Active Directory Questions

Team, I am posting some more Active directory question. These questions below are getting little more complicated than previous questions. I am also including feedback from Joe Nagy. Joe has been passing his knowledge to us and I wanted to share some of it with you all here.

Please pay attention to Joe's feedback there is so much to gain from his feedback if you pay attention.If you have any question, please post it here.

1. If full qualified domain name is Smtp25.org what would be the distinguish name

2. Which support tools are being used to troubleshoot the DNS issues?

3. What tools are you familiar with AD General Heath Check?

4. What port Kerberos uses and what is Kerberos

5. What is KCC, and Explain bi-directional ring with extra edges?

6. Explain Journal Wrap, how it happens and how can it be fixed

7. What is default DNS Type code on SRV RESOURCE?

8. Explain lingered object and how to trouble shoot the issues related to it

• This is to see if they know LDAP. In order to work with LDAP and AD, LDAP has to "bind" to specific object in AD before doing any operations. All 'binds' are done with distinguished names.
  
• 2003 support tools added DNS tests to DCDIAG that the 2000 tools don't have. Also for general connectivity/DNS testing Netdiag is very helpful. Plus...there's dnscmd, dnslint..... and of course network monitor captures.... I use Ethereal
  
• Anyone who's had to troubleshoot a DC ought to know that DCDIAG /v is almost always the first place to go
  
• (Question 4&5) Port 88 UDP and TCP. Kerberos Version 5 is standard on all versions of Windows 2000 and later plus ensures the highest level of security to network resources. The Kerberos protocol name is based on the three- headed dog figure from Greek mythology known as Kerberos. The three heads of Kerberos comprise the Key Distribution Center (KDC), the client user and the server with the desired service to access. The KDC is installed as part of the domain controller and performs two service functions: the Authentication Service (AS) and the Ticket-Granting Service (TGS). Kerberos is totally different beast than LM/NTLM. You get tickets instead of contently doing 'challenge/response'. BUT, in an environment you will never ONLY use Kerberos. For things like non-interactive logins(OWA), cross domain SMB access, and many other instances you will fall back to NTLM (v2 if you're setup to not use v1 or LM which are security risks as they store hashes on the servers that can be cracked)
  
• NTFS maintains a special log called the NTFS USN journal, which is a high-level description of all the changes to files and directories on an NTFS volume. FRS uses this mechanism in order to track changes to NTFS directories of interest, and to queue those changes for replication to other computers. The NTFS USN journal has defined size limits and will discard old log information on a first-in, first-out basis in order to maintain its correct size.
  
• If FRS processing falls behind the NTFS USN journal, and if NTFS USN journal information that FRS needed has been discarded, then FRS enters a journal wrap condition. FRS then needs to rebuild its current replication state with respect to NTFS and other replication partners.
  
• Resolution: To perform a nonauthoritative restore, stop the FRS service, configure the BurFlags registry key, and then restart the FRS service. To do so:
  

1. Click Start, and then click Run.

2. In the Open box, type cmd and then press ENTER.

3. In the Command box, type net stop ntfrs.

4. Click Start, and then click Run.

5. In the Open box, type regedit and then press ENTER.

6. Locate the following subkey in the registry:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore\Process at Startup

7. In the right pane, double-click BurFlags.

8. In the Edit DWORD Value dialog box, type D2 and then click OK.

9. Quit Registry Editor, and then switch to the Command box.

10. In the Command box, type net start ntfrs.

11. Quit the Command box.

When the FRS service restarts, the following actions occur:

The value for BurFlags registry key returns to 0. Files in the reinitialized FRS folders are moved to a Pre-existing folder.

An event 13565 is logged to signal that a nonauthoritative restore is started. The FRS database is rebuilt.

The member performs an initial join of the replica set from an upstream partner or from the computer that is specified in the Replica Set Parent registry key if a parent has been specified for SYSVOL replica sets.

The reinitialized computer runs a full replication of the affected replica sets when the relevant Replication schedule begins.

When the process is complete, an event 13516 is logged to signal that FRS is operational. If the event is not logged, there is a problem with the FRS configuration.

• LingeringObjects are introduced by DCs/GCs that have been offline or failed to replicate for the tombstone lifetime. Say that DC A and B are online. B goes offline. 10 users get deleted from A. The 10 users remain in deleted items for 60 days or whatever its set to. (Tombstone lifetime). If you bring B back up any time before the 60 days are up, no problem. During replication, B would move the users to deleted items just as on A. But, if its brought up AFTER, those deleted users aren't in the A database at all, anywhere so B knows they aren't on A but has no way of knowing what happened to them. So they remain in B's database as lingeringobjects. Most places use strictreplication consistency to avoid replicating the objects around which could cause problems.
  

1.HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters

2.Click Add Value on the Edit menu.

3.Add the following value:

Value Name: Strict Replication Consistency

Data type: REG_DWORD

Value data: If the value is 1 it is enabled and lingeringobjects won't replicate.

Lingering objects may be a problem in the following scenarios:

•The lingering object is holding a value on a unique attribute, such as samAccountName, that another object wants to use.

•The lingering object is a security risk, for example, it may represent a user that you should have deleted.

•The lingering object only exists in the read-only naming context (global catalog). This behavior makes the object difficult to delete.

If you enable Strict Replication Consistency, a destination stops replicating and you receive the error message that is described in the "Symptoms" section of this article if the destination receives modifications for an object that it does not have. Typically, this problem occurs when a good domain controller that does not have the object replicates in a change to a lingering object from a bad source that has been out of contact.

• If you enable Loose Replication Consistency, if a destination receives a change to an object that it does not have, the entire object is replicated to the target for the sake of replication consistency. This behavior causes a lingering object to be reapplied to all domain controllers in the replication topology.
  
• TO REMOVE: 2003 support tools Repadmin has a /removelingeringobjects switch that helps. 2000 is much more difficult, especially in they are in the GC partions that are READ ONLY. You can't delete from READ ONLY. This is where an "operational" attribute comes into play. Progamatically, at RootDSE, an operational attribute called 'removelingeringobject' with info about the object is written. You're essentially telling AD to delete it for you since its read only and you can't.
  

Best Regards,

Oz ozugurlu

What is in the .DIT DATABASE?

What is inside the .DIT database is one of the most asked question these days while we are interviewing several people were at work at present. Understanding .DIT database is the one of the most important skill when it comes to Active directory. Below is the description of partitions and what they do. If you want to see these partitions you will need to use ADSIEdit.msc which comes with support tools windows 2X server family.

Domain Partition

(Resident directory object)

This partition called RDO and stores below objects

• User
  
• Groups
  
• Computer accounts
  
• Organizational Units
  
• All things you can see from ADUC.msc
  

All these are resident directory object lives in this partition. DNS zone data also can be found here under CN=Systems, CN=MicrosoftDNS

Schema Partition

Definition of an object is called schema, all domain controllers must be agree definition of an object, and this definition is replicated to all other domain controllers so all domain controllers is agree about the schema. Definition is replicated to all other Domain controllers in active directory FOREST. So all domain controllers are agree about the definition of Object

Configuration partitions

It contains information about all other domain controllers, lets every domain controllers know existence of other domain controllers, where they are, what are the names of those Domain controllers and so on. It stores information about services, including Microsoft Exchange

• CN=Services
  
• CN=Microsoft Exchange
  

Application partition (windows 2003 .DIT only)

Application partition DNS zone data stores here, therefore it information wont ger replicated to a DC's who are not DNS servers.This was not the case in Windows 2000 Active directory, DNS data was part of Domain parttion, therfore it replicated to other domain which were not DNS server. Microsoft fixed this issue by creating Application partition in windows 2003 .DIT Database.

Best Regards

Oz ozugurlu

Enterprise Exchange Dedicated GC Design

Enterprise design Exchange is always one of the most stunning skills for every Exchange administrator/Engineer would love to involve one day. GC's (Global Catalog) servers are being used to locate mail enabled object within the SMTP domain by Exchange servers. The performance of Exchange Server will directly impacted if the GC The exchange Server is talking too is not fast enough to make the queries back to the Exchange server. In large enterprise environment Exchange administrators may wish to locks down DS (directory Access) for GC's by disabling the Automatic Discovery and hard coding the GC servers. This always been a good idea for large environments in my opinion.

Would it be better if we could dedicate GC for corporate Exchange servers.When I say dedicate I mean DC/GC will serve to Exchange server only and wont involve into any other services as regular DC does.. As we all know the DC (domain Controller) is authentication server, so it will authenticate users. Now we have problem here we want to dedicate the DC/GC for Exchange, how are we going to achieve this goal.

Special thanks to Joe Nagy for passing us his high level approach in scenarios related to Active directory and Exchange design, best performance and practices.

Solution:

First thing we will do is, creating OU called CG in the ADUC. We will Drag and drop the DC/GC into this organizational unit. Go to properties of OU, and

• Click on group Policy
  
• Click New
  
• Name the Policy "DNS GC SRV Record Lift" click edit
  
• Expend computer configuration
  
• Administrative templates
  
• System
  
• Net logon
  
• DC Locator DNs Records and on the right pane locate
  
• Priority Set in the DC Locator DNS SRV Records
  
• Set is anything over "33" because The SRV resource record has DNS type code 33,
  
• Save it and Exit
  

Conclusion:

Dedication GC in large environment will improve the performance of Exchange, this is fact and this type of design should be considered as high level engineering approach.

Format of the SRV Resource Record:

The SRV resource record has DNS type code 33, with the following syntax: Service.Proto.Name TTL Class SRV Priority Weight Port Target

Service:

The symbolic name of the requested service, as defined in Assigned Numbers or locally. Some widely used services (notably POP) do not have a single universal name. If Assigned Numbers names the service indicated, that name is the only name that is legal for SRV lookups. Only locally defined services can be named locally. Service is case insensitive.

Proto:

TCP and UDP are at present the most useful values for this field, though any name defined by Assigned Numbers or locally can be used (as for Service). Proto is case insensitive.

Name:

The domain this resource record refers to. The SRV resource record is unique in that the name searched for is not this name.

• TTL: Standard DNS meaning.
  
• Class: Standard DNS meaning.
  

Priority:

As for MX, the priority of this target host. A client must attempt to contact the target host with the lowest-numbered priority it can reach; target hosts with the same priority should be tried in pseudorandom order. The range is 0-65535.

Weight:

a load-balancing mechanism. When selecting a target host among those that have the same priority, the chance of trying this one first should be proportional to its weight. The range is 1-65535. Domain administrators should use Weight 0 when there is not any load balancing to do (to make the resource record easier for humans to read).

Port:

The port on this target host of this service. The range is 0-65535. This is often as specified in Assigned Numbers but need not be.

Target:

As for MX, the domain name of the target host. There must be one or more "A" records for this name. Implementers should, but are not required, to return the "A" record(s) in the Additional Data section. Name compression is to be used for this field. A Target of "." means that the service is not available at this domain.

http://support.microsoft.com/kb/232025

Best Regards

Oz Ozugurlu

BES Server and Network Latency

Below article has been taken from RIM website explaining the latency and its side effects to the Exchange server. We will also attaching to this e-mail official RIM document "Capacity Planning and Performance Tuning for Environments Using the BlackBerry Enterprise Solution".

Pinging nhqbes1.SMTp25.net [10.160.10.112] with 32 bytes of data:

Reply from 10.160.10.112: bytes=32 time=358ms TTL=124

Reply from 10.160.10.112: bytes=32 time=328ms TTL=124

Reply from 10.160.10.112: bytes=32 time=358ms TTL=124

Reply from 10.160.10.112: bytes=32 time=345ms TTL=124

Reply from 10.160.10.112: bytes=32 time=367ms TTL=124

Reply from 10.160.10.112: bytes=32 time=362ms TTL=124

Reply from 10.160.10.112: bytes=32 time=372ms TTL=124

Reply from 10.160.10.112: bytes=32 time=426ms TTL=124

Reply from 10.160.10.112: bytes=32 time=354ms TTL=124

Reply from 10.160.10.112: bytes=32 time=357ms TTL=124

Reply from 10.160.10.112: bytes=32 time=205ms TTL=124

Ping statistics for 10.160.10.112:

Packets: Sent = 11, Received = 11, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 205ms, Maximum =  426ms, Average =  348ms

When latency between the BlackBerry Enterprise Server and the Microsoft Exchange Server increases, the number of factors that may impede the successful delivery of UDP notifications increases as well. Increased latency lengthens the time required for data transfer--which uses TCP/IP--between applications, for instance, the higher the latency between the BlackBerry Enterprise Server and the Microsoft Exchange Server, the longer it takes for data to travel between them. The increased data transfer time is relational to the latency of the WAN connection, and not necessarily its bandwidth. This is because TCP acknowledgements take longer to be sent if network latency exists, which delays the occurrence of the next data transfer.

If latency exists between the BlackBerry Enterprise Server and the Microsoft Exchange Server, it is expected that latency exists in the messaging environment. To help achieve optimal BlackBerry Enterprise Server performance, refer to the recommendations made in the Capacity Planning and Performance Tuning for Environments Using the BlackBerry Enterprise Solution document.

Problem:

users are having interruption on their BlackBerry devices. Blackberry users are not getting mail on their hand due to high latency on the network.

Root Cause:

The Current bandwidth seems to be the bottleneck at this point. The extended ping fluctuates dramatically, which indicates the pipe/bandwidth problem from site Exchange server to the national BES server. The connections also are not stable since it spikes at all the times.

• Overall picture how BES will work when a user receives a message:
  
• BES servers will open several worker treats similar to MAPI connections to the Exchange mailbox server to scan the new mails, upon arriving into each BES users mailboxes. Worker treats will pull these mails back to BES servers and push it to RIM facility, and RIM finally will let wireless ISP to deliver these to the handhelds
  

The latency is indentified by BES support is fact and worker treats to get hang and resulting similar issues is addressed on their best practices.

Identifying latency as root cause:

We have created test account on Local exchange server, reside within the same data canter as BES servers and asked Client to activate his Black berry by using this account. The account was successfully activated and Client was able to send and receive mails by using his black Berry

• This shows us clearly the latency was the bottleneck.
  

Recommended Solution:

• RIM recommends centralized architecture when it is possible. RIM also advices to make sure the latency is less than 35 millisecond between the black Berry server and the mailbox server. SMTP25 Exchange Team also recommends centralizing all mailbox servers along with Black Berry server to prevent such problems happening in the future.
  

Best regards,

Oz Ozugurlu