text:
Microsoft's official enterprise support blog for AD DS and more
Hello AskDS Blog Readers, Mike here again! A common request we hear is how to automatically connect specific network shares to drive letters based on group membership. Mapping network drives based on group membership requires some programming knowledge-- either VBScript or command shell (batch files). VBScript based logon scripts can require hundreds of lines of code to provided a complete solution. And batch files require the assistance of helper applications such as IFMEMBER.EXE and NET.EXE, and introduce many challenges with controlling how Windows processes the script. But Group Policy Preferences removes the programming requirement and awkwardness of scripting mapped drives based on group membership. There are many scenarios in which you may want to map a local drive letter to a specific network share to include public drive mappings, inclusive group drive mappings, and exclusive group drive mappings.
Public drive mappings typically do not require membership to a particular group. However, sometimes public drive mappings do not provide enough granularity. Most organizations have data specific to business units such as accounting, marketing, or human resources.. Inclusive Group Drive mappings solve this problem by allowing a configuration that maps a specific drive letter to a specific network share based on the user being a member of a particular group. This ensures members of the accounting unit receive drive letters mapped for accounting and members of human resources map their respective drives. Exclusive drive mappings are not very common; however, they do provide the flexibility to prevent a user from mapping a particular drive letter to a network share if they are not a member of a specific group. A good example of exclusive drive mappings is to prevent the CIO or other executives members from mapping a drive letter in which they are likely to never use. Let us take a closer look at these scenarios
Producing a Group Policy Preference item to create public drive mappings is simple. The GPO containing the preference item is typically linked to higher containers in Active Directory, such as a the domain or a parent organizational unit.
Figure 1 Configuring mapped drive preference item
Newly created Group Policy objects apply to all authenticated users. The drive map preference items contained in the GPO inherits the scope of the GPO; leaving us to simply configure the preference item and link the GPO. We start by configuring the drive map preference item by choosing the Action of the item. Drive map actions include Create, Replace, Update, and Delete. These are the actions commonly found in most preference items. Create and Delete actions are self-explanatory. The compelling difference between Replace and Update is that Replace deletes the mapped drive and then creates a new mapped drive with the configured settings. Update does NOT delete the mapped drive-- it only modifies the mapped drive with the new settings. Group Policy Drive Maps use the drive letter to determine if a specific drive exists. The preceding image shows a Drive Map preference item configure with the Replace action. The configured location is a network share named data; hosted by a computer named hq-con-srv-01. The configured drive letter is the G drive. All other options are left at their defaults. This GPO is linked at the contoso.com domain.
The results of this configuration are seen when using Windows Explorer on the client computer. The following picture shows a user's view of Windows Explorer. We see there is one network location listed here, which is the G drive that is mapped to \\hq-con-srv-01\data.
Figure 2 Public drive map client view
Later, we'll see how to use exclusive drive mappings with public drive mappings as a way to exclude public drive mappings from a subset of users.
Inclusive drive mappings are drives mapped to a user who is a member of (or included) in a specific security group. The most common use for inclusive drive maps is to map remote data shares in common with a specific sub set of users, such as accounting, marketing , or human resources. Configuring an inclusively mapped drive is the same as a public drive mappings, but includes one additional step. The following image shows us configuring the first part of an inclusive drive mapping preference item.
Figure 3 Inclusive drive mapping
Configuring the first part of an inclusive drive mapping preference item does not make it inclusive; it does the work of mapping the drive. We must take advantage of item-level targeting to ensure the drive mapping items works only for users who are members of the group. We can configure item level targeting by clicking the Targeting button, which is located on the Common tab of the drive mapping item. The targeting editor provides over 20 different types of targeting items. We're specifically using the Security Group targeting item.
Figure 4 Security group targeting item
Using the Browse button allows us to pick a specific group in which to target the drive mapping preference item. Security Group targeting items accomplishes its targeting by comparing security identifiers of the specified group against the list of security identifiers with the security principal's (user or computer) token. Therefore, always use the Browse button when selecting a group; typing the group name does not resolve the name to a security identifier.
Figure 5 Configured inclusive security group targeting item
The preceding screen shows a properly configured, inclusive targeting item. A properly configured security group targeting item shows both Group and SID fields. The Group field is strictly for administrative use (we humans recognize names better than numbers). The SID field is used by the client side extension to determine group membership. We can determine this is an inclusive targeting item because of the text that represents the item within the list. The word is in the text "the user is a member of the security group CONTOSO\Management." Our new drive map item and the associated inclusive targeting item are now configured. We can now link the hosting Group Policy object to the domain with confidence that only members of the Management security group receive the drive mapping. We can see the result on a client. The following image shows manager Mike Nash's desktop from a Windows Vista computer. We can see that Mike receives two drive mappings: the public drive mapping (G: drive) and the management drive mapping (M: drive).
Figure 6 Client view of inclusive drive mapping
The last scenario discussed is exclusive drive mapping. Exclusive drive mappings produce the opposite results of an inclusive drive mapping; that is, the drive map does NOT occur if the user is a member of the specified group. This becomes usefully when you need to make exceptions to prevent specific drives from mapping. Let's add an exclusive drive mapping to our public drive mapping to prevent specific members of management from receiving the public drive mapping.
Figure 7 Configured exclusive drive mapping
The preceding image shows the changes we made to the public drive mapping (from the first scenario). We've added a Security Group targeting item to the existing public drive mapping preference item. However, the targeting item applies only if the user IS NOT a member of the ExcludePublicDrives group. We change this option using the Items Options list. The client view of manager Monica Brink shows the results of applying Group Policy.
Figure 8 Client view of exclusive drive mapping
This client applies two Group Policy objects; each containing a drive mapping preference item. One item contains our public drive mapping with an exclusive security group targeting item. The other GPO contains the management drive mapping with an inclusive security group targeting item. The client processes the public drive mapping GPO; however, the exclusive targeting item verifies that Monica is a member of the ExcludePublicDrives group. Monica is also a member of the Management group. Therefore, Monica's group memberships prevent her from receiving the public drive mapping and include her in receiving the management drive mapping.
Drive mapping preference items do not require any scripting knowledge and are easy to use. Leveraging targeting items with drive mapping items increases the power in which to manage drive mapping to users and computers. Public drive mappings are typically linked at higher levels in the domain and generally apply to a large subset (if not all) users. Inclusive drive mappings associate as specific subset of data with a specific group of people, often times mapping to logical divisions within an organization such as accounting, marketing, or human resources. Exclusive drive mappings invert the principals of inclusive drive mappings. The user must not be a member of the specified group for the drive mapping to occur.
Be sure to link GPOs high enough in Active Directory so the scope of the drive mapping effects the largest group of user accounts. Obviously, not every GPO should be linked at the domain; however, if there is an accounting organizational unit with three child OUs-- then linking at the Accounting OU effects that largest amount of users. Allow your inclusive and exclusive targeting item to do the bulk of your work. GPOs hosting inclusive drive mappings are best used when the number of user needing the drive mapping are fewer than the number who do not. Exclusive drive mappings are best used when the number of user not requiring the drive mapping are fewer than the number that do. These rules help prevent users from becoming members of too many groups and increasing the cost of managing drive mappings within the organization.
- Mike "Play Some Skynyrd!' Stephens
Ned here. For those testing Windows 7 administration capabilities, this is for you.
Download here
This is the list of Windows Server 2008 administration tools which are included in Win7 RSAT Client:
Server Administration Tools:• Server Manager
Role Administration Tools:• Active Directory Certificate Services (AD CS) Tools• Active Directory Domain Services (AD DS) Tools• Active Directory Lightweight Directory Services (AD LDS) Tools• DHCP Server Tools• DNS Server Tools• File Services Tools• Hyper-V Tools• Terminal Services Tools
Feature Administration Tools:• BitLocker Password Recovery Viewer• Failover Clustering Tools• Group Policy Management Tools• Network Load Balancing Tools• SMTP Server Tools• Storage Explorer Tools• Storage Manager for SANs Tools• Windows System Resource Manager Tools
If you need any kind of support, head on over to the TechNet forums or drop us a line here.
- Ned Pyle
Hi, Ned here again. Today I'm going to go through some well-hidden information on DFSR SYSVOL migration; hopefully this sticks in your brain and someday allows you to enjoy your weekend rather than spending it fighting issues.
As you already know, Windows Server 2008 introduced the ability to use Distributed File System Replication (DFSR) to replicate your SYSVOL folder, rather than the legacy File Replication Service (FRS). And there was much rejoicing. The step-by-steps for this process are documented here:
1: SYSVOL Migration Series: Part 1 – Introduction to the SYSVOL migration process 2: SYSVOL Migration Series: Part 2 – Dfsrmig.exe: The SYSVOL migration tool 3: SYSVOL Migration Series: Part 3 – Migrating to the 'PREPARED' state 4: SYSVOL Migration Series: Part 4 – Migrating to the 'REDIRECTED' state 5: SYSVOL Migration Series: Part 5 – Migrating to the 'ELIMINATED' state
(And before you get wound up in the Comments section - Yes, there is a TechNet Whitepaper for this coming just as soon as we can get it published! Don't hurt me!)
So let's run through some Q & A.
Q: What are the Domain Controller availability requirements during my migration?
A: There are a couple.
1. The PDC Emulator must be online any time the DFSRMIG tool is being invoked for a read or write operation. If the PDC Emulator is offline or inaccessible for LDAP, the user of DFSRMIG will receive:
"Unable to connect to the Primary DC's AD.
Please make sure that the PDC is reachable and try the command later."
2. All DCs must remain online until they each complete their state steps. All DCs do not need to be accessible simultaneously. But the global state will never reach the Prepared, Redirected, or Eliminated state until all DCs have been able to complete their individual phases.
The PDC Emulator requirement is because by default, administrators always edit group policy on the PDCE, so in most environments it will have the most up to date knowledge of policy. That and we need to talk to someone unique, so it might as well be him.
It is recommended that a SYSVOL migration not be attempted unless all DCs are online and available. Change control blackouts should be scheduled to prevent modification to DCs that might impact their availability. This will minimize the window of time that the migration will take.
Q: Is there some super-secret way to return to using FRS after reaching the Eliminated phase of DFSR migration?
A: Microsoft does not support returning your domain to using FRS for SYSVOL replication after a completed DFSR migration (except to rebuild the domain). This is why the steps are done in a phased approach with two checkpoints where you can revert back to FRS without any consequences. Once you trigger the ELIMINATED phase to start, there is no going back, period.
Q: When does Robocopy run during the migration and what does it do?
A: The DFSR service uses robocopy at several stages to synchronize SYSVOL directories outside of normal replication when it detects a SYSVOL migration is underway; a set of 'pre-seeding' and 'save the GP admins from themselves' operations.
1. When Prepared state (DFSRMIG /SETGLOBALSTATE 1) is invoked, all DC's robocopy their FRS SYSVOL data locally into the new DFSR content set. This is equivalent to 'pre-seeding' data and ensures that minimal file replication occurs to converge the content set. This is triggered by the DFSR service itself when:
2. When entering the Redirected state, the PDC Emulator (only) robocopies the local differences of FRS SYSVOL data into the new local DFSR content set, on itself. The other servers receive new data via replication.
3. If you undo the Redirected state back to Prepared, the reverse happens. The PDC Emulator robocopies its local DFSR content set data into its local FRS content set. FRS replication synchronizes all other servers... eventually. Allow more time for this than entering Redirected, as FRS is not as fast to synchronize as DFSR.
For sharp-eyed readers: we won't run into any of the old pre-seeding issues (the file hash being changed by robocopy) here because DFSR correctly creates the SYSVOL_DFSR folder ACL, so there are no inheritance issues when the contents are copied in and replicated.
Q: Event 8004 says something about RODC's. I don't have any RODC's. What the frak?
A: The following event is incorrectly written in the DFSR event log(s) on servers that are not Read-only Domain Controllers when setting elimination state using DFSRMIG.EXE:
Log Name: DFS Replication Source: DFSR Date: 9/28/2007 11:53:46 AM Event ID: 8004 Task Category: None Level: Information Keywords: Classic User: N/A Computer: <WRITABLE DC> Description: The NTFRS member object for the Read-only Domain Controller <WRITABLE DC> was deleted successfully.
Well, it finally happened – we had a bug. No, no, don't try to tell me it's not possible, it was bound to occur someday. :)
The text in the event log is completely cosmetic and benign. It is supposed be fixed in a later version of the OS. Just ignore it.
Q: What are all the AD and Registry state values that will be set at a given point in the migration?
A: Ok, you asked for it buddy.
1. Prepared Phase - DFSRMIG /SETGLOBALSTATE 1
a. DFSRMIG contacts the PDC Emulator directly. b. Global objects are created under: CN=DFSR-GlobalSettings,CN=SYSTEM,DC=<domain> CN=DOMAIN SYSTEM VOLUME CN=SYSVOL SHARE CN=CONTENT CN=TOPOLOGY c. CN=DFSR-GlobalSettings now has msDFSR-Flags attribute set to 0. d. As DC's pick up the globalstate change via AD replication and DFSR service polling, they create and write to registry entry: HKLM\System\CurrentControlSet\Services\DFSR\Parameters\Sysvols\Migrating Sysvols Local State = 4 [REG_DWORD] e. The PDC Emulator creates the: CN=dfsr-LocalSettings,CN=<servername>,DC=<domain> objects for all DCs and sets this attribute to:
msDFSR-Flags = 80 (if RWDCs). msDFSR-Flags = 64 (if RODCs - the RODC itself will set it to 80 later). f. The DFSR service has now started and created the new local SYSVOL_DFSR structure. Robocopy has made a local copy of the FRS SYSVOL. All AD topology data has been written in to support the content set. Initial sync of the data has started (since robocopy has locally pre-seeded the data this should involve minimal replication data on the network). The registry on all DC's is: Local State = 5 [REG_DWORD] g. Once initial sync is done on all DCs: Local State = 1 [DWORD] 'msDFSR-Flags' (on CN=dfsr-LocalSettings) = 16 h. If DFSRMIG /GETGLOBALSTATE returns that all DCs are prepared, 'msDFSR-Flags' on CN=dfsr- GlobalSettings has changed to 16 because all DCs are prepared. All DCs are currently replicating DFSR and FRS content sets, with FRS being shared as SYSVOL.
2. Redirected Phase - DFSRMIG /SETGLOBALSTATE 2
a. DFSRMIG contacts the PDC Emulator directly. b. CN=DFSR-LocalSettings now has msDFSR-Flags attribute set to 96 on all DCs and this replicates out through AD. c. As DCs pick up the attribute from AD replication, their DFSR service sets: Local State = 6 [REG_DWORD] d. On the PDC Emulator only, robocopy syncs any changes between the FRS and DFSR's content sets, and this is replicated out through DFSR. e. Once SYSVOL data is in sync, SYSVOL content set is set to be the active SYSVOL share on all servers. FRS and DFSR are both still replicating data. f. When this is complete, for each DC: Local State = 2 [DWORD] 'msDFSR-Flags' (on CN=dfsr-LocalSettings) = 32 g. If DFSRMIG /GETGLOBALSTATE returns that all DCs are redirected, 'msDFSR-Flags' on CN=dfsr- GlobalSettings has changed to 32 because all DCs are prepared. All DCs are currently replicating DFSR and FRS content sets, with DFSR being shared as SYSVOL.
3. Eliminated Phase - DFSRMIG /SETGLOBALSTATE 3
a. DFSRMIG contacts the PDC Emulator directly. At this point it is not possible to undo the changes! b. CN=DFSR-LocalSettings now has msDFSR-Flags attribute set to 112 on all DCs and this replicates throughout AD. c. As DCs pick up the attribute from AD replication, their DFSR service sets: Local State = 7 [REG_DWORD] d. On the PDC, the FRS content set information is removed and this is replicated through AD. As each DC sees this change, their FRS service stops replicating the FRS content set. The FRS service is stopped (and restarted if custom FRS sets still exist on a given server). e. When this is complete, for each DC: Local State = 3 [DWORD] 'msDFSR-Flags' (on CN=dfsr-LocalSettings) = 48 f. If DFSRMIG /GETGLOBALSTATE returns that all DCs are eliminated, 'msDFSR-Flags' on CN=dfsr-GlobalSettings has changed to 48 because all DCs are prepared. All DCs are currently replicating DFSR only. g. A final cleanup task on each DC will set their 'msDFSR-Flags' on CN=dfsr-LocalSettings to <NOT SET>. The same will happen from the PDC to CN=dfsr-GlobalSettings.
If any 'undo' phases are entered (where an administrator has decided to go from redirected back to prepared, redirected back to start, or prepared back to start), the flow above happens in reverse, with the exception that the following two entries exist in the 'Local State' registry entries:
8 (Undo Redirecting) 9 (Undo Preparing)
Q: I'm not a huge fan of Ultrasound. Are there any other ways to validate the health of SYSVOL prior to and after migration?
A: Sure thing - already discussed in a previous blog post here.
Q: Are there any migration KBs or bugs I need to worry about?
A: One KB, with a simple solution to domains that have non-standard (and frankly, not any safer than default) security configurations: http://support.microsoft.com/kb/2567421
And that's it. If you have any questions on DFSR SYSVOL migration not covered by this blog post or by the FileCab step-by-step guide, don't hesitate to start swinging in the Comments section below.
- Ned "Working on Windows 7 Beta But Still Has An Unnatural Love for Win2008 DFSR" Pyle
Hi all, Mark from Directory Services again. This time I would like to talk about one of the many tools that we use in troubleshooting network issues. At times you may see errors such as The RPC server is unavailable or There are no more endpoints available from the endpoint mapper (These error messages can be DNS related at times). Of course you may see an error code such as 1722 or 1753. So you ask, "What does the error code mean?" If you get an error such as 1722 or 1753, open a command prompt and type in the following:
Net helpmsg <error number>
An example would be net helpmsg 1722 and after hitting enter you will get The RPC server is unavailable. If the error number is something such as a hex number then they will not resolve using the net helpmsg command.
Before we get into talking about using portqry we need to understand a little bit more about RPC (Remote Procedure Call). When a server starts up applications and services that are going to be listening for other clients connecting, they may register with the RPC Endpoint Mapper (EPM). EPM will keep a database of all these registrations and what ports they are listening on. Ports are used so that applications can communicate between client and server. By default EPM will listen on port 135. When a client needs to know what port an application is listening on it queries RPC to find out. This is much like going to the hospital to see a sick friend. The address of the hospital would be the IP address of the server. When you go in the door to the information desk to find out what room your friend is in would be the same as querying RPC on port 135. Then once you're in the room with your friend you now connected with the application you wanted to talk to. Some ports such as LDAP (389), SMB (445), etc. are hard coded so they are consistent across all Windows clients and servers. To see a list of common ports go to KB article here. Applications may register a port on what is referred to as ephemeral ports. An ephemeral port is a port above 1024 and less than 65536. Take LSASS (Local Security Authority Subsystem Service) for an example, it will usually listen on a couple of ports just above 1024 such as 1025, 1026 or 1027. An example of the output is below:
Note: I am querying port 135 against a Domain Controller in my examples.
UUID: 12345778-1234-abcd-ef00-0123456789ac
The UUID stands for Universally Unique Identifier, no 2 applications should ever have the same UUID, and is followed by an annotated name if one exists. On the second line is the protocol the application uses and the IP address of the server. Then in the brackets will be the port number the application is listening on. The example above was taken from the LSASS service but you can see multiple entries for a single application as well. Such as this:
Now note that the UUID's are the same, the annotated name is the same if one I present, but the protocol is different and now we have the server name path as this is the named pipe instance. So how do we query the RPC to find out what applications are registered? Glad you asked! First we need to download the portqry command line tool from here or the GUI tool from here. I prefer using the command line tool and piping the results to a text file. Once you have the tool downloaded and installed open a command prompt. Let's say you have issues connecting to another server (call it Server1) across a WAN where there is a firewall in place. At the command prompt run the following command:
Portqry –n server1 –e 135 > port135.txt & port135.txt
This will query the RPC EPM service (-e switch) on server1 (-n switch) and pipe the results to a text file. The use of the"&" and referring to the text file again will open the text file after the command is done. Now look at the text file. The first portion is simply taking the server name that you are querying against and resolving to an IP address:
Querying target system called:
Attempting to resolve name to IP address...
Name resolved to 192.168.0.30
The next line is very critical:
TCP port 135 (epmap service): LISTENING
Querying Endpoint Mapper Database...
Server's response:
If something other than LISTENING is returned then there could be a problem with a port being blocked somewhere. If the port shows to be FILTERED then a firewall or VLAN could be blocking that port, if the port returns NOT LISTENING then we got to the machine but the machine is not listening on that port number. If you get a LISTENING or FILTERED response, check and see whether we are checking TCP or UDP, most likely it was attempting to use UDP and this would be a normal response as UDP is connectionless. An example of this would be if you query port 88 for Kerberos against a DC and use the following syntax:
Portqry –n server1 –e 88 –p both
TCP port 88 (kerberos service): LISTENING
UDP port 88 (kerberos service): LISTENING or FILTERED
By default we will only query the port on TCP. By using the –p switch we can tell the portqry tool which protocol we want to use. Using the both after the –p we can tell the utility to query both TCP and UDP. In the above example we use UDP by default for Kerberos so that is why I wanted to check both protocols.
Now back to querying the endpoint mapper. Let's say you have two Domain Controllers with a firewall separating them and they are not replicating. You believe the networking admin has all the ports open on the firewall. From one DC query the other DC on port 135 and look at the output. Search the text file for lsass then note the UUID. Scroll up or down in the text file until you find the port number in brackets such as this, [1025]. Now run the portqry again using this:
Portqry –n server1 –e 1025
Does it return LISTENING? If so then good, if it shows FILTERED then the port is blocked on the firewall. Keep searching for lsass as you will find it will listen on more than one port, usually 2 different ones. Once you find the second port run the command again using the second port number and verify it is listening as well. You can also search the text file of FRS (File Replication Service) and query its port. If you query port 389 (LDAP) then you will get a stream of information from the DC such as below:
currentdate: 12/16/2008 23:37:23 (unadjusted GMT) subschemaSubentry: CN=Aggregate,CN=Schema,CN=Configuration,DC=domain,DC=com dsServiceName: CN=NTDS Settings,CN=server1,CN=Servers,CN=Corp,CN=Sites,CN=Configuration,DC=domain,DC=domnamingContexts: DC=domain,DC=com defaultNamingContext: DC=domain,DC=com schemaNamingContext: CN=Schema,CN=Configuration,DC=domain,DC=com configurationNamingContext: CN=Configuration,DC=domain,DC=com rootDomainNamingContext: DC=domain,DC=com supportedControl: 1.2.840.113518.104.22.1689 supportedLDAPVersion: 3 supportedLDAPPolicies: MaxPoolThreads highestCommittedUSN: 1541417 supportedSASLMechanisms: GSSAPI dnsHostName: server1.domain.com ldapServiceName: domain.com:firstname.lastname@example.com serverName: CN=SERVER1,CN=Servers,CN=Corp,CN=Sites,CN=Configuration,DC=domain,DC=com supportedCapabilities: 1.2.840.113518.104.22.1680 isSynchronized: TRUE isGlobalCatalogReady: TRUE domainFunctionality: 2 forestFunctionality: 0 domainControllerFunctionality: 2
You can use the –p both switch with this command and it will query both UDP and TCP and it will return the same information each time. Note the UDP will show up as LISTENING or FILTERED as discussed before. If you want to query multiple ports you can use a switch such as this: -o 88,389,445 All you have to do is separate the port numbers with a comma then it will run it against all the ports you specify one right after another. If you want to do a range of ports say between 1100 and 1105 use –r 1100:1105.
If you prefer to use a GUI based tool instead of the command line download the GUI version from the link above or here. Extract the files then run the portqueryui.exe to open the tool. Enter the IP address or server name in the first field then in the Query Type you will notice you have a drop down box for Service to query. This is useful as these ports will be fined in the config.xml file that is located in the same directory. This is useful to gather information against multiple ports that are commonly queried and outputs the results to a window you can simply copy and paste into a text file for review later. It also allows you to manually enter the port numbers that you want to query on and the protocols.
You can use portqry to troubleshoot several different issues. I had a case where when checking the NTFS permissions on a folder it would take up to 20 seconds to resolve the SID to a name. In a network trace we saw the traffic going from the server to a DC. In the trace we queried port 135 to find out what ports LSASS was listening on. It returned 2 different ports. In the trace we could see that the server would send a SYN packet to the first port and we would never get a response from the server. It kept trying to use that port for almost 20 seconds then it would fail over to the second port on the list and resolve the SID to a name. We used portqry using the first port number and showed the customer that port was being filtered on the VLAN which he later confirmed was true. Another time we used portqry to confirm a problem with a trust between 2 domains which is common scenario for us.
Another note is that you cannot run portqry on a server back to itself. To do this run the following command on the server itself:
Netstat –ano > netstat.txt & netstat.txt
This will list out the protocols (TCP and UDP) the local address, foreign address (this would be a remote server that has a connection to your server) it's state then the PID of the service that is listening locally. Here is a sample:
Active Connections
Proto Local Address Foreign Address State PID
To find what process is listening open Task Manager, go to View – Select Columns – put a check mark in the box for PID then ok. You can click on the PID column to sort it by numerical order to look up the number easier. As in my example above the port 53, which is DNS, 1424 resolves to DNS.exe, 400 is lsass.exe, 748 is svchost.exe (one of many svchost.exe's), etc.
I hope I have not confused anyone too much and hope this helps in any troubleshooting network issues. Thanks!
816103 HOW TO: Use Portqry to Troubleshoot Active Directory Connectivity Issues
Troubleshooting networks without Netmon (Ned Pyle has some good information here as well)
- Mark Ramey
Hi, Ned here again. Are you tired of me blogging about DFSR and FRS yet? If so, stop reading. :)
Today I am going to describe the architectural differences of SYSVOL replication on Read-Only Domain Controllers in Windows Server 2008 – FRS versus DFSR. This makes another good case for taking the effort of getting your domain functional levels to 2008 and migrating off of the File Replication Service.
Before I get rolling, a mini-glossary:
RODC - Read-Only DC (Introduced in Windows Server 2008) RWDC - Writable DC (introduced in Windows 2000 Server) FRS - File Replication Service (introduced in Windows 2000 Server) DFSR - Distributed File System Replication (introduced in Windows Server 2003 R2)
Running RODCs with FRS as the replication engine for SYSVOL
While FRS can be used, it has some significant downsides in its behavior if the environment is not carefully administered. Since RODCs are designed to be placed in locations that will not have administrators or very basic role-separated administrators, this can be problematic. FRS does not contain the full plumbing to undo changes, but instead only prevents changes from leaving the DC.
As you can imagine, using FRS to replicate RODC SYSVOL folders has some administrative caveats and is not recommended. FRS ,as a feature, has effectively been deprecated (as you can tell from here and the Windows Server 2008 administration tools – where did DFSGUI.MSC go?).
Running RODCs with DFSR as the replication engine for SYSVOL
DFSR offers some architectural advantages that make it very compelling for RODCs.
For these reasons, DFSR-based SYSVOL replication (available when running in Windows Server 2008 Domain Functional Mode) is recommended.
PS: Have you downloaded Windows Server 2008 R2 yet and deployed DFSR in a test environment? You are in for some surprises there with read-only. You should check that out…
- Ned "My First Born Was Named USN Journal" Pyle
Ned here again. The cat is out of the bag now and we're a little more free to talk about DFSR features that are planned (not guaranteed - planned) to release with Windows Server 2008 R2. Our friends at the File Cabinet blog have posted an excellent writeup - definitely worth a look:
DFS Replication: What's new in Windows Server™ 2008 R2
Here's the short and sweet list of areas that were added or improved:
You can try all these out in a test environment right now - hurry up and grab the ISO's before it's too late.
- Ned 'The Short Simpson' Pyle
Hi, Steve again. I thought I would speak through a series of posts about what knowledge is critical to fulfilling the Windows Server Domain Admin role. This topic carries a ton of breadth and depth knowledge. As a beginning, you have to find out where all this knowledge and training is located. My goal is to get you started down this path so you are exposed to different technologies that you will need to understand and master in order to become a Domain or Enterprise administrator.
The process of building the depth of knowledge required may take years to acquire. With some help and guidance I hope to reduce this time to several months. For other folks that have already started on this path or are already fulfilling this role, there may be topics that I reference that may hold some value for them as well. A lot of great information for Windows Server 2003 exists and I will focus on these resources.
As I go through this blog there will be links to more information. The links will consist of required reading to achieve our goal of being domain admin ready. It may take weeks to progress through this blog for some folks. I intend to develop follow up blogs that discuss in more detail, especially focused on ideas revolving around the design portions for Active Directory (AD). I would like to present some examples of a theoretical company's environment and build an actual AD design.
So let's get started. You have been using a computer for your personal use and you have just been hired to the helpdesk at your company to manage user accounts.
Microsoft has published an enormous library of technical information and other information on TechNet. What is TechNet? Well, that would be a blog unto itself, but as a quick reference you can find the technical libraries for most of our products there. You will also find educational resources, downloads, event information, webcasts and newsgroups. Microsoft also provides a learning portal designed for IT Professionals here.
Let's talk about design first; each company has to choose an AD design. The simplest is a single forest/single domain where all of your accounts are stored in one domain. By default the first domain you create is the forest root domain, you can add more domains to your forest as a child domain of the root or add new domains as a separate tree in the forest. So how do you decide how many domains should you have? The vast majority of companies can live comfortably within one forest, but may require multiple domains within the same forest for a variety of reasons. This link discusses planning an AD deployment and choosing a logical structure. The more complicated your design the more time and effort required to manage your environment. You might ask yourself if your company requires more than one group of administrators to manage computer and user accounts and requires isolation of data or resources for security purposes. If the answer is clearly yes then you can plan on having more than one domain. You want to try to match your company structure to your AD structure whenever possible as a general rule of thumb. Domains quite often are used to isolate and group resources and normally domain administrators don't have access to resources within another domain. You also decide that locality might play an important role in domain structure. It may be due to network isolation or even language differences but several companies have chosen to isolate different geographic locations into separate domains. In order to choose the correct design for your company you will need to engage participants from all of your business divisions so they can share their requirements for resources.
AD allows admins to create logical containers within a domain that allows you to group resources for control and/or manageability. These items are called Organizational Units or OU's for short. You may decide to create an OU structure for User Accounts that is separate from Group Accounts or Computer Accounts. You can further refine your collections of accounts based on business function or geography.
AD also supports using objects to describe the physical organization of your network. For example, a site is defined by one or more network subnets. AD sites control what AD resources within the domain or forest a client should use. Typically we want our clients to use resources within their local site rather than traversing to other sites.
By now, you are probably getting the picture that AD design is flexible enough to support a wide variety logical models. As an exercise you might consider an AD design for a large international company named Contoso. Just to make it easy say we have 30,000 employees in Redmond, WA, USA and 8,000 in North America, South America, Europe and Asia. Right from the start you are going to have questions where you will need to engage other business divisions to get answers. For instance, the first question you might want to answer is; "Is one forest enough or should I isolate a segment of our business entirely and setup a trust between two forests?" The next question might be "Should I use one domain or should I use multiple domains to organize and manage my resources?" You should also engage the network experts in your organization to understand how best to map the physical structure of your network into AD.
The steps in choosing a design are critical to the success of a company's IT infrastructure. Even though it seems like there is no "right" answer there are definitely going to be "wrong" answers. The best advice I can give is design a few models and start discovering the pro's and con's of each design.
There are fewer factors involved in choosing a namespace design. This document covers your choices well. Different business divisions might have some requirements with regards to namespace and they will need to be engaged in this discussion. You will find this discussion loops into the AD design as well and can be considered jointly.
Ok let's say we have selected a namespace and we know how many forests, domains and sites fit our company best. What's our next step in AD? We need to choose structure for where our accounts in AD will be stored. We want to choose a logical structure that makes our objects in AD easy to find and manage. You do this by creating OU's within your domain. Some choices you may make are creating OU's for either user and computer accounts or combining them. Keeping them separate will make manageability easier. You may group similar machines in the same OU or you may break out accounts based on business function or geographic location.
Having a methodical and tested plan is key here. AD is an important component in the organization and we must maintain its availability. There are several scenarios that need to be covered in a plan developed to cover that potential event. Here are points of failure that should be included in a recovery plan:
Each one of these events or a combination is possible. You will need to work through these potential events and determine a clear and concise set of steps that need to be completed to resolve the problem.
Regular backup of AD is critical. Testing these backups to make sure you can quickly and easily restore the data is best practice. All too often backup is scheduled but it's not running or you cannot restore the data.
What are FSMO roles and how should they be distributed in your environment? This varies based on forest size. In the smallest environments we might put all roles on one server. In a large environment we might choose to place each role on a different machine. The FSMO PDC Emulator (PDCe) role brings the highest volume of work. In a large domain you would probably want to make sure the DC hosting the PDCe role is isolated from performing other roles, such as: not targeted by LDAP based applications, deployment server, web server, file and print server etc… The FSMO roles are important to make sure the forest and domain have these roles assigned to a specific DC.
In addition to server selection we might also distribute the FSMO role holder by physical location. This maybe the most secure site or best network availability or highest number of client requests.
Many companies have time requirements for their computer systems. By default the PDCe FSMO role holder is at the top of the time pyramid for the domain. Other domain members use W32Time service to synchronize their system clocks. Keeping the PDCe synchronized with an accurate source will help keep you domain member's time accurate.
As domain admin you will need to know how new accounts are created. Question: "Will HR be creating user accounts within their own software and does that software create new user accounts in AD?". Some environments have very complex user provisioning scenarios. In more simple scenarios the user account maybe created by an administrator and manually gets their mailbox created and user group membership configured. In more distributed environments the Account Operators group maybe used and in the most complex scenarios it maybe the Human Resources Dept or the hiring manager who creates the user accounts.
There is a lot of information that falls under the group policy umbrella that a domain admin needs to be familiar with. In a nutshell you can use group policy to configure computer and user configuration settings on machines throughout your domain. You'll want to familiarize yourself with GPMC, the group policy management tool.
There are approximately 2,400 settings in Windows Vista that can be set in group policy. This gives the admins a good deal of flexibility in configuring computer and user settings. You use group policy not only to restrict the abilities of specific users in your domain but you can also enhance their experience through group policy as well.
There are several general categories that can be controlled including: Application Deployment, Certificate Enrollment and Trust, Logon-logoff-startup-shutdown scripts, Restrict Groups settings, Internet Explorer configuration, disk quotas, user folder redirection, user rights and security configuration, etc… The list goes on and on depending on your needs.
Group policy is also flexible; you can link group policies at a domain, site or OU level. Clients that have memberships in these containers either by direct membership or inheritance will receive these policies. Therefore, it follows that your design of AD can help ease the distribution of user and computer configurations.
Here again collaborating with different business divisions within your organization is a must. Workstations in the accounting department will most likely need different software and access to their local machines than users in the Marketing department. Similarly, web servers will have different configurations than domain controllers. You can individually set the configuration as part of an image during the build process or you can manually change a machines configuration, but when you want to change thousands of machines at once, Group Policy is definitely the way to go.
On top of normal GPO settings, we now have group policy preferences which increases the flexibility and extends the capability of what administrators can do with group policy.
As the domain admin you have the proverbial "keys to the kingdom" for the resources in your domain. Security is a big responsibility to protect your domain's resources. Domain security access requires authentication. There are several levels of authentication and you will want to implement the highest level of security where possible.
Windows 2003 implements several authentication protocols: Negotiate, Kerberos, NTLM, Secure Channel, and Digest . It's also extensible so other authentication protocols can be added.
NTLM is a challenge-response authentication mechanism. The client attempts to access a resource and is challenged for credentials by the server. The client sends the username and a hash of the user account's password and the server attempts to authenticate your credentials on a domain controller in the user's domain. Therefore, the server must chain back to the user's domain to be authenticated. NTLM has several variations and this is only one iteration. You would also loop anonymous access under this category if the username and password are null the target machine will attempt to logon the user as anonymous. If the server resource accepts anonymous authentication then the client will get access.
Kerberos is a more secure and efficient form of authentication than NTLM. It is the default authentication package in most cases beginng with Windows 2000. To summarize kerberos authentication, a client will ask for a service ticket for the server resource it wants to access. The client receives the ticket and forwards the ticket to the resource server to be authenticated. Wherever possible you would want to configure authentication to use Kerberos.
Certificates can be used for authentication as well. Certificate technologies have grown in scope and complexity over the past several years. More and more technologies are using certificates to increase security. So even though it's not an authentication protocol it is used in conjunction with authentication protocols to increase security. For example, smartcard authentication uses a certificate that is installed on a physical card. The card is placed in a smartcard reader and the user provides a PIN to access certificates on the card. In this way its two factor authentication because we are using something we have, the smartcard, and something we know, the PIN, to provide authentication.
Certificates can also be used to increase security by encrypting the network traffic. Secure Sockets Layer, SSL is a well known method of encrypting traffic and can provide server identity. SMIME is another common scenario where users can encrypt and digitally sign their email.
We are seeing more and more companies implementing their own internal Certificate Authority infrastructure. Having a certificate authority for your domain allows you to assign both user and computer certificates through both automated and manual methods. Using these certificates can significantly increase the security inside and outside your network.
Authentication can be difficult to manage. Two very common scenarios are choosing authentication methods in SQL and IIS. It would be nice if all your applications in the enterprise supported Kerberos and you could just worry about one method but that's not realistic. It may be an overwhelming task to determine the configuration of all applications. Where you would have concerns are scenarios where plain text or basic authentication is being used. You'll want to restrict this behavior as much as possible and never use your domain admin credentials to access those applications. If however it is the only method that can be used at the very least the authentication should be encrypted using certificates.
Domain admins must determine if they will allow a trust to be established with another domain or forest. Moving to 2003 forest level allows you to establish a forest level trust and therefore inherit trusts for domains within the other forest.
We can use certificates to provide encrypted sessions to servers. The most common example with be using HTTP over SSL. In this case, we would issue a server certificate to the web server that would confirm the server's identity and allow for users to establish an encrypted session. For internet facing web servers, normally you would purchase a certificate from a trusted authority.
Another example of using SSL internally within your organization is for LDAP over SSL. Typically our domain controllers service client request over port 389. We can leverage application that are LDAPS enable by installing a server authentication certificate on our DC's.
These two technologies provide file encryption. Bitlocker was introduced in the Windows Vista operating system. It helps provide whole drive encryption that is seamless to the user. It helps protect both data and operating system files and is especially useful on laptops where a user may not be able to maintain physical security of the device. EFS is the technology we use to encrypt specific files on a computer. By default the domain admin is the recovery agent for all EFS files in the domain. These encryption technologies can remove your access to data and it may be lost. Care needs to be given to design a proper system where the domain admin decides who can use encryption and for what purposes. As well as who will be the recovery agent in case a client cannot decrypt their files.
Resource access is controlled through an access control list, (ACL), in most situations. Fundamentally, we need to determine whether we will create ACL's based on users or groups. We recommend setting security on resources by using domain based groups when more than one user will be accessing the resource. Adding a user to that group gives them access to all those resources and, conversely, removing them restricts their access. Change management is much easier if group membership matches resource needs. Securing groups and controlling group membership is important as a domain admin to strike a balance between people that do not want to use any groups and those who would like a person to be a member of a 1000 groups.
Some businesses are required by government regulations to maintain auditing at a certain level. Outside of these bounds, security auditing needs to be controlled closely on the domain controllers. This would include not only capturing the data but also periodically reviewing the audit logs to confirm their content.
Password Policy – This is rather straight forward. Mainly need to determine the level of complexity, password expiration age and lockout threshold. Here, you want to have a secure password that changes on a regular basis but not so stringent that it costs your company money in lost productivity and helpdesk related issues. Complex passwords are the best way to increase security. On the other hand, there is a certain theory that a low account lockout threshold will increase security.
The lower the number for account lockout the more frequently accounts will be locked out. Any number less than 7 will most likely increase lockout dramatically.
Choosing the right combination of lockout threshold, duration and complexity will help keep everyone working with an acceptable level of password security.
Care should be given to examine specific accounts that handle sensitive data. Not only should the data be closely protected but also the accounts that are used to control that data. This may include company executives, domain administrators, HR and Finance employees and application service accounts.
Delegation of Control – Depending on your organization's size you may have a highly distributed group of users that modify Active Directory objects. The goal would be to give each person responsible for AD management the least privilege required to perform their responsibilities.
For ease of use we create specific groups with Active Directory to achieve common tasks: Server Operators, Account Operators, Backup Operators etc… These groups have predefined access to domain resources. Other actions may be non-standard and require specific permissions in Active Directory. Several applications write to Active Directory and their service accounts will need specific access rights. Typically this would be applications that may need Enterprise Admin permissions to install. In addition, they may create specific groups particular to their application that allows them to write to Active Directory. Microsoft Exchange is a good example.
ACLs on AD objects – For the most part, the default permissions on an object within Active Directory will be acceptable. It can be very difficult to manage and troubleshoot access problems when you are not using a standard approach to control access. Setting specific restrictions to particular objects is where administration can turn into a nightmare. Make sure strict change control and documentation is enforced whenever making changes to AD. Keep in mind Active Directory will outlast many of your administrators. Nobody wants to be in a position where you are trying to back out changes that were completed a year ago without documentation of what changes were made.
Although these technologies are managed and mostly controlled by our networking group, domain admins need to understand the concepts associated with network design and administration. At the core, TCP/IP is our primary communication protocol suite.
DHCP is how our hosts get network addresses that are dynamically assigned and how we configure clients for DNS registration, Wins and DNS discovery.
WINS is older technology for NetBIOS name resolution that is still in use in many networks.
DNS is more critical to a fully functioning and distributed AD environment. Netlogon is used to register the domain controller records in DNS. These records allow client to discover domain roles and services within their AD site.
Users are accessing our network in greater frequency outside of the LAN. In order to work closely with your network counterparts you need to understand some of their technologies. These would include but are not limited to: Routing, Remote Access, VPN, IPSec, Wireless, RDP, etc…
There are two types of firewalls that you will encounter: the one at the edge of your network's boundaries and one installed on workstation/server computers. While the network team will manage the perimeter firewall, the firewall installed on your clients and servers may be managed by Group Policy and, hence, in the domain admins' realm.
For the firewalls on the perimeter, you will need to be familiar with the ports that are required to be open.
The FSMO roles: Schema Master and DomainNaming Master are forest based roles. The PDCe, RID Master and Infrastructure Master are domain specific roles. In a small domain scenario you may have all 5 roles installed on the same server. In larger environments you will most likely decide to distribute these roles to separate machines, and in the case of having more than one domain in your forest, you will need to host these roles on multiple machines. Usually the roles are hosted on machines in the data center or hub site. As far as the roles are involved the PDCe role hosts a lot more activity then all the other roles combined.
Global Catalog(GC) server placement is also a concern for efficiency. GC's are required for logon and need to be distributed efficiently. Having a GC present in remote sites will help to significantly reduce the amount of logon traffic and the time required for logon. Conversely, a GC in a remote site will consume network bandwidth during replication cycles.
The schema is the base configuration for Active Directory. It defines the types of objects that will be created inside the database. Changes to the schema can be difficult or impossible to be undone. As the domain is upgraded to new versions there is typically going to be a schema update associated. Other applications may also extend the schema such as Exchange or third party applications. Before any schema update, ensure a rollback or recovery process is in place. Removing an upgrade to the schema is may not be possible or corruption of the schema may cause permanent malfunction of AD. You will need to be a member of the Schema Admins group to be able to modify the schema and the modification needs to take place on the Schema Master.
The configuration container has a lot of information stored there but very little that will be actively managed. For instance, there is information about the configuration of the active directory forest and their associated partitions. This includes information about AD sites and Enterprise services such as Certificates and Exchange email. Extended Rights inside AD are defined here such as changing the FSMO role holders. There is just one configuration per forest so whatever is written here is available to all domains in the forest.
This is where all of your user, computers and groups are stored. But if you enable advanced features in AD Users and Computers snapin, ADUC.MSC you will see a lot more data is contained in the system container. There is information associated with the AdminSDHolder process which protects your admin accounts from loosing permissions to AD, Domain DNS information and Group policy is also stored here. Rarely, if ever, will you modify any items in the system container using ADUC. It would be wise to restrict delegation to this container. On the other hand, the AD delegation wizard makes distributing permissions to other admins or account management people easy.
You can store and replicate DNS information for the forest and for specific domains to DC's. Active Directory integrated zones are stored in AD. Standard primary zones are stored as files on the DNS server.
Just to mention a brief description of the core toolset a domain admin may use on a regular basis or under emergency conditions.
This is a small subset of tools that an admin will use but these tools seem to be used regularly. There are frequently other applications with similar or overlapping features. There are even software packages that will monitor and manage Active Directory.
There are many new features and services available that released with Windows 2008 Server. Some of the key changes for 2008 Active Directory Domain services are: Read Only DC's, Disaster Recovery and Fine Grained Password Policy.
It's been a long road to get to this point if you have been following all the links in the document along the way. In no way is this intended to be the "be all and end all" of domain admin knowledge. I hope if you are a domain admin already, you gained some knowledge in some areas. If you are new to domain administration you hopefully learned a great deal. You might now look to some official Microsoft curriculum or certification, please visit Microsoft Learning website.
- Steve 'Milk in the fridge' Taylor
Hi. Jim here again from the Directory Services team. Today I will break down some of the core components of credential roaming and how it functions. To secure critical transactions such as signing, encrypting, and decrypting e-mail or authenticating identity, many environments rely on certificates. The user certificates and the associated private keys are linked to the local profile on whatever machine the user logs onto. Let's talk about the local user profile briefly. When a user logs onto a computer for the first time a local profile is created for that user. This profile sets the desktop environment, certificates, private keys, and all other user-specific configuration information. When the user logs back onto the same machine this profile is reused.
You can see where I am going here. What if the user logs onto multiple machines? In this scenario a user could end up having separate sets of certificates and private keys on each computer's local profile. Administrators would have to manage multiple certificates stored on multiple machines in multiple profiles. What if a profile on one machine gets deleted? What if that deleted profile contained certificates and private keys used to decrypt data? What if the user leaves the company? I hope you have key recovery configured.
Enter Credential Roaming –
Credential roaming functionality addresses these concerns by making it possible to roam only the user's credentials in a manageable, secure manner that is ultimately transparent to the user. For the purpose of this post we will only be discussing the roaming of certificates and private keys. The credential roaming implementation in Windows Vista and Windows Server 2008 is additionally able to roam stored user names and passwords. For more information on this go here - "How to Manage Stored User Names and Passwords on a Computer in a Domain in Windows XP" at:
Remember, credential roaming only supports x.509 v3 certificates and RSA or DSA key pairs that are stored in the user's credential store. Only credentials in the user's MY and REQUEST stores are roamed.
Ok, Ok, enough already. Let's get into how credential roaming works in a nutshell. What you need first is a functioning, healthy Active Directory environment. This is crucial as credential roaming relies on group policy, auto enrollment and healthy Active Directory and SYSVOL replication. Windows Server 2003 SP2 and XP SP3 both support credential roaming. The update below must be applied to XP SP2 computers as well as Windows Server SP1 machines to facilitate credential roaming.
907247 Description of the Credential Roaming service update for Windows Server 2003 and for Windows XP - http://support.microsoft.com/default.aspx?scid=kb;EN-US;907247
After you have verified you are running the correct versions of Windows and you have deployed the 907247 update, you can begin the initial configuration of credential roaming in your organization. In order to receive the script necessary to modify your Active Directory schema you must have an engagement with Microsoft Consulting Services or you can request the script from Microsoft Customer Support Services. For more information about the request procedure, see the Microsoft Knowledge Base article
I will not be covering the initial credential roaming configuration as the steps for configuration are explained here in exhaustive detail:
Configuring and Troubleshooting Certificate Services Client–Credential Roaming - http://technet.microsoft.com/en-us/library/cc700821.aspx
Once credential roaming functionality has been configured in your Active Directory environment, here is what happens on an XP computer with the 907247 update installed. This also assumes healthy active directory replication and successful group policy application in regard to credential roaming policy specifically.
1. A user logs on to a domain joined computer. 2. Group policy applies successfully and includes the policy setting for credential roaming. Here is the location in the registry where the Credential Roaming Group Policy settings are written: HKEY_CURRENT_USER\Software\Policies\Microsoft\Cryptography\Autoenrollment AEPolicy REG_DWORD 0x7 DIMSRoaming REG_DWORD 0x1 DIMSRoamingTombstoneDays REG_DWORD 0x3c DIMSRoamingMaxNumTokens REG_DWORD 0x7d0 DIMSRoamingMaxTokenSize REG_DWORD 0xffff 3. Coinciding with Winlogon and Userinit.exe the dimsntfy.dll (which has been updated by the 907247 update) sets off an event to activate credential roaming. The dimsntfy.dll lives within the WINDOWS\system32 folder. 4. Also located in the WINDOWS\system32 folder, the Dimsroam.dll (also updated by the 907247 update) is the Key Roaming DIMS Provider DLL. The Dimsroam.dll is compelled by group policy to count the number of tokens in the local certificate store. The maximum number of tokens allowed to roam can be configured within the following credential roaming group policy setting.
1. A user logs on to a domain joined computer.
2. Group policy applies successfully and includes the policy setting for credential roaming.
Here is the location in the registry where the Credential Roaming Group Policy settings are written:
HKEY_CURRENT_USER\Software\Policies\Microsoft\Cryptography\Autoenrollment AEPolicy REG_DWORD 0x7 DIMSRoaming REG_DWORD 0x1 DIMSRoamingTombstoneDays REG_DWORD 0x3c DIMSRoamingMaxNumTokens REG_DWORD 0x7d0 DIMSRoamingMaxTokenSize REG_DWORD 0xffff
3. Coinciding with Winlogon and Userinit.exe the dimsntfy.dll (which has been updated by the 907247 update) sets off an event to activate credential roaming. The dimsntfy.dll lives within the WINDOWS\system32 folder.
4. Also located in the WINDOWS\system32 folder, the Dimsroam.dll (also updated by the 907247 update) is the Key Roaming DIMS Provider DLL. The Dimsroam.dll is compelled by group policy to count the number of tokens in the local certificate store. The maximum number of tokens allowed to roam can be configured within the following credential roaming group policy setting.
If there are more tokens available then what is specified (In the above screenshot the default maximum of 2000 per user is set) credential roaming will not work. If the total number of non-tombstoned credentials plus tombstoned credentials is less than two times the number indicated in the group policy setting above, then the credential roaming series of events proceeds on its merry way. (Non Tombstoned + Tombstoned) < 2000 x 2 = credential roaming works (Non Tombstoned + Tombstoned) > 2000 x 2 = credential roaming fails You do the math ; ) 5. The local credentials of the user and the credentials within the Active Directory object of the user are compared against the state.dat file. The state.dat is the current state file. The state.da~ is the previous state file. When credential roaming reconciles new certificates from Active Directory to the local store and from the local store back up to Active Directory the state.dat file records those transactions. Each time this occurs the original state.dat file is renamed to state.da~ and a new state.dat is created. Both the state.dat and the state.da~ files are located here on a Windows XP machine: C:\Documents and Settings\"username"\Local Settings\Application Data\Microsoft\DIMS The security on this directory by default is as follows: DomainName\UserName: F (Full Control – Inherited) NT AUTHORITY\SYSTEM: F (Full Control – Inherited) BUILTIN\Administrators: F (Full Control – Inherited) On a Vista machine, it is located here – %LOCALAPPDATA%\Microsoft\DIMS Any modification to these permissions may affect the functionality of credential roaming. I will speak more of this in a forthcoming credential roaming troubleshooting post. I must also point out in regard to Vista that the NTDS.DIT file on domain controllers grows continually larger after enabling credential roaming for Windows Vista clients. Please see the following for information on the hotfix, or install Vista Service Pack 1 to proactively avoid this issue: 934797 - The size of the Ntds.dit file on the domain controller grows continually larger after you enable the "Credential Roaming" feature for Windows Vista-based client computers in the domain http://support.microsoft.com/default.aspx?scid=kb;EN-US;934797 Let's press on shall we… If there has been a modification of the certificates in the local store or the user object in Active Directory, the changes are either downloaded to the store or uploaded to Active Directory. The reconciliation of the local store with Active Directory and vice versa is handled by the dimsroam.dll. The private key material is encrypted the DPAPI key and all credential roaming communication between the computer and Active Directory is Kerberos encrypted.
If there are more tokens available then what is specified (In the above screenshot the default maximum of 2000 per user is set) credential roaming will not work. If the total number of non-tombstoned credentials plus tombstoned credentials is less than two times the number indicated in the group policy setting above, then the credential roaming series of events proceeds on its merry way.
(Non Tombstoned + Tombstoned) < 2000 x 2 = credential roaming works
(Non Tombstoned + Tombstoned) > 2000 x 2 = credential roaming fails
You do the math ; )
5. The local credentials of the user and the credentials within the Active Directory object of the user are compared against the state.dat file. The state.dat is the current state file. The state.da~ is the previous state file. When credential roaming reconciles new certificates from Active Directory to the local store and from the local store back up to Active Directory the state.dat file records those transactions. Each time this occurs the original state.dat file is renamed to state.da~ and a new state.dat is created. Both the state.dat and the state.da~ files are located here on a Windows XP machine:
C:\Documents and Settings\"username"\Local Settings\Application Data\Microsoft\DIMS
The security on this directory by default is as follows:
DomainName\UserName: F (Full Control – Inherited) NT AUTHORITY\SYSTEM: F (Full Control – Inherited) BUILTIN\Administrators: F (Full Control – Inherited)
On a Vista machine, it is located here –
Any modification to these permissions may affect the functionality of credential roaming. I will speak more of this in a forthcoming credential roaming troubleshooting post. I must also point out in regard to Vista that the NTDS.DIT file on domain controllers grows continually larger after enabling credential roaming for Windows Vista clients. Please see the following for information on the hotfix, or install Vista Service Pack 1 to proactively avoid this issue:
934797 - The size of the Ntds.dit file on the domain controller grows continually larger after you enable the "Credential Roaming" feature for Windows Vista-based client computers in the domain
Let's press on shall we…
If there has been a modification of the certificates in the local store or the user object in Active Directory, the changes are either downloaded to the store or uploaded to Active Directory.
The reconciliation of the local store with Active Directory and vice versa is handled by the dimsroam.dll. The private key material is encrypted the DPAPI key and all credential roaming communication between the computer and Active Directory is Kerberos encrypted.
The dimsroam.dll also deletes certificates that are older than the tombstone lifetime in days set in the credential roaming group policy. These certificates with an older tombstone are deleted from both Active Directory and the user's local store. Any reference to them is also removed from the state.dat file. The Tombstone value should be a value long enough so that the user is able to logon to all machines that they use so that the certificate is deleted from all the respective local certificate stores upon logon. If this value is too low, then previously deleted certificates can be put back into the AD Credentials store and cause the certificate to be repopulated on all machines that the user logs onto.
6. The maximum size of the user object's credentials attribute is the result of the maximum number of tokens multiplied by the maximum token size. A user object can become large if there are a large number of tokens that also have a large token size. With certificates the token size will vary depending on the key size. The size above (65535) is default. It is conceivable that a user's credential size would be larger than what is defined in the policy, thus causing credential roaming to fail for that user. 7. If auto-enrollment is configured in group policy the pautoenrol.dll kicks off AFTER credential roaming code is finished. This prevents auto-enrollment from taking place needlessly. If auto-enrollment was to take place before credential roaming it is conceivable that a user logging on to a different machine would enroll for a certificate already procured on another machine and waiting to be roamed.
6. The maximum size of the user object's credentials attribute is the result of the maximum number of tokens multiplied by the maximum token size. A user object can become large if there are a large number of tokens that also have a large token size. With certificates the token size will vary depending on the key size. The size above (65535) is default. It is conceivable that a user's credential size would be larger than what is defined in the policy, thus causing credential roaming to fail for that user.
7. If auto-enrollment is configured in group policy the pautoenrol.dll kicks off AFTER credential roaming code is finished. This prevents auto-enrollment from taking place needlessly. If auto-enrollment was to take place before credential roaming it is conceivable that a user logging on to a different machine would enroll for a certificate already procured on another machine and waiting to be roamed.
The Dimsroam.dll will fire off the credential roaming series of events described to this point when the following occurs:
In addition Credential Roaming also roams the DPAPI master keys. For more explanation of the Windows Data Protection API (DPAPI) go here. For group policy only there may be a latency of up to four hours before the certificate store is refreshed. This is by design and was introduced to reduce high load on domain controllers when group policy is updated or created. Like anything else, credential roaming deployments require careful consideration and testing before enterprise wide roll outs. Go here for more exhaustive information on all things credential roaming.
- Jim "Lord of the Strings" Tierney


text:
Fly53 Bunker Camo Lightweight Mens JacketFly53 use their musical heritage to influence their everyday involvement in manufacturing clothing, to ensure a rapid rise into one of the UK's most premier streetwear brands. This jacket features an all-over camouflage design that's on trend for the season. The zip-up fastening and attached hood ensure maximum versatility depending on the weather conditions, whilst signature branding is included with logos to both the front and the back. The ribbed hem and cuffs round off with a classic look. Pair this lightweight jacket with slim fit jeans and flat-laced plimsolls to give your outfit an urban-inspired vibe. Useful info:
View all Fly53 products | |

subset: commoncrawl


text:
Christina Harms: 22, an Aberdeen Central High School graduate and former Special Olympics athlete, had fetal alcohol syndrome. Shepard became her legal guardian after her mother's death.
Cassandra Shepard: 27, formerly of Aberdeen, charged with domestic violence murder, aggravated abuse of a vulnerable adult and obstruction of justice in Harms' death.
Sherrie Beckering: 50, Shepard's mother, charged with aggravated abuse of a vulnerable adult in Harms's death.
Dale Beckering: 52, Shepard's stepfather, charged with aggravated abuse of a vulnerable adult in Harms's death.
Harley Harms: 2, daughter of Christina Harms, was put in the custody of Utah's Division of Child and Family Services after her mother's death. Relatives are trying to get her back to South Dakota.
Ken Harms: Harms' father, of Aberdeen, is seeking custody of his granddaughter.
Linda Harms: Harms' mother, died in 2008 after asking Shepard to be her daughter's guardian.
Phillip Harms: Harms' brother, of Aberdeen.
Dawn Knoepfle: Family friend, of Aberdeen, cared for Linda Harms when she was dying, was Christina Harms' temporary co-guardian until Shepard became her permanent sole guardian.
Marie Chapin: Wife of Lyle Chapin, Harms' cousin, of Luverne, Minn., set up account to bring Harley to South Dakota and hired an attorney to support Ken Harms.
Bonnie Lewis: Harms' aunt, Linda Harms' sister, of Texas, who offered to take Christina Harms to Texas when her sister died, but Linda Harms wanted her daughter to be able to see her brother more often.
Adam Shepard: Shepard's brother, of Aberdeen, father of Harley Harms


text:
6 mile mountain bike trail,
The Veteran's Park in Lexington, Kentucky provides a great single track option for urban riders. The six mile trail is generally regarded as an easy ride by most riders. Partnering with the Kentucky Mountain Biking Association, Lexington's first mountain bike trail is sure to continue to grow in popularity. A "Fix-Station" has also been set up at the trail location for riders to perfrom work on their bikes.
Get Directions
4303 Tates Creek Rd. Lexington, KY 40515
Favorite Kentucky Hiking Trail


text:
I saw this list Eero Saarinen wrote for his second wife at the Morgan Library 'Lists' exhibition. I especially love the "I know this is not a good sentence" part. Pretty fascinating view into that guy's mind.
I wish I could take a photo of this when I saw it! This was one of my favorite lists at the Morgan Library exhibit. The last sentence took me an extra minute than the rest to decipher.


text:
Eric Stackpole's passion for discovery was originally directed toward outer space. As a mechanical engineering student at San Jose State University in 2007, he founded a campus club devoted to building mini satellites. That landed him a job at NASA's Ames Research Center, which led to an emphasis on robotics in graduate school.
One day in 2010, Stackpole's shoe squeaked on a tile floor, reminding him of the "ping" made by sonar; in his mind's eye he saw the lights of a remote-operated vehicle (ROV) vanishing into deep, dark water.
Inspired, he began to develop a cheap, camera-enabled mini submersible. He soon realized that Earth has an environment as strange as anything beyond the atmosphere. "There's this mysterious underwater world, a lot like space," he says. "You can move in three dimensions; the equipment has to be rugged. And there are aliens down there—creatures we've never seen before."
The mini submarine is designed to descend to 330 feet, too deep for scientific divers.Stackpole's sub is simple and cheap by marine science standards; it weighs 5.5 pounds and costs around $500 in mostly off-the-shelf parts. Two onboard battery packs provide about 1.5 hours of runtime. The vessel is designed to descend to 330 feet, too deep for scientific divers. That makes it a rich zone for observation—or, as Stackpole puts it, "armchair adventures and daily discovery."
The operator controls the ROV using either a keyboard or a USB game controller, and images are beamed to the surface over a tether plugged into a computer's Ethernet port. The sub can carry lightweight payloads, such as sensors or water samplers, which also makes it a valuable instrument for environmental monitoring.
Through mutual acquaintances, Stack-pole met David Lang, a community manager for a web startup. Lang had once run a Berkeley, California, sailing school, and the two quickly bonded. With an ROV, they agreed, anyone could probe underwater realms—especially anyone willing to solder, wire, and glue together a personal mini sub based on Stackpole's plans.
They envisioned a DIY community of professionals and amateurs, collaborating on robotic exploration for fun and science. Enthusiastic to foster it, they made the ROV open source, so anyone could improve upon its design and programming. They also started a Kickstarter campaign to crowd-fund the assembly and distribution of a couple dozen kits. Just two hours after launch, they had hit their $20,000 target; a month later they'd raised $111,622 and taken more than 100 orders. Kits began shipping to Kickstarter backers this fall, and the pair plan to set up an online store early next year.
The sub, now dubbed OpenROV, made its inaugural trip into Hall City Cave, a partially flooded cavern in California, last January, followed by a dive to the Aquarius Reef Base in the Florida Keys in June. Stackpole is now in Antarctica working on a science team; he's hoping to send Lang images from OpenROV's first voyage at the South Pole.
--Emily J. Gertz


text:
The Concert Series at Wellesley College Presents the Chamber Music Society
Presented by The Concert Series at Wellesley College at Jewett Auditorium
May 2, 2010
The Wellesley College Chamber Music Society (CMS) offers an opportunity for small ensembles — including strings, winds, guitar, harp, piano, harpsichord, and voice — to explore chamber music works of the last three centuries. Each year, CMS boasts over 20 student ensembles.
106 Central Street
Wellesley, MA 02109
Admission Info:
General Day and Time Info:
7:30 pm
Accessibility Info: Currently, no accessibility information is available for this event.
Facebook Comments
Member Reviews
There are currently no reviews/comments for this event. Be the first to add a review/comment , and let folks know what you think!


text:
"Coca-Cola" NLH and DorsY Collaborations
Artist description:
Here is Collab of NoLeonardoHere and me :) it was lots of fun to do collab together :D
Created Jul 02, 2008. Unless noted Copyright 2008
dorsy69 .
We encourage you to submit a comment and let the artist know what you think of this drawing. Please log in or join to post a comment.
Post a comment
i want some coca-cola now OAO......*buys a coca cola*.....uhm..5H! and favs! ^^
Very realistic! Looks nice and cold too. Now I know how my cats feel not to be able to open a can. :) 5/5
Free drawing tools
All drawings on our website are created with our free web based drawing tools.
Drawing tools
Top draws this month
Check out some of the hottest drawings created by our members this week.
View top drawings
Draw and chat live
DrawChat is a chat room where you can draw and chat live with other members.
Start DrawChat


text:
Wie is er Nu Online
F, 94 United States
F, 44 United States
I am free from the restraints that used to bind me, I see now that I was the only one who had the power all along. They tried to hold on as tight as they could ....
F, 49 United States
LOVE,And Respect Most importand Of Our Friendship.It is just me & My PRINCE & PRINCESS Of This group.Iam here For Fun I Love Any Languages Of Music.You ....
Populaire rooms
Paltalk in het nieuws
OMGPOP's Chief Revenue Officer Wilson Kriegel Becomes President, COO of Video Chat Startup Paltalk.
Read More -
NY based Paltalk offers more than just talk. CEO Jason Katz sees today's popular handheld communication devices as ideal vehicles for its range of free services providing cutting-edge video and chat capabilities.
Read More -
Paltalk's integration of video, audio and text chatting unified into one window makes for a strong chatware program that includes a wealth of features. Read More


text:
Roll Over Image to Magnify
& Click to Zoom |
Why Set & Save?
Just click "Add to Set & Save" when placing items in your cart.
Adults: when practical, cleanse the affected area by patting or blotting with an appropriate cleansing wipe. Gently dry by patting or blotting with at tissue or a soft cloth before applying ointment. When first opening the tube, puncture foil seal with top of cap. Apply to the affected area up to 4 times daily, especially at night, in the morning or after reach bowel movement. Intrarectal use: remove cover from applicator, attach applicator to tube, lubricate applicator well and gently insert applicator into the rectum, thoroughly cleanse applicator after each use and replace cover. Also apply ointment to external area. Regular use provides continual therapy for relief of symptoms. Children under 12 years of age: ask a doctor.
For external and/or intrarectal use only. Ask a doctor before use if you have heart disease • high blood pressure • thyroid disease • diabetes • difficulty in urination due to enlargement of the prostate gland.
Ask a doctor of pharmacist before use if you are presently taking a prescription drug for high blood pressure or depression. When using this product do not exceed the recommended daily dosage unless directed by a doctor.
Stop use and ask a doctor if bleeding occurs • condition worsens or does not improve within 7 days • introduction of applicator into the rectum causes additional pain.
If pregnant or breast-feeding, ask a health professional before use. If swallowed, get medical help or contact a Poison Control center right away. (1-800-222-1222).
People Who Viewed This Item Also Viewed


text:
Were I to stumble upon this movie, "The Devil's Tomb" on the scifi channel on a Saturday afternoon, I'm sure it would be a pretty entertaining time. Hell, even I am not above the pleasures of gratuitous gunfights set to rap/metal. The cast of this movie is absolutely unreal though, especially considering the "shot on video" look of the whole thing. Take a gander:
Cuba Gooding Jr. ... Mack Ray Winstone ... Blakely Ron Perlman ... Wesley Taryn Manning ... Doc Henry Rollins ... Fulton Valerie Cruz ... Elissa Bill Moseley ... Prof. Duncan
Kevin Tenney has been busy lately. First of all, he's been producing a remake of his 80's classic "Night of the Demons", which is actually looking like it will get some type of theatrical release.
Apparently he's also been working on a zombie film called "Brain Dead", and the news today is that it will be getting a limited theatrical release in just a few short weeks. March 30th, 2009 to be exact. Synopsis and trailer below:
This is really the kind of thing for Mark and his obsession with professional wrestling, but since I know there's no way he's up this early, I figured I'd take it on myself. (I kid because I love)
This is an Indie feature called "Parts Unknown", and between the trailer and the synopsis, there shouldn't be a whole lot of selling I need to do. So, here's what you require:
We've talked about this once or twice in passing, but I figured I'd put something more official here. "Anvil: the Story of Anvil," has a new trailer released that actually raises my expectation for the documentary just a little. My overarching concern remains that there simply isn't much there. Ninety-five percent of metal fans respond with a confused look when the name Anvil is mentioned, so the documentary is going to have to excel on its merit.
Here's the trailer for Sam Raimi's "Drag Me To Hell", his supernatural film starring Allison Lohman which sees a wide release May 29th of this year.
Here's the plot from IMDB:
Let's face it... having a parent that excels at a certain field doesn't automatically mean that you're going to. If that were true, I'd be the most kick-ass insurance salesmen in South Florida.
With Jennifer Lynch, daughter of wildman David Lynch, the jury still seems to be out. Her previous directing credits include the 3.9 rated on IMDB "Boxing Helena" in 1993, one episode of "Joe Bob's Drive-in Theater" (!!!) in 1995, and this film, "Surveillance".
I'm a little late to the game on this Indie film, but what I'm seeing in this trailer makes it look promising. Of course, it appears as if it sat on a shelf for the entirety of 2008, with no DVD release date set yet for 2009, so who knows what's going on with the distribution. It has been playing the festival circuit, and from what I can see has gotten some positive response. Here's the synopsis:
Okay, so after seeing this trailer I think I finally understand the excitement behind "Blood: The Last Vampire". It comes to you from director Chris Nahon, who I see currently has a script out for a "Skate or Die" movie, which may actually make him my personal hero.
"Blood The Last Vampire" is based on the Anime film of the same name from 2000, and the story goes like this:
Here at Bloody Good Horror, we frequently voice our appreciation of films from Japan, China, North Korea, and Thailand (among others), even if we can never truly understand them as much as we'd like. In a recent runaround on YouTube, I think I may have found a film that exemplifies this disconnect perfectly; "Dai-Nipponjin (Big Man Japan)."
Synopsis via IMDB:
This movie is... weird...
Who could kill a child? Turns out most of us, pretty easily in fact.


text:
Top Apps
- Audio & Video
- Business & Enterprise
- Communications
- Development
- Home & Education
- Games
- Graphics
- Science & Engineering
- Security & Utilities
- System Administration
Showing page 1 of 2.
FileZilla The free FTP solution
556,553 weekly downloads -
FreeFileSync Visual folder comparison and synchronization
13,573 weekly downloads -
Task Coach Free flexible open source todo manager featuring hierarchical tasks
4,024 weekly downloads -
wxMaxima wxMaxima is a cross-platform graphical front-end for the computer algebra system Maxima based on wxWidgets. It provides nice display of mathematical output and easy access to Maxima functions through menus and dialogs.
745 weekly downloads -
MadEdit MadEdit is a Cross-Platform Text/Hex Editor written in C++&wxWidgets. MadEdit can edit files in Text/Column/Hex modes, and supports many useful functions e.g. SyntaxHighlightings, WordWrap, Encodings(UTF8/16/32,Big5,GBK...) and WordCount.
733 weekly downloads -
MultiGet file downloader MultiGet is a http/ftp downloader with a nice GUI for linux/windows/unix desktop users. It can run on almost all desktops without any configuration. It has many powerful functions comparing to others.
607 weekly downloads -
Robolinux Run Windows XP & 7 Virus Free In The Robolinux Stealth Virtual Machine
1,653 weekly downloads -
PCMan X PCMan is an easy-to-use telnet client mainly targets BBS users formerly running under MS Windows. PCMan X is a newly developed, open-source and cross-platform version written with wxWidgets, supporting X Window, MS Windows, and Mac OS X.
493 weekly downloads -
Kablink Kablink open team collaboration software uses social networking to unify team workspaces w/ real-time web conferencing. Collaboration for knowledge networking, program management, communities-of-practice, telework, other business process/functional areas
76 weekly downloads -
Kujawiak Viewer (kuView) kuView is a picture viewer, provides useful features including Unicode, Exif, scaling filter, shell integration, and archive browsing. May be used as replacement for built-in viewer or ACDSee-like on Windows. Has tiny executable, is portable and green.
70 weekly downloads -
Agender With Agender you can associate notes with some date or with no date in particular, you simply start it and it will create a task-bar icon and stay in the background, without annoying you, it can run on login. Visit the website to see more.
33 weekly downloads -
BlogTrans BlogTrans is a tool to backup/import/export blog contents, and transform data between different blog-backup format. BlogTrans currently support MoveableType import format, wretch.cc format, and Blogger gdata API.
51 weekly downloads -
Whyteboard Whyteboard is a painting whiteboard application for Linux and Windows, that allows the annotation of PDF and PostScript documents, and image files with common drawing tools.
10 weekly downloads -
wxMEdit wxMEdit, a cross-platform Text/Hex Editor, a fork of MadEdit
34 weekly downloads -
Mingdao IDPChecker A tool for mingdao high school IDP score check
2 weekly downloads -
BLibrestez55 Robotics Software Project BLibrestez Robotics Software Library Project
1 weekly downloads -
ROC(Taiwan) Judgement Search ROC Judgement Search 中華民國司法裁判書查詢與下載
1 weekly downloads -
StepIntoChinese Step Into Chinese is a flexible language-mining and flashcard tool to assist English speakers seeking to understand Chinese language.
1 weekly downloads -
SudokuBoxer Sudoku GUI game & solver. Develop by wxPython
1 weekly downloads -
Tracefrog Tracefrog is a program that gives you the real time web page's update. You can track the web pages you interested for any web sites with any part. (no matter it provides RSS or not).
1 weekly downloads -
WxSudoku A Sudoku Puzzle Game written by wxwidgets.
1 weekly downloads -
pyiTctrl pyiTctrl enhances usability of iTunes, more easier and efficient. On-screen display and global hot-key enables iTunes' users to control without touching iTunes.
1 weekly downloads -
Daodict Daodict is a Cross-Platform and international dictionary written in wxWidgets.
0 weekly downloads -
G502MaJiang A peer-to-peer online MaJiang game for UNIX-like operating systems. There is also a slightly adapted version for PttBBS-based bulletin board systems.
0 weekly downloads -
Tisney Junior 山寨版 Disney Junior
0 weekly downloads