Why Do We Need FSMO Roles ?

You read about AD 2003 or 2008 and start getting confused about FSMO roles? and asking yourself why do we need them anyways?

Before we start listing the reasons why FSMO roles needed, let’s refresh our knowledge

• Single master replication model ( NT 4.0) this means .DIT database read only, and only primary domain controller can write and read from .Dit database. BDC (backup domain controller) can only read the .DIT database
• .DIT database ( Active directory database)
• Now imagine in AD environment you can not create users, because you cannot write to .DIT database, I am sure you will easily see big problems if this happens to you when you are the person who is responsible from creating users, groups
• Microsoft saw this as problem and they fix it by implementing AD 2000 and up what is called “multi-master replication model”, meaning all domain controller can read and write to .DIT database and they all are equal , except FSMO roles.

Obvious multi-master replication model brought huge redundancy to Active directory picture and now clients can locate and register their own records to any available DC/DNS server and thus less likely total stoppage of Active directory services.

Now, there is a problem with Multi-master replication problem , if two similar task needed to be done in two different places which one would be the winner?

If I am introducing domain controller called DC1 and at the same time you are sitting on different location ad you are DCPromoing another server with same name, which one would run without problems?

Think similar scenarios in AD, thus certain jobs in AD “Must be controlled” by specific domain controllers.

For instance The domain naming master domain controller controls the addition or removal of domains in the forest.When I want to add a new domain the request goes to “DNS master” I get an okay from DNS master and I move on. When you do the same thing in a split second, DNS master knows already he gave me an okay , even though I have just started and will tell you “Sorry you cannot do this, because I already gave okay to someone else”

I hope it makes sense now and you will see and understand the need for FSMO roles.

There are two main task involved in FSMO

• Seize FSMO roles ( FSMO holder can not longer be contacted and therefore, use ntdsutil to go into .DIT database and find the registry settings for FSMO roles, and modify them from failed DC to one of the alive DC, save and replicated the changed
• Never turn back on failed DC who was FSMO role owner if you ever seize the FSMO role from it.
• run DCPromo /ForceRemoval to install the .DIT database
• run metadata Cleanup for your domain/Forest
• now you can bring the old DC as new DC into your forest
• Move FSMO roles ( FSMO role owner is alive and willingly to give up from assigned FSMO role. Same changes are being done on the .DIT database and via AD replication

MVP (Exchange)
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +

Http://smtp25.blogspot.com (Blog)

Https://telnet25.spaces.live.com (Blog)

Https://telnet25.worldpress.com (Blog)

RSAT Tools for Windows 7

If you have not installed RSAT tools for Windows' 7 here they are.

Download beta RSAT Tools on windows 7 workstation

install the update corresponds to your Windows 7

• Go to control panel
• Click on programs and futures, turn windows futures on & off
• In the windows futures window,locate RSAT
• Select the tolls you wish to install
• Click on task bar, properties start menu
• Click customize , display System administrative tools
• 

enjoy the new administration tools

Also check out powerGUI is looks real nice and handy, it has Exchange and AD plug in, great tool to get into PowerShell

 Oz Casey Dedeal

MVP (Exchange)
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +

Http://smtp25.blogspot.com (Blog)

Https://telnet25.spaces.live.com (Blog)

Https://telnet25.worldpress.com (Blog)

Installing Windows 2008 R2 into existing Domain AdPrep /ForestPrep

Goal: Install first windows 2008 R2 Domain controller into existing 2008 Forest/Domain.

Problem: Receiving fallowing error, upon running DCpromo “To install a domain controller into this Active directory forest using “adprep /forestprep”.

The Adrep utility is available on the windows 2008 R2 installation media in the \support\adprep folder

Solution:

You need to log into one of your existing domain controller (Infrastructure Master) and copy the folder mentioned in the above error to let’s say C drive.

To see the FSMO roles, simply go to command line and run

• netdom query FSMO

So you are going to be running below command from your Infrastructure Master, not the new R2 DC you are trying to bring up.

Summarize task

• Log in DC ( Infrastructure Master)
• Copy support\adprep folder into C drive of your existing DC
• Open command line
• Run AdPrep32 /ForestPrep (I ran Adprep32 because my existing DC is 32 Bit)
  Wait ForestPrep to finish
• Run AdPrep32 /DomainPrep (I ran Adprep32 because my existing DC is 32 Bit)
• You are done now go back to Windows 2008 R2 you wish to DCpromo
• Run DCpromo and fallow the wizard

Adprep TechNet

Oz Casey Dedeal

MVP (Exchange)
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +

Http://smtp25.blogspot.com (Blog)

Https://telnet25.spaces.live.com (Blog)

Https://telnet25.worldpress.com (Blog)

How to Configure Application Server Relay trough Exchange 2007 HTS Server.

You have application server and you wish to let this server relay mails  trough your exchange 2007 server. I will show you how to set this up on exchange server and how to troubleshoot to make sure it is working or now.

• Exc07.smtp25.org=10.10.10.7 ( exchange HTS server)
• App01.smtp25.org=10.10.10.131 ( Some application server needs mail relay)

open EMC, drill down under Server Configuration, click on Hub Transport configuration

• We will work on the right pane under “receive Connectors”
• The receive connector installed on HTS server and it is
• logical gateway through which all messages are received.

• Or think it is as  “receive connectors as protocol listeners” similar to  Exchange 03 is an SMTP Virtual Server.

• Now lets create one “receive connector” and specify who can relay trough and sent messages out from this connector

On the Receive connectors , make a right click and select

• New Receive Connector

• Give it a name
• Internal_Relay ( I used this one)
• Custom ( Click Drop Down and select intended use)
• Click next

• Local Network Settings
• Specify the FQDN for the connector

Now we need to specify the application relay server IP address here.

• First remove the default

• Include the IP Address of relaying server
• In my scenario this is going to be 10.10.10.131
• Click next
• Click new

• and finish

• Now I have the connector in the Receive connector list

Now log into application server and open CMD

• Telnet mail2 25 ( hit enter)
• Helo ( hit enter)
• mail from:report@telnet25.org ( Change this to accommodate your environment), Most likely this will be the e-mail address application will try to sent mail out to the exchange server
• I receive “ 530 5.7.1 Client was not authenticated”

• we have still have problems and do little more work to get this going
• Go back to connector , click on Permissions group, select
• Anonymous users

Go back to relaying server we will perform the basic SMTP test from CMD one more time

• telnet mail2 25
• helo
• mail from:Report@Telnet25.org
• rcpt to:Report@Telnet25.org
• Data ( hit enter)
• Subject: Testing Mail Relay ( Hit enter)
• Testing Mail Relay ( this is Body)
• press dot + Enter + dot on the keyboard

• now we got 250
• open the mailbox for report@telnet25.org to verify the e-mail in the destination mailbox

Oz Casey Dedeal

MVP (Exchange)
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +

Http://smtp25.blogspot.com (Blog)

Https://telnet25.spaces.live.com (Blog)

Https://telnet25.worldpress.com (Blog)