Pat Spencer

I found this article quite helpful.  It contains some excellent detailed information. https://redmondmag.com/articles/2009/07/01/6-tips-for-troubleshooting-active-directory.aspx Especially detailed is the AD Diagnostics Registry settings:

This is a quick and dirty but works. Here is a simple script to export and then import the OU structure from one AD to another, such as when you want to create a lab from a production AD. To export the Prod OU's to a CSV, enter the following command:  Get-ADOrganizationalUnit -Filter *|select name,@{n="Path";E={($_.DistinguishedName).replace("OU="+$_.name+",","") }} | ConvertTo-Csv -NoTypeInformation |out-file -FilePath Prod-OUS-4-Import.csv Next,  edit the domain name in the CSV to change it to the new domain. Also, clean up the file to remove any OU's that are out of scope.  Third, run the following script using the CSV to import the names and Path of the OU's # Command Line Parameters Param(  [Parameter(Mandatory=$false,HelpMessage='CSV FIle')][string]$Inputfile=".\Prod-OUS-4-Import.csv" ) import-module activedirectory # Read in data $OUS = import-csv $InputFile $ous |ft -a  #validate data on screen # get current ...

Securing AD with Least Privilege Principle I have been working for the last number of weeks on a project to secure AD, and to reduce the Attack Surface of AD. If you are not on board with why you need to secure AD from compromise, and to establish good security work habits, please view one or more of the following videos.  These show how incredibly easy it is for a hacker to break in to your systems. From Microsoft Ignite 2015. How You Can Hack-Proof Your Clients and Servers in a Day https://channel9.msdn.com/Events/Ignite/2015/BRK2346 This is an excellent technical article with hands-on demo of tools, password decodes, remote code execution, enable webcam, etc. . Detecting the Undetectable https://channel9.msdn.com/Events/Ignite/2015/BRK2344 . Next step is to review and become familiar with Microsoft's Best Practices for Securing AD. http://www.microsoft.com/en-ca/download/details.aspx?id=38785 Some of the key components of these documents and video's are: Set...

See the following for step by step how to use active directory powersSell cmdlets against 2003 domain controllers http://blogs.technet.com/b/ashleymcglone/archive/2011/03/17/step-by-step-how-to-use-active-directory-powershell-cmdlets-against-2003-domain-controllers.aspx Also, in order to run RSAT on Windows 7, with 2003 or 2008 DC's: This is still untested, but it looks like the author has figured out how to add the Active Directory PowerShell modules to Windows 7. Why would you want to do this? Well, I am writing PowerShell script to document AD, and I would like to be able to run them in an older AD environment, such as an upgrade candidate, etc. With a Win 7 workstation, I am hoping that I can load it up and run the script against an old 2003 server. System Requirements: Windows 2003 SP2 server, with Active Directory Management Gateway Services (Active Directory Web Services for Windows Server 2003 and 2008) installed. ( http://www.microsoft.com/en-us/download/details.aspx?id=2...

How to Implement the Central Store for Group Policy Admin Templates http://blogs.technet.com/b/askpfeplat/archive/2011/12/12/how-to-implement-the-central-store-for-group-policy-admin-templates-completely-hint-remove-those-adm-files.aspx

The objective here is to create reports of objects that contain properties with multiple instances, or nested properties. Example is Get-DNSServer Get-DNSServer by itself, with no parameters, produces a very detailed, multiple-heading report with a ton of detail.   The internal code to produce this report will be the subject of another technote. For this exercise though, see the outout from the command PS C:\ > Get-DnsServer |gm -MemberType Property Name                       MemberType Definition ----                       ---------- ---------- PSComputerName             Property   string PSComputerName {get;} ServerCache           ...

Excellent articles on Migrating CA's Microsoft "by the book" AD CS Migration: Migrating the Certification Authority http://technet.microsoft.com/en-us/library/ee126140(WS.10).aspx#BKMK_GrantPermsAIA (Note: This has confusing references to either leaving the CA Server name the same or changing it) Moving Your Organization from a Single Microsoft CA to a Microsoft Recommended PKI http://blogs.technet.com/b/askds/archive/2010/08/23/moving-your-organization-from-a-single-microsoft-ca-to-a-microsoft-recommended-pki.aspx Migrating Windows Certificate Authority Server from Windows 2003 Standard to windows 2008 Enterprise Server http://smtpport25.wordpress.com/2010/01/16/migrating-windows-certificate-authority-server-from-windows-2003-standard-to-windows-2008-enterprise-server/ (Note that this is full of little typos, but looks like a simple solution to a simple scenario. Be sure and read the feedback though, and there are lots of unanswered questions).  

Excellent Articles on AD Upgrades: Upgrading an Active Directory Domain from Windows Server 2003 or Windows Server 2003 R2 to Windows Server 2012 https://msmvps.com/blogs/mweber/archive/2012/07/30/upgrading-an-active-directory-domain-from-windows-server-2003-or-windows-server-2003-r2-to-windows-server-2012.aspx Group Policy Settings Reference for Windows and Windows Server http://www.microsoft.com/en-us/download/details.aspx?id=25250

Excellent article on how to transfer FSMO roles using powershell http://thelazyadmin.com/2013/08/managing-fsmo-roles-with-powershell/ Summary: Netdom query fsmo Move-ADDirectoryServerOperationMasterRole -Identity “Target_DC_Name” –OperationMasterRole 0,1,2,3,4

How to expand parameterizedProperty Note if you issue the following command: Get-ADComputer -Filter * |Get-Member You will get the following result:   TypeName: Microsoft.ActiveDirectory.Management.ADComputer Name              MemberType            Definition ----              ----------            ---------- Contains          Method                bool Contains(string propertyName) Equals            Method                bool Equals(System.Object obj) GetEnumerator     Method...

This article discusses how to deal with the fact that you can no longer get a 3rd party SSL Certificate for an internal domain. The issue is that 3rd party Certs will not allow non-verifiable Certs after Oct 2016.  Essentially, that means that you should now configure your Exchange environment (2007/2010/2013) to not depend on Certs for internal names. The solution is too simple.  Just configure your DNS server to implement a "Split-DNS-Horizon". Note that this also works perfectly for auto-configuring your Outlook clients, regardless of whether they are connected internally or externally. For this example, lets assume that your internal domain is domain.local, and that your email domain is domain.com The easiest and simplest trick is to configure an entry in your internal DNS servers, to point autodiscover.domain.com to the internal IP address of your CAS server. The best way to do this is to create a new DNS Zone with the name "autodiscover.domain.com", and then c...

The default install of DIRSYNC will synchonize your entire AD with Office365. To my way of thinking, this is excessive and unnecessary. During the install, at the end of following running Configuration Wizard, you will be asked if you wish to "Synchronize now".   Uncheck this box and then, after a reboot, follow the instructions below: Step 1: Create a shortcut to C:\Program Files\Windows Azure Active Directory Sync\SYNCBUS\Synchronization Service\UIShell\miiclient.exe (Synchronization Service Manager) Change the advanced properties to Run as Administrator .  Launch this tool Step 2: After the install,  Open Active Directory Users and Computers and search for all users starting with "MSOL_".  You will see that there is a new account called "MSOL_6b06ffadffb5" or some such giberish.  The number is different on every Server.   Change the password on this account to something secure, that you can enter in the Service Manager Step 3:  In Synchron...

Reference http://blogs.technet.com/b/canitpro/ Cloud http://www.windowsnetworking.com/articles-tutorials/cloud-computing/planning-hybrid-it-infrastructure-using-windows-azure-infrastructure-services-part1.html Exchange Exchange Service Packs and Rollups http://social.technet.microsoft.com/wiki/contents/articles/240.exchange-server-and-update-rollups-build-numbers.aspx Exchange Server 2013 and Cumulative Updates (CU’s) Build Numbers http://social.technet.microsoft.com/wiki/contents/articles/15776.exchange-server-2013-and-cumulative-updates-cus-build-numbers.aspx Office365 manage-office-365-using-powershell http://www.o365info.com/2012/07/manage-office-365-using-powershell-12.html

Some DNS name queries are unsuccessful after you deploy a Windows Server 2008 R2-based DNS server.  It seems inconsistent but it all depends on the DNS Name being called.  (BMO.COM always exhibits the problem) http://support.microsoft.com/kb/832223   Scenario: Clear DNS cache on the server: dnscmd /clearcache Run NSLOOKUP Set type=all BMO.COM Notice that the first attempt times out.  Repeated attempts will eventually be successful. Workaround: Type: dnscmd /config /enableednsprobes 0  

REPADMIN /replsummary *   A sample report looks like this:   C:\Windows\system32>repadmin /replsummary * Replication Summary Start Time: 2013-05-09 20:14:39   Beginning data collection for replication summary, this may take awhile:   .........................     Source DSA          largest delta    fails/total %%   error AMSDC                 02h:19m:19s    0 /   5    0 ASHDC                     26m:31s    0 /   5    0 ATHDC                     11m:42s    0 /   5    0 CHRDC   ...

The default AD Tombstone lifetime in Windows 2003 AD is 60 days. This was raised to 120 days in AD on Windows 2008 You can increase the lifetime before tombstoning an AD Object using the following: http://www.petri.co.il/changing_the_tombstone_lifetime_windows_ad.htm

Discovered today that you need to create a GPO to allow the account “NT Virtual Machine\Virtual Machines” to logon as a service. Without this, you will discover that eventually you will not be able to start a VM.   It will give a Logon denied error message. Install the GPMC on a Hyper-V server Create or modify an existing GPO to include the above account in the LOGON AS A Service policy Run GPUPDATE /FORCE on all Hyper-V servers.

I learned today how to query AD from the command line to list only active servers. The filter includes the conditions "not disabled" and also "not an EMC Celerra" csvde -f output.csv -r "(&(objectClass=computer)(!(userAccountControl=4098))(&(operatingSystem=*server*)(!(operatingSystem=EMC Celerra *))))" -l displayName,operatingSystem,operatingSystemVersion,operatingSystemServicePack,name,cn,dNSHostName