Tomek's DS World : Downloads info

ILM 2007 SP1 … Exchange 2010 support

tomek — Thu, 28 Jan 2010 13:28:00 GMT

FIM 2010 is still being cooked in Redmond area but in the meantime we got brand new ILM 2007 Service Pack 1 package which just was published on Downloads web site. ILM 2007 SP1 is cumulative hotfix package but also it brings support for provisioning objects with Exchange 2010.

This is nice progress if you remember how long we had to wait for Exchange 2007 to be supported with ILM … way to go for future ILM team.

Information how to use ILM AD MA to provision objects to Exchange 2010 is published on Technet in Deploy Exchange 2010 in a Cross-Forest Topology article.

Whit Exchange 2010 support we also are getting a new code example and description “Prepare for Online Mailbox Move”. Quote from download description:

Microsoft Exchange Server 2010 supports online mailbox migration from a remote Exchange Server 2010, Exchange Server 2007, or Exchange Server 2003 forest to your Exchange 2010 forest. Prior to performing the online mailbox migration, mail-enabled users with a predefined list of attributes must be present in the target Exchange 2010 forest where the mailbox will be moved to. You can use either the sample code or the sample script to help with your online mailbox migration:

The ILM-based rules extension sample code demonstrates how to customize your current ILM deployment to create the required mail-enabled users in the target Exchange 2010 forest. For more information, see Prepare Mailboxes for Cross-Forest Moves Using the PrepareMoveRequest.ps1 script in the Shell. To download the feature pack, see Microsoft Knowledge Base article 977791 (Service Pack 1 (build 3.3.1139.2) is available for Microsoft Identity Lifecycle Manager (ILM) 2007 Feature Pack 1) .

The remote PowerShell-based sample script demonstrates how to run a PowerShell script to create the required mail-enabled users in the target Exchange 2010 forest. For more information, see Prepare Mailboxes for Cross-Forest Moves Using Sample Code.

Enjoy your reading …

Snapshot recovery tool strikes back

tomek — Wed, 28 Oct 2009 15:16:38 GMT

Some time ago, when Windows 2008 was released I had some spare time (where are those days) and I wanted to master some of my .NET coding skills. What is better than find an idea to use them … and that’s how 1Identity Snapshot Recovery Tool was created.

Snapshot Recovery Tool is command line tool which might be used to un-delete existing tombstone and later to populate all or some of attributes with data from directory services snapshot data.

Snapshots is nice feature introduced in Windows 2008 which allows you to inspect Active Directory content at given point in time when snapshot was taken. My opinion is that this was half-backed attempt to introduce something like Recycle Bin which is present now days in W2008R2. But hey .. it was there so I decided to use it.

Using this tool and snapshot data one can recover all attributes including links as in memberOf attributes for a user and member for a group.

It can recover single object or multiple objects based on GUID list or LDAP query.

Few words about original place where this tool was published – 1Identiyt. 1Identity was initiative of mine to build an independent network of directory services and identity experts which would build tools and documentation … it didn’t worked this time. Mostly because lack of time from my side. Maybe one day I will get back to this idea.

In the meantime … snapshot recovery tool is back here on DirTeam.org and if You want it, and You can find use for it … feel free to use it.

Comments, bug reports and suggestions welcomed here or on t.onyszko@w2k.pl.

P.S.#1 I want to say big THANK YOU here for Jorge who has tested this tool and provided very useful feedback regarding functionality and bugs. And showed this tool few times at some (DEC\TEC) occasions.

P.S.#2 I also want to say Thank you to all of You who have tried this tool and liked it. I read some blog posts and comments about it and it was nice to read that my work has actually helped somebody.

(Web)Press review

tomek — Thu, 17 Sep 2009 11:11:06 GMT

During preparation to TEC sessions and during TEC I noted some topics to blog about in a future so I hope that I will find time to blog about them soon. I noted also some URLs to tools which are out there so today’s post is some kind of web press release.

Patch management. If you have ever wondered how to deploy updates maybe You will get interested in script which was posted by Brian Desmond on his blog. Pretty interesting if you will ask me. Worth to check.

Group nesting. If you are managing AD environment and You have nothing against using W2008R2 Powershell you might take a look at script posted on AD Powershell team blogs site. It allows You to select group and analyze how it is nested in other groups and even present it in (sic!) tree form. Nice example how to utilize R2 Powershell capabilities.

Speaking about R2 Powershell. As some of You may know these cmdlets are not utilizing LDAP but brand new AD Web Service which is also being shipped with R2. For down level DCs (look how quickly W2008 has become down level :) ) there is web download which delivers this service for Windows 2003 and 2008 DCs and ADAM \ AD LDS. It is called Active Directory Management Gateway and will allow You to manage these DCs with Powershell.

At the end something from other area – file server. New tool has hit Downloads web site – it is File Server Capacity Tool which comes in 32-bit i 64-bit flavor. I think name of this tool is self explaining.

So that’s all from web review for today …

ILM fix in Exchange 2007 roll-up 9

tomek — Fri, 17 Jul 2009 11:32:00 GMT

Exchange 2007 support in ILM 2007 has some tough history behind it. Lets not talk about painful past :). Even that this configuration (ILM and Exchange 2007) was available since Rollup 4 package with some fixes in Rollup 5 it wasn’t perfect. In some scenarios it still failed with MA export error caused by simple fact that update-recipient cmdlet used by ILM 2007 has ignored DC name passed by ILM in parameters on which operation should be performed. This caused sometime that this cmdlet was performing operations against DC which didn’t knew about the change being made. This problem is described in KB963379.

This had caused:

problems with creating user mailboxes
problems with updating user mailboxes after change to account was made
problems with hideing user mailboxes from address list.

For those who had experienced such problems good news is that latest Rollup Update 9 contains following fix as described in KB970162:

The Update-Recipient command does not update specified domain controller parameters when you use Identity Lifecycle Manager (ILM) 2007 to migrate mail users to mailbox users in Exchange Server 2007 Service Pack 1

Rollup Update 9 for Exchange 2007 can be downloaded from Microsoft Download web site.

Good to hear that this was finally fixed … I hope that this time for sure.

Microsoft IT (AD) Health Scanner

tomek — Tue, 07 Jul 2009 12:16:00 GMT

Take a lot of work, add 7 week old son and serious flue (which strikes 2 days after You got back from travel which incorporates transfer on some heavy used airports – first thought – pork ;) ) and you will get some silence on a blog. I hope that while my son will get older silence periods will get shorter and shorter :). To day just quick download announcement.

In my MS Downloads feed I came across a new tool called Microsoft IT Health Scanner released by Essential Business Server team. Later I found also blog entry on this tool on ESB team blog. I called it AD not IT in blog entry title as right now this is tool which is focused on running AD and AD related infrastructure tests for most common problems, as ESB team says based on most common issues solved by Microsoft support. Maybe in future it will run more tests as this tool has update mechanism included.

IT Health scanner runs around 100 tests including (quoting ESB blog):

(…)

Configuration of sites and subnets in Active Directory

Replication of Active Directory, the file system, and SYSVOL shared folders

Name resolution by the Domain Name System (DNS)

Configuration of the network adapters of all domain controllers, DNS servers, and e-mail servers running Microsoft Exchange Server

Health of the domain controllers

Configuration of the Network Time Protocol (NTP) for all domain controllers

(…)

Definitely looks interesting and my quick scan through result list (I will explain later why this was really quick scan) shows that these are really most common causes of problems in AD environments. This tool is intended to let you find these problems and provide links to article which will allow these problems to be resolved. As tool description states it is targeted for small to medium networks (which of course is different in definition across the world):

(…) recommended up to 20 servers and up to 500 client computers (…)

(I think that mostly because it runs with WMI and this might be a bit expensive for larger networks) but it still might be very useful for many environments.

Why my first touch with this tool was very quick … well as it states in its description it doesn’t support W2008R2 yet and all my virtual labs at this moment runs in full W2008R2 mode. Because of that my first approach to test it ended in discovery phase. But definitely I will build different lab and I will try to use it to analyze healthy AD and also directory with some issues.

Anyway … worth to remember … worth to have it in a toolbox.

PS. As it is a case in many automated scanning tools report should be read with understanding and caution ;) .

Geneva Beta 2

tomek — Sun, 31 May 2009 08:08:00 GMT

A bit late news but during TechEd which took place some time ago a new release, Beta 2 of Geneva family was announced. For those who are not familiar with Geneva it is code name for new family of products around federation and identity management.

(cc) loops

Geneva product family id build from three components (in very simple words):

Geneva Framework, which gives developer easy to use in .NET framework which will help them develop claims aware applications which may work with STS and CardSpace. Geneva Framework will make development of “identity aware” applications easier.
Geneva Server, which delivers next version of federation services on Windows Server platform. Geneva Server also delivers Security Token Service (STS) which can issue claims based on different data source (AD, AD LDS, SQL as a source is built into this beta). Geneva Server will also support federation between corporation world and cloud services.
Geneva CardSpace, which is new version of CardSpace client included in Windows as a client component. This version includes UI improvements and supports Geneva product line. More on this topic can be found in video posted on ID Element.

Geneva solutions can be downloaded through MSDN pages.

With Geneva Beta 2 release some additional materials was published which allows knowledge about Geneva to be expanded a bit. Those materials are:

Identity Developer Training Kit, which is self study material for developers how to enable applications with claims and how to work with Geneva. More about IDT can be found on Vittorio’s blog.
Complete set of VMS and step by step lab materials which allows quick start to play with Geneva in few common scenarios.
Geneva Interop Whitepapers, describing interoperability configuration between Geneva and Sun and Novell solutions.

To make this list complete ID Element released few new video materials related to Geneva and its new release. A lot of information for those who want to gain some new knowledge.

Today is Sunday (still) so new download info arrives

tomek — Sun, 26 Apr 2009 12:07:57 GMT

Sunday evening is a good time (after busy day and week) to scan through feeds and other things in my news inbox. I found two things which I want to share with you.

(cc) bobafred

First is a new version of Microsoft Product Support Reports. If you’ve worked with PSS there is good chance that you are familiar with those tools. If not – well MPS is just a bunch of scripts which gathers diagnostic information on a given machine. What is nice about it, is that they can gather this information in a context of given service. What is important for AD troubleshooting might not be so important for SQL. Worth to check and keep in toolbox.

Second link is long awaited “Active Directory Domain Services in the Perimeter Network (Windows Server 2008)”, which simply can be described as document which explains how to deploy RODC in perimeter network. It enhances concepts from RODC deployment guide published some time ago with perimeter network deployments. Have a fun.

“I’m PC” guy doing brain surgery

tomek — Sun, 15 Feb 2009 13:54:21 GMT

It was funny to watch “I’m PC” guy doing advising on brain surgery on last Battlestar Gallactica episod.

BTW – BSG after the break is probably best part of this series in its four seasons. Its a pity that it ends.

And to keep this post tech related – joe has released new ADFind version 1.40 with some new, nifty features. Check it out as well as BSG if You are sci-fi fan and you’ve never watched it (which isn’t very likely)

Quick download links

tomek — Sun, 25 Jan 2009 05:33:00 GMT

Kind of quiet here lately which means that in most cases a lot of things going on :) but not on the blog. But I’m planning to get back to more often blogging soon. Especially with ILM2 related topics. For now just few download information which I spotted on in my feeds.

(cc) edgenumbers

ADFIND – this is a tool which doesn’t have to be introduced (if otherwise I would advice to get to know with it). Joe has just released new 01.39 version. Few nice features, even more coming in 1.40.

Update Best Practice Guide for Securing Active Directory Installations document. I haven’t got time to look what exactly has been updated but it might be good to refresh the link.

Powershell is getting more and more popular among MS product groups so we have now Powershell cmdlets for ILM 2007 FP1. To be honest I haven’t got a time to familiarize myself what’s in it – planning to do this after next week..

PS. And yes .. Win7 is also available and I’m running it on my laptop for 3 weeks now. But everyone are writing about it so I’ve decided not to :).

ILM 2 RC – just quick download information

tomek — Sun, 02 Nov 2008 23:25:20 GMT

It looks like product group has made ILM 2 to reach Release Candidate (RC) stage and has been released for public download on the Microsoft Download.

Now it is the time to start seriously look at this new version.

RSAT is available for download

tomek — Tue, 25 Mar 2008 13:47:16 GMT

Wave of information has started to spread across the Internet that RSAT has been finally released for download. So here are links for RSAT download:

All of you who have deployed Windows Server 2008, especially as Core version should like this information.

Active Directory technical specification

tomek — Thu, 13 Mar 2008 11:02:28 GMT

In case somebody missed it - Microsoft has published lately technical specification for its products. Result of some trials before European Union Committee (I still don't like this institution).

Among other documents you can find there Active Directory Technical Specification. And now everything is clear about AD ... isn't it :).

Time to find some nice place and retire :).

SAP MA updated

tomek — Wed, 23 Jan 2008 13:27:09 GMT

For all interested - quietly SAP MA for ILM 2007 has been updated and published on Microsoft Downloads.

From what I know this update contains minor bug fixes made after initial SAP MA publish date back in May 2007. If You have this solution deployed in production remember to test this update first in test lab (You have test lab, do You? )

SAP MA has just arrived

tomek — Wed, 23 May 2007 11:43:00 GMT

Long awaited SAP MA for ILM 2007 (former MIIS 2003) has just been released.

Download is available on Microsoft Download page.

Fix for DNS RPC management interface security problem

tomek — Tue, 08 May 2007 13:03:00 GMT

Some time ago I wrote about a serious problem which is affecting DNS service, to be more specific management interface available through RPC. As DNS is one of heavily used service in Active Directory networks this is real problem.

With this month's security patches we can get fix for this problem described in MS07-029 security bulletin. This is one of serious flaws so my advice would be to test it in a test lab and apply on production as soon as it is possible according to Your patch deployment plan.

In this month total number of seven critical bulletins were released so it looks like it is wise to get to know with them and apply in our networks. All information about this month's security patches are on Technet site.