Paul Bergson

Active Directory Cleanup - The Most Common Question I See

pbbergs — Wed, 10 Jun 2009 01:30:00 GMT

I am out in the Microsoft NewsGroups and quite often I see someone having trouble with their Active Directory (AD) domain. The number one issue I see is they will lose a Domain Controller (DC) and just move on without realizing that without letting the rest of the DC’s know that this machine is not coming back –or– they attempt to reintroduce a DC back into the domain with the same name without cleaning up the metadata within AD.

To clean up AD after a lost DC is relatively simple and a script has been released that now makes it so there is no need to use ntdsutil. The few times I have had to clean up AD, I still use the manual method but I like to feel in control of things and see what is happening. There should be nothing wrong in using the script.

The KB article to manually cleanup the metadata is 216498

The TechNet script to clean up the metadata is linked here addmvb04

Once you have cleaned things up you still have to go into Active Directory Sites and Services and remove the lost DC from the site in which it belonged. This is a requirement even if you had a successful demotion. The steps for this are outlined at the end of each section within the manual cleanup.

Disabling IPv6 on Windows 2008

pbbergs — Fri, 20 Mar 2009 01:36:00 GMT

I have run into nothing but trouble with IPv6. Not that there is anything in particular that is wrong, but not all apps understand and can work with it. For example I am running a geographically dispersed cluster on a Windows server with 2008 Exchange 2007 on a Dell 2950. I am getting these odd Event Log errors 2501, 2601 and 2604.

When updating security for a remote procedure call (RPC) access for the Exchange Active Directory Topology service, Exchange could not retrieve the security descriptor for Exchange server object xxxxxxx - Error code=8007077f. The Exchange Active Directory Topology service will continue with limited permissions.

For my experience it turns out a tunnel adapter on the 2950 is mapping a DNS record on IPv6. I thought I had disabled all the IPv6 pieces but I was mistaken.

The following recipe should be what is needed to disable all pieces of IPv6 on Windows Server 2008 (As well as Vista) as well as enabling ping on IPv4.

Enable Pings, Firewall doesn't allow IPv4 pings
                Server Manager / Configuration / Windows Firewall with Advanced... / Inbound Rules
                                Action / New Rule
                                                Select Custom
                                                                Next
                                                Select All Programs
                                                                Next
                                                Protocol Type = ICMPv4
                                                                Next
                                                Local Ip Address = Any
                                                Remote IP Address = Any
                                                                Next
                                                Select allow the connection
                                                                Next
                                                Check Domain
                                                Check Private
                                                Check Public
                                                                Next
                                                Name = IPv4
                                Finish

Network
                Right Click Network Places
                Select Manage Network Connections For each enabled and used NIC
                                Right Click - Local Area Connection - Select Properties
                                                Networking Tab
                                                                DeSelect IPv6
                                                Close

Disables tunneling but not the loopback interface
                Regedit (For additional info http://technet.microsoft.com/en-us/library/bb878057.aspx)
                                Add the following key
                                                HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6Parameters\DisabledComponents
                                                                DWORD => FFFFFFFF

Change the Nic Provider Order
                Network Connections
                                Advanced
                                                Advanced Settings
                                                                Provider Order
                                                                                Move Microsoft Windows Networks to the top

Bare Metal Backup and Recovery of a Windows 2008 Server with WBAdmin

pbbergs — Tue, 03 Feb 2009 00:45:00 GMT

I work in a shop where we are unable to roll out the latest version of Veritas' NetBackUp (NBU) do to bugs. Although the version 6.5.3 now supports Windows 2008, it can't provide a clean backup that can be trusted so we needed to find a way to roll out a backup product. So while we wait for Veritas to get its act together (One year and counting) we have chosen to backup our Windows 2008 physical machines using WBAdmin. Our virtual machines are all backed up via snapshotting technology so this is not a factor. So as we start to roll out physical machines I built this set of details (Which is still in flux). The nice thing about the details below is it will allow you to do a rebuild w/o having to preload anything. It even partitions the disk for you, this is really a slick technology.

What does this have to do with AD you might ask? Well we need to roll out 2008 and we have to have a reliable means to backup our DC's, so this is it. I'm not sure if others are in the quandry we are but if so, I hope this helps out.

The info below is for backing up machines to an external disk using unc for the destination. Unfortunately you can't schedule these through the backup gui. This option is only available for backing up a disk to another local disk, I'm not sure why WBAdmin won't allow unc pathing but trust me that it won't work. So you will have to build a scheduled task to run your nightly backup.

Hopefully the info below will be of assistance and please let me know of any issues you find with this article.

Backing up a Windows Server 2008 with snapshot enabled:

wbadmin start backup -backupTarget:\\servername\sharename -include:c:,e: -quiet –vssfull

wbadmin 1.0 - Backup command-line tool

Retrieving volume information...

This would backup volume systems(C:) to \\servername\sharename.

Backup to \\servername\sharename is starting.

Creating the shadow copy of volumes requested for backup.

Running backup of volume systems(C:), copied (1%).

Running backup of volume systems(C:), copied (4%).

Running backup of volume systems(C:), copied (98%).

Backup of volume systems(C:) completed successfully.

Backup completed successfully.

Summary of backup:

------------------

Backup of volume systems(C:) completed successfully.

Finding out the versions currently available to restore:

wbadmin get versions -backuptarget:\\servername\sharename

wbadmin 1.0 - Backup command-line tool

Backup time: 11/25/2008 10:55 AM

Backup target: Network Share labeled \\servername\sharename

Version identifier: 11/25/2008-16:55

Can Recover: Volume(s), File(s), Application(s), Bare Metal Recovery, System State

Finding out what specifically is available within a version backup:

wbadmin get items -Version:11/25/2008-16:55

wbadmin 1.0 - Backup command-line tool

Volume Id = {7896551d-751d-11dd-8929-806e6f6e6963}

Volume 'systems', mounted at C:

Application = Registry

Component = Registry (\Registry)

Recover a Failed System:

Boot up the machine with a W2K8 install disk (Make sure to use the correct bit length x32 or x64)

… Windows is loading files…

Accept English

Select “Repair Your Computer”

Click “Load Drivers”

Browse the media for the drivers (Make sure to use the correct bit length x32 or x64)

Click Add Drivers

Would recommend you verify that you have a good network connection by checking the nic’s activity lights. I had issues with a nic on a couple of different occasions that boiled down to a bad network connection.

Select “Windows Complete PC Restore”

Cancel

Select Restore a Different Backup

Select Advanced

Select Search for a backup on the network

Yes

\\ip address of server\sharename

Enter domain\domain user id and password

Select the backup to restore

Select the drive(s) to restore

Select Exclude Disks

Select any disk you may want to exclude from the restore

Select Advanced

Deselect Restart computer… (This is done for visual inspection to verify that the restore went correctly)

Finish

Confirm reformatting

Troubleshooting Active Directory Issues

pbbergs — Tue, 27 Jan 2009 01:38:00 GMT

There are a number of different issues that can create problems with Active Directory:

When someone has troubles and unclear as to why I usually suggest the following:
Run diagnostics against your Active Directory domain.

If you don't have the support tools installed, install them from your server install disk.
d:\support\tools\setup.exe

Run dcdiag, netdiag and repadmin in verbose mode.
-> DCDIAG /V /C /D /E /s:yourdcname > c:\dcdiag.log
-> netdiag.exe /v > c:\netdiag.log (On each dc)
-> repadmin.exe /showrepl dc* /verbose /all /intersite > c:\repl.txt
-> dnslint /ad /s "ip address of your dc"

**Note: Using the /E switch in dcdiag will run diagnostics against ALL dc's
in the forest. If you have significant numbers of DC's this test could
generate significant detail and take a long time. You also want to take
into account slow links to dc's will also add to the testing time.

If you download a gui script I wrote it should be simple to set and run
(DCDiag and NetDiag). It also has the option to run individual tests
without having to learn all the switch options. The details will be output
in notepad text files that pop up automagically.

The script is located on my website at
http://www.pbbergs.com/windows/downloads.htm

Just select both dcdiag and netdiag make sure verbose is set. (Leave the
default settings for dcdiag as set when selected)

When complete search for fail, error and warning messages.

Description and download for dnslint
http://support.microsoft.com/kb/321045