{"id":1005,"date":"2014-07-11T11:16:55","date_gmt":"2014-07-11T09:16:55","guid":{"rendered":"http:\/\/blogs.chrisse.se\/?p=1005"},"modified":"2023-06-06T13:49:48","modified_gmt":"2023-06-06T13:49:48","slug":"the-oboot-nc-and-the-distribution-dit","status":"publish","type":"post","link":"https:\/\/blog.chrisse.se\/?p=1005","title":{"rendered":"The O=Boot NC and the distribution DIT"},"content":{"rendered":"\n

So every Windows Server has an NTDS.dit file right? Well, All Windows Server \u2013 Domain Controllers you mean right? Nope they in fact have two J<\/span><\/p>\n\n\n\n

There is something referred to as the distribution DIT that works as a template DIT and is used when you promote a machine to a DC (either ADAM\/ADLDS or ADDS) either as the first dc in a forest or as a replica.<\/p>\n\n\n\n

The distribution DIT can be found at the following location:<\/p>\n\n\n\n

Table 1: Distribution DIT Location
<\/span><\/p>\n\n\n\n

\n<\/colgroup>\n\n\n\n\n\n\n
\n

Location<\/span><\/p>\n<\/td>\n

\n

Location<\/span><\/p>\n<\/td>\n

\n

SXS<\/span><\/p>\n<\/td>\n

\n

OS<\/span><\/p>\n<\/td>\n<\/tr>\n

ADDS<\/span><\/td>\n%windir%\\system32\\ntds.dit<\/span><\/td>\nN\/A<\/span><\/td>\nWindows 2000 Server
<\/span>\n

 <\/p>\n

Windows Server 2003<\/span><\/p>\n<\/td>\n<\/tr>\n

ADDS<\/span><\/td>\n%windir%\\system32\\ntds.dit<\/span><\/td>\nYes<\/span><\/td>\nWindows Server 2008
<\/span>\n

 <\/p>\n

Windows Server 2008 R2
<\/span><\/p>\n

Windows Server 2012
<\/span><\/p>\n

Windows Server 2012 R2<\/span><\/p>\n<\/td>\n<\/tr>\n

ADAM\/ADLDS<\/span><\/td>\n%windir%\\ADAM\\adamntds.dit<\/span><\/td>\nN\/A<\/span><\/td>\nWindows XP * Separate download
<\/span>\n

 <\/p>\n

Windows Server 2003 * Separate download or R2<\/span><\/p>\n<\/td>\n<\/tr>\n

ADAM\/ADLDS<\/span><\/td>\n%windir%\\ADAM\\adamntds.dit<\/span><\/td>\nYes<\/span><\/td>\nWindows Vista * Separate download
<\/span>\n

 <\/p>\n

Windows 7 * Separate download
<\/span><\/p>\n

Windows 8
<\/span><\/p>\n

Windows Server 2008
<\/span><\/p>\n

Windows Server 2008 R2
<\/span><\/p>\n

Windows Server 2012
<\/span><\/p>\n

Windows Server 2012 R2<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n\n\n\n

Note: SxS means that the files are package in the SxS folder on the disk and isn’t copied into the location until the actual role is installed.<\/p>\n\n\n\n

So what is the Distribution DIT and when is it used?
<\/strong><\/p>\n\n\n\n

It’s actually the DIT all DCs start out with except one case<\/p>\n\n\n\n

    \n
  1. \n
    IFM promoted replicas; they start with the IFM source DC as there DIT.
    For more information on Install From Media (IFM), see the following post: http:\/\/blogs.chrisse.se\/2011\/07\/08\/how-install-from-media-ifm-really-works-part-1\/<\/a><\/div>\n

     <\/p>\n<\/li>\n<\/ol>\n\n\n\n

    The distribution DIT is copied to the database location (DatabasePath) specified in DCPROMO during promotion, we can verify this by checking the JET database signature of the two databases once DCPROMO has completed, in my case I compare between the distribution DIT for ADLDS and my installed ADLDS instance ‘ESEDEV’<\/p>\n\n\n\n

      \n
    1. Distribution DIT:<\/li>\n<\/ol>\n\n\n\n
      \"\"<\/figure>\n\n\n\n
        \n
      1. Installed\/Promoted DIT:<\/li>\n<\/ol>\n\n\n\n
        \"\"<\/figure>\n\n\n\n

        As you can see \u2013 They do match.<\/p>\n\n\n\n

        So what does the Distribution DIT contains?
        <\/strong><\/p>\n\n\n\n

        The distribution DIT contains the base schema for either ADDS or ADLDS (that has a more light weight schema that ADDS) \u2013 So here my tool ESEDump comes into play, let’s dump a distribution DIT for ADLDS:<\/p>\n\n\n\n

        Dumping table datatable:<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        We can see that the first rows inside the distribution DIT contains O=Boot and CN=Schema,O=Boot, CN=BootMachine,O=Boot and then simpely the schema comes, we can see that all of the schema objects has a PDNT that equals == 5, the DNT of the CN=Schema,O=Boot naming context (NC) \u2013 Or wait are they really NCs? \u2013 let’s add in ‘instanceType’<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Yes they are NCs \u2013 InstanceType decoded as follows:
        <\/span><\/p>\n\n\n\n

          \n
        1. 0x5 (05) == ( IS_NC_HEAD | WRITE );
          <\/span><\/li>\n\n\n\n
        2. 0xD (13) = = ( IS_NC_HEAD | WRITE | NC_ABOVE );
          <\/span><\/li>\n<\/ol>\n\n\n\n

          More information on the instance-type attribute can be found here: http:\/\/msdn.microsoft.com\/en-us\/library\/cc219986.aspx<\/a><\/p>\n\n\n\n

          So what is CN=BootMachine? This is a fake DSA so that the code can use common routines during install (Can’t explain it better than starting an entire new article \u2013 might happen someday)<\/p>\n\n\n\n

          So what happens during install?
          <\/strong><\/p>\n\n\n\n

          So it’s time to determine how the schema in the distribution DIT is used during install (or promotion of a new domain controller) \u2013 well it depends \u2013 if it’s used at all.<\/p>\n\n\n\n

          These are the different cases.<\/p>\n\n\n\n

            \n
          1. Promoting the first domain controller in a forest<\/span>:<\/div>

             <\/p>\n

              \n
            1. The distribution DIT is copied into the database location (DatabasePath) specified in DCPROMO.<\/li>\n\n\n\n
            2. A domain naming context is created in the DIT (except for ADAM\/ADLDS)<\/li>\n\n\n\n
            3. A configuration naming context is created in the DIT.<\/li>\n\n\n\n
            4. A schema naming context is created in the DIT.<\/li>\n\n\n\n
            5. The boot schema is moved from CN=Schema,O=Boot to the newly create schema naming context.<\/div>

              During this move the following happens for all objects that has a PDNT of:4 e.g. the CN=Schema,O=Boot:<\/p>\n

                \n
              1. Object’s are moved to CN=Schema,CN=Configuration,X=foo<\/li>\n\n\n\n
              2. As the object’s are moved their ancestors_col must be updated in the DIT to inheritance from the new CN=Schema,CN=Configuration,X=foo<\/li>\n\n\n\n
              3. As the object’s are moved from one naming context (NC) (CN=Schema,O=Boot) to another (CN=Schema,CN=Configuration,X=foo) their NCDNT_col in the DIT needs to be updated as well.<\/li>\n\n\n\n
              4. Object’s have their metadata updated , fields updated are:<\/div>\n
                  \n
                1. OriginatingDsa<\/li>\n\n\n\n
                2. timeChanged<\/li>\n<\/ol>\n<\/li>\n\n\n\n
                3. Give the object a new GUID.<\/li>\n\n\n\n
                4. Set a default security descriptor depending on ADDS or ADLDS and depending on if attribute or class.<\/li>\n<\/ol>\n<\/li>\n\n\n\n
                5. The prefixMap is read of CN=Schema,O=Boot and saved into the prefixMap of CN=Schema,CN=Configuration,X=foo
                  More information on the prefixMap\/prefixTable can be found here: http:\/\/msdn.microsoft.com\/en-us\/library\/cc228445.aspx<\/a>\n

                   <\/p>\n

                  Note: This allows the distribution DIT to contain schema entries that the DSA doesn’t have knowledge about (e.g. other attributes and classes than the base schema can come pre-loaded) \u2013 This used to be the case for Small Business Server that pre-loaded the Exchange Schema.<\/p>\n<\/li>\n\n\n\n

                6.  <\/div>\n
                    \n
                  1. Removing CN=BootMachine,O=Boot<\/li>\n\n\n\n
                  2. Removing CN=Schema,O=Boot<\/li>\n\n\n\n
                  3. Removing O=Boot<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<\/li>\n\n\n\n
                  4. \n
                    Promoting a replica in an already existing forest:
                    <\/span><\/div>\n
                      \n
                    1. \n
                      Remove the following as a schema already exists in the enterprise and will be replicated in.<\/div>\n
                        \n
                      1. Removing all object’s with a PDNT of 4 == e.g. all objects that have CN=Schema,O=Boot as parent.<\/li>\n
                      2. Removing CN=BootMachine,O=Boot<\/li>\n
                      3. Removing CN=Schema,O=Boot<\/li>\n
                      4. Removing O=Boot<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n

                         <\/p>\n<\/li>\n<\/ol>\n\n\n\n

                        Both in case A (First DC in the forest) and case B (Replica in an existing forest) \u2013 the install code will trigger the garbage collector so it can immediately delete all traces of the O=Boot naming context (NC) and its decadent object’s.<\/p>\n\n\n\n

                        For more information on the garbage collector have a look at: http:\/\/blogs.chrisse.se\/2012\/11\/28\/how-the-active-directory-data-store-really-works-inside-ntds.dit-part-4\/<\/a><\/p>\n\n\n\n

                        This article started out by a question that was \u2013 How can the Schema naming context (NC) has a higher USN than many of the attributes in the schema \u2013 Doesn’t the schema container have to be created first, before its child objects? \u2013 Well we know the answer to that question already but let’s confirm it.<\/p>\n\n\n\n

                        Let’s get the “usnCreated” on the Schema naming context (NC):<\/p>\n\n\n\n

                        \"\"<\/figure>\n\n\n\n

                        Ok, it’s 4100.<\/p>\n\n\n\n

                        Let’s try an attribute “Account-Expires”<\/p>\n\n\n\n

                        \"\"<\/figure>\n\n\n\n

                        OK, that’s a pretty low “usnCreated” and much lower than the Schema naming context (NC) above.<\/p>\n\n\n\n

                        So let’s look up the “Account-Expires” in the distribution DIT:<\/p>\n\n\n\n

                        \"\"<\/figure>\n\n\n\n

                        Yes , “usnCreated” is 6 in the distribution DIT as well, with other words “usnCreated” will come from the distribution DIT for base schema object’s, hence they have a lower usnCreated than the schema naming context (NC) itself.<\/p>\n\n\n\n

                         <\/p>\n","protected":false},"excerpt":{"rendered":"

                        So every Windows Server has an NTDS.dit file right? Well, All Windows Server \u2013 Domain Controllers you mean right? Nope they in fact have two J There is something referred to as the distribution DIT that works as a template DIT and is used when you promote a machine to a DC (either ADAM\/ADLDS or … <\/p>\n

                        Continue reading “The O=Boot NC and the distribution DIT”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1005","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/blog.chrisse.se\/index.php?rest_route=\/wp\/v2\/posts\/1005","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.chrisse.se\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.chrisse.se\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.chrisse.se\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.chrisse.se\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1005"}],"version-history":[{"count":2,"href":"https:\/\/blog.chrisse.se\/index.php?rest_route=\/wp\/v2\/posts\/1005\/revisions"}],"predecessor-version":[{"id":1025,"href":"https:\/\/blog.chrisse.se\/index.php?rest_route=\/wp\/v2\/posts\/1005\/revisions\/1025"}],"wp:attachment":[{"href":"https:\/\/blog.chrisse.se\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1005"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.chrisse.se\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1005"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.chrisse.se\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1005"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}