Diskpart / s

Hello friends from the world of scripts, powershell, .vbs, .bat, and all those who invest hours working out a good old scripiteco.

This week we prepared something nice with Diskpart. For those who follow the Blog must have read something about disk reserved, right? To stay free of an incident like that, or something like that, we insert the disk D after the VM has been initialized. In this scenario we remove the template D disc and insert again after rising SO ensuring that each VM will have your disc with its unique ID and unique serial.

What needs raised? When we went up a virtual machine only with Disk C and the DVD player (Volume 0) DVD-ROM drive has signed with the letter D. This staff there began to stay cool.

Let's customize this process by removing the D volume and signing with the letter Z. And from that process we will create a partition on the disk.

The automated process requires the following command:

C: \ diskpart.exe / s C: \ temp \ scripts \ dispart.txt - This parameter will call the .txt file, drew guys? We will create a .txt file with the name diskpart.txt insertion commands listed below and saves them in the C: \ Temp \ scripts, cool? The next step is to open the CMD and insert the above command line, repeating the sequence,C: \ diskpart.exe / s C: \ temp \ scripts \ dispart.txt

Once this is done the disk is ready for use.

select volume 0

remove letter = D

assign letter Z =

select disk 1

Attributes disk clear readonly

online disk

convert MBR

create partition primary

assign letter = d

format fs = ntfs quick label = "DATA"

Active

Exit

I hope to have cooperated.

Verifying GPO Replication

How will my dear readers !!

I am in a constant search for a script that brings me the replication time of Sysvol ... remembering that the environment in question is "Windows Server 2003" as functional mode domain; that is, we only have the ability to replicate the Sysvol with FRS ... who can help ... .eheheheheh

... During this journey, I came across a very cool function called Get-ADGPOReplication filtering results of the cmdlet Get-GPO so we can compare the versions of each GPO Sysvol on all domain DCs !! So we can verify that replication as well as the policy objects are consistent throughout the domain ... I know at this time hit that will thrill cry !!

Below function code:

function Get-ADGPOReplication
{
<#
.SYNOPSIS
This function retrieve one or all the GPO and Their report DSVersions and SysVolVersions (Users and Computers)
.DESCRIPTION
This function retrieve one or all the GPO and Their report DSVersions and SysVolVersions (Users and Computers)
.PARAMETER GPOName
Specify the name of the GPO
All .PARAMETER
Specify That You want to retrieve all the GPO (slow if you have a lot of Domain Controllers)
.EXAMPLE
Get-ADGPOReplication -GPOName "Default Domain Policy"
.EXAMPLE
Get-ADGPOReplication -All
.NOTES
Francois-Xavier Cat
lazywinadm
lazywinadmin.com

VERSION HISTORY
1.0 22/09/2014 Initial version
Adding some more Error Handling
Fix some typo
#>
#requires -version 3
[CmdletBinding ()]
PARAM (
[Parameter (Mandatory = $ True, ParameterSetName = "One")]
[String []] $ GPOName,
[Parameter (Mandatory = $ True, ParameterSetName = "All")]
[Switch] $ All
)
BEGIN
{
TRY
{
if (-not (Get-Module ActiveDirectory -Name)) {Import-Module ActiveDirectory -Name -ErrorAction Stop -ErrorVariable ErrorBeginIpmoAD}
if (-not (Get-Module -Name GroupPolicy)) {Import-Module -Name GroupPolicy -ErrorAction Stop -ErrorVariable ErrorBeginIpmoGP}
}
CATCH
{
Write-Warning -Message "[BEGIN] Something wrong happened"
IF ($ ErrorBeginIpmoAD) {Write-Warning -Message "[BEGIN] Error while Importing the module Active Directory"}
IF ($ ErrorBeginIpmoGP) {Write-Warning -Message "[BEGIN] Error while Importing the module Group Policy"}
Write-Warning -Message "[BEGIN] $ ($ Error [0] .exception.message)"
}
}
PROCESS
{
FOREACH ($ DomainController in ((Get-ADDomainController -ErrorAction Stop -ErrorVariable ErrorProcessGetDC -filter *). Hostname))
{
TRY
{
IF ($ psBoundParameters ['GPOName'])
{
Foreach ($ GPOItem in $ GPOName)
{
$ GPO = Get-GPO -Name $ GPOItem -Server $ DomainController -ErrorAction Stop -ErrorVariable ErrorProcessGetGPO

[PSCustomObject] [ordered] {@
GroupPolicyName = $ GPOItem
DomainController = $ DomainController
UserVersion = $ GPO.User.DSVersion
UserSysVolVersion = $ GPO.User.SysvolVersion
ComputerVersion = $ GPO.Computer.DSVersion
ComputerSysVolVersion = $ GPO.Computer.SysvolVersion
} #PSObject
} #Foreach ($ GPOItem in $ GPOName)
} #IF ($ PsBoundParameters ['GPOName'])
IF ($ psBoundParameters ['All'])
{
$ GPOList = Get-GPO -All -Server $ DomainController -ErrorAction Stop -ErrorVariable ErrorProcessGetGPOAll

foreach ($ GPO in $ GPOList)
{
[PSCustomObject] [ordered] {@
GroupPolicyName = $ GPO.DisplayName
DomainController = $ DomainController
UserVersion = $ GPO.User.DSVersion
UserSysVolVersion = $ GPO.User.SysvolVersion
ComputerVersion = $ GPO.Computer.DSVersion
ComputerSysVolVersion = $ GPO.Computer.SysvolVersion
} #PSObject
}
} #IF ($ PsBoundParameters ['All'])
} #TRY
CATCH
{
Write-Warning -Message "[PROCESS] Something wrong happened"
IF ($ ErrorProcessGetDC) {Write-Warning -Message "[PROCESS] Error while running retrieving Domain Controllers with Get-ADDomainController"}
IF ($ ErrorProcessGetGPO) {Write-Warning -Message "[PROCESS] Error while running Get-GPO"}
IF ($ ErrorProcessGetGPOAll) {Write-Warning -Message "[PROCESS] Error while running Get-GPO -All"}
Write-Warning -Message "[PROCESS] $ ($ Error [0] .exception.message)"
}
} #FOREACH
} #PROCESS
}

1. Create a .ps1 file containing the code above, or download it here
2. Run the script in PS ISE as administrator
3. Run the function !!

We have some syntax options, such as:

To bring the result of a single GPO:

Get-ADGPOReplication -GPOName "Default Domain Policy"

To bring the result of some policies:

Get-ADGPOReplication -GPOName "Default Domain Policy", "Default Domain Controllers Policy"

To bring its results for the All Policies:

Get-ADGPOReplication -All

We can also improve the filters with the following command:

Get-ADGPOReplication -all | Out-GridView -Title "GPO Verify $ (Get-Date)"

... Now we just need to be able to filter the time required for a change in Sysvol, is uncommitted in all domain DC's.

Saved Queries

Active Directory Queries!!!!!!

Find Groups that contains the word admin

(objectcategory=group)(samaccountname=*admin*)

Find users who have admin in description field
(objectcategory=person)(description=*admin*)

Find all Universal Groups 
(groupType:1.2.840.113556.1.4.803:=8)

Empty Groups with No Members 
(objectCategory=group)(!member=*)
Finds all groups defined as a Global Group, a Domain Local Group, or a Universal Group
(groupType:1.2.840.113556.1.4.804:=14)

Find all User with the name Bob
(objectcategory=person)(samaccountname=*Bob*)

Find user accounts with passwords set to never expire
(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=65536)

Find all users that never log in to domain
(&(&(objectCategory=person)(objectClass=user))(|(lastLogon=0)(!(lastLogon=*))))

Find user accounts with no log on script
(objectcategory=person)(!scriptPath=*)

Find user accounts with no profile path
(objectcategory=person)(!profilepath=*)

Finds non disabled accounts that must change their password at next logon
(objectCategory=person)(objectClass=user)(pwdLastSet=0)(!useraccountcontrol:1.2.840.113556.1.4.803:=2)

Finds all disabled accounts in active directory
(objectCategory=person)(objectClass=user)(!useraccountcontrol:1.2.840.113556.1.4.803:=2)

Finds all locked out accounts
(objectCategory=person)(objectClass=user)(useraccountcontrol:1.2.840.113556.1.4.803:=16)

Finds Domain Local Groups
(groupType:1.2.840.113556.1.4.803:=4)

Finds all Users with Email Address set
(objectcategory=person)(mail=*)

Finds all Users with no Email Address
(objectcategory=person)(!mail=*)

Find all Users, Groups or Contacts where Company or Description is Contractors
(|(objectcategory=user)(objectcategory=group)(objectcategory=contact))(|(description=North*)(company=Contractors*))

Find all Users with Mobile numbers 712 or 155
(objectcategory=user)(|(mobile=712*)(mobile=155*))

Find all Users with Dial-In permissions
(objectCategory=user)(msNPAllowDialin=TRUE)

Find All printers with Color printing capability
Note: server name must be changed
(&(&(&(uncName=*Servername*)(objectCategory=printQueue)(printColor=TRUE))))

Find Users Mailboxes Overriding Exchange Size Limit Policies
(&(&(&objectCategory=user)(mDBUseDefaults=FALSE)))

Find all Users that need to change password on next login.
(&(objectCategory=user)(pwdLastSet=0))

Find all Users that are almost Locked-Out
Notice the “>=” that means “Greater than or equal to”.
(objectCategory=user)(badPwdCount>=2)

Find all Computers that do not have a Description
(objectCategory=computer)(!description=*)

Find all users with Hidden Mailboxes
(&(objectCategory=person)(objectClass=user)(msExchHideFromAddressLists=TRUE))

Find all Windows 2000 SP4 computers
(&(&(&(objectCategory=Computer)(operatingSystem=Windows 2000 Professional)(operatingSystemServicePack=Service Pack 4))))

Find all Windows XP SP2 computers
(&(&(&(&(&(&(&(objectCategory=Computer)(operatingSystem=Windows XP Professional)(operatingSystemServicePack=Service Pack 2))))))))

Find all Windows XP SP3 computers
(&(&(&(&(&(&(&(objectCategory=Computer)(operatingSystem=Windows XP Professional)(operatingSystemServicePack=Service Pack 3))))))))

Find all Vista SP1 computers
(&(&(&(&(sAMAccountType=805306369)(objectCategory=computer)(operatingSystem=Windows Vista*)(operatingSystemServicePack=Service Pack 1)))))

Find All Workstations
(sAMAccountType=805306369)

Find all 2003 Servers Non-DCs
(&(&(&(samAccountType=805306369)(!(primaryGroupId=516)))(objectCategory=computer)(operatingSystem=Windows Server 2003*)))

Find all 2003 Servers – DCs
(&(&(&(samAccountType=805306369)(primaryGroupID=516)(objectCategory=computer)(operatingSystem=Windows Server 2003*))))

Find all Server 2008
(&(&(&(&(samAccountType=805306369)(!(primaryGroupId=516)))(objectCategory=computer)(operatingSystem=Windows Server 2008*))))

referência: http://www.kreslavsky.com/2008/08/active-directory-saved-queries-templates.html

Default permissions of the Sysvol folder

They follow a standard NTFS permissions of the SYSVOL folder:

% SystemRoot% \ Windows \ Sysvol

• Clear the Allow inheritable permissions from parent to propagate to this object check box
• Administrators: Full Control
• Authenticated Users: Read, Read & Execute, List Folder Contents and
• Creator Owner: Nothing selected
• Server Operators: Read, Read & Execute, List Folder Contents and
• System: Full Control

% SystemRoot% \ Windows \ Sysvol \ Sysvol

• Clear the Allow inheritable permissions from parent to propagate to this object check box

% SystemRoot% \ Winnt \ Sysvol \ Sysvol \ domain

• Clear the Allow inheritable permissions from parent to propagate to this object check box

% SystemRoot% \ Winnt \ Sysvol \ Sysvol \ domain \ Policies

• Clear the Allow inheritable permissions from parent to propagate to this object check box
• Administrators: Full Control
• Authenticated Users: Read, Read & Execute, List Folder Contents and
• Creator Owner: Nothing selected
• Group Policy Creator Owners: Read, Read & Execute, List Folder Contents, Modify, and Write
• Server Operators: Read, Read & Execute, List Folder Contents and
• System: Full Control

For each file or folder that is located in the% SystemRoot% \ Winnt \ Sysvol \ Sysvol \ domain \ Policies

• Check the Allow inheritable permissions from parent to propagate to this object check box

Sysvol share permissions:

• Administrators: Full Control
• Authenticated Users: Full Control
• Everyone: Read

Reference: http://truetechsolutions.supersized.org/archives/8-Default-Permissions-for-Sysvol.html

Memory Limits for Windows Releases

The following documentation regarding the limit of physical memory for Windows versions:

http://msdn.microsoft.com/en-us/library/aa366778 (v = VS.85). aspx

Migrate Server Roles to Windows Server 2008 R2

Below is a URL that I think is very interesting, especially for computer consultants, where deployments and migrations are part of the day is dia.Trata tutorials migration of server roles in Windows Server 2003 and Windows Server 2008 to Windows Server 2008 R2.

http://technet.microsoft.com/en-us/library/dd365353 (WS.10). aspx

0 × 00000024 (Kaspersky 0x001904AA ...

I had an experience at least annoying with Windows Server 2008 and Kaspersky antivirus, the research I did, the same problem occurs with Windows Vista.

The symptom is continuous reboot server.The server boots into SAFE MODE normally, but in normal mode remains at the logon screen for some time and the system reboots after showing a blue screen.

The error code shown on the blue screen 0 × 00000024 (0x001904AA ...(the rest of the code may vary).

The solution to the problem was removing the Kaspersky antivirus from the server, using the procedures listed in the following sitehttp://hubpages.com/hub/How-to-uninstall-or-remove-Kaspersky-totally

Another method I found but have not tested, is to rename or delete the file% windir% \ system32 \ drivers \ klif.sys in SAFE MODE and reboot the server.

I hope this is helpful!

Script to do a merge between GPO's

Below is the url regarding PowerShell script to perform a merge of two GPO's

http://blogs.technet.com/b/ashleymcglone/archive/2011/01/19/finally-copy-and-merge-gpos-powershell-saves-the-day.aspx

Service overview and network port requirements for the Windows Server system

 

Staff,

Follow the link for a very important article that lists the ports required for miscellaneous services infrastructure provided by Windows Server. very useful!!

http://support.microsoft.com/kb/832017

RPC integrity checking for DNS requests in Windows Server 2008 R2

 

Staff, a new security feature of Windows Server 2008 R2 must take our attention, which is the RPC integrity checking for DNS requests. This feature is not supported on Windows 2000 DNS and Windows Server 2003.

Because of this verification, in a mixed environment and migration where we will have the coexistence of servers and workstations running legacy systems, it may be necessary for disable this feature because it can cause failure in the external name resolution in DNS clients running Windows Server 2003, 2000 and XP do not have problems on clients running Windows 7.

Unfortunately discovered feature in the worst way (during a migration process, experiencing the symptoms mentioned above) and not by study … so I'm posting it because it is a resource which we have a few references and believe to be useful! below is the command to disable the security feature:

Dnscmd.exe /Config /RpcAuthLevel 0

…. to activate the feature, just change-mos value from 0 to 1 … as shown.

Dnscmd.exe /Config /RpcAuthLevel 1

For us to verify the current status of the configuration, we can use the parameter /info:

Dnscmd.exe /info /RpcAuthLevel

I hope it's useful!

RAID

As promised to students 6430, follows the link to Wikipedia for RAID … actually link is pretty cool:

http://en.wikipedia.org/wiki/raid

I hope that is useful!

Configuring NLB Cluster in Windows Server 2008

In this article, I show how to set up an NLB cluster in Windows Server 2008.

I will create a cluster with only 2 nodes that are configured as follows:

Node 1:

• IP : 192.168.0.1
• Mask : 255.255.255.0
• Node 2:
• IP: 192.168.0.2
• Mask: 255.255.255.0

The cluster is with IP 192.168.0.3

The first step is to install a feature of Network Load Balancing (NLB) on both nodes of the cluster, click Start, Server Manager, Features and Add Features.As the figure below:

In the Add Features Wizard check the Network Load Balancing, click NEXT and the INSTALL button to install the feature

Click CLOSE after the installation completes.

Click START, Administrative Tools, and Network Load Balancing Manager

Click Right-click Network Load Balancing Cluster and select New Cluster

In New Cluster: Connect, type the ip or name of a node in the cluster and click the Connect button.After the interface is connected, click NEXT

In the Host Parameters, select the priority of the IP addresses of the nodes and the state of initial activity of the node to join the cluster. ... And click NEXT

Click ADD and add the cluster IP address (this is the IP address to be accessed by customers) ... after completing the settings, click OK and NEXT button.

Choose the operating mode of the cluster ... will choose the unicast mode (which will cause the MAC address of network interfaces of the servers (we) are equal to the virtual MAC address of the cluster). Click NEXT

In the Port Rules by clicking the ADD have the option to create rules for the cluster to meet requests only on certain ports.Leave the default option (from 0 to 65535). Clique em FINISH… Click FINISH ...

... Our NLB cluster is almost ready, lack now add the second node to the cluster. To do this, click the right-click the cluster and select Add Host to Cluster as shown in the figure below ...

In the Add Host to Cluster: Connect, type the name or IP of the server that will be another cluster node and click the Connect button. After the interface is connected, click NEXT

In the Host Parameters, select the priority of the IP address of another node and the state of the initial activity even when entering the cluster. ... And click NEXT

Set again the port rules to the other node and click FINISH

We have our NLB cluster running.

Now, to test, I run the PING command (from a client station) while the dedicated IP's of the two nodes (192.168.0.1 and 192.168.0.2) and the cluster's IP (192.168.0.3) ...

... I will now disable the network interface of one of us. The expected result is that it does not lose connectivity with the cluster (192.168.0.3).

I hope it's useful!

Documentation on Global Name Zone in Windows Server 2008

This goes for personal travel 6421 (31/08/2009) from BF.

Personally, as promised, follow the link to an official document of Microsoft about GLOBAL ZONE NAME Windows Server 2008.

http://download.microsoft.com/download/e/2/0/e2090852-3b7f-40a3-9883-07a427af1560/DNS-GlobalNames-Zone-Deployment.doc

.... soon will be posting articles on the subject!

A Abs to all!

Microsoft Posters

 

These posters from Microsoft are very good for study, not only those who are seeking certification as well as for everyday tasks.

People .... Just click on the link:

http://cid-fe19f09132c649bd.skydrive.live.com/browse.aspx/.res/FE19F09132C649BD!1033

Partitioning disk with GPT

 

Ladies and Gentlemen,

I am posting links to information on the partitioning of GPT disk, much improved and more flexible than our old friend MBR.

Segue link´s: Here's a link's:

http://www.microsoft.com/whdc/device

/storage/GPT_FAQ.mspx

http://en.wikipedia.org/wiki/GUID_Partition_Table

How to reset the restore mode password in Active Directory

In this article, let's resetting a password is commendable in a domain environment at Microsoft, the password used in "directory services Restore mode" which is requested at the time of promoting a server to domain controller during DCPROMO proccess. This password will be used when there is a nessecidade to perform an offline maintenance on the Active Directory data, e.g. a authoritative restore.

There is an aggravating circumstance, mainly in the exchange network administrators, which is not very important documentation this password, which makes offline AD maintenance. To work around this problem, we can reset the password of Restore Mode by doing the following:

At the DOS prompt, run the NTDSUTIL utility, as pictured below …

At the NTDSUTIL prompt, type set dsrm password, to sign in DSRM utility that will reset the password.

If you are running these procedures on the server you want to reset the password, type reset password on server null hit enter and type and confirm a new password of "directory services Restore mode" … if you want the command to be executed on a remote server, type reset password on server <ServerName> reminding you that the password must meet complexity …

After these procedures, type q to exit the DSRM prompt and q again to quit the NTDSUTIL prompt

Now just restart the server and pressing the F8 key to use the "directory services Restore mode" , and good luck in your AD maintenance …

Windows Server 2008/R2 DHCP NAP Enforcement

In this video, basic settings Network access protection (NAP). A very cool feature to control the level of safety of clients accessing resources such as DHCP, TS, and 802.1 x. With the NAP capability, we can verify the security tools status including…

• Firewall network connections.
• Antivirus.
• AntiSpware.
• Automatic updates.

Depending on the assumptions access policies configured, we deny, allow or restrict the connectivity of customers on our network.

More information on NAP: http://technet.microsoft.com/en-us/network/bb545879.aspx

<a href="http://video.msn.com/?mkt=pt-BR&amp;playlist=videoByUuids:uuids:bcd0cdb9-8649-4753-a94d-4ab843f3780a&amp;showPlaylist=true" target="_new" title="NAP">Vídeo: NAP</a>

Windows Server 2008 R2 Versions

The next link with the description of all versions of Windows Server 2008 R2:
http://65.55.177.205/

Windows Server 2008 Step-by-Step

Ladies and Gentlemen,
It follows a series of notes on some settings step by step in Windows Server 2008 ...

• Step-by-Step Guide for Read-Only Domain Controllers
• Step-by-Step Guide for Windows Server 2008 Active Directory Domain Services Installation and Removal
• Windows Server 2008 Restartable AD DS Step-by-Step Guide
• Step-by-Step Guide for Using the Active Directory Database Mounting Tool in Windows Server 2008
• Step-by-Step Guide for Windows Server 2008 Active Directory Domain Services Backup and Recovery
• Windows Server 2008 Auditing AD DS Changes Step-by-Step Guide
• Step-by-Step Guide for Fine-Grained Password and Account Lockout Policy Configuration
• Active Directory Domain Services Installed Help