Querying FSMO roles & ADPREP

To find out what domain controller roles are within the organisation:

List all DCs in forest with DN and RDN:

DsQuery Server -o rdn -Forest
DsQuery Server -Forest

List all the DCs in domain:

DsQuery Server -domain domain_name.com

List all the DCs in domain (that are Global Catalog Servers):

DsQuery Server -domain domain_name.com -isgc

List all DCs in forest (that hold FSMO):

DsQuery Server -Forest -hasfsmo schema

Use the “>” to store the output to a text file. The below command will store all the domain controller names in AllDCs.txt.

DsQuery Server -Forest > AllDCs.txt

List FSMO roles using NETDOM

netdom query fsmo

Adding a new Domain Controller to the Domain.

ADPREP commands to upgrade Domain Controllers (In this order)

ADPREP /forestprep
ADPREP /domainprep
ADPREP /domainprep /gpprep
ADPREP /rodcprep
Guide to Windows Server 2008 ADPREP: 
Problems with ADPREP and SYSVOL migration process:

How to view and transfer FSMO roles in Windows Server 2003
http://support.microsoft.com/kb/324801

How do I install Active Directory on my Windows Server 2003 server?
http://www.petri.co.il/how_to_install_active_directory_on_windows_2003.htm

Adobe Reader X (Rollout)

With the release of Adobe Reader X I needed to roll this out to a number of systems. There seems to be a mass of complex information regarding something as simple as a silent install at login on the client PCs.

Below is a list of reference material to help make this process easier! There are a number of methods, so no right and wrong way of doing it! I’m in the process of deployment so building up a list of information to get it right (will update here later)

Silent Install switch (could be added to login script) then via GP:

\\server\Software-Distribution\AdbeRdr1000_en_US.exe /msi EULA_ACCEPT=YES /qn

Installation via software deployment in GP (old guide but the same principle)

http://www.adobe.com/content/dam/Adobe/en/devnet/acrobat/pdfs/gpo_ad_8.pdf

Exchange 2007 | Sendas email account using alternate domain

I’ve was asked to set up an additional domain name under Exchange 2007. The only issue is that Exchange doesn’t quite handle multiple domain names very well, yes you can add aliases and easily create them within the exchange console, however the problem comes to “sending as” a different domain on the client machine (outlook) I managed to get this method working, although it may not be the best method, I’m couldn’t find any other solutions.

Method 1:

  • Create a new user and mailbox.
  • Set the default email address as email@domain.co.uk
  • Add full send as permissions to the mailbox.
  • Setup redirect so all email to email@domain.co.uk is forwarded to email@domain2.com

This is good, but is messy as multiple user accounts are required…

Method 2 (Preferred Method):

  • Setup a new distribution list email@domain.co.uk (remove the alias from users current profile to do this)
  • Add User as the manager of this list and the only member
  • Set the permissions for full send as via the powershell…

You can change mailbox permissions using two methods but only the powershell method seems to work properly (so probably best to stick to this)

  • 1) Via Powershell: Add-AdPermission “DL” -user “name.surname” -AccessRights extendedright -ExtendedRights “send as”
  • 2) From the “users and computers” selected the distribution group changed to “Advanced” settings and edited the security on the DL to add “user” to Full access”

TS/RDS Disconnect Sessions GP

  • Start -> Run -> gpedit.msc
  • Open Computer Configuration -> Administrative Templates -> Windows Components -> Terminal Services – > Session.

Set time limit for disconnected sessions

  • You can use this setting to specify the maximum amount of time that a disconnected session is kept active on the server. By default, Terminal Services allows users to disconnect from a remote session without logging off and ending the session.

Sets a time limit for active Terminal Services session

  • You can use this setting to specify the maximum amount of time a Terminal Services session can be active before it is automatically disconnected.

Sets a time limit for active but idle Terminal Services session

  • You can use this setting to specify the maximum amount of time that an active session can be idle (that is, no user input) before it is automatically disconnected.

Allow reconnection from original client only

  • Specifies whether to allow users to reconnect to a disconnected Terminal Services session using a computer other than the original client computer.

Terminate session when time limits are reached

  • Specifies whether to terminate a timed-out Terminal Services session instead of disconnecting it.

SCANPST.EXE Tool Location (PST recovery)

Looking for ScanPST tool bundled with Microsoft Office?

Try on the following locations:

SCANPST.EXE

  • disk drive:\Program Files\Microsoft Office\OFFICE12
  • disk drive:\Program Files\Common Files\System\Mapi\1033\
  • disk drive:\Program Files\Common Files\System\Mapi\1033\NT
  • disk drive:\Program Files\Common Files\System\MSMAPI\1033
  • disk drive:\Program Files(x86)\Microsoft Office\Office12
  • disk drive:\Program Files(x86)\Common Files\System\Mapi\1033\
  • disk drive:\Program Files(x86)\Common Files\System\MSMAPI\1033

Exchange Delivery Error 5.2.0

User gets an error message when sending email from an external email address to a public folder email using exchange 2007

Delivery has failed to these recipients or distribution lists

#< #5.2.0 smtp;550 5.2.0 STOREDRV.Deliver: The Microsoft Exchange Information Store service reported an error. The following information should help identify the cause of this error: "MapiExceptionNotAuthorized:16.18969:D0130000.....

Fix:

  1. Logon to the public folder (in Outlook client is easiest)
  2. Right click -> Permissions -> Change -> “Anonymous” User to Create Items (Contributor)
  3. Should do the trick work 🙂

WSUS (wuauclt.exe) | Updates CLI

Detectnow Option

Because waiting for detection to start can be a time-consuming process, an option has been added to allow you to initiate detection right away. On one of the computers with the new Automatic Update client installed, run this at command prompt:

wuauclt.exe /detectnow

Resetauthorization Option

WSUS uses a cookie on client computers to store various types of information, including computer group membership when client-side targeting is used. By default this cookie expires an hour after WSUS creates it. If you are using client-side targeting and change
group membership, use this option in combination with detectnow to expire the cookie, initiate detection, and have WSUS update computer group membership.

Note that when combining parameters, you can use them only in the order specified as follows:

wuauclt.exe /resetauthorization /detectnow

Windows Server Update Services (WSUS) Support Tools:

CLI for WUAUCLT:

Source: http://technet.microsoft.com/en-us/library/cc708617(WS.10).aspx

Check Action Sessions & disconnect on TS via CMD

Run the following on any Server in the domain from CMD.

  • query session /server:servername

You can then close the sessions by running the following:

  • reset session [ID] /server:servername

This e-mail and any attachments are intended for the addressee only and may=
be confidential. If you are not the intended recipient, please advise the =
sender as soon as practicable and delete the e-mail from the system. The Un=
iversity of Chichester is a company
limited by guarantee, registered in England and Wales. Registration number=
4740553. The registered office is College Lane, Chichester, West Sussex, P=
O19 6PE.

DNS Zone export to TXT & Clear DNS

Exports the contents of the specific DNS zone to a .txt file. Just makes the process easier for debugging etc, when dealing with larger DNS zones:

dnscmd /zoneexport domain.com c:\zones-export.txt

Clears the local computer cache.

Ipconfig /flushdns

Clears the DNS server cache.

dnscmd /clearcache

Terminal Services Licensing service cannot start Server 2008

Event Viewer displays:

  1. The Terminal Services Licensing service cannot start. The following error occurred: Can’t initialize Cryptographic – error code 8009000f.
  2. An error occurred during the Terminal Services license server initialization phase.
  3. To resolve this issue, ensure that required groups are granted the correct permissions to the TermServLicensing registry key and that the value of the DBPath registry key matches the location of the LServer directory. If the problem persists, shut down and then restart the Terminal Services license server

Fix:

  • Change permissions on C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys
  • Manually restarted the service (service.msc)

In my case, Local administrator already had full access. Added Domain Admin (Full Access) and Network Services (Full Access)

Check this article which pointed me in the right direction: http://msdn.microsoft.com/en-us/library/bb909654(VS.90).aspx

Next…

Now with the above problem solved… we then move onto our next problem:

http://blogs.msdn.com/b/rds/archive/2010/03/30/event-17-certificate-corruption-on-terminal-services-remote-desktop-license-servers.aspx#CertDeletion

Another useful link:

http://www.windowsitpro.com/article/licensing/jsi-tip-9040-you-cannot-activate-a-terminal-services-license-server-in-a-windows-server-.aspx

Host vs Lmhost

Hosts File
The host file is located in the %SystemRoot%\System32\Drivers\Etc directory as Hosts with no file extension on both Windows NT and Windows 2000 machines. The Hosts file is primarily used to resolve host names (Computer
Names) to an IP address.

LmHosts File
The LmHosts file is located in the %SystemRoot%\System32\Drivers\Etc directory as LmHost.Sam on both Windows NT and Windows 2000 machines as well. The LmHosts files are primarily used to resolve NetBios names to IP
addresses.

Exchange *.Log File Removal (BAT)

It is BAD BAD practice to try and delete the exchange 2007 log files! It should not be done ever!

Running into space issues on exchange needed to remove 80,000+ *.log files. These would be removed by doing a backup, but without any space to run the backup there’s not a lot of options.

I ran this command to perform a removal of the log files in the mailbox DB, I had to use this script the job as the windows would crash as soon as multiple files were highlighted and selected for deletion:

  • CD /D E:\Exchange\Mailbox\First Storage Group
  • del /s *.txt

In order to move logs onto another drive use this command:

  • CD /D E:\Exchange\Mailbox\First Storage Group
  • move *.log “K:\Exchange_Logs_Move”

DO NOT DELETE / REMOVE THFOLLOWING FILES:

  • E00.chk
  • E00.log
  • Mailbox Database.edb

Add Network Printer via VBS

Use the script below to add a network printer, you can simply dump this into a txt file, rename to a .VBS and change the printer addresses (these need to be shared of course!)
The last bit of code should stop the “Error: 8007007B – the filename, directory name, or volume label syntax is incorrect” as it will keep retrying the connection to the printer share if the network is slow and timming out etc.

Last bit is to drop the script into the DC netlogon and add to group policy! BAMM!


Dim net
Set net = CreateObject("WScript.Network")
net.AddWindowsPrinterConnection "\\server\printer"
net.SetDefaultPrinter "\\server\printer"

MapPrinter "\\server\printer"

Sub MapPrinter(strPrinter)
On Error Resume Next
Set objNetwork = CreateObject("WScript.Network")
boolConnected = False
intAttempts = 1
While boolConnected = False And intAttempts <= 5
Err.Clear
objNetwork.AddWindowsPrinterConnection strPrinter
If Err.Number <> 0 Then
intAttempts = intAttempts + 1
WScript.Sleep 2000
Else
boolConnected = True
End If
Wend
End Sub

“Active Desktop Recovery” / Script Error

“Active Desktop Recovery”

“An error has occurred in a script on this page”

Not 100% sure why this error occurs, however if you bung this information into a VBS file and run “hey-presto” the error is gone and the background is back to normal. I have only seen this when there is a GP in place that sets the background and doesn’t allow it to be changed by the user, I think this could be why it can’t just be changed back!

Most other fixes I’ve tried mean you have to reset the computer or uninstall/reinstall Internet Explorer (IE), I must have wasted hours on this problem until I found this script!

Option Explicit
' Create the Shell object
Dim objShell
Set objShell = CreateObject("WScript.Shell")
'Change values that mess up IE 7 from decimal 272 to 0
objShell.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Internet
Explorer\Desktop\SafeMode\Components\DeskHtmlVersion", "0",
"REG_DWORD"
objShell.AppActivate "Program Manager"
objShell.SendKeys "{F5}"
WScript.Quit