Welcome to Dirteam.com/ActiveDir.org Blogs Sign in | Join | Help
 
 
in Search

Paul Bergson

  • Active Directory Cleanup - The Most Common Question I See

    I am out in the Microsoft NewsGroups and quite often I see someone having trouble with their Active Directory (AD) domain.  The number one issue I see is they will lose a Domain Controller (DC) and just move on without realizing that without letting the rest of the DC’s know that this machine is not coming back –or– they attempt to reintroduce a DC back into the domain with the same name without cleaning up the metadata within AD.

     

    To clean up AD after a lost DC is relatively simple and a script has been released that now makes it so there is no need to use ntdsutil.  The few times I have had to clean up AD, I still use the manual method but I like to feel in control of things and see what is happening.  There should be nothing wrong in using the script.

     

    The KB article to manually cleanup the metadata is 216498

    The TechNet script to clean up the metadata is linked here addmvb04

     

    Once you have cleaned things up you still have to go into Active Directory Sites and Services and remove the lost DC from the site in which it belonged.  This is a requirement even if you had a successful demotion.  The steps for this are outlined at the end of each section within the manual cleanup.

  • Disabling IPv6 on Windows 2008

    I have run into nothing but trouble with IPv6.  Not that there is anything in particular that is wrong, but not all apps understand and can work with it.  For example I am running a geographically dispersed cluster on a Windows server with 2008 Exchange 2007 on a Dell 2950.  I am getting these odd Event Log errors 2501, 2601 and 2604. 

    When updating security for a remote procedure call (RPC) access for the Exchange Active Directory Topology service, Exchange could not retrieve the security descriptor for Exchange server object xxxxxxx - Error code=8007077f.  The Exchange Active Directory Topology service will continue with limited permissions.

    For my experience it turns out a tunnel adapter on the 2950 is mapping a DNS record on IPv6.  I thought I had disabled all the IPv6 pieces but I was mistaken. 

    The following recipe should be what is needed to disable all pieces of IPv6 on Windows Server 2008 (As well as Vista) as well as enabling ping on IPv4.


    Enable Pings, Firewall doesn't allow IPv4 pings
                    Server Manager / Configuration / Windows Firewall with Advanced... / Inbound Rules
                                    Action / New Rule
                                                    Select Custom
                                                                    Next
                                                    Select All Programs
                                                                    Next
                                                    Protocol Type = ICMPv4
                                                                    Next
                                                    Local Ip Address = Any
                                                    Remote IP Address = Any
                                                                    Next
                                                    Select allow the connection
                                                                    Next
                                                    Check Domain
                                                    Check Private
                                                    Check Public
                                                                    Next
                                                    Name = IPv4
                                    Finish
     
    Network
                    Right Click Network Places
                    Select Manage Network Connections For each enabled and used NIC
                                    Right Click - Local Area Connection - Select Properties
                                                    Networking Tab                               
                                                                    DeSelect IPv6
                                                    Close
     
    Disables tunneling but not the loopback interface
                    Regedit  (For additional info http://technet.microsoft.com/en-us/library/bb878057.aspx)
                                    Add the following key
                                                    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6Parameters\DisabledComponents
                                                                    DWORD => FFFFFFFF
     
    Change the Nic Provider Order
                    Network Connections
                                    Advanced
                                                    Advanced Settings
                                                                    Provider Order
                                                                                    Move Microsoft Windows Networks to the top

  • Bare Metal Backup and Recovery of a Windows 2008 Server with WBAdmin

    I work in a shop where we are unable to roll out the latest version of Veritas' NetBackUp (NBU) do to bugs.  Although the version 6.5.3 now supports Windows 2008, it can't provide a clean backup that can be trusted so we needed to find a way to roll out a backup product.  So while we wait for Veritas to get its act together (One year and counting) we have chosen to backup our Windows 2008 physical machines using WBAdmin.  Our virtual machines are all backed up via snapshotting technology so this is not a factor.  So as we start to roll out physical machines I built this set of details (Which is still in flux).  The nice thing about the details below is it will allow you to do a rebuild w/o having to preload anything.  It even partitions the disk for you, this is really a slick technology.

     

    What does this have to do with AD you might ask?  Well we need to roll out 2008 and we have to have a reliable means to backup our DC's, so this is it.  I'm not sure if others are in the quandry we are but if so, I hope this helps out.

     

    The info below is for backing up machines to an external disk using unc for the destination.  Unfortunately you can't schedule these through the backup gui.  This option is only available for backing up a disk to another local disk, I'm not sure why WBAdmin won't allow unc pathing but trust me that it won't work.  So you will have to build a scheduled task to run your nightly backup.

     

    Hopefully the info below will be of assistance and please let me know of any issues you find with this article.

     

    Backing up a Windows Server 2008 with snapshot enabled:

    wbadmin start backup -backupTarget:\\servername\sharename  -include:c:,e: -quiet –vssfull

     

    wbadmin 1.0 - Backup command-line tool

    (C) Copyright 2004 Microsoft Corp.

     

    Retrieving volume information...

     

    This would backup volume systems(C:) to \\servername\sharename.

     

    Backup to \\servername\sharename is starting.

     

    Creating the shadow copy of volumes requested for backup.                                               

    Running backup of volume systems(C:), copied (1%).

    Running backup of volume systems(C:), copied (4%).

    Running backup of volume systems(C:), copied (98%).

    Backup of volume systems(C:) completed successfully.

    Backup completed successfully.

     

    Summary of backup:

    ------------------

    Backup of volume systems(C:) completed successfully.

     

     

    Finding out the versions currently available to restore:

     wbadmin get versions -backuptarget:\\servername\sharename

     

    wbadmin 1.0 - Backup command-line tool

    (C) Copyright 2004 Microsoft Corp.

     

    Backup time: 11/25/2008 10:55 AM

    Backup target: Network Share labeled \\servername\sharename

    Version identifier: 11/25/2008-16:55

    Can Recover: Volume(s), File(s), Application(s), Bare Metal Recovery, System State

     

     

    Finding out what specifically is available within a version backup:

    wbadmin get items -Version:11/25/2008-16:55

     

    wbadmin 1.0 - Backup command-line tool

    (C) Copyright 2004 Microsoft Corp.

     

    Volume Id = {7896551d-751d-11dd-8929-806e6f6e6963}

    Volume 'systems', mounted at C:

    Application = Registry

    Component = Registry (\Registry)


    Recover a Failed System:

    Boot up the machine with a W2K8 install disk                             (Make sure to use the correct bit length x32 or x64)

                    … Windows is loading  files…

    Accept English

    Next

    Select “Repair Your Computer”

    Click “Load Drivers”

                    Ok

                                    Browse the media for the drivers        (Make sure to use the correct bit length x32 or x64)

                                    Click Add Drivers

    Next

     

    Would recommend you verify that you have a good network connection by checking the nic’s activity lights.  I had issues with a nic on a couple of different occasions that boiled down to a bad network connection.

     

    Select “Windows Complete PC Restore”

    Cancel

                    Select Restore a Different Backup

                                    Next

                    Select Advanced

                                    Select Search for a backup on the network

                                                    Yes

                                                                    \\ip address of server\sharename

                                                                                    Ok

                                                                    Enter domain\domain user id and password

    Select the backup to restore

                    Next

    Select the drive(s) to restore

                    Next

    Select Exclude Disks

                    Select any disk you may want to exclude from the restore

                    Select Advanced

                                    Deselect Restart computer…   (This is done for visual inspection to verify that the restore went correctly)

                    Next

    Finish

    Confirm reformatting

                    Ok

  • Troubleshooting Active Directory Issues

    There are a number of different issues that can create problems with Active Directory:

    When someone has troubles and unclear as to why I usually suggest the following:
    Run diagnostics against your Active Directory domain.

    If you don't have the support tools installed, install them from your server install disk.
    d:\support\tools\setup.exe

    Run dcdiag, netdiag and repadmin in verbose mode.
    -> DCDIAG /V /C /D /E /s:yourdcname > c:\dcdiag.log
    -> netdiag.exe /v > c:\netdiag.log (On each dc)
    -> repadmin.exe /showrepl dc* /verbose /all /intersite > c:\repl.txt
    -> dnslint /ad /s "ip address of your dc"

    **Note: Using the /E switch in dcdiag will run diagnostics against ALL dc's
    in the forest. If you have significant numbers of DC's this test could
    generate significant detail and take a long time. You also want to take
    into account slow links to dc's will also add to the testing time.

    If you download a gui script I wrote it should be simple to set and run
    (DCDiag and NetDiag). It also has the option to run individual tests
    without having to learn all the switch options. The details will be output
    in notepad text files that pop up automagically.

    The script is located on my website at
    http://www.pbbergs.com/windows/downloads.htm

    Just select both dcdiag and netdiag make sure verbose is set. (Leave the
    default settings for dcdiag as set when selected)

    When complete search for fail, error and warning messages.

    Description and download for dnslint
    http://support.microsoft.com/kb/321045

     

Powered by Community Server (Personal Edition), by Telligent Systems