Creating Keytab for UNIX machines access in Active Directory

For UNIX servers can gain access to AD and that they can take an active object in AD as well as the possibility of SPNs we record for them, work with Kerberos authentication in a transparent, etc. What makes it all possible is the Keytab that is generated by Ktpass tool (native Windows tool).

Below example command to generate the Keytab (remembering that the computer object in AD must be previously created):

ktpass / princess host / COMPUTER.domain.test@DOMAIN.TEST / out NomeDoArquivo_host.keytab / crypto All / ptype KRB5_NT_PRINCIPAL -desonly / mapuser DOMAIN \ COMPUTER $ + rndPass

Replace:

COMPUTER = Computer Name

DOMAIN.TEST = Domain Name

DOMAIN = Netbios Domain

note: -Necessary align with the UNIX team to computer names and domain involved in the command will be charged with lowercase or uppercase letters.

Microsoft Cluster - Disco reserved

Personal, recently something happened at least interesting with a Mailbox server (MS-Exchange 2010).

This machine was running on ESXi 5.0. How interesting:

In a VMware environment provisioning happens machines from a template, ie a customized Windows with C and D units, right? You install a Windows update patches, install BKP client and other tools according to your environment. Nice!And how the bidding of templates? When you request to be provisioned a machine from a template vCenter makes a clone of that template, that looks cool. Folks, this is perfect if you are not using this as vmware couple of other, that is, if you are not using as Microsoft Cluster or a DAG (MS-Exchange).

The cluster creation process in one of the steps is necessary make a validation. In this validation step these machines created from the clone with D discs received a warning! Ai houses the personal danger ... It's just a warning. The validation is successful.

what can hapen? It may happen that this disk D please reserved. Now imagine that this machine, as in my example, is running an Exchange that was made in the installation disk D. Oh, my friends, when the phone your table play and the GI or the Help Desk say that dozens of boxes mail are out, or rather, the business executive is no mail. At this time you pick up all your mess and go to the nearest cinema, or you start to cry.

How can we validate it? Staff, the goal of this post is not to bring the fastest and practical troubleshooting to get the reserved disk. The idea here is to show that it exists and should not happen.

Microsoft Windows [Version 6.1.7601]

Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C: \ Users \ Admin> diskpart

Microsoft DiskPart version 6.1.7601

Copyright (C) 1999-2008 Microsoft Corporation.

On computer: VMTESTECLUSTER01

DISKPART> list disk

Disk ### Status Size Free Dyn Gpt

--- ----- --- --- - -

Disk 0 Online 100 GB 1024 KB

Disk 1 Online 80 GB 1024 KB

Disk 2 Online 600 GB 0 B

Disk 3 Online 600 GB 0 B

Disk 4 Online 600 GB 0 B

DISKPART> select disk 1

Disk 1 is now the selected disk.

DISKPART> detail disk

VMware Virtual Disk SCSI Disk Device

Disk ID: E87C0E42

Type: SAS

Status: Online

Path: 0

Target: 1

LUN ID: 0

Location Path: PCIROOT (0) #PCI (1500) #PCI (0000) #SAS (P00T01L00)

Current read-only state: No

Read-only: No

Boot Disk: No

Pagefile Disk On

Hibernation File Disk On

Crashdump Disk On

Clustered Disk On

Volume ### Ltr Label Fs Type Size Status Info

---- - ---- - ---- --- --- ---

Volume 3 D New Volume NTFS Partition 79 GB Healthy

DISKPART>

Microsoft Windows [Version 6.1.7601]

Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C: \ Users \ Admin> diskpart

Microsoft DiskPart version 6.1.7601

Copyright (C) 1999-2008 Microsoft Corporation.

On computer: VMTESTECLUSTER02

DISKPART> list disk

Disk ### Status Size Free Dyn Gpt

--- ----- --- --- - -

Disk 0 Online 100 GB 1024 KB

Disk 1 Online 80 GB 1024 KB

Disk 2 Online 600 GB 0 B

Disk 3 Online 600 GB 0 B

Disk 4 Online 600 GB 0 B

DISKPART> select disk 1

Disk 1 is now the selected disk.

DISKPART> detail disk

VMware Virtual Disk SCSI Disk Device

Disk ID: E87C0E42

Type: SAS

Status: Online

Path: 0

Target: 1

LUN ID: 0

Location Path: PCIROOT (0) #PCI (1500) #PCI (0000) #SAS (P00T01L00)

Current read-only state: No

Read-only: No

Boot Disk: No

Pagefile Disk On

Hibernation File Disk On

Crashdump Disk On

Clustered Disk On

Volume ### Ltr Label Fs Type Size Status Info

---- - ---- - ---- --- --- ---

Volume 3 D NTFS Partition 79 GB Healthy

DISKPART>

The Disk ID same in both machines. What's wrong with having the same ID's? The cluster resource not to promote competition in access to this disk puts in reserve.

Best practices in this case is to remove the D drive, what's in your template, and adds it again, the ID will be different for each machine.

and now?I get it best practice to not happen to get in a disk reserved. Okay, tell me there? How do I remove the disc reserves in a situation like this? Well, you can remove the so reserved but can not request a cluster validation on that machine. Remove the reservation and migrate resources, in my example, uninstall disk MS-Exchange D. Remove the disc D. After that add the D disk and install MS-Exchange again. Then do the validation.

Let's put the resolution to remove the reserved mode. Recalling that the idea of ​​this post is to guide so that does not happen.

Open Powershell and type the following command line:

Clear-ClusterDiskReservation -Disk 1 -node node1 -Force

I hope that by sharing this experience I can add something.

Number of active users in AD

Hi All,

Buenos dias. Today we post a powershell line to Activie Directory that can bring a great excuse for a coffee.

This line will bring the number of enabled users in your domain, enjoyed the idea?

Well, I have several cafes, or several conversations about the response of this command.

(Get-ADUser -filter * | where {$ _. Enabled -eq "True"}). Count

List Domain Group Members

My dear colleagues, below script to list the members of all Active Directory domain security groups:

$ Groupinfo = "| Select 'Group Name', 'Group Description', 'Member Name', 'Member Description'
AllGroups = $ @ ()
$ MyGroups = Get-ADGROUP -filter {GroupCategory -eq "Security"} -SearchBase "dc = DOMAIN, DC = LOCAL" -Properties Name, Member | select Name, Member
foreach ($ Group in $ MyGroups) {
$ GroupInfo.'Group Name '= $ Group.Name
$ GroupInfo.'Group Description '= $ Group.Description
foreach ($ Member in $ Group.Member) {
$ User = Get-Member ADUser $ -Properties Name | select Name
$ GroupInfo.'Member Name '= $ User.Name
$ Groupinfo | select 'Group Name', 'Member Name'
$ AllGroups + = $ groupinfo | Select 'Group Name', 'Member Name'
}
}

$ AllGroups | Export-CSV allginfo.csv -NoTypeInformation

We can use the same script to filter out members of a single chain.For it changed the filter parameter $ MyGroups = Get-ADGROUP -filter {GroupCategory -eq "Security"} that selects all domain security groups for $ MyGroups = Get -ADGroup -filter {Name -eq "groupname"}.

I hope you find it useful!

Set-ExecutionPolicy: Can not set execution policy

Hello their maledetos nerds !!! ehehehehe

When trying to run a certain PS script remotely on an Exchange server, I came across the following error message:

. \ UpdateIndexAllMailboxDatabases.ps1: File C: \ Temp \ SCRIPTS \ EXCHANGE \UpdateIndexAllMailboxDatabases.ps1 can not be loaded. The file C: \ Temp \ SCRIPTS \ EXCHANGE \UpdateIndexAllMailboxDatabases.ps1 is not digitally signed. The script will not execute on the system. Please see "get-help about_signing" for more details ..
At line: 1 char: 37

... After a Get-ExecutionPolicy had the RemoteSigned return .There think twice !!! Set-ExecutionPolicy Unrestricted and was returned the following message:

Execution Policy Change
The execution policy helps protect you from scripts That You do not trust. Changing the execution policy might expose you to the security risks described in the help topic at about_Execution_Policies
http://go.microsoft.com/fwlink/?LinkID=135170 . Do you want to change the execution policy?
[Y] Yes [N] No [S] Suspend Help (default is "Y") [?] Y
Set-ExecutionPolicy: Windows PowerShell execution policy successfully updated your, but the setting is overridden by
the policy defined at a more specific scope. Due to the override, your shell will retain its current effective
execution of policy RemoteSigned. Type "Get-ExecutionPolicy -List" to view your execution policy settings.For more
information please see "Get-Help Set-ExecutionPolicy".
At line: 1 char: 1
+ Set-ExecutionPolicy Unrestricted
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo: PermissionDenied: (:) [Set-ExecutionPolicy] SecurityException
+ FullyQualifiedErrorId: ExecutionPolicyOverride, Microsoft.PowerShell.Commands.SetExecutionPolicyCommand

As recommended in the message, I ran the cmdlet to list the policy of execution policy by scope

Get-ExecutionPolicy -List

Scope ExecutionPolicy
- -----
MachinePolicy RemoteSigned
UserPolicy Undefined
Process Undefined
CurrentUser Undefined
LocalMachine RemoteSigned

... Immediately I performed the following Set-ExecutionPolicy -Scope MachinePolicy -executionpolicy Bypass command for the policy to be released ... ops:

Set-ExecutionPolicy: Can not set execution policy. Execution policies at the MachinePolicy or UserPolicy scopes must beset through Group Policy.

To correct this error, we are forced to make this modification directly in season record:

HKLM: \ Software \ Policies \ Microsoft \ Windows \ PowerShell and change the value ExecutionPolicy   toBypass.

By rerunning the command to list the scope for policy, we realize that now really the setting was uncommitted !!

Get-ExecutionPolicy -List

Scope ExecutionPolicy
- -----
MachinePolicy Bypass
UserPolicy Undefined
Process Undefined
CurrentUser Undefined
LocalMachine RemoteSigned

Then I could run my script and they all lived happily ever after!

Verifying GPO Replication

How will my dear readers !!

I am in a constant search for a script that brings me the replication time of Sysvol ... remembering that the environment in question is "Windows Server 2003" as functional mode domain; that is, we only have the ability to replicate the Sysvol with FRS ... who can help ... .eheheheheh

... During this journey, I came across a very cool function called Get-ADGPOReplication filtering results of the cmdlet Get-GPO so we can compare the versions of each GPO Sysvol on all domain DCs !! So we can verify that replication as well as the policy objects are consistent throughout the domain ... I know at this time hit that will thrill cry !!

Below function code:

function Get-ADGPOReplication
{
<#
.SYNOPSIS
This function retrieve one or all the GPO and Their report DSVersions and SysVolVersions (Users and Computers)
.DESCRIPTION
This function retrieve one or all the GPO and Their report DSVersions and SysVolVersions (Users and Computers)
.PARAMETER GPOName
Specify the name of the GPO
All .PARAMETER
Specify That You want to retrieve all the GPO (slow if you have a lot of Domain Controllers)
.EXAMPLE
Get-ADGPOReplication -GPOName "Default Domain Policy"
.EXAMPLE
Get-ADGPOReplication -All
.NOTES
Francois-Xavier Cat
lazywinadm
lazywinadmin.com

VERSION HISTORY
1.0 22/09/2014 Initial version
Adding some more Error Handling
Fix some typo
#>
#requires -version 3
[CmdletBinding ()]
PARAM (
[Parameter (Mandatory = $ True, ParameterSetName = "One")]
[String []] $ GPOName,
[Parameter (Mandatory = $ True, ParameterSetName = "All")]
[Switch] $ All
)
BEGIN
{
TRY
{
if (-not (Get-Module ActiveDirectory -Name)) {Import-Module ActiveDirectory -Name -ErrorAction Stop -ErrorVariable ErrorBeginIpmoAD}
if (-not (Get-Module -Name GroupPolicy)) {Import-Module -Name GroupPolicy -ErrorAction Stop -ErrorVariable ErrorBeginIpmoGP}
}
CATCH
{
Write-Warning -Message "[BEGIN] Something wrong happened"
IF ($ ErrorBeginIpmoAD) {Write-Warning -Message "[BEGIN] Error while Importing the module Active Directory"}
IF ($ ErrorBeginIpmoGP) {Write-Warning -Message "[BEGIN] Error while Importing the module Group Policy"}
Write-Warning -Message "[BEGIN] $ ($ Error [0] .exception.message)"
}
}
PROCESS
{
FOREACH ($ DomainController in ((Get-ADDomainController -ErrorAction Stop -ErrorVariable ErrorProcessGetDC -filter *). Hostname))
{
TRY
{
IF ($ psBoundParameters ['GPOName'])
{
Foreach ($ GPOItem in $ GPOName)
{
$ GPO = Get-GPO -Name $ GPOItem -Server $ DomainController -ErrorAction Stop -ErrorVariable ErrorProcessGetGPO

[PSCustomObject] [ordered] {@
GroupPolicyName = $ GPOItem
DomainController = $ DomainController
UserVersion = $ GPO.User.DSVersion
UserSysVolVersion = $ GPO.User.SysvolVersion
ComputerVersion = $ GPO.Computer.DSVersion
ComputerSysVolVersion = $ GPO.Computer.SysvolVersion
} #PSObject
} #Foreach ($ GPOItem in $ GPOName)
} #IF ($ PsBoundParameters ['GPOName'])
IF ($ psBoundParameters ['All'])
{
$ GPOList = Get-GPO -All -Server $ DomainController -ErrorAction Stop -ErrorVariable ErrorProcessGetGPOAll

foreach ($ GPO in $ GPOList)
{
[PSCustomObject] [ordered] {@
GroupPolicyName = $ GPO.DisplayName
DomainController = $ DomainController
UserVersion = $ GPO.User.DSVersion
UserSysVolVersion = $ GPO.User.SysvolVersion
ComputerVersion = $ GPO.Computer.DSVersion
ComputerSysVolVersion = $ GPO.Computer.SysvolVersion
} #PSObject
}
} #IF ($ PsBoundParameters ['All'])
} #TRY
CATCH
{
Write-Warning -Message "[PROCESS] Something wrong happened"
IF ($ ErrorProcessGetDC) {Write-Warning -Message "[PROCESS] Error while running retrieving Domain Controllers with Get-ADDomainController"}
IF ($ ErrorProcessGetGPO) {Write-Warning -Message "[PROCESS] Error while running Get-GPO"}
IF ($ ErrorProcessGetGPOAll) {Write-Warning -Message "[PROCESS] Error while running Get-GPO -All"}
Write-Warning -Message "[PROCESS] $ ($ Error [0] .exception.message)"
}
} #FOREACH
} #PROCESS
}

1. Create a .ps1 file containing the code above, or download it here
2. Run the script in PS ISE as administrator
3. Run the function !!

We have some syntax options, such as:

To bring the result of a single GPO:

Get-ADGPOReplication -GPOName "Default Domain Policy"

To bring the result of some policies:

Get-ADGPOReplication -GPOName "Default Domain Policy", "Default Domain Controllers Policy"

To bring its results for the All Policies:

Get-ADGPOReplication -All

We can also improve the filters with the following command:

Get-ADGPOReplication -all | Out-GridView -Title "GPO Verify $ (Get-Date)"

... Now we just need to be able to filter the time required for a change in Sysvol, is uncommitted in all domain DC's.

Saved Queries

Active Directory Queries!!!!!!

Find Groups that contains the word admin

(objectcategory=group)(samaccountname=*admin*)

Find users who have admin in description field
(objectcategory=person)(description=*admin*)

Find all Universal Groups 
(groupType:1.2.840.113556.1.4.803:=8)

Empty Groups with No Members 
(objectCategory=group)(!member=*)
Finds all groups defined as a Global Group, a Domain Local Group, or a Universal Group
(groupType:1.2.840.113556.1.4.804:=14)

Find all User with the name Bob
(objectcategory=person)(samaccountname=*Bob*)

Find user accounts with passwords set to never expire
(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=65536)

Find all users that never log in to domain
(&(&(objectCategory=person)(objectClass=user))(|(lastLogon=0)(!(lastLogon=*))))

Find user accounts with no log on script
(objectcategory=person)(!scriptPath=*)

Find user accounts with no profile path
(objectcategory=person)(!profilepath=*)

Finds non disabled accounts that must change their password at next logon
(objectCategory=person)(objectClass=user)(pwdLastSet=0)(!useraccountcontrol:1.2.840.113556.1.4.803:=2)

Finds all disabled accounts in active directory
(objectCategory=person)(objectClass=user)(!useraccountcontrol:1.2.840.113556.1.4.803:=2)

Finds all locked out accounts
(objectCategory=person)(objectClass=user)(useraccountcontrol:1.2.840.113556.1.4.803:=16)

Finds Domain Local Groups
(groupType:1.2.840.113556.1.4.803:=4)

Finds all Users with Email Address set
(objectcategory=person)(mail=*)

Finds all Users with no Email Address
(objectcategory=person)(!mail=*)

Find all Users, Groups or Contacts where Company or Description is Contractors
(|(objectcategory=user)(objectcategory=group)(objectcategory=contact))(|(description=North*)(company=Contractors*))

Find all Users with Mobile numbers 712 or 155
(objectcategory=user)(|(mobile=712*)(mobile=155*))

Find all Users with Dial-In permissions
(objectCategory=user)(msNPAllowDialin=TRUE)

Find All printers with Color printing capability
Note: server name must be changed
(&(&(&(uncName=*Servername*)(objectCategory=printQueue)(printColor=TRUE))))

Find Users Mailboxes Overriding Exchange Size Limit Policies
(&(&(&objectCategory=user)(mDBUseDefaults=FALSE)))

Find all Users that need to change password on next login.
(&(objectCategory=user)(pwdLastSet=0))

Find all Users that are almost Locked-Out
Notice the “>=” that means “Greater than or equal to”.
(objectCategory=user)(badPwdCount>=2)

Find all Computers that do not have a Description
(objectCategory=computer)(!description=*)

Find all users with Hidden Mailboxes
(&(objectCategory=person)(objectClass=user)(msExchHideFromAddressLists=TRUE))

Find all Windows 2000 SP4 computers
(&(&(&(objectCategory=Computer)(operatingSystem=Windows 2000 Professional)(operatingSystemServicePack=Service Pack 4))))

Find all Windows XP SP2 computers
(&(&(&(&(&(&(&(objectCategory=Computer)(operatingSystem=Windows XP Professional)(operatingSystemServicePack=Service Pack 2))))))))

Find all Windows XP SP3 computers
(&(&(&(&(&(&(&(objectCategory=Computer)(operatingSystem=Windows XP Professional)(operatingSystemServicePack=Service Pack 3))))))))

Find all Vista SP1 computers
(&(&(&(&(sAMAccountType=805306369)(objectCategory=computer)(operatingSystem=Windows Vista*)(operatingSystemServicePack=Service Pack 1)))))

Find All Workstations
(sAMAccountType=805306369)

Find all 2003 Servers Non-DCs
(&(&(&(samAccountType=805306369)(!(primaryGroupId=516)))(objectCategory=computer)(operatingSystem=Windows Server 2003*)))

Find all 2003 Servers – DCs
(&(&(&(samAccountType=805306369)(primaryGroupID=516)(objectCategory=computer)(operatingSystem=Windows Server 2003*))))

Find all Server 2008
(&(&(&(&(samAccountType=805306369)(!(primaryGroupId=516)))(objectCategory=computer)(operatingSystem=Windows Server 2008*))))

referência: http://www.kreslavsky.com/2008/08/active-directory-saved-queries-templates.html

Default permissions of the Sysvol folder

They follow a standard NTFS permissions of the SYSVOL folder:

% SystemRoot% \ Windows \ Sysvol

• Clear the Allow inheritable permissions from parent to propagate to this object check box
• Administrators: Full Control
• Authenticated Users: Read, Read & Execute, List Folder Contents and
• Creator Owner: Nothing selected
• Server Operators: Read, Read & Execute, List Folder Contents and
• System: Full Control

% SystemRoot% \ Windows \ Sysvol \ Sysvol

• Clear the Allow inheritable permissions from parent to propagate to this object check box

% SystemRoot% \ Winnt \ Sysvol \ Sysvol \ domain

• Clear the Allow inheritable permissions from parent to propagate to this object check box

% SystemRoot% \ Winnt \ Sysvol \ Sysvol \ domain \ Policies

• Clear the Allow inheritable permissions from parent to propagate to this object check box
• Administrators: Full Control
• Authenticated Users: Read, Read & Execute, List Folder Contents and
• Creator Owner: Nothing selected
• Group Policy Creator Owners: Read, Read & Execute, List Folder Contents, Modify, and Write
• Server Operators: Read, Read & Execute, List Folder Contents and
• System: Full Control

For each file or folder that is located in the% SystemRoot% \ Winnt \ Sysvol \ Sysvol \ domain \ Policies

• Check the Allow inheritable permissions from parent to propagate to this object check box

Sysvol share permissions:

• Administrators: Full Control
• Authenticated Users: Full Control
• Everyone: Read

Reference: http://truetechsolutions.supersized.org/archives/8-Default-Permissions-for-Sysvol.html

MSExchange ADAccess 2114

In a recent project, I experienced a problem (at least by the messages on the Installation Wizard on eSales and Viewer - see image below).. This problem occurred (at least in my case) the installation of the Hub-Transport. Below is the message displayed EventViewer ...

MSEXCHANGEADTOPOLOGYSERVICE.EXE Process (PID = 1256). Topology discovery failed, error 0x80040a02 (DSC_E_NO_SUITABLE_CDC). Look up the Lightweight Directory Access Protocol (LDAP) error code specified in the event description. To this, use Microsoft Knowledge Base article 218185, "Microsoft LDAP Error Codes." Use the information in That article to learn more about the cause and resolution to this error. Use the Ping or PathPing command-line tools to test network connectivity to local domain controllers.

... Such an error occurs in Exchange Server 2007.2010. The resolution is put to the same Exchange server account in the Domain Admin group. After inclusion of the server group, restart the server and reinstall Exchange (if the problem has been presented in time of installation.).

Also spent a similar problem with Exchange Server 2003 ... in this case, the situation was regarding the deletion of an account of the Exchange server object AD.A restoration was carried out via ADRESTORE and even after inclusion of the restored object in the security groups required for Exchange Server Exchange services failed to initialize ....

Appears in the Event Viewer event ID 2114 MSExchange DSAccess.

In this case, I performed the following procedures:

1. After the deletion of the object, restore the same with ADRESTORE;
2. Add in the server security groups required (in some cases, these steps alone are enough to return to normal services);
3. Remove the network cable from the Exchange server;
4. Place the Exchange server in Workgroup and restart the server, without attaching the network cable;
5. In AD, reset the account of the Exchange server;
6. Plug the cable into the Exchange server and put it back in the field;
7. Restart the server;

After these procedures, the services back to work!

Another very common procedure for troubleshooting permissions on an Exchange organization, and runs the setup / domainprep command again in DC.

Hope that helps!

Wallpaper does not load in Windows 7 via GPO

A known bug in Windows 7 and Windows Server 2008 R2 is for the loading of the wallpaper, when it is configured via GPO.

To solve the problem, we can take the following actions:

• Enter the machine's registry ( http://en.kioskea.net/faq/589-how-to-open-registry )
• Navigate to the following key:
  • HKEY_CURRENT_USER \ Control Panel \ Desktop
• Find the REG_SZ value called Wallpaper
• Change the value with the path where the wallpaper is shared.

You can download a fix that will make the change:

• Fix x86
• Fix x64

If necessary change on multiple workstations, we can effect such change through thePreferences via GPO. As the image below:

If your domain is Windows Server 2003 and either does not support the Preferences feature, you need the distribution via script to make the change key in the registry.

The following example:

Const HKEY_CURRENT_USER = & H80000001

strComputer = "."
Set oReg = GetObject ("winmgmts: {ImpersonationLevel = impersonate}! \ \" & _
strComputer & "\ root \ default: StdRegProv")
strKeyPath = "Control Panel \ Desktop"
strValueName = "Wallpaper"
strValue = "\ \ server \ share \ wallpaper.jpg"
oReg.SetStringValue HKEY_LOCAL_MACHINE, strKeyPath, strValueName, strValue

Migrate Server Roles to Windows Server 2008 R2

Below is a URL that I think is very interesting, especially for computer consultants, where deployments and migrations are part of the day is dia.Trata tutorials migration of server roles in Windows Server 2003 and Windows Server 2008 to Windows Server 2008 R2.

http://technet.microsoft.com/en-us/library/dd365353 (WS.10). aspx

0 × 00000024 (Kaspersky 0x001904AA ...

I had an experience at least annoying with Windows Server 2008 and Kaspersky antivirus, the research I did, the same problem occurs with Windows Vista.

The symptom is continuous reboot server.The server boots into SAFE MODE normally, but in normal mode remains at the logon screen for some time and the system reboots after showing a blue screen.

The error code shown on the blue screen 0 × 00000024 (0x001904AA ...(the rest of the code may vary).

The solution to the problem was removing the Kaspersky antivirus from the server, using the procedures listed in the following sitehttp://hubpages.com/hub/How-to-uninstall-or-remove-Kaspersky-totally

Another method I found but have not tested, is to rename or delete the file% windir% \ system32 \ drivers \ klif.sys in SAFE MODE and reboot the server.

I hope this is helpful!

GPO Search

Ladies and gentlemen!

I've been googling and found a very cool application provided by our Windows Azure … it is a website where we can search GPO and registry settings!! Pretty cool, what's more we have provider for IE 7 and 8.

http://gps.cloudapp.net/

Quick video showing the Following uses of the site ...

 

How to reset the restore mode password in Active Directory

In this article, let's resetting a password is commendable in a domain environment at Microsoft, the password used in "directory services Restore mode" which is requested at the time of promoting a server to domain controller during DCPROMO proccess. This password will be used when there is a nessecidade to perform an offline maintenance on the Active Directory data, e.g. a authoritative restore.

There is an aggravating circumstance, mainly in the exchange network administrators, which is not very important documentation this password, which makes offline AD maintenance. To work around this problem, we can reset the password of Restore Mode by doing the following:

At the DOS prompt, run the NTDSUTIL utility, as pictured below …

At the NTDSUTIL prompt, type set dsrm password, to sign in DSRM utility that will reset the password.

If you are running these procedures on the server you want to reset the password, type reset password on server null hit enter and type and confirm a new password of "directory services Restore mode" … if you want the command to be executed on a remote server, type reset password on server <ServerName> reminding you that the password must meet complexity …

After these procedures, type q to exit the DSRM prompt and q again to quit the NTDSUTIL prompt

Now just restart the server and pressing the F8 key to use the "directory services Restore mode" , and good luck in your AD maintenance …