NLtest to see the local PC trust within the Domain

One of the frequent asked questions is that, suddenly the server or workstation drops out the domain and cannot establish successful logon. I have seen such scenarios even on Exchange servers, where administrator goes to AD finds the computer account for the exchange server and clicks on "reset" by mistake, don't ask me how but seriously I have seen this happen at client side.

I have also seen after P2V (Physical to virtual) computer secret is broken and they could not log on to domain. The fix for all these were taking these computers out the domain and adding them back to the domain and re-establish the secure channel between PC, or server to Domain controllers.

The security channel's password is stored along with the computer account on all domain controllers. For Windows 2000 or Windows XP, the default computer account password change period is every 30 days

Below is some very useful information in regards to how windows based computing works with local secret and how this can be reset ?

Each Windows-based computer maintains a machine account password history that contains the current and previous passwords that are used for the account. When two computers try to authenticate with each other and a change to the current password is not yet received, Windows relies on the previous password. If the sequence of password changes exceeds two changes, the computers involved may not be able to communicate, and you may receive error messages. For example, you may receive "Access Denied" error messages when Active Directory replication occurs.

You cannot change the machine account password by using the Active Directory Users and Computers snap-in, but you can reset the password by using the Netdom.exe tool

The Netdom.exe tool resets the account password on the computer locally (known as a "local secret") and writes this change to the computer's computer account object on a Windows domain controller that resides in the same domain. Simultaneously writing the new password to both places ensures that at least the two computers involved in the operation are synchronized, and starts Active Directory replication so that other domain controllers receive the change.

Now the question is, is there any way to find out if the trust is broken or in place, to answer this question follow the below examples and investigate each output.

The utility called nttest is used for to test trust relationships

The workstation that is a member of the TESTD domain has an implicit trust with a domain controller

• C:\>nltest /server:vmdc2 /sc_query:smtp25
  
• To determine if a domain controller can authenticate a user account:
  
• C:\>nltest /Whowill:smtp25 zz-oozugurlu
  
• NLTEST can be used to find a trusted domain that has a given user account.
  
• C:\>nltest /finduser: zz-oozugurlu
  
• To determine the domain controllers in the ESS domain:
  
• C:\>nltest /dclist:smtp25
  
• To determine the user
  
• C:\>nltest /user: zz-oozugurlu

Technet

KB 325850

Oz ozugurlu

MVP (Exchange)

MCITP (EMA) , MCITP (EA ) MCITP(SA),

MCSE (M+,S+) MCDST, Security+, Server +,Project+

Blog: http://www.smtp25.blogspot.com

Active Directory 2008

Active directory for no question is the most important constituent in Microsoft networking. Most people will not even realize all the other applications runs on top of the AD and its .DIT database. Recent AD cleanup work I have done for a large client made me start seeing, AD in a different perspective. Exchange is only one of these applications, which depends heavily or will die without Active directory. Active directory will need healthy DNS in order to function properly or else, it will suffer from many diseases such as not being able to locate the resources client needs or the replication. Below some of good information, I decided to summarize.

Therefore, the equation goes this way

• Exchange=AD=DNS (=, needs)
  

The interaction with AD Database for most of the administrator starts with daily operational tasks. This includes creating users, groups and similar task. The fact to matter is every time these type of task is being performed the administrator touches or modifies the .DIT database by using ADUC ( active directory users and computers snaps in)

.DIT database is partitioned database and there are 3 partitions constitute the .DIT database.

• Domain
  
• Configuration
  
• Schema
  

AD DS (Active directory, domain services) database is stored by default in the

• %Systemroot%/NTDS/NTDS.dit ( Directory information tree)
  

Below are the components of the .DIT database

	Interfaces=LDAP,MAPI
	NTDSa.dll
	DSA
	DATABASE LAYER
	ESE (Esent.dll)

Lightweight Directory Access Protocol (LDAP)

LDAP v3 is the most common interface used by directory clients to locate information in the directory store. LDAP v3 is backward compatible with LDAP v2. Clients can use port 389 (the standard LDAP port), port 636 (LDAP secured by SSL), port 3268 (for global catalog lookups), and port 3269 (Global catalog LDAP secured by SSL) to access the LDAP interface. Clients can also use UDP Port 389 for both LDAP and Netlogon (this interface is used to locate domain controllers).

Messaging API (MAPI)

MAPI is used by messaging clients such as Outlook to access the Microsoft Exchange Server data stored in the data store. Exchange Server 2000 and later use the AD DS data store to store all recipient information, and the MAPI interface enables messaging clients to access the Global Address List (GAL). MAPI uses RPC communication.

The DSA

DSA runs as Ntdsai.dll on each domain controller) provides the data store access interfaces. In addition, the DSA enforces directory semantics, maintains the schema, guarantees object identity, and enforces data types on attributes. When clients or other domain controllers need to access the directory store, they used one of the supported interfaces to connect (bind) to the DSA and then search for, read, and write to AD DS objects and their attributes.

The database layer resides in Ntdsai.dll

It provides an internal interface between the DSA and the directory database. The DSA cannot directly connect to the database; applications go through the database layer. The database layer also provides an object view of the directory database, making the data accessible to the DSA as a set of hierarchical containers.

The database layer is also responsible for the creation, retrieval, and deletion of individual records (objects), attributes within records, and values within attributes.

The Extensible Storage Engine (ESE)

A Windows component is used by AD DS, as well as by several other Windows components, as an interface to the database. The ESE is responsible for indexing the data in the database file and for transferring the data in and out of the database. It also maintains the rows and columns that comprise the database. Its purpose is to enable applications to store and retrieve data. The ESE also implements the transactional process for committing changes to the database.

The data store stores directory information in a single database file. In addition, the data store also uses transaction log files, to which it temporarily writes uncommitted changes, as well as committed transactions prior to committing them to the database.

Domain

• Domain is boundary of replication
  

• Domain is boundary of DNS name space.
  
• Domain is boundary of administration.
  
• Domain is also boundary of authentication
  

Domain Controller:

• Authentication server is domain controller.
  

DNS

• Domain name service/System
  
• We use DNS the reference object and locate the services offers by a domain,
  
• In addition, DNS is required to locate computer, services and any other information is available in the active directory.
  

Global Catalog server

• Global Catalog server is a central repository. The global catalog server has a partial, read-only replica of all other domain directory partitions in the forest .All domains in the Tree share common global catalog server.GC contains references to all objects in active directory regardless, which domain the (objects) are created. That is why global catalog server is very important
  
• Without a global catalog, search requests received by a domain controller for an object in a different domain would result in that domain controller referring the query to a domain controller in the object domain
  
• Global catalog queries are identical to any other LDAP query against a Windows Server 2008 domain controller. The only difference is that the global catalog query uses TCP port 3268 rather than TCP port 389, which is the standard LDAP port. If a domain controller that is also a global catalog server receives a query on port 389, it will not search the global catalog for objects in other domains.
  

User Logons

Global catalog servers are also used when processing user logons.

• Every time a user logs on to a domain, a global catalog server is contacted.
  
• This is because nonglobal catalog domain controllers do not contain any information about universal group membership.
  
• Universal groups can contain user and group accounts from any domain in a particular forest.
  
• Since universal group membership is forest-wide, group membership can only be resolved by a domain controller that has forest-wide directory information
  

In order for an accurate security token to be generated for the user-seeking authentication, the global catalog must be contacted to determine the user's universal group membership.

Windows Server 2008 supports a feature known as universal group membership caching that makes it possible to log on to a Windows Server 2008 network without contacting a global catalog. Universal group membership can be cached on nonglobal catalog domain controllers after a user has logged on to that domain controller.

After this information is obtained from a global catalog, it is cached on the domain controller for the site indefinitely and is periodically updated (by default every 8 hours). Enabling this feature results in faster logon times for users in remote sites, as the authenticating domain controllers do not have to access a global catalog

Tree

Hierarchy of domains forming contiguous name space that maps to the DNS infrastructure. What defines three is contiguous name space.

• Father.com
  
• Son.Father.com
  
• Sister.Father.com
  

There are not many differences in AD 2003 versus AD 2008. There are several improvements in AD 2008, but having a good solid base on AD 2003 will cover almost 85 percent of the knowledge in my opinion. The recent book I am reading "Windows serer 2008 Active Directory Resource Kit" Microsoft Press book does have great information in this regard. If you would want to get AD 2008 book this one is highly recommended.

Oz Ozugurlu

MVP (Exchange)

MCITP (EMA), MCITP (SA)

MCSE 2003, M+, S+, MCDST

Security+, Project +, Server +

Blog: http://www.smtp25.blogspot.com

Netlogon and DHCP Client service

I remember asking many times in the interviews, about the DHCP client service. Here is the question, if exchange server has, or should configured with static IP address, why do we need to keep DHCP client service to be running? On it. Wouldn't ,it be better to disable it, and make exchange a little bit stronger, considering the best practice, is to disable services you don't need?

Active Directory is Multi-mater replication model with DNS integration. Many times, I refer the DNS as dynamic repository, where Servers, Workstation and other network applications publishes their own records (name and IP addresses and services, they provide) for client to locate them and offer these services to be used. Domain controllers will publish records in DNS claiming, they are domain controllers and they provide domain controller services to the clients, such as authentication service at the very basic and other similar services, such as DHCP, DNS, Remote access, Web services, Print Services, Multimedia, FTP, file service etc.

The servers are responsible for registering dynamic records into the DNS database. They also, refresh and update their own records. The servers refresh these records every 24 hours, by the help of NetLogon Service. (Domain controllers), the refresh process can be forced by restarting NetLogon service on the domain controllers if it is necessary for troubleshooting purpose.

When workstation starts, it will register host record (A records) into the DNS, and claim to be a workstation, along with the computer name and the IP address. Sometimes network administrators are adding these records into the DNS manually for various reasons as well.

The dynamically added records also will be refreshed, automatically every 24 hours. The way to force these records is to issue simple Ipconfig /RegisterDNS command or restarting the DHCP Client service. From Command line issuing below command simply will do the work, or if you prefer GUI, you need to go to services.msc snap in and locate the DHCP service and manually do the same steps.

• net stop DHCP
  
• net start DHCP
  

You will remember one of my previous posts telling a little story about DHCP client service. An Exchange administrator for an X company one day gets bored and he decides to make some improvements on production Exchange systems. He realize the exchange servers have static IP addresses , and he tells himself, why do I need DHCP client service running, let me disable them, and give more power to the Exchange boxes, and we disables the "DHCP client service" and leaves work early the same day without letting anyone the new improvements he has introduced.

Later on 12 exchange servers for X company gone crazy, and mail outage starts. Company spend quite a bit of time to figured of what was going wrong, they try to call the exchange admin and cannot reach him and try the most famous way to fix the problems, reboot the mail servers one by one. However, this even wont not do any good since the exchange admin not only stop the "DHCP client service" but also he sets them to disable permanently. Anyway the short story after reboot they end up calling Microsoft PS exchange support and Microsoft figures out in less than one minute the DHCP Client service was set to disable, they turn the service on ( restart) and set it to start automatic, and problem goes away.

I do not know what happened to Exchange admin on the X Company, but I heard he was in big trouble the next day. Manually created records in DNS will not get any time stamp and therefore they cannot become stale.

Make sure your DHCP client service is not set to disable on your exchange server (-: and do understand what it does

Oz Ozugurlu,

Systems Engineer

MCITP (EMA), MCITP (SA)

MCSE 2003, M+, S+, MCDST

Security+, Project +, Server +

Read-Only Domain Controller (RODC) and Exchange 2007

A Read-Only Domain Controller (RODC) is a new type of domain controller in Windows Server 2008. Its main purpose is to improve security in office branches.

The idea behind the RODC is real good; I was very much impressed with even not having GUI at all. What really no good is that, Exchange won't be able to use RODC. This really made me upset, and I cannot stop thinking, why, why, why? Another culprit is that after installation of RODC you bumped into DOS, "hey we have power Shell finally, why not have the power Shell there, as default instead of having poor limited, DOS? Why, why, why?

Anyway, I hope someone will hear out our voice and make changes. Separating server roles is a great idea in my opinion. Windows suffered enough so far for having everything on the default server installation, this includes, games, Windows media player and all other bunch of services gets installed on default windows. I never did understand having solitaire, or windows media player on your root DC/GC. The examples I brought up might be minor details, but in reality it indicates the mentality.

Anyway, when I was talking our Microsoft consultant today, he told me Exchange could not use RODC, which made me upset. Just like in AD. Today we deployed OCS (Office communication server) all groups appeared on the default container for the OCS. Why is it so hard to put them into its own OU, why why, why? Why we don't have account called service account with different Icon, so that we can distinguish from regular user account

I believe little things make difference, and we would love to see those in the near future

Best Regards

Oz ozugurlu Systems Engineer

MCITP (EMA), MCITP (SA),

MCSE 2003 M+ S+ MCDST

Security Project+ Server+

oz@SMTp25.org

http://smtp25.blogspot.com

WHAT IS THOMBSTONE PROCESS

What is Tombstone process and what happens to these objects is going to be the content of this little article. If you ever wonder what happens when an object gets , deleted in active directory, keep reading this article.

Tombstone Process in a basic way

• Object got deleted
  
• AD marks is as deleted object by setting the objects attribute called "isDeleted" to TRUE ,
  
• At the same time, the AD strips most of the attributes from the object
  
• Renames the object
  
• Moves it to the object, to the special container in the object naming context
  
• (NC) named CN= Deleted Objects
  
• The object, now called a tombstone
  
• Object is no longer visible from ADUC. ( administrators)
  

Here is the tricky part the Tombstone is visible to the Active Directory replication process. Why is that so? Remember multi-master replication model. In order to make sure the deletion is performed on all the DCs that host the object being deleted, Active Directory replicates the tombstone to the other DCs. Thus the tombstone is used to replicate the deletion throughout the Active Directory environment

I never did understand why it is so painful try to bring deleted object in AD, with build in tools. What I mean is, if we look at third party tools, Quest, Hyena etc, it is couple clicks to bring the deleted object from AD. Anyway, I would love to see the build in capabilities in AD as good as these third part tools or at least some close, but I know it won't happen for some reason (-:

The tombstone lifetime is determined by the value of the TombstoneLifetime attribute on the Directory Service object in the configuration directory partition.

• Adsiedit
  
• Configuration
  
• DC name
  
• CD=Configuration
  
• DC=Forest domain
  
• CN=Services
  
• CN=Windows NT
  
• Right click CN=Directory Service properties
  
• The attribute name is TombstoneLifetime
  

On a domain controller in a forest that was created on a domain controller running Windows Server 2003 with Service Pack 1 (SP1), the default value is 180 days.

On a domain controller in a forest that was created on a domain controller running Windows 2000 Server or Windows Server 2003, the default value is 60 days.

Best Regards,

Oz Ozugurlu

Systems Engineer

MCITP (EMA), MCITP (SA)

MCSE 2003 (M+,S+) MCDST

Security+,Project+,Server+

http://smtp25.blogspot.com

Moving a Domain Controller to a Different Site

Moving domain controllers from one site to another one will require to re-IP the new domain controllers. What are the possible setbacks for this operation? The answer to this question become easy for us since we are in the middle of huge AD migration and have done it several times in production.

Here is the bullet point to consider when it comes to identify the existing services on the infrastructure domain controllers and decommissioned the old domain controllers.

1. Identify the FSMO roles on each domain
   
2. Distribute the FSMO roles according to MS best practices
   
   

   The schema master and domain naming master roles should be placed on the same domain controller as they are rarely used and should be tightly controlled.
   

• The infrastructure master should not be located on the same domain controller holding the RID master and PDC emulator roles if it is also a GC server.
  

1. Identify the services running from each domain controller such as
   

• DNS
  
• DHCP, DHCP scope portions
  
• WINS ( I hate WINS)
  
• CA ( certificate Authority)
  
• Web related services
  
• Terminal server (licensing server)
  

1. Application dependencies, relaying to existing domain controllers
   

• LDAP
  
• SLDAP
  

1. Make sure you plan the proper backup for active directory
   
   

   Use System stage backup or equivalent backup system to backup AD database and related files. Flat windows and file system backup is not proper backup for active directory. At least use scheduled NT backup, on the 2 or 3 DC's trough out the enterprise (there is no need to backup every single domain controller, simply this would be a redundant afford (multi master replication). The proper backup of AD, (system state backup) allows authoritative restore. If you can $$$ use third party tools for fast recovery and backup.
   

2. If you move paging file from C to another drive, remember a paging file equal to or larger than RAM size should be placed on the same partition as the operating system to allow crash dumps to be recorded.
   
3. Add the /DEBUG switch to the Boot.ini file to enable post-mortem debugs of your servers. Adding the debug switch causes a 2-3 percent decrease in server performance but allows a debugger to be hooked up once a crash has occurred for post-mortem debugging
   
4. Disable Unnecessary Services
   
   

   This is one of my favorite; I wish there were clearer instruction came with defaults installation.
   

• Disable Windows updates (Assuming you are using WSUS)
  
• Disable Wireless zero service
  
• Print spooler service, every enterprise at least one DC must be running it.
  

Domain controllers will re-register dynamic record in DNS, claiming to be the domain controller with the new IP address. Make sure all the name servers for each domain (in case child domains exist) got updated in DNS. IF you a have child domains exist make sure all name server have been exist

I never did understand why windows media player comes with default installation windows. If you are going to promote it to be a domain controller, who cares about windows media player running on a DC? Or the games. Windows 2008 server should have clear base line installations.

The IP addresses of existing Domain controllers might be used by several components on the production servers and there might be a dependency for these IP addresses, so keeping the existing IP addresses and transferring them to the new build Domain controller might be necessary or smart move to lessen the possible breakage on the production network.

Best practice methods for Windows 2000 domain controller setup

Size the server and the hard drive as mentioned in the previous posts I did while ago. The point is to understand what kind of operations the OS and the database operate under and how to improve the performance and redundancy.

At the basic with decent server (64BIT preferred)

FYI:

When you split the AD files across the disks as we have done, the following are the recommended exclusions; normally you'd have to figure these locations out via registry settings. Keep in mind these ONLY apply when you've split the AD files the way we've done.

C Drive ( 64 Bit windows 2003 SP2) 8 Gig memory	OS & Logs	RAID 1 + 0
D Drive ( NTDS)	SysVol & .DIT database	RAID 1 + 0
H Drive CD-Room

Best regards

Oz ozugurlu,

Systems Engineer

MCITP (EMA), MCITP (SA),

MCSE 2003 M+ S+ MCDST

Security Project+ Server+

oz@SMTp25.org

http://smtp25.blogspot.com

Who is your Active directory bridgehead server (ISTG)

When it comes to a bridgehead server in the world of exchange, we all would know there is no difference in Exchange 2000 and 2003, because role base administration and implementation was not clear at all, and there was not clear documentation guiding to get the servers hardened in this way.

So many of us installed exchange same way we install any other exchange and call it, this is Exchange bridgehead server. The most brilliant idea was to rename the mail stores on the BH server and the SG to, "Do not Create mail box" to prevent helpdesk to create mail box on the BH server. I remember still seeing helpdesk gets confused and cannot read, so they create mailbox on the BH server, and pisses all the exchange administrators.

What has changed in Exchange 2007? As we all know Role base administration is in place in exchange 2007, for administration and the implementation.

Old days we had (below roles are not really useful in a practical world)

• Exchange Full Administrator
  
• Exchange Administrator.
  
• Exchange View-Only Administrator.
  

Exchange 2007

• Exchange Organization Administrators
  
• Exchange Recipient Administrators.
  
• Exchange View-Only Administrators
  
• Exchange Server Administrators.
  

Server Roles as follows

• Mailbox (MB)
  
• Client Access (CA)
  
• Unified Message (UM)
  
• Hub Transport (HT)
  
• Edge Transport (ET)
  

Ok, now let's take a look at AD bridgehead server and ISTG (inter-site topology generator)

Windows 2000 Domain controllers each create Active Directory Replication connection objects representing inbound replication from intra-site replication partners. For inter-site replication, one domain controller per site has the responsibility of evaluating the inter-site replication topology and creating Active Directory Replication Connection objects for appropriate bridgehead servers within its site. The domain controller in each site that owns this role is referred to as the Inter-Site Topology Generator (ISTG).

• Open Active Directory Replication Monitor
  
• Add Site/Server Wizard from the Edit menu
  
• Add the server
  
• Right-click the name of the server just below the site name
  
• Select Generate Status Report
  
• After Active Directory Replication Monitor displays that the report is complete
  
• Save it on your PC
  
• Open it and locate
  
• "Enterprise Data" section of the report
  

Can we select ISTG in a site?. Yes but it is not recommended by MS

Bridgehead Server Selection

By default, bridgehead servers are automatically selected by the intersite topology generator (ISTG) in each site. Alternatively, you can use Active Directory Sites and Services to select preferred bridgehead servers. However, it is recommended for Windows 2000 deployments that you donot select preferred bridgehead servers.

Selecting preferred bridgehead servers limits the bridgehead servers that the KCC can use to those that you have selected. If you use Active Directory Sites and Services to select any preferred bridgehead servers at all in a site, you must select as many as possible and you must select them for all domains that must be replicated to a different site. If you select preferred bridgehead servers for a domain and all preferred bridgehead servers for that domain become unavailable, replication of that domain to and from that site does not occur.

If you have selected one or more bridgehead servers, removing them from the bridgehead servers list restores the automatic selection functionality to the ISTG.

Oz ozugurlu,

Systems Engineer

MCITP (EMA), MCITP (SA),

MCSE 2003 M+ S+ MCDST

Security Project+ Server+

oz@SMTp25.org

http://smtp25.blogspot.com

WHAT IS YOUR GUID?

Here is the question how you can identify the build in domain administrator account in your domain assuming ,The classic description filed for this account is wiped out and account is renamed Description would be Built-in account for administering the computer/domain. The answer to this question came so fast, within 10 seconds from Jason Weaver, senior systems engineer.

First step, Download sid2user

The easiest way is to copy the files into support tools directory so that you can execute from any level from dos (assuming you have already installed windows 2003 support tools on your workstation, otherwise you need to drill to the same directory where these two little executables will reside in. I use powers hell so it is up to you to use either power shell or classis CMD.

PS F:\> user2sid oozugurlu

• S-1-5-21-2026909314-1939897469-926709054-95328
  
• Number of subauthorities is 5
  

Nice I get my SID ID as above. What is a SID ID anyway?

When a new domain user or group account is created, Active Directory stores the account's SID in the Object-SID (objectSID) property of a User or Group object. It also assigns the new object a globally unique identifier (GUID), which is a 128-bit value that is unique not only in the enterprise but also across the world

SID:

• Security identifier A security identifier (SID) is a unique value of variable length that is used to identify a security principal or security group in Windows operating systems. Well-known SIDs is a group of SIDs that identify generic users or generic groups. Their values remain constant across all operating systems.
  

GUID:

• Globally Unique identifier, 128-Bit value unique across the word.
  
• SID: S-1-5-domain-500
  
• Name: Administrator
  

Description: A user account for the system administrator. By default, it is the only user account that is given full control over the system

• SID: S-1-5-domain-501
  
• Name: Guest
  

Description: A user account for people who do not have individual accounts. This user account does not require a password. By default, the Guest account is disabled

PS C:\> user2sid oozugurlu

S-1-5-21-2026909314-1939897469-926709054-95328

• Number of subauthorities is 5
  
• Domain is SMTP25
  
• Length of SID in memory is 28 bytes
  
• Type of SID is SidTypeUser
  

PS C:\> sid2user 5 21 2026909314 1939897469 926709054 500

• Name is manSMTP25
  
• Domain is SMTP25
  
• Type of SID is SidTypeUser
  

Don't forget as you see in above example I have taken out the – Dashes and leave it blank and added 500 at the end to determine the user account name for the build in administrator

It is not possible to delete the Administrator account? Well it is not if you try you will receive following errors "Cannot delete built in accounts" windows wont seem to be happy with you trying to delete this account, so it is impossible to delete it, you don't want to delete this account anyway, when DC is hosed up this is the only account can get in to the Domain controllers.

KB

Oz ozugurlu,
Systems Engineer
MCITP (EMA), MCITP (SA),
MCSE 2003 M+ S+ MCDST
Security Project+ Server+
oz@SMTp25.org

http://smtp25.blogspot.com

ENTERPRISE DOMAIN CONTROLLERS IMPLEMENTATION

Here is nice information for enterprise windows installation, SOP job aid. The table below is for splitting AD Database and logs with recommended way and configuring the RAID array and the hard drives for best performance. Installing 64 BIT Windows 2003 and 2008 has huge advantages; it is simply way faster than any other version of AD. Thanks a lot one more time, for Paul Yu, (Microsoft Consulting Services) for the great information.

FYI: when you split the AD files across the disks as we have done, the following are the recommended exclusions; normally you'd have to figure these locations out via registry settings. Keep in mind these ONLY apply when you've split the AD files the way we've done.

C Drive ( 64 Bit windows 2003 SP2) 8 Gig memory		OS & Logs	RAID 1 + 0
D Drive ( NTDS)		SysVol & .DIT database	RAID 1 + 0
H Drive CD-Room

Note:

If cost is a factor in planning for disk space, you can place the operating system and Active Directory database on one RAID array (such as RAID 0+1) and the Active Directory log files on another RAID array (such as RAID 1). However, it is recommended that you store the Active Directory database and the SYSVOL shared folder on the same drive.

AD Exclusions

• C:\WINDOWS\NTDS\Edb*.log
  
• C:\WINDOWS\NTDS\Res1.log
  
• C:\WINDOWS\NTDS\Res2.log
  
• D:\WINDOWS\NTDS\ntds.dit
  
• D:\WINDOWS\NTDS\Temp.edb
  
• D:\WINDOWS\NTDS\Edb.chk
  

SYSVOL Exclusions

• C:\WINDOWS\NTFRS\jet\sys\Edb.chk
  
• C:\WINDOWS\NTFRS\jet\Ntfrs.jdb
  
• C:\WINDOWS\NTFRS\jet\log\*.log
  

COMBINED LIST

• C:\WINDOWS\NTDS\Edb*.log
  
• C:\WINDOWS\NTDS\Res1.log
  
• C:\WINDOWS\NTDS\Res2.log
  
• C:\WINDOWS\NTFRS\jet\sys\Edb.chk
  
• C:\WINDOWS\NTFRS\jet\Ntfrs.jdb
  
• C:\WINDOWS\NTFRS\jet\log\*.log
  
• D:\WINDOWS\NTDS\ntds.dit
  
• D:\WINDOWS\NTDS\Temp.edb
  
• D:\WINDOWS\NTDS\Edb.chk
  
• D:\WINDOWS\sysvol\domain\DO_NOT_REMOVE_Ntfrs_Preinstall_Directory
  
• D:\WINDOWS\sysvol\staging\domain
  

Oz ozugurlu,
Systems Engineer
MCITP (EMA), MCITP (SA),
MCSE 2003 M+ S+ MCDST
Security Project+ Server+
oz@SMTp25.org
http://smtp25.blogspot.com

DHCP PROCESS Summary

Why do we need to know the DHCP lease Process? Because you are sitting in MCSE class, or you will try to go another job and someone in the interview, just like me will ask you the process. Perhaps you are doing troubleshooting why client is not getting IP address from DHCP server and you forgot to see the ports 67 and 68 was blocked. In any case knowing your stuff is going to make you smart and stronger. I recommend keep memorizing below simple process just in case if you ever been any of the situations I have speculated.

In TCP/IP little world a device cannot communicate to any other device unless it has an IP address. Now think about, XP client who has not have any IP address yet, able to locate the DHCP server and ask for an IP address. IN logic world you should say, hey wait a second how come client even can talk to DHCP server, client does not have any IP Address yet. ???????. If you wonder about the answer keep reading.

• At the time of the lease request, the client doesn't know what its IP address is, nor does it know the IP address of the server. To work around this, below how client is able to talk to a DHCP server
  
• Client uses 0.0.0.0 as its address and assumes 255.255.255.255 for the server's address.
  
• DHCP discover message on UDP port 68 and destination port 67.
  
• The discover message contains the hardware MAC address and NetBIOS name of the client.
  
• Once the first discover message is sent, the client waits 1 second for an offer. If no DHCP server responds within that time, the client repeats its request four more times at 2-, 4-, 8-, and 16 second intervals, if the client still doesn't get a response, it will revert to Automatic Private IP Addressing (APIPA) and Continue to broadcast discover messages every 5 minutes until it gets an answer. With APIPA, (169.254.X.Y) The Windows client will automatically pick what it thinks is an unused address.
  

DHCP lease is 4 way Process as listed below.

• DHCP – discovery (The discover message contains the hardware MAC address and NetBIOS name of the client.)
  
• DHCP - Lease offer
  
• DHCP - lease request
  
• DHCP- Lease acknowledgment
  

To keep memorize the process use simple map below

• DD ( DHCP Discovery)
  
• LO (Lease Offer)
  
• LR (Lease Request)
  
• LA (Lease Acknowledgment)
  

If this is not helping. Keep memorize the first one (- :

Discovering DHCP

Oz ozugurlu,
Systems Engineer
MCITP (EMA), MCITP (SA),
MCSE 2003 M+ S+ MCDST
Security Project+ Server+
oz@SMTp25.org
http://smtp25.blogspot.com

ACTIVE DIRECTORY DIAGNOSTIG LOG IN

We are familiar with diagnostic login in exchange. What happens if we need same type of capability for Active Directory? As you may know there is no place in the event log where diagnostic login can be turned on for AD related troubleshooting scenarios, such as troubleshooting KCC issues. The KCC (Knowledge consistency Checker) is a Microsoft Windows 2000 and Microsoft Windows Server 2003 component that automatically generates and maintains the intra-site and inter-site replication topology.

The KCC runs at regular intervals to adjust the replication topology for changes that occur in Active Directory, such as adding new domain controllers and new sites that are created. At the same time, the KCC reviews the replication status of existing connections to determine if any connections are not working. If a connection is not working, after a threshold is reached, KCC automatically builds temporary connections to other replication partners (if available) to insure that replication is not blocked.

On each domain controller, the KCC creates replication routes by creating one-way inbound connection objects that define connections from other domain controllers. For domain controllers in the same site, the KCC creates connection objects automatically without administrative intervention. When you have more than one site, you configure site links between sites and a single KCC in each site automatically creates connections between sites as well.if we want to make sure the KCC is completing successfully this would be one of the ways of doing it

Dcdiag /v /test: kccevent /s: nhqdtcdc4

(note: Nhqdtcdc4 is the name of my domain controller)

Testing server: JPK\NHQDTCDC4 Starting test: Connectivity * Active Directory LDAP Services Check * Active Directory RPC Services Check ......................... NHQDTCDC4 passed test Connectivity oing primary tests Testing server: JPK\NHQDTCDC4 Test omitted by user request: Replications Test omitted by user request: Topology Test omitted by user request: CutoffServers Test omitted by user request: NCSecDesc Test omitted by user request: NetLogons Test omitted by user request: Advertising Test omitted by user request: KnowsOfRoleHolders Test omitted by user request: RidManager Test omitted by user request: MachineAccount Test omitted by user request: Services Test omitted by user request: OutboundSecureChannels Test omitted by user request: ObjectsReplicated Test omitted by user request: frssysvol Test omitted by user request: frsevent Starting test: kccevent * The KCC Event log test Found no KCC errors in Directory Service Event log in the last 15 minutes. ......................... NHQDTCDC4 passed test kccevent Test omitted by user request: systemlog Test omitted by user request: VerifyReplicas Test omitted by user request: VerifyReferences Test omitted by user request: VerifyEnterpriseReferences Test omitted by user request: CheckSecurityError Running partition tests on : DomainDnsZones

If you are still having trouble with KCC what to do next? The next step is going to be turn on the diagnostic login for KCC. If you are thinking you have never seen this in event log, yes you are right, it would be nice if Microsoft included this into even log MMC, but we are not there yet (-:

Open regedit

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\ Diagnostics

• double-click on the diagnostics logging entry
  
• enter a number (05) based on how much you want logged
  

KKC should run every 15 minutes by default. The numbers are from 1 to 5 , 1 being minimum 3 being medium and 5 being maximum diagnostic login.

Here are the diagnostic logging settings for windows 2003

• Knowledge Consistency Checker
  
• Security Events
  
• ExDS Interface Events
  
• MAPI Interface Events
  
• Garbage Collection
  
• Internal Configuration
  
• Directory Access
  
• Internal Processing
  
• Performance Counters
  
• Initialization/Termination
  
• Service Control
  
• Name Resolution
  
• Backup
  
• Field Engineering
  
• LDAP Interface Events
  
• Setup
  
• Global Catalog
  
• Inter-site Messaging
  
• Group Caching
  
• Linked-Value Replication
  
• DS RPC Client
  
• DS RPC Server
  
• DS Schema
  
• Replication Events
  

Oz ozugurlu,
Systems Engineer
MCITP (EMA), MCITP (SA),
MCSE 2003 M+ S+ MCDST
Security Project+ Server+
oz@SMTp25.org
http://smtp25.blogspot.com

Active Directory for daily operations

Below are some useful Shortcut keys for managing Active Directory for daily operations. I use most of these tools to perform administrator daily task. Knowing these shortcuts for sure is a good thing. Also Check the link on the bottom "Active Directory Product Operations Guide" I found the link incredibly useful.

• dnsmgmt.msc (DNS Manager)
  
• domain.msc (Active Directory domains and trusts)
  
• schmmgmt.msc (Active Directory Schema snap-in)
  
• dssit.msc (Active Directory Sites and Services)
  
• dsa.msc (Active Directory Users and Computers)
  
• DCPromo (Active Directory Installation Wizard)
  
  

  Dcdiag.exe (This command line tool analyzes the state of domain controllers in the forest or enterprise and reports any problems to assist in troubleshooting.
  adsiedit.msc (Used for editing Active Directory to add, delete, or move objects within the directory.)
  

• Netdiag.exe
  (Helps isolate networking and connectivity problems by performing a series of tests to determine the state of the network client.)
  
• Netdom.exe
  
• Ntdsutil.exe (Used to perform database maintenance of Active Directory, manage and control single master operations, and remove metadata left behind by domain controllers that were removed from the network without being properly uninstalled.)
  
• Repadmin.exe (diagnose replication problems between domain controllers.)
  

Active Directory Product Operations Guide

Oz ozugurlu,
Systems Engineer
MCITP (EMA), MCITP (SA),
MCSE 2003 M+ S+ MCDST
Security Project+ Server+
oz@SMTp25.org
http://smtp25.blogspot.com

Does the LSASS.EXE have enough memory, on your Domain Controller?

The Key performance of the DC (Domain Controller) is the how much of the database can be cached into the memory. The process is responsible from this task is the LSAAA.EXE caching mechanism, releases cache to free memory when OS requires it. The Domain controller who are not strong enough (low memory) will not be able cache as much and this will be noticeable performance issue on the Domain controller. Therefore it is a good idea to make sure the DC's have enough memory installed on them and the other processes are not eating up from DC memory.

The core Process LSASS.EXE is also responsible from replication, authentication, Net logon, and KCC. If the LSASS is not happy this is going to cause Busy and tired DC (Domain Controller). Any other process other than LSASS MUST be investigated on the domain controllers if they are utilizing most of the CPU resources on a Domain Controller.

The similar behavior in Exchange is the Store.exe if you remember.

What is LSASS.EXE, The LSAS management of local security authority domain authentication and Active Directory Management?

The Lsass.exe process is responsible for management of local security authority domain authentication and Active Directory management. This process handles authentication for both the client and the server, and it also governs the Active Directory engine. The Lsass.exe process is responsible for the following components:

• Local Security Authority
  
• Net Logon service
  
• Security Accounts Manager service
  
• LSA Server service
  
• Secure Sockets Layer (SSL)
  
• Kerberos v5 authentication protocol
  
• NTLM authentication protocol
  

Lsass.exe usually uses 100 MB to 300 MB of memory. Lsass.exe uses the same amount of memory no matter how much RAM is installed in the computer. However, when a larger amount of RAM is installed, Lsass can use more RAM and less virtual memory

Have you ever used Server Performance Advisor V1.0 this is FREE Utility from Microsoft. Service Performance Advisor is a server performance diagnostic tool developed to diagnose root causes of performance problems in a Windows Server™ 2003 operating system.

Best,

Oz Ozugurlu
Systems Engineer
MCITP (EMA), MCITP (SA),
MCSE 2003 M+ S+ MCDST
Security Project+ Server+

oz@SMTp25.org
http://smtp25.blogspot.com (Blog)

The KKC (Knowledge Consistency Checker)

The KKC (Knowledge Consistency Checker) is a build in process which creates the replication topology in active directory Forest. By default the KCC runs every 15 minute intervals and dictates the replication routes from a domain controller to another DC. To make it simpler, if you have a domain controller in site-B and you have created a user here. The user object is going to be added .DIT database on this domain controller. IF there is a domain controller on Site-A and they are not able to see the user object created on Site-B, this is because the replication is not happening form Site-B domain controller to the Site-A domain controller. There might ne number of different reasons why KCC cannot or don't want to create the KCC connection from site-B to Site-A. Thumb of rule is the figured out what culprit is.

Creating manual connections might save the day. The issue regarding AD replication might be connected to Exchange. A user go created the RUS is not stamping the user; therefore SMTP Proxy address never gets generated.

Note: Microsoft does not recommend creating manual connections, since KCC is automated process and design to figured out the best path for replication, Microsoft recommends

To create a manual connection goes to site and services, Extend Site, click server object, select NTDS settings

• Make a right click
  
• New active directory connection
  
• Select a domain controller from the list, click ok and finish.
  

Wait for changes gets replication in the AD topology. On the connector and choose replicate now.

The Purpose of KCC

Data integrity is maintained by tracking changes on each domain controller and updating other domain controllers in a systematic way. Active Directory replication uses a connection topology that is created automatically, which makes optimal use of beneficial network connections and frees the administrators from having to make such decisions.

What replicates with KCC?

• Each combination of directory partitions that must be replicated
  
• Domain controllers that store the same domain directory partition must have connections to each other
  
• all domain controllers must be able to replicate the schema and configuration directory partitions
  

The routes for the following combinations of directory partitions are aggregated to arrive at the overall topology

• Configuration and schema within a site.
  
• Each domain directory partition within a site.
  
• Global Catalog read-only, partial directory partitions within a site.
  
• Configuration and schema between sites.
  
• Each domain directory partition between sites.
  
• Global Catalog read-only, partial directory partitions between sites.
  

Terminology with KCC

• KCC runs every 15 minutes.
  
• The domain controllers that replicate directly with each other are called replication partners
  
• these partnerships are added, removed, or modified automatically, as necessary, on the basis of what domain controllers are available and how close they are to each other on the network
  
• KCC creates connections that enable domain controllers to replicate with each other
  
• A connection defines a one-way, inbound route
  
• Connection objects are created automatically by the KCC; they can also be created manually.
  
• Site Links
  

  For replication to occur between two sites, a link must be established between the sites. Site links are not generated automatically and can be created in Active Directory Sites and Services. Unless a site link is in place, the KCC cannot create connections automatically between computers in the two sites, and replication between the sites cannot take place. Each site link contains the schedule that determines when replication can occur between the sites that it connects. The Active Directory Sites and Services user interface guarantees that every site is placed in at least one site link. A site link can contain more than two sites, in which case all the sites are equally well connected
  

• Bridgehead Servers
  

  To communicate across site links, the KCC automatically designates a single server, called the bridgehead server, in each site to perform site-to-site replication. Subsequent replication occurs by replication within a site. When you establish site links, you can designate the bridgehead servers that you want to receive replication between sites. By designating a specific server to receive replication between sites, rather than using any available server, you can specify the most beneficial conditions for the connection between sites. Bridgehead servers ensure that most replication occurs within sites rather than between sites.
  

Best,

Oz ozugurlu