Changing the Profile of a Network Adaptor in Windows Server 2012

To change a particular network adaptor between profiles such as Public or Private or Domain, you can use PowerShell. Just open a PowerShell prompt and follow the commends below, ensuring you know your network adaptor name and the name of the required profile

PS C:\>$Profile = Get-NetConnectionProfile -InterfaceAlias such as "Ethernet"
PS C:\>$Profile.NetworkCategory = such as "Private"

PS C:\>Set-NetConnectionProfile -InputObject $Profile

Name Resolution in 'the cloud' using Active Directory

When running DNS to support an Active Directory domain within Amazon's EC2 and MS Azure I've observed some subtle differences with the set-up of the forwarders for resolution of external name spaces.

To add context to the above, I'm running AD domains within the Azure and AWS domains and therefore domain joined servers are configured to use the DNS server on the Active Directory Domain Controller for DNS in order to support normal domain membership capabilities. Should the member server or client require name resolution for external namespaces then additional configuration is required in some cases, as the client only makes DNS queries to Domain Controller and therefore can't leverage the inbuilt functionality provided by the platform.

In Azure, standalone machines using the out of the box configuration, will rely on the Azure DNS option on the VNET which will resolve any external name queries by via the Azure infrastructure as defined by the option illustrated below for when viewing the VNET >> DNS Servers.

The same is true for VPCs in AWS, their default DHCP option set will be configured with 'AmazonProvidedDNS' which will provide a reserved IP address at the base of the VPC address space (the last octet incrememted by 2) and will be enabled to service name resolution for external DNS names.

When considering the scenario of configuring forwarding for name queries from a Domain Controller or other hosted DNS server and also assuming that it is undesirable for the servers to have direct access to the Internet via the VNET default routing or public IP address assignment. Therefore I have configured the forwarders on the DNS Server with the Azure/AWS supplied recursive resolvers and remove the Root Hints ensuring that there is a single defined path for name resolution. This approach ensures that any name resolution queries are answered by the Domain Controllers for the name space for which it is authoritative and any external name space queries are forwarded within the VPC/VNET and answered by the platform and sent back to the DC. This ensures that no DNS traffic directly originating or destined for an internal server is exposed to the outside world.

The recursive resolvers that can be used in as forwarders are listed below;

• Azure DNS - 168.63.129.16

• AWS DNS - 169.254.169.253

Reset a Computers Secure Channel with the Domain

To reset the secure channel betweeen a computer and the domain, the following PowerShell command can be used;

Reset-ComputerMachinePassword

It can also be performed on a remote computer using the following;

Invoke-Command -ComputerName "Server01" -ScriptBlock {Reset-ComputerMachinePassword}

Full details can be found here

Managing Azure PowerShell behind a Proxy

I've struggled recently when attempting to manage our MS Azure environment from my corporate machine as it's behind a proxy server. I found that issuing the following line of PowerShell would allow me to authenticate the PowerShell with the proxy and connect to Azure successfully.

[System.Net.WebRequest]::DefaultWebProxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials

List FSMO Roles via Command Line

To list FSMO via the command line, use the following command

netdom query fsmo 

It's much easier than using the MMC GUI

Security Accounts Manager Failed

This morning we received errors from a remote site 2003 based Domain Controller which was sharing the hardware with a File Server, with the following message being logged in the Directory Services Log.

NTDS (460) NTDSA: Corruption was detected during soft recovery in logfile C:\WINDOWS\NTDS\edb.log. The failing checksum record is located at position END. Data not matching the log-file fill pattern first appeared in sector 14418 (0x00003852). This logfile has been damaged and is unusable.

 When restarting the server, the following message was appearing and when clicking 'OK', the DC would then reboot.

 

By entering Directory Services Restore Mode, several checks were preformed using NTDSUTIL from the Command Prompt.

NTDSUTIL > FILES > INFO showed that all files were present and the correct size.

NTDSUTIL > FILES > INTEGRITY showed that the Database was corrupt.

NTDSUTIL > FILES > RECOVER would not recover the database.

Finally I tried,

esentutl /p “C:\Windows\NTDS\ntds.dit” /!10240 /8 /o

Deleted all log files present in the NTDS folder, in this case C:\Windows\NTDS

Then a DB analysis which completed successfully.

NTDSUTIL > Semantic Database Analysis > Go

Upon rebooting the server, no more error messages and I was now in a point where I could gracefully Demote the server and replace it with a dedicated Domain Controller.

Troubleshooting AD Replication & Lingering Objects

Some handy links for better understanding the troubleshooting of AD replication, Lingering objects and their removal, with a guide coming soon.

Removing Lingering Objects

Information about Lingering Objects in an AD Forest
 https://support.microsoft.com/en-us/kb/910205

Removing Lingering Objects
http://blogs.technet.com/b/askds/archive/2014/09/15/remove-lingering-objects-that-cause-ad-replication-error-8606-and-friends.aspx

Fixing Lingering Object Problems
https://technet.microsoft.com/en-us/library/cc738018%28v=ws.10%29.aspx

Strict Replication Consistency 

Contrary to popular belief, Strict Replication Consistency isn't enabled by default on DCs that reside in forests upgraded from 2000 functional levels
http://blogs.technet.com/b/askds/archive/2010/02/15/strict-replication-consistency-myth-versus-reality.aspx

Troubleshooting Replication

AD Replication Status Tool
A very useful tool for troubleshooting replication, think of repladmin but in a GUI and more.
http://blogs.technet.com/b/askds/archive/2012/08/23/ad-replication-status-tool-is-live.aspx

ReplDiag
http://activedirectoryutils.codeplex.com/releases/view/13664

Scheduling PowerShell Scripts

I have a requirement to run a PowerShell .ps1 file each evening to perform a backup in an AWS environment. Having written the .ps1 script and placed it on the server. I've now created the Task with the following parameters using the Task Scheduler GUI.

Program/script C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Add arguments -File ".\EC2_Backup.ps1"

Start in D:\Scripts

To invoke the AWS connection details for the region and access keys, I also added the following to the top of the script

Initialize-AWSDefaults

My take on Stub Zones vs Conditional Forwarders

I'm lucky/unfortunate enough (delete depending on the day) to architect and manage a geographically distributed Active Directory environment consisting of multiple domains and forests. The forests are connected using a variety of AD trusts and they all hinge on our DNS infrastructure.

I've typically been a big advocate for AD integrated stub zones rather than Conditional Forwarders due to the ability to centrally manage them by virtue of their AD integration whether it be Domain or Forest wide scope and also their ability to update the name servers belonging to the DNS zone.

To be clear, stub zones contain three record types (SOA, NS and A) which reference the name servers responsible for the source DNS zone. Periodically the SOA, NS and A records are updated from the Master Server list for the particular zone. When a query is performed against the server hosting and matching the Stub Zone, the server references the NS and then A records contained in the zone to direct the query to a suitable name server for an answer. This is perfectly acceptable when the source zone is located on a number of Domain Controllers in a central location such as a data centre but may add complications when the Domain Controllers are geographically distributed, such as in Hub/Spoke topologies where the spokes consist of DCs in remote offices connected to small/slow links. While answers to name queries are cached by the server hosting the stub zone, attempting to perform name lookups across such links may introduce delays or add to the traffic on the links. Microsoft indirectly acknowledge this eventuality by virtue of the behaviour of stub zones in the Technet - Contrasting stub zones and conditional forwarders but in the context of security and not being able to directly influence server to server connections when compared to the static configuration of Conditional Forwarders.

Stub zones do not provide the same server-to-server benefit because a DNS server hosting a stub zone in one network will reply to queries for names in the other network with a list of all authoritative DNS servers for the zone with that name, instead of the specific DNS servers you have designated to handle this traffic.

Based on the above statements, interpretation and my experience, my recommendations are as follows..

Conditional Forwarders - Great for server to server connections for name resolution such as specifically defining server A will always forward to server X,Y,Z for contoso.com when contoso.com is a hosted on a geographically heavy distributed AD infrastructure or where not all sites are routable from server A. The obvious downside with all Conditional Forwarders is maintaining the list of forwarders on a per server basis.

Stub Zones - Ideal when referencing DNS zones hosted on resource forests/infrastructures which are hosted centrally, fully routable/reachable from the server hosting the stub zone. Obvious benefits are that the name server list is maintained as part of the stub and the zone can be AD integrated to ensure that it is available throughout the Domain or Forest. Be careful when creating a stub zone which references a zone which is hosted on geographically distributed infrastructure.

Pause and Resume Bitlocker Encryption Operation

Maybe a bit of a useless one but  you can control the encryption process of a drive if you find that the process is hindering your progress on a machine using the commands below.


manage-bde –pause driveletter :

When you are ready to start encrypting the drive again, type the following command:

Manage-bde –resume driveletter :

I'm not sure how much value this offers as with MDT 2012, you can now pre-encrypt drives to negate the need to perform the encryption step post Windows deployment

Lack of Updates - sorry.. but more soon!

I thought it best to apologise for the lack of updates which have been posted for almost the last two years. Since my last post, I've had a promotion and moved to the other side of the world and found that my workload has greatly increased.

I checked my analytics figures today for the first time since 2013 and can see that the blog is as popular as ever, so that's spurred me on to start putting more effort into posting.

Hopefully I'll have something up soon..

Direct Access 2012 Installation Fun

We've recently upgraded our environment from Windows XP to Windows 7 Enterprise and therefore I thought it worthwhile to see what all the fuss was about regarding DA.

Instead of using UAG and Server 2008 R2, I took a shortcut and went straight for DA with Server 2012. Below are a few of the issues that I experienced and their associated fix.

Network Location Server

It's worth noting that when considering the placement of the Network Location Server, that it's not a good idea to place it on the DirectAccess server. This is due to DA configured clients, misjudging that they are outside the corporate infrastructure when the NLS is unreachable. When the NLS is unavailable they will attempt to connect to their DA server which will also be unavailable (it's the same server in this case) therefore putting the machines into a loop and disrupting their connectivity.

Do yourself a favour, build a separate NLS and consider using VMware Fault Tolerance (as an example - there are other virtualisation technologies) to ensure that it's always available in the event of a hardware failure.

The adapter configured as external-facing is connected to a domain

When configuring the server, no matter what config I used, the 'Domain' profile was being associated with the external NIC, this is a problem due to the Network Location Awareness functionality within the Operating System which I could not resolve elegantly. After much Googling I resorted to a Block rule in the Windows Firewall.

General: Block the Connection
Scope: 2x External IPs
Programs and Services: Services - Network Location Awareness - NLASVC

Once configured, disable and re-enable the external interface and it should be associated with a public profile.

There is no valid certificate to be used by IPsec which chains to the root/intermediate certificate configured to be used by IPsec in the DirectAccess configuration.

The fix was to allow the DirectAcess server to auto enrol it's own Computer Certificate, even though a Server Authentication cert was present in it's Local Computer Cert Store. The Enhanced Key Usage on our Computer  Certificate Template includes Server Authentication and Client Authentication, I believe that it's the Client Authentication that made the difference.

Adventures when upgrading SCCM 2012 to SP1

I recently upgraded our newly installed SCCM 2012 RTM infrastructure to SP1 after it's release in late December and after doing so I encountered a number of issues, below are the issues that I experienced and the associated fixes.


Broken MDT Database Connectivity

We have MDT 2012 U1 integrated with our SCCM infrastructure and use the MDAC based database functionality to lookup various details but after the SP1 upgrade,  the following errors could be found in the BDD.log;

Unable to create ADODB.Connection object, impossible to query SQL Server: ActiveX component can't create object (429)

After some research and forum posts I managed to confirm that the upgrade process had removed MDAC from the MDT Boot Image and therefore crippling database connectivity when inside WinPE. To resolve this, I found it necessary to recreate the the MDT Boot Image from within the SCCM Admin Console.


Misassignment of drive letters during OSD of Windows 7

Another side effect of the SP1 upgrade was that previously working Windows 7 images were installing but assigning drive letters D: or E: instead of the normal C: drive assignment. This appears to be a result of the introduction of the new Task Sequence variable OSDPreserveDriveLetter. When investigating my existing Task Sequences I found that a new step had been added to named 'Set Variable for Drive Letter' which declares the value of this variable as False. By changing this value to True, this ensures that the intended drive letter assignment is honoured and therefore future OS drives are assigned C:.

Offline USMT excluding Local Accounts in SCCM 2012 & MDT 2012

Local Machine accounts can be excluded from the USMT process by specifying an additional Task Sequence variable and then either explicitely excluding the local account(s) or explicity including the domain accounts. An issue with the offline USMT method is that the machine is unable to determine the domain by it's name and therefore it's necessary to use the Domain's SID based on the fact that each user account within a given domain will have a similar SID apart from the RID which forms the last section of the SID string.

See the Wikipedia explanation

1. First of all create the necessary TS variable in a new step before the Scanstate operation named OSDMigrateAdditionalCaptureOptions
2. Give it a value of /ue:* /ui:<Domain SID>*

Multiple instances of /ui can be used to specify additional domains if required.

A domain's SID can be retrieved by using PSGetSID.exe from SysInternals and using the following syntax; psgetsid.exe <Domain Name>

SCCM 2012 Application Catalog - Login Prompt (Multiple Domains)

In a AD Multi Domain environment, I've found that even after following the guidance from Microsoft regarding delegating permissions to the relevant web application folders (found here) I've still encountered prompts for credentials when accessing the web based Application catalogue which is by default http://servername.domain.com/CMApplicationCatalog.

Based on some research and also backed up by Chris Bradford's blog post, it appears that the problem can be caused by the 'Add default Application Catalog website to Internet Explorer trusted sites zone' option in the SCCM Client Settings. I've found it best to set this to 'False' and fallback on our internal namespace being registered via other means in the correct IE Security Zone.

To ensure that the NTLM credentials are passed through when accessing internal namespace addressed resources either add your domain with a wildcard (*.domain.com) or your server name to your IE Intranet Zone. This can be done via manually or by script but certainly appears to produce better results than using the SCCM Client option.

Portal Web Site Control Manager detected PORTALWEB is not responding to HTTP requests. The http status code and text is 401, Unauthorized.

I've found the message "Portal Web Site Control Manager detected PORTALWEB is not responding to HTTP requests.  The http status code and text is 401, Unauthorized." in the logs of the server which hosts our SCCM 2012 Application Catalog, when diagnosing the issues with the 'SCCM Software Center' failing to display available software showing a message of "Loading Software Center returned error code 0x80041001(-2147217407)". Also when browsing to the Application Catalog it displays a "Server Error in '/' Application" error. Googling the issue, it appears to be widespread with SCCM 2012 and related to WCF Activation.

The resolution can be found in the following MS KB - http://support.microsoft.com/kb/2015129

I would also recommend testing any Application Catalog related issues experienced on a client by accessing the Catalog via other clients. I have found clients can be at fault more times than the server.

Quick and Dirty .NSF Audit Script

In order to better understand our mail environment we wanted to ascertain approximately how much email was being held locally on our workstations in the form of local archives. I therefore wrote the script below in VBScript to be ran as a Computer Startup Script via Group Policy. The script performs a WMI query and then hands the result over to a Stored Proc in a SQL Server DB.

 Option Explicit  
 On Error Resume Next  
 Dim strDBServerName, strDBName, strDBUser, strDBPass, strConnString, strComputerName, strNSFSize, strLine, strNSFMarkerPath  
 Dim wshNetwork, cmdObj, recObj, sysinfo, objFSO, objFileMarker, colFiles, objWMIService, objFileNSF  
 Set objFSO = CreateObject("Scripting.FileSystemObject")  
 strNSFMarkerPath = "C:\NSFSurvey.txt"  
 If NOT objFSO.FileExists(strNSFMarkerPath) Then  
      Set wshNetwork = WScript.CreateObject( "WScript.Network" )  
      Set sysInfo  = CreateObject("ADSystemInfo")  
      strComputerName = wshNetwork.ComputerName & "." & sysInfo.DomainDNSName  
      strDBServerName = ""  
      strDBName = "NSFSize"  
      strDBUser = ""  
      strDBPass = ""  
      strConnString = "driver=sql server;server=" & strDBServerName & ";database=" & strDBName & ";uid=" & strDBUser & ";pwd=" & strDBPass  
      Set cmdObj=createobject("adodb.command")  
      Set recObj=createobject("adodb.recordset")  
      Set objWMIService = GetObject("winmgmts:\\" & wshNetwork.ComputerName & "\root\cimv2")  
      Set colFiles = objWMIService.ExecQuery _  
   ("Select * from CIM_DataFile Where Extension = 'nsf' AND (Drive = 'C:')")  
      If colFiles.Count = 0 Then  
           Set objFileMarker = objFSO.CreateTextFile(strNSFMarkerPath)  
           Wscript.Quit  
      End If  
      For Each objFileNSF in colFiles  
           strNSFSize = CLng(strNSFSize) + objFileNSF.FileSize  
      Next  
      'Wscript.Echo strNSFSize  
      With cmdObj  
           .activeconnection=strConnString  
           .commandtype=4  
           .commandtext="dbo.USP_NSFSize"  
           .parameters.refresh  
           .parameters(1).value = strComputerName  
           .parameters(2).value = strNSFSize  
           .execute  
      End with  
      Set objFileMarker = objFSO.CreateTextFile(strNSFMarkerPath)  
 End If  

The TSQL for the table is below;

 SET ANSI_NULLS ON  
 GO  
 SET QUOTED_IDENTIFIER ON  
 GO  
 SET ANSI_PADDING ON  
 GO  
 CREATE TABLE [dbo].[NSFSizes](  
      [Timestamp] [datetime] NULL,  
      [computerFQDN] [varchar](55) NOT NULL,  
      [NSFSize] [bigint] NOT NULL  
 ) ON [PRIMARY]  
 GO  
 SET ANSI_PADDING OFF  

And also the Stored Proc

 SET ANSI_NULLS ON  
 GO  
 SET QUOTED_IDENTIFIER ON  
 GO  
 CREATE PROCEDURE [dbo].[USP_NSFSize]  
      @strComputerName varchar(55),  
      @strNSFSize bigint  
 AS  
 INSERT INTO dbo.NSFSizes (Timestamp, computerFQDN, NSFSize) VALUES (GETDATE(),@strComputerName, @strNSFSize)  

Configuring IBM IMM from Windows (Remotely)

I had a server shipped to a remote site today and had forgotten to preconfigure the network settings for the IBM IMM. Luckily this can be configured from the machine from within Windows.

To do this, first of all download the Advanced Settings Utility for appropriate operating system, in this case Windows Server 2008 R2, so I selected the x64 version from the IBM site.

Download and extract the utility and then run it from  a command prompt. I required just the IP Address, Subnet Mask and Default Gateway address changing to static values. This will also disabled DHCP on the IMM interface and then reboot the IMM to apply the new address.

asu64.exe set imm.hostipaddress1 192.168.1.10

asu64.exe set imm.hostipsubnet1 255.255.255.0

asu64.exe set imm.gatewayipaddress1 192.168.1.1

asu64.exe set imm.dhcp1disabled

asu64.exe set imm.reboot

IBM Hardware Warranty Lookup

The URL for the IBM Hardware Warranty lookup site is here

Exchange 2010 Management Console connecting to a decommisioned server

You may find that the Exchange Management Console still attempts to connect to a previous Exchange 2010 server when opening, this can be resolved by navigating to the "HKCU\SOFTWARE\Microsoft\ExchangeServer\v14\AdminTools" registry key and deleting the NodeStructureSettings value.

Once deleted start the Exchange Management Console and it should automatically detect the On-Premises organisation and this time connect to a live server.