Read-Only Domain Controller (RODC) and Exchange 2007

A Read-Only Domain Controller (RODC) is a new type of domain controller in Windows Server 2008. Its main purpose is to improve security in office branches.

The idea behind the RODC is real good; I was very much impressed with even not having GUI at all. What really no good is that, Exchange won't be able to use RODC. This really made me upset, and I cannot stop thinking, why, why, why? Another culprit is that after installation of RODC you bumped into DOS, "hey we have power Shell finally, why not have the power Shell there, as default instead of having poor limited, DOS? Why, why, why?

Anyway, I hope someone will hear out our voice and make changes. Separating server roles is a great idea in my opinion. Windows suffered enough so far for having everything on the default server installation, this includes, games, Windows media player and all other bunch of services gets installed on default windows. I never did understand having solitaire, or windows media player on your root DC/GC. The examples I brought up might be minor details, but in reality it indicates the mentality.

Anyway, when I was talking our Microsoft consultant today, he told me Exchange could not use RODC, which made me upset. Just like in AD. Today we deployed OCS (Office communication server) all groups appeared on the default container for the OCS. Why is it so hard to put them into its own OU, why why, why? Why we don't have account called service account with different Icon, so that we can distinguish from regular user account

I believe little things make difference, and we would love to see those in the near future

Best Regards

Oz ozugurlu Systems Engineer

MCITP (EMA), MCITP (SA),

MCSE 2003 M+ S+ MCDST

Security Project+ Server+

oz@SMTp25.org

http://smtp25.blogspot.com

MCSE Class Ended on Last Saturday

Another MCSE Class ended on last Saturday. I wanted to say thanks to all of you attending the class and putting me up 120hr, lecture. I had a lot of fun and I hope you all did as well. Please complete all your exams and get in touch with me if you need anything.

My next MCSE class in starting on the June 21th, Saturdays and I will also be rolling into Exchange 2003 and 2007 class (combined Class). Those of you who have taken MCSE will know, exchange is the way to go (- : I am very much excited with exchange 2007 and it's all new look, futures. It will be a great class and I would love to see you there. I will also start teaching windows 2008 Classes scheduled within couple months.

Team,

Great job, good focus; and congratulation to all of you for completing the MCSE 2003 class, and becoming certified. I wish you all great success in your future aspirations. I know some of you already got new jobs which made me very proud.

Good job.

Best Regards,

Oz ozugurlu

Systems Engineer

MCITP (EMA), MCITP (SA),

MCSE 2003 M+ S+ MCDST

Security Project+ Server+

oz@SMTp25.org

http://smtp25.blogspot.com

WHICH FSMO ROLE IS THE MOST IMPORTANT

I am reading MS Tec-net discussing group and following up some post, in regards to a problem, and second person who is trying to help is writing back

"The PDCEmulator role is the more or less old PDC from NT4, but only used for backwards compatibility"

This statement above made me write this article. The question is, What FSMO role is the most important or less important always been asked to me in each MCSE class

Beside the function of emulating the PDC (Primary Domain Controller) for NT4 clients in the domain, below is the list what PDC Emulator does.

PDC Emulator

• Synchronizes time over the domain, ensuring all clients have the same time - which is required for kerberos authentication (logons) to work properly.
  
• Manages password changes made in the domain
  
• Incorrect logons are forwarded to the PDC before the error is shown to the user - to check the password is in fact incorrect
  
• Account lockouts are processed on the PDC emulator
  
• Group policy management is always made on the PDC emulator, unless specified by the administrator
  
• People will notice its downtime rather quickly ( missing PDC will generate tons of call to your help desk, trust me on this)
  
• Usually the first one to be noticed if missing will be the PDC Emulator (due to its role as Domain Master Browser really in a multi-subnet network.)
  

In a single domain environment, the others might not be as important as PDC or I would say so quick or noticeable as an negative impact to your environment

Missing DNS master

If you were adding Domains the absence of Domain Naming Master , will be the problem, since the operation will fail.

Missing Schema master

If an application needs to make changes to the Schema and cannot contact to schema master you will have problems. For instance installing exchange will extend the schema, so you won't be able to install exchange, and this is end of the world to me (-:, hey when it comes to Exchange I should not be needing to list any other reason here why you and me would need Schema master to be here, when we want to install exchange server. (-:

Missing RID master

The RID master is the one most people would notice either first or right after the PDC Emulator since after adding about 500 users (security principals really) to a single DC you would run out of RIDs. If you are not adding 500 users per day (-: you don't have to worry about this role for today.

Missing Infrastructure master

This is another domain-specific role and its purpose is to ensure that cross-domain object references are correctly handled.

Conclusion:

Despite the name of PDC, and not having any NT 4.0 in the environment does not make the PDC emulator the less important role? In fact this is the most heavily used FSMO role and it is also the most important FSMO role (quick side effects). All FSMO roles are important, but the Missing PDC is going to give you the quickest headache you would ever wanted on monday early morning. Who is your PDC (-:

Regards,

Oz Ozugurlu

Systems Engineer

MCITP (EMA), MCITP (SA),

MCSE 2003 M+ S+ MCDST

Security Project+ Server+

oz@SMTp25.org

http://smtp25.blogspot.com

WHAT IS THOMBSTONE PROCESS

What is Tombstone process and what happens to these objects is going to be the content of this little article. If you ever wonder what happens when an object gets , deleted in active directory, keep reading this article.

Tombstone Process in a basic way

• Object got deleted
  
• AD marks is as deleted object by setting the objects attribute called "isDeleted" to TRUE ,
  
• At the same time, the AD strips most of the attributes from the object
  
• Renames the object
  
• Moves it to the object, to the special container in the object naming context
  
• (NC) named CN= Deleted Objects
  
• The object, now called a tombstone
  
• Object is no longer visible from ADUC. ( administrators)
  

Here is the tricky part the Tombstone is visible to the Active Directory replication process. Why is that so? Remember multi-master replication model. In order to make sure the deletion is performed on all the DCs that host the object being deleted, Active Directory replicates the tombstone to the other DCs. Thus the tombstone is used to replicate the deletion throughout the Active Directory environment

I never did understand why it is so painful try to bring deleted object in AD, with build in tools. What I mean is, if we look at third party tools, Quest, Hyena etc, it is couple clicks to bring the deleted object from AD. Anyway, I would love to see the build in capabilities in AD as good as these third part tools or at least some close, but I know it won't happen for some reason (-:

The tombstone lifetime is determined by the value of the TombstoneLifetime attribute on the Directory Service object in the configuration directory partition.

• Adsiedit
  
• Configuration
  
• DC name
  
• CD=Configuration
  
• DC=Forest domain
  
• CN=Services
  
• CN=Windows NT
  
• Right click CN=Directory Service properties
  
• The attribute name is TombstoneLifetime
  

On a domain controller in a forest that was created on a domain controller running Windows Server 2003 with Service Pack 1 (SP1), the default value is 180 days.

On a domain controller in a forest that was created on a domain controller running Windows 2000 Server or Windows Server 2003, the default value is 60 days.

Best Regards,

Oz Ozugurlu

Systems Engineer

MCITP (EMA), MCITP (SA)

MCSE 2003 (M+,S+) MCDST

Security+,Project+,Server+

http://smtp25.blogspot.com