Tag: Active Directory

First of all thanks to everyone that attended my session ” Upgrade Active Directory from WS03 to WS08 R2″ at Microsoft Tech Days 2011 in Sweden. For those of you that couldn’t attend on site I did a session on upgrading a Windows Server 2003 Active Directory environment to Window Server 2008 R2 with a focus on automated processes. The scripts used in this session (also available for download at this blog) were developed by the Enfo Zipper – Directory Services Team and used in a real world scenario to upgrade an enterprise customer’s forest.

FYI: The session will be available online later during the spring.

 

Note: The steps below including the sample scripts is provided “AS-IS” with no warranties. Some of the sample scripts have a dependence that the Windows Support Tools for Windows Server 2003 – Service Pack 2 are installed on all Domain Controllers.

 

Table 1.1 Upgrade Active Directory from WS03 to WS08 R2 Sample Scripts

 

 

 

 

In addition to the presentation slide’s I will also share some additional information about compatibility between a forest/domain running Windows Server 2003 DCs compared to running Windows Server 2008 R2 and how this can effect LOB apps, services and your business.

 

Prepare a new Windows Server 2008 R2 Domain Controller

 

Operating System Configuration

 

We generally recommend that customers apply its standard Windows Server 2008 R2 Standard Edition image as long as your desired “Domain Controller Configuration” (Disk layout, Unnecessary agents are uninstalled) is applied.
Note: If you’re going to reuse the name that the previous Windows Server 2003 DC you’re replacing had, assign a temporary name.

 

The following hotfixes should be installed to prevent known issues when introducing Windows Server 2008 R2 Domain Controllers:

 

Note: The listed hotfixes has to be installed before the machine is promoted to domain controller (Or Windows Server 2008 R2 Service Pack 1).

 

Table 3.2   Required Domain Controller Hotfixes before promotion

 

 

We recommend that in addition to those hotfixes, the customer should ensure that the machine has reached the desired/approved patch level within the organization.

 

 

1. Replace an existing Windows Server 2003 Domain Controller

   DHCP Service
   If the particular domain controller also acting as a DHCP Server, Logon using Domain Admin or DHCP Administrator credentials (the later also requires the logon locally right).
   Use the following steps to backup the DHCP database:

 

 

• Click Start, click Run, type cmd in the Open box, and then click OK.

 

• Type md C:migdata and then press enter.

 

• Type net use X: \serverprojectshare <TBD>

 

• Type CD scripts and press enter.

 

• Type GetDHCPConfig.BAT -export and press enter.

  Note: While the export command runs, DHCP server is stopped and does not respond to clients seeking new leases or lease renewals. (Verify if there is another DHCP server with overlapping scopes in the same site and/or service interruption is approved)

 

DNS Service

 

If the particular domain controller also acting as a DNS Server and hosting additional none Active Directory Integrated Zones. (Active Directory Integrated Zones are stored in Active Directory and will be replicated to the destination domain controller)

 

Logon using Domain Admins or DNS Admins (the later also requires the logon locally right).Use the following steps to backup none Active Directory Integrated Zones:

 

 

• Click Start, click Run, type cmd in the Open box, and then click OK.

 

• Type md C:migdata and then press enter (if not already created in a previous step)

 

• Type net use X: \serverprojectshare <TBD> (if not already created in a previous step)

 

• Type CD scripts and press enter.

 

• Type GetDNSConfig.BAT and press enter.

  
  Note: While the export command runs, The DNS Services is stopped and started.

 

Event Logs

 

We recommend to backup the event logs of the domain controller prior to the replacement since it can help with troubleshooting.

 

 

1. Click Start, click Run, type cmd in the Open box, and then click OK.

 

1. Type md C:migdata and then press enter (if not already created in a previous step)

 

1. Type net use X: \serverprojectshare <TBD> (if not already created in a previous step)

 

1. Type CD scripts and press enter.

 

1. Type script copyLogs.vbs and press enter (make sure the logs where successfully backed up)

 

TCP/IP Settings

 

Save the TCP/IP Settings configuration so those can be applied to the destination domain controller.

 

 

1. Click Start, click Run, type cmd in the Open box, and then click OK

 

1. Type md C:migdata and then press enter (if not already created in a previous step)

 

1. Type net use X: \serverprojectshare <TBD> (if not already created in a previous step)

 

1. Type CD scripts and press enter.

 

1. Type GetIPConfig.bat and press enter

 

System State Backup

 

Ensure there is enough and health system backups before proceeding to next step.

 

Backup the captured configuration in previous step by taking the following steps:

 

 

1. Type net use X: \serverprojectshare <TBD>

 

1. Type xcopy C:migdata X:DCs%computername% /E and then press enter.

 

Directory Services

 

This is the final step and enters the critical point of no return where the Windows Server 2003 Domain Controller is going to be demoted to a member server and will no longer acting as a Directory Service Agent (DSA) or a replica (Replication Partner) and won’t keep an instance of the Directory Services Database.

 

Enfo Zipper recommends to run the demotion process unattended and automated to avoid mistakes and errors.

 

 

1. Click Start, click Run, type cmd in the Open box, and then click OK.

 

1. Type net use X: \serverprojectshare <TBD> (if not already created in a previous step)

 

1. Type CD scripts and press enter.

 

1. Type cscript RunDCPromo.VBS . (The demotion process should now start, please wait while the Windows Server 2003 Domain Controller being demoted and restarts)

 

Decommissioning

 

Logon to the server as local administrator using the password specified in the unattended_demote.txt file above and either shutdown the server and/or disconnect it from the network. For safety reasons we recommend that the server is renamed to something else before its shutdown and that the IP-address is changed from static to dynamic.

 

 

1. Click Start, click Run, type cmd in the Open box, and then click OK

 

1. Type netdom renamecomputer %computername% /NewName:%computername%_retired and press enter

 

1. Type netsh interface ip set address “Local Area Connection” dhcp and press enter.
   Note: The name “Local Area Connection” may differ from server to server.

 

1. Type shutdown –s –t 00 and press enter.

 

 

1. 
   Promote a new Windows Server 2008 R2 Domain Controller

   Configure TCP/IP Settings and Names
   Logon locally to the domain controller and take the following steps in order to restore the name and TCP/IP Settings from the retired Windows Server 2003 Domain Controller that this domain controller is intend to replace:

   1. Click Start, click Run, type cmd in the Open box, and then click OK
   1. Type net use X: \serverprojectshare <TBD>
   1. Type CD scripts and press enter.
   1. Type xcopy X:DCs<NAME OF SOURCE DC> C:restore /E
   1. Type netdom renamecomputer %computername% /NewName:<NAME> and press enter (if you wish to re-use the same name)
   1. Type netsh interface ip set dns “Local Area Connection” static <IP_OF_WIN2K3DC>
      Note: The name “Local Area Connection” may differ from server to server
   1. Type netsh interface ip set dns “Local Area Connection” static <IP_OF_NEARESTBYDC>
      Note: The name “Local Area Connection” may differ from server to server
   1. Type shutdown –r –t 00

   Promote the server to a Domain Controller
   Logon locally to the domain controller and take the following steps in order to promote the server to Domain Controller, Enfo Zipper recommends to run the promotion process unattended and automated to avoid mistakes and errors.

   1. Click Start, click Run, type cmd in the Open box, and then click OK.
   1. Type net use X: \serverprojectshare <TBD> (if not already created in a previous step)
   1. Type dcpromo /answer: X:scriptsunattended_first.txt and press enter. (The promotion process should now start, please wait while the Windows Server 2008 R2 Domain Controller is being promoted and restarts)

   Verify that the promotion to Doman Controller was successful
   Logon as Domain Admin to the domain controller and take the following steps in order to verify that the promotion of the Domain Controller completed successfully without errors

   1. Once logged on back, Review the DCPROMO.txt log file. Click Start, Click run and type Notepad C:WindowsDebugdcpromo.log and press enter. Search the file for the word error using notepad, ensure there were no errors, close notepad.
   1. Quickly review the DCPROMOUI.log file. Click Start, Click run and type Notepad C:WindowsDebugdcpromoui.log and press enter. Close notepad.

   DNS Service
   Enfo Zipper recommends that full replication has taken place before you proceed with the following step, in order to ensure that please run the DNSConvergeCheck script between the local domain controller and one of the domain controllers in the hub site.
   The DNSConvergeCheck script can be found at: http://go.microsoft.com/fwlink/?LinkId=135502
   If full replication has taken place, please proceed with the following commands in order to import DNS Zone data (None-Active Directory integrated Zones).

   1. Click Start, click Run, type cmd in the Open box, and then click OK
   1. Type net use X: \serverprojectshare <TBD> (if not already created in a previous step)
   1. Type CD scripts and press enter.
   1. Type SetDNSConfig.BAT
   1. All DNS Zones should now successfully have been restored.

   DHCP Service
   Logon as Enterprise Admin and take the following steps to install the DHCP Server service and restore the database and settings for the Windows Server 2003 Domain Controller.

   1. Click Start, click Run, and click Administrative Tools and then Click PowerShell Modules
   1. Type Add-WindowsFeature DHCP and press enter. (if asked to/promoted to restart the server, please follow the instructions given)
   1. If a restart was required, Logon back as Enterprise Admin, Click Start, click Run, type cmd in the Open box, and then click OK
   1. Type net use X: \serverprojectshare <TBD> (if not already created in a previous step)
   1. Type CD scripts and press enter.
   1. Type sc config dhcpserver start= auto
   1. Type SetDHCPConfig.BAT -import

   Post-Operating System Configuration
   The following hotfixes should be installed to prevent known issues when introducing Windows Server 2008 R2 Domain Controllers:
   
   Note: The listed hotfixes has to be installed after the machine is promoted to domain controller (Or Windows Server 2008 R2 Service Pack 1)

   Table 3.6   Required Domain Controller Hotfixes after promotion

   Microsoft KB	Description
   978387 (http://go.microsoft.com/fwlink/?LinkId=184915):	Dcdiag fails with error code 0x621
   978277 (http://go.microsoft.com/fwlink/?LinkId=184911):	The specified account does not exist
   978516 (http://go.microsoft.com/fwlink/?LinkId=185190)	Significant delays when you read the same set of files several times
   978837 (http://go.microsoft.com/fwlink/?LinkId=185191)	Group Policy Management Editor window crashes when you apply some changes for NRPT policy settings

   Disable EDNS
   Disable EDNS to avoid issues with global DNS servers that doesn’t support EDNS, (Not needed if forwarders is configured to handle external DNS queries outside the forest and to the internet)

   1. Click Start, click Run, type cmd in the Open box, and then click OK
   1. Type dnscmd /config /EnableEDNSProbes 0 and press enter.

   Configure Kerberos supported encryption types
   Note this step is only required if the domain contains service accounts and/or computer accounts that are configured to use DES-only encryption.

   1. In the Group Policy Management Console (GPMC), locate the following location: Computer Configuration Windows Settings Security Settings Local Policies Security Options
      
   1. Click to select the Network security: Configure encryption types allowed for Kerberos option.
      
   1. Click to select Define these policy settings and all the six check boxes for the encryption types
      .
   1. Click OK. Close the GPMC.

   Note: The policy sets the SupportedEncryptionTypes registry entry to a value of 0x7FFFFFFF. The SupportedEncryptionTypes registry entry is at the following location:
   HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesSystemKerberosparameters

ADMT v3.2 has finally been released to the public; I’m currently involved in a migration project where we consolidate over 70+ forests to one corporate forest running Windows Server 2008 R2 and one of the main benefits with version 3.2 is the support for Windows Server 2008 R2

About ADMT 3.2

 

ADMT v3.2 is an out-of-band tool available as a free download (in 8 languages: English, Chinese (Simplified and Traditional), French, German, Japanese, Portuguese, and Spanish) to enable customers to deploy Active Directory in the following scenarios:

 

–        Migration of Active Directory data from one environment to another. ADMT 3.2 specifically supports migration to Windows Server 2008 R2 with added support for Managed Service Accounts.

 

–        Restructuring of Active Directory environment due to mergers, acquisitions, divestitures, consolidations, etc.

 

 

 

From the download page:

 

 

 

Overview

 

The Active Directory Migration Tool version 3.2 (ADMT v3.2) simplifies the process of migrating objects and restructuring tasks in an Active Directory® Domain Service (AD DS) environment. You can use ADMT v3.2 to migrate users, groups, service accounts, and computers between AD DS domains in different forests (inter-forest migration) or between AD DS domains in the same forest (intra-forest migration). ADMT can also perform security translation (to migrate local user profiles) when performing inter-forest migrations.

 

 

 

System Requirements

 

·        Supported Operating Systems: Windows Server 2008 R2

 

·        ADMT can be installed on any computer capable of running the Windows Server 2008 R2 operating system, unless they are Read-Only domain controllers or in a Server Core configuration.

 

·        Target domain: The target domain must be running Windows Server 2003, Windows Server 2008, or Windows Server 2008 R2

 

·        Source domain: The source domain must be running Windows Server 2003, Windows Server 2008, or Windows Server 2008 R2

 

·        The ADMT agent, installed by ADMT on computers in the source domains, can operate on computers running Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.

 

 

You can download ADMT v3.2 here

It’s been a very busy month, I’ve been traveling a lot and been speaking at a few different seminars and conferences. First of was the Windows 7 Summit held here in Sweden by ourselves TrueSec,

 

Windows 7 Summit

I did two sessions together with Mikael Nyström, first session was an introduction to the Windows 7 Client, covering some UI changes and the approach Microsoft has taken with Multi-Touch and the other was about new technologies and features in Windows Server 2008 R2, it was a great time and I had lots of fun on the stage, I’m sorry that I misspelled my own sisters name during the Recycle-Bin demo J

 

Microsoft decided to record the sessions, so if anyone is interested to see the sessions (In Swedish), here you go!

 

An introduction to the Windows 7 Client.
http://mediadl.microsoft.com/mediadl/www/s/sverige/technettv/2009/Win7Summit/Windows7Summit-090226-pass1.wmv

 

New Technologies and Features in Windows Server 2008 R2
http://mediadl.microsoft.com/mediadl/www/s/sverige/technettv/2009/Win7Summit/Windows7Summit-090226-pass2.wmv

 

Redmond
Directly after the Windows 7 summit it was time to fly over to Seattle/Redmond for the Microsoft MVP Summit. A big thanks to the entire Directory Service Team at Microsoft for the amazing week we had in Redmond at the Microsoft Campus working with them, and all other DS MVPs that attended the Microsoft MVP Summit, also thanks to my friend Eddy for inviting me to his new house, you got a nice place J

 

Microsoft TechDays in Västerås

At Microsoft TechDays in Västerås (Sweden) I attended as a speaker and presented on how to Incorporate RODCs (Read Only Domain Controllers) to your existing Active Directory, this was a 400 level sessions where I decided to give a deep-dive on how RODCs really works (and doesn’t work) in detail and how it effects an already existing Active Directory and related components. Unfortunately time didn’t allow me to show the FAS (Filter Attribute Set) Demo, I’m sorry for that, but I’m planning a detail article on FAS works, the basic idea is that you can flag attributes with sensitive/confidential information to never replicate to RODCs, in case of an RODC compromise, this information isn’t reveled.

 

You can download the slide deck from the session here: tech_days09_sweden_ds_final.zip

 

I’ve got many questions about RODCs and DNS after my sessions, I’ve blogged about that topic a while ago, you can find the article here: How Read-Only Domain Controllers and DNS works.

 

Thanks to Microsoft for putting together the TechDays Conference, this was the first time the concept of “TechDays” where used in Sweden, the idea is to have a sort of local TechED event, and I must said everything did work very well, hopefully there will be a TechDays next year as well.

Note: Domain controllers running Windows Server 2003 do not consider RODCs when they evaluate site coverage requirements and may register its Domain Name System (DNS) service (SRV) resource records for a site that contains an RODC. As a result, they perform automatic site coverage for any site regardless of the presence of an RODC for the same domain. Consequently, client computers that attempt to discover a domain controller in the RODC site can also find the domain controller that is running Windows Server 2003 and may not authenticate to the RODC.

 

There are a few possible solutions for this problem:

 

 

1. Apply the Windows Server 2008 read-only domain controller compatibility pack for Windows Server 2003 clients and for Windows XP clients (http://support.microsoft.com/kb/944043/en-us)
   (This hotfix has to be applied to all Windows Server 2003 DCs that may perform automatic site Coverage)
   

 

1. Ensure that only domain controllers running Windows Server 2008 are present in the site closest to the RODC site.
   

 

1. Configure the weight or the priority of the DNS SRV records so that clients are more likely to authenticate with the RODC than with a remote Windows Server 2003 domain controller.
   

 

1. Disable automatic site coverage on domain controllers running Windows Server 2003 present in the site closest to the RODC site.

 

How to disable automatic site coverage:

 

 

1. Click Start, click Run, type regedit, and then click OK.

 

1. Navigate to the following registry subkey HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesNetlogonParameters

 

1. Click Edit, point to New, and then click DWORD Value.

 

1. Type AutoSiteCoverage as the name of the new entry, and then press ENTER.

 

1. Double-click the new AutoSiteCoverage registry entry

 

1. Under Value data, type 0 to disable automatic site coverage. 1 = to enable it.

 

1. Click Start, Click Run, type cmd and then click OK.

 

1. In the Command Prompt, type the following command:
   nltest /dsregdns or restart the netlogon service