Ladies and gentlemen!
I've been googling and found a very cool application provided by our Windows Azure … it is a website where we can search GPO and registry settings!! Pretty cool, what's more we have provider for IE 7 and 8.
Quick video showing the Following uses of the site ...
Staff, a new security feature of Windows Server 2008 R2 must take our attention, which is the RPC integrity checking for DNS requests. This feature is not supported on Windows 2000 DNS and Windows Server 2003.
Because of this verification, in a mixed environment and migration where we will have the coexistence of servers and workstations running legacy systems, it may be necessary for disable this feature because it can cause failure in the external name resolution in DNS clients running Windows Server 2003, 2000 and XP do not have problems on clients running Windows 7.
Unfortunately discovered feature in the worst way (during a migration process, experiencing the symptoms mentioned above) and not by study … so I'm posting it because it is a resource which we have a few references and believe to be useful! below is the command to disable the security feature:
Dnscmd.exe /Config /RpcAuthLevel 0
…. to activate the feature, just change-mos value from 0 to 1 … as shown.
Dnscmd.exe /Config /RpcAuthLevel 1
For us to verify the current status of the configuration, we can use the parameter /info:
Dnscmd.exe /info /RpcAuthLevel
I hope it's useful!
Personnel, after catching a little error messages as 0x800CCC80, 0x800CCC6a, event ID 4625, etc… decided to post the required settings for configuring Microsoft Outlook 2007, 2010 for IMAP4 and POP3 connection with default settings for Exchange Server 2007, 2010 published with ISA Server 2004, 2006 and Forefront TMG. Do the settings for an account using the IMAP4 Protocol, however all settings apply POP3 accounts, exeto by the number of ports.
The first step is to configure the user information, server and log on as the image below. Recalling that we can inform the IP servers.
After filling out the fields with the required information, we must configure the connection information as follows:
On the tab "Outgoing server" option "my outgoing server (SMTP) requires authentication" should be unchecked.
And "Advanced" tab in the IMAP server must meet in 147 port (default) and the type of TLS, encryption of the connection to the SMTP server using the default port (25) Protocol and no encryption type for the connection.
Ready! after these settings are only test.
Note:-settings can vary according to the settings made on the CAS Server as well as in the firewall.
In this article we will tackle the flow of DNS name resolution from equipment running Windows 2000 and later is very important to know-mos this flow, primarily involves troubleshooting.
In pre-Windows 2000 clients, we primarily NetBIOS name resolution that does not necessarily need to be used in Windows 2000 and later systems, which use DNS name resolution as a primary method.
DNS names are divided into two parts as shown below:
WWW. Z1BR.com
ZAMBONIS.Spaces.live.com
COMPUTER01.LOCAL WOODGROVEBANK.
This structure consists of host name (in yellow) and DNS suffix (in red).The host name is associated with a record in DNS that points to an IP address and the DNS suffix associated DNS zone where registry.
Now that we are reminded of how the structure of DNS names, let's look at how the flow of name resolution.
Let's take as an example of a user who wants to access a network share; the user enters \\ServerFS01\SharedFolder
The first step is to complete the requested host name with the DNS suffix of agreement as specified in the network connection properties, clicking on properties of TCP-IP (in both IPv4 and IPv6) version click on the button "Advanced" and the DNS tab as shown in the image:
Is selected by default, the option "Append parent suffixes of the primary DNS Suffix", this option will add the suffix father of MACHINE names requested which was not specified the FQDN, as in our example. Note that below this option we choose in choose a suffix list; in the case of having multiple domains for example (the suffixes are added to the list, in order, until you found the host), with this procedure we can expedite workstation, in a large forest. Another option we configure statically would add a DNS suffix for the connection (this setting will not be changed automatically).
With regard to the primary suffix of the machine, we can find it in the "Advanced properties of the system" in the "computer name" tab, as shown in the picture on below (note that the suffix is by default changed automatically when the machine is joined to a new domain); for security reasons, some organizations desmarcam this checkbox, which can cause name resolution problems if the analyst update manually the primary suffix.
After completing the host name with the DNS suffix, the next system procedure is to check the machine's DNS CACHE function local DNS cache is to expedite the process of resolving names in addition to decrease network traffic; we can see this cache through ipconfig/displaydns command and erases it via ipconfig/flushdns command.
You can disable logging cache through the command net stop DNSCACHE or disabling the DNS Client service by service console (services.msc).
In the local DNS CACHE can be stored records positive responses resolved successfully by the DNS server) and negative records (answers resolved by the DNS server on which the DNS client cannot connect to the host, such as the status of "host not found" when we access a URL. by default, the storage time for a record in the DNS cache is 86,400 seconds (1 day) and a negative record of 900 seconds (15 minutes). However we modify this period by editing the registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNSCache\Parameters
If the requested name is not resolved by the DNS cache, the next step would be to consult the hosts file located in the directory%windir%\System32\drivers\etc\. The hosts file contains static entries and is typically used to expedite the process of resolving names, pre-population of DNS cache, for environments in "workgroup" as in a DMZ or still to block sites. We use cautiously the hosts file, because it is a way to decentralise the resolution of names; what can cause problems for a resolution, if there are changes in settings of TCP-IP hosts mapped. Below is the video where I show an example of editing the hosts file:
The next step is to forward the request to the preferred DNS server configured on the properties of TCP-IP of the network interface. If the preferred DNS server is offline, or for any reason the DNS client does not have server connectivity, name resolution request is forwarded to the secondary DNS server, if the same is also without communication with the client, the request is forwarded to another DNS server that is listed at the top of the list of DNS servers in the DNS tab of the advanced settings of TCP-IP. The list is checked from top to bottom, what makes recommended placing at the top of the list, the same site and servers, or servers of sites where the link to connect to the DNS client has the highest bandwidth available.
When the request arrives at the DNS server, the server performs the following procedures to try to resolve the host:
1-server's cache (this is not the same DNS cache commented previously, and yes the cache of DNS service);
2 – DNS zones (… search server hosting areas …)
3 – search in the WINS database (if configured …with this feature server searches the database of the WINS servers listed to verify the existence of the requested record.)
4 – conditional forwarders (requisitions routing rules for a given domain DNS)
5 – Forwarders (… forwarding for any request that the server does not resolve)
6 – Root Hints (… servers responsible for the root domain (".") on the Internet)
Note: these DNS server resources will be covered in detail in the next articles in the series
As promised to students 6430, follows the link to Wikipedia for RAID … actually link is pretty cool:
http://en.wikipedia.org/wiki/raid
I hope that is useful!
Ladies and gentlemen,
Just to relax a little, I am posting a video, where I show how to enable the theme of Windows 7 on Windows Server 2008 R2. This feature is used so that the terminal Service user, have an experience similar to the Windows environment 7 … requirements:
In this article, I show how to set up an NLB cluster in Windows Server 2008.
I will create a cluster with only 2 nodes that are configured as follows:
Node 1:
The cluster is with IP 192.168.0.3
The first step is to install a feature of Network Load Balancing (NLB) on both nodes of the cluster, click Start, Server Manager, Features and Add Features.As the figure below:
In the Add Features Wizard check the Network Load Balancing, click NEXT and the INSTALL button to install the feature
Click CLOSE after the installation completes.
Click START, Administrative Tools, and Network Load Balancing Manager
Click Right-click Network Load Balancing Cluster and select New Cluster
In New Cluster: Connect, type the ip or name of a node in the cluster and click the Connect button.After the interface is connected, click NEXT
In the Host Parameters, select the priority of the IP addresses of the nodes and the state of initial activity of the node to join the cluster. ... And click NEXT
Click ADD and add the cluster IP address (this is the IP address to be accessed by customers) ... after completing the settings, click OK and NEXT button.
Choose the operating mode of the cluster ... will choose the unicast mode (which will cause the MAC address of network interfaces of the servers (we) are equal to the virtual MAC address of the cluster). Click NEXT
In the Port Rules by clicking the ADD have the option to create rules for the cluster to meet requests only on certain ports.Leave the default option (from 0 to 65535). Clique em FINISH… Click FINISH ...
... Our NLB cluster is almost ready, lack now add the second node to the cluster. To do this, click the right-click the cluster and select Add Host to Cluster as shown in the figure below ...
In the Add Host to Cluster: Connect, type the name or IP of the server that will be another cluster node and click the Connect button. After the interface is connected, click NEXT
In the Host Parameters, select the priority of the IP address of another node and the state of the initial activity even when entering the cluster. ... And click NEXT
Set again the port rules to the other node and click FINISH
We have our NLB cluster running.
Now, to test, I run the PING command (from a client station) while the dedicated IP's of the two nodes (192.168.0.1 and 192.168.0.2) and the cluster's IP (192.168.0.3) ...
... I will now disable the network interface of one of us. The expected result is that it does not lose connectivity with the cluster (192.168.0.3).
I hope it's useful!
This goes for personal travel 6421 (31/08/2009) from BF.
Personally, as promised, follow the link to an official document of Microsoft about GLOBAL ZONE NAME Windows Server 2008.
.... soon will be posting articles on the subject!
A Abs to all!
Save gentlemen
Here's a link's containing the necessary evidence for the Microsoft certifications focused on infrastructure:
I hope it's useful!
Here is a link at least curious and very interesting Interplanetary Internet!
These posters from Microsoft are very good for study, not only those who are seeking certification as well as for everyday tasks.
People .... Just click on the link:
http://cid-fe19f09132c649bd.skydrive.live.com/browse.aspx/.res/FE19F09132C649BD!1033
Ladies and Gentlemen,
I am posting links to information on the partitioning of GPT disk, much improved and more flexible than our old friend MBR.
Segue link´s: Here's a link's:
In this article, let's resetting a password is commendable in a domain environment at Microsoft, the password used in "directory services Restore mode" which is requested at the time of promoting a server to domain controller during DCPROMO proccess. This password will be used when there is a nessecidade to perform an offline maintenance on the Active Directory data, e.g. a authoritative restore.
There is an aggravating circumstance, mainly in the exchange network administrators, which is not very important documentation this password, which makes offline AD maintenance. To work around this problem, we can reset the password of Restore Mode by doing the following:
At the DOS prompt, run the NTDSUTIL utility, as pictured below …
At the NTDSUTIL prompt, type set dsrm password, to sign in DSRM utility that will reset the password.
If you are running these procedures on the server you want to reset the password, type reset password on server null hit enter and type and confirm a new password of "directory services Restore mode" … if you want the command to be executed on a remote server, type reset password on server <ServerName> reminding you that the password must meet complexity …
After these procedures, type q to exit the DSRM prompt and q again to quit the NTDSUTIL prompt
Now just restart the server and pressing the F8 key to use the "directory services Restore mode" , and good luck in your AD maintenance …
I will show a simple process and pretty cool that is installing Windows 7 through a Pen-drive common…
For the procedures, we will need a pen-drive and DVD install Windows 7 …
Let us prepare the Pen-drive for installation. From the command prompt, you are going to access the application DISKPART to prepare for the partition.
After the opening of the DiskPart prompt, type list disk command to identify the Pen-drive as image below:
Locate the removable disk (in my case, the DISK 1), and then select the same through select disk command <x> (where x is the number of the disk). After the disk check, enter CLEAN command to delete the existing partition on the same …
… now, let's create a primary partition and activate it through the create partition primary command and ACTIVE
We already have the partition created and active, now is the only format … type FORMAT QUICK fs = FAT32, I do quick FAT32 formatting
Our Pen-drive, is now ready, now is the only copy the contents of the DVD to the Pen-drive and bootar the machine by USB. Simple, fast and convenient! rss
I hope that is useful!
Ladies and gentlemen, I will show a cool feature we from Windows Vista, which is to create multiple local group policy.
In earlier versions of operating systems (Windows 2000, 2003 and XP) we have only one layer, where we have the local GPO applied to all local users and groups from the machine. With Windows Vista and beyond, we have three layers to work with the local GPO´ s:
In case of conflict between the GPO ´ s, the last GPO applied is that prevaleçe and the order in which they are applied is ..... Default (1st local GPO) layer, GPO for administrators and non-administrators (2nd layer) and finally the GPO to specific user (3rd layer)
In the case of a computer in a domain, the GPO ´ s site, domain, and OU GPO will prevail over the ´ s locations. You can also turn off the processing of local GPO ´ s, configuring the option "turn off Local Group Policy objects processing" in "computer Configuration Administrative Templates \System \ policy" in the domain GPO.
To demonstrate how to create and apply these GPO ´ s, I use a computer with Windows 7 installed. The first step is to create a common user as shown in image …
… then we will work with a UserAdmin (local administrator) and UserComum (user). The next step is to create a custom MMC, we need to add a Group Policy object editor "for each GPO created. To do this, click Start , in Search type MMC.exe, and click OK .
In the Console1 window, ', click file, and then click Add or remove snap-in. In the list of available snap-ins, click "Policy object editor" group, and then click Add . Choose the object to the local computer. Click Concluir.
Again, click file, and then click Add or remove snap-in. In the list of available snap-ins, click "Policy object editor" group, click then add and click Browse . Click the tab, users click não-administradores group … click OK and Finish button.
Again, click file, and then click Add or remove snap-in. In the list of available snap-ins, click "Policy object editor" group, click then add and click Browse . Click the tab, users click the Administrators group of … click OK and Finish button.
Do the same procedure by selecting the object UserAdmin …
Click file, click Save and save the MMC with a name of your own …
Now we must set up group policies according to our needs. For example, I will configure common users that will disappear the option menu, all programs "Iniciar… menu
Logging in with a typical user, you can see that the policy was applied to the user.
As an example, administrators set up for a GPO that does not appear Documentos… option
Logging in with a user a member of the Administrators group , the GPO is applied … Note that the option "all programs" appears to the user, because it was not a customized GPO …
… I customize user GPO to the, UserAdmin in this policy I will disable LOGOFF option and purposely create a conflict, contrary to the GPO applied to group Administradores.
Logging with the user, we can see that the Logoff option is disabled and that documents appear to the user, proving the GPO precedence (3rd layer)
If you want to remove the policies, do the same process of adding a new object … click Start , Search type MMC.exe, and click OK then click. file, and then click Add or remove snap-in. In the list of available snap-ins, click "Policy object editor" group, click then add and click Browse . Click the tab users, select the user or group you want to delete the policy, click with the right button and choose the option to remove the GPO, as pictured below …
I hope that is useful!
Staff, let's talk in this article about "bitlocker to go ", which is the ability to encrypt a removable disk, such as a Pen-drive for example. What is very helpful with respect to information security, it is very easy to lose a pendrive due to its small size, not to mention how this object is susceptible to theft. The feature can be enabled on any computer running Standalone Windows 7 and in an environment in the area where we have workstations running Windows 7 and servers with Windows Server 2008 R2 (configuration through group policies … but that already is another article! RSS) with BitLocker enabled on a removable disk, the same can only be accessed through the typing a password, which is registered at the time of encryption configuration.
To enable the appeal, is quite simple … then right-click on the device and enable the feature, as shown in the image below:
We have the option of configuring access protection through a password or smart card with a … show the example using a password. Register and confirm the same …. click Next
If you forget your password, we can save a recovery password in a file, both when printing the same …
After you choose the method for recovery password storage shall be instituted device encryption. wait until the end of encryption, if you want to modify, copy, or move the removable disk files, click the PAUSE button to freeze the encryption process … so you do not run the risk of damaging the files …
After the device encryption will always be required typing the password to permit access to information …
We can see clearly the device encrypted in "My Computer".
In the case of lost password, we have the option of using a recovery password (same saving and there in the previous steps or …) …
… just digit password and follow the wizard, it will stick so that we can change our access password again.
Using the removable device on other machines, we have access to the files of the Pen-drive via "bitlocker to go reader", which is already contained in encrypted device; that makes it read-only access to data …
As we can see, this is a hands-on resource, fast and very useful!
