AD RMS Bulk Protection Tool. You can download it from here ( http://www.microsoft.com/downloads/details.aspx?FamilyID=F9FBE58F-C175-41D0-AFDC-6F160AB809CD&displaylang=ru&displaylang=en ) Once you download the .msi file, double click it to allow it to install. Click Next Check I accept the terms in the License Agreement and click Next . Click Next Click Install Click Finish when the installation completes. To start using the AD RMS Bulk Protection Tool: Click Start / All Programs / AD RMS Bulk Protection Tool / AD RMS Bulk Protection Tool A special command prompt windows will ope...