Jason Yoder, MCT

We are in the home stretch! Over the past two days we have configured DFS on both Windows Server 2003 R2 and Windows Server 2012 R2. Re have replicated out data and we are now ready to start the process of decommissioning out old server. Change the GPO to point to the new server and the new folder paths Once you are confident that replication has occurred and completed successfully, you can now modify your GPOs to point to the new server. Clients will continue to use the old server until they are using the new GPO. The DFS Replication will make sure their data is moved to the new server. Open Group PowerShell management Console . In the GPO that controls the user profiles, open: Computer Configuration à Policies à Administrative Templates à System à User Profiles Open Set User Home Folder Change the server in the UNC to the new server. Click OK , and close the GPO. Open the GPO that controls the file redirection User Configuration à Policies à Windows Settings à Folder Redirection ...

Yesterday we set of DFS on both Windows Server 2003 R2 and Windows Server 2012 R2.   Today we are going through the steps to set up our DFS Namespace and Replication so we can start the transfer of data.   Add the DFS Namespace On S1 (Windows Server 2013 R2), click Start à Administrator Tools à DFS Monument Right click Namespaces and then select New Namespace . In the Namespace Server window, type S1 and click Next If you receive this message about the Distributed File System Service is not running, click Yes In the Namespace Name and Settings window, provide the name for the namespace.   In this example, we will use UserData . Click Edit Settings and select Administrators have full access; other users have read and write permissions Click OK Click Next In the Namespace Type window, select Domain-based Namespace and click Next . Click Create . Click Close   Add the folder targets for both the home and the Redirected folders Expand Namespaces ...

Last week I delivered a Windows Server 2012 R2 class in Fort Wayne.   I had a real neat idea from the class pop up during the Distributed File System (DFS) content.   The class member’s situation was that he had over a terabyte of user home folders and redirected folders on a Windows Server 2003 R2 box and needed to move it to a Windows Server 2012 R2 box with minimal, if not zero, disruption to his 24-7 organization.   DFS sounds like a good idea, but would the two versions of DFS work together? This is part 1 of a 3 part series on how we accomplished this task.   We started off with this configuration: Our general process looks like this: ·          Install DFS Namespace and replication on both servers (S1 and S2). ·          Create a DFS Namespace on S1 that has references to both shares. ·          Create a DFS Replication Group between ...

This is one that I have been thinking about for a while. One of my students in a server 2008 class pointed me to an article that corrected my train of thought. The question is, why is the Everyone group granted access when a share is created? Remember, I’ve been an MCSE since Windows NT4. At that time, the Everyone group included all authenticated users, and those who were on the network anonymously. I found this to be a security vulnerability so I have been advising students to remove this and use the Authenticated Users group instead for general share access for your entire domain. (Caution, it you have a trust relationship set up with another organization, they are also a member of the Authenticated Users group.) This article from Microsoft explains that the anonymous users have been removed from the Everyone group. This change happened in Windows 2003/XP.

Backing up your EFS key can help you recover files in the event you suffer a hard drive loss.  Obviously this will not help recover lost file on the crashed hard drive.  For those encrypted files on the crashed hard drive, hopefully you have good backups.  To back up the EFS certificate on your client, you first need to make sure you have encrypted at least one file or folder.    Open a command prompt and type Cipher /y     This displays your EFS certificate thumbprint.  Now that we have established that you have one, lets back it up.  Type Cipher /x . Click OK . Provide a name for the file you want to export to certificate to. Provide a password and confirm it to protect the key.   To recover the certificate, you need to use the certificate mmc. The end user who owns the certificate must log on to the destination computer. Open MMC by typing mmc in the Run dialog box. In the File menu, click Add/Remove Snap-in ....

Kerberos is a time sensitive authentication system.  This is good.  The time tolerance helps to prevent a replay attack.  You can make this tolerance more or less stricter then the default of 5 minutes.  Network packets for Kerberos authentication that have a time stamp within the tolerance value, as compared to the domain controllers clock, is considered valid. For a local computer, you would open the local security policy. For a domain joined computer, open a GPO that applies to the client. For a Domain Controller, open the Default Domain Policy GPO. Expand: Computer Configuration / Policies / Windows Settings / Security Settings / Account Policies Open Maximum tolerance for computer clock synchronization Check Define this policy setting . Enter in the number of minutes you will allow clocks to be out of sync and click OK

The Global Catalog (GC) is used for searching objects in other domains in your forest.  Also some applications, like Exchange, use the Global Catalog to help provide their services.  The Global Catalog contains a Partial Attribute Set (PAS) of all the objects in a domain that users generally search for.  The GC is configurable in that you can choose to add properties of objects to be replicated in the GC.  Below is the step by step procedure to do so. Step 1 – Locate the Schema Operations Master You should perform this step on the Domain Controller that holds the Schema Operations Master Role.  It is true that Windows Domain Controllers are multi-master.  This means that a change on one will replicate to all.  However, there are certain functionalities that can only be performed by one DC at a time.  To get a list of the current FSMO (Flexible Single Master Operation) role holders: Click Start . Type CMD and press Enter . Type netdom que...

I never really understood the logic behind this one. By default, members of the Authenticated Users group can add up to 10 clients to your domain. I’ve tested this and it is true. I created a new user in my domain without given the user any special privileges and added a client to the domain without any issues. This is why it is so important to make sure you have redirected your default computer container to an OU that is heavily locked down. Another avenue to think about is if you are deploying software by user account. The user will be able to steal company software. Also, any malware on this rogue client will now be on your network. To change the default computer container that new computer objects will be placed, log into your Domain Controller and type this: Redircmp container-dn contain-dc For example redircmp OU=MyComputers,DC=Contoso,DC=com The burning question here is how to stop this from happening. On your Windows Server 2008 Domain controller, click Start...

This is an easy one liner in PowerShell. Open PowerShell V2. Once open, we need to access the Active Directory objects by typing Import-Module ActiveDirectory . Now Type Get-adcomputer –filter * -properties lastlogondate | Where {$_.LastLogonDate –le [DateTime]::Now.AddDays(-7)} We first use the Get-ADCopmuter cmdlet to access the computer objects in Active Directory. Setting –filter * allows us to work with all the computer objects. Next we added the –properties LastLogonDate . This is done because that attribute is normally now returned with the object. Second, we piped the output of the first command to the Where cmdlet. The $_.LastLogonDate variable looks at each input one at a time and grabs the LastLogonDate attribute for analysis. We then compare it to [DateTime]::Now.AddDays(-7) This command gets the current date/time from the host and subtracts 7 days from it. We then use the –le comparision operator (Less than or equal to) to determine if the dat...

Windows already protects your account passwords by first storing only a hash of the password, and then encrypting that hash.  You an increase protection of the database by either removing the SAM database encryption key to removable media, or by requiring a start-up password to unlock the database.  A word of caution, you will need a trusted administrator at the console of the server when you restart it to insert the media or type the password.  This document looks at setting up a password to unlock the SAM Database   On you Windows Server or client, click Start. Type SYSkey and press   Enter If User Access Control (UAC) is enabled, you may need to provide the proper credentials. Encryption Enabled should already be selected for you.  Click Update . Select Password Startup . Provide and confirm the password you want to lose. Warning: If you lose this password, you lose access to this computer. Click OK . Click OK at the confirmatio...

A server baseline allows us to so how changes we make to our servers affect the performance of the server. it also allows us to be, dare I say “proactive” in managing our servers. Creating a baseline involves collecting data that could lead to a bottleneck. A bottleneck is a point in the path that data travels in which it has to wait. If your data is stuck, so are your users. The data the you need to collect for a baseline will vary depending on what you have on that server. This document covers just the basics. For a basic baseline, we need to look at 4 areas: Processor, Network Interface Card (NIC), RAM, and the hard drives. We will be using the Windows Performance Monitor to collect this information for us. A baseline is taken over a period of time. Because of this, we will be using the Data Collector Sets in the Performance Monitor to do our collection. To start the Performance Monitor, click Start , type Perfmon and press Enter Expand Data Collector Sets . Right ...

In class we had some confusion between some NTFS permissions. Here is the official word from Microsoft on the ones in question. Modify - Users can view and modify files and file properties, including deleting and adding files to a directory or file properties to a file. Write - Users can write to a file. Read & Execute - Users can run executable files, including scripts. Read - Users can view files and file properties. After testing this, yes the user with only Write access to the folder and its files can also read them. Another part of this question is what happens to a high level permission when you explicitly remove some of the lower level permissions. With the Modify permission set, you are also given Read & Execute, List folder contents, Read, and Write . By removing Read permission, you also lose Modify and Read & Execute . If you remove Write you only lose Modify . Pay close attention to what rights you are giving, and removing from...

To help make things a little easier for you, Windows Remote Desktop Connection maintains a list of the clients that you have connected to. This makes it easier for you to re-connect to clients that you need to frequent log into remotely. The Remote Desktop Connection does not have a mechanism in the GUI to remove entries from this list. To do so, you must edit the registry. · Click Start . · Type regedit and press Enter . · Browse to HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default · In this case, the name of the computer in the list is QC6 · By removing this entry, you will remove it from the list in Remote Desktop. Reference: http://support.microsoft.com/kb/312169

With over 2400 possible GPO objects (and counting), it is difficult to know what objects exist without manually going through a GPO and looking at all of them. I recommend using Bing or Google and asking "How do it (insert issue here) in group policy?" But if you like doing more detailed research, below are some links that can help. Group Policy Home Page: http://technet.microsoft.com/en-us/windowsserver/grouppolicy/default.aspx Group Policy Settings Reference for Vista/2008: http://www.microsoft.com/downloads/details.aspx?FamilyID=2043b94e-66cd-4b91-9e0f-68363245c495&displaylang=en Group Policy Settings Reference for 2003: http://www.microsoft.com/downloads/details.aspx?FamilyID=7821C32F-DA15-438D-8E48-45915CD2BC14&displaylang=en

Windows Server operating systems utilize domain controllers for manage the networks communications and security. All the DCs work together to make the network majic happen. There are some roles that cannot be shared and must be localized on one domain controller. These roles are called the Flexible Single Master Operations (FSMO) roles. They include: · Schema: Used to expand the schema. · Domain Naming Master: Adds or removes domain or application partitions from active directory. · RID Master: allows new or existing DCs the ability to create user, computer, and security groups. · PDC Emulator: Send updates to legacy operating systems and is used by to update user and computer passwords. · Infrastructur master: Required to run ADPREP /ForestPrep . When a DC holding a FSMO role is unexpectedly lost, your network can experience problems. For normal down time, you transfer these roles using the graphical interface whi...