“Error:Error constructing or Publishing certificate” while requesting a certificate for Lync server

Recently, I was working on installing Lync Server 2010 for testing purposes , all was going smoothly till I reached the certificate request and assignment step . When I ran the certificate request wizard I was able to complete the request but with a warning as shown below :

Utilizing the power of Active Directory module for PowerShell to accomplish tasks fast and easy

I was working with a customer , who requested for an easy way to do the following two tasks :

1. Identify all the installed operating system versions and their current service packs for all computers in his company’s Active Directory Domain.
2. List all disabled computers accounts all over the domain and move them to a designed OU for review prior deletion

As his Active Directory is hosted by Windows Server 2008 R2 domain controllers I advised him to utilize the capabilities of Windows PowerShell with Active Directory module , as follow :

First of all , let’s list all available modules for Windows PowerShell , then import the one for Active Directory by executing the following commands at an elevated Windows PowerShell window :

Get-Module –ListAvailable

Import-Module ActiveDirectory

Reset domain Administrator account password using only your Windows installation media !

Do you know that you can reset your Active Directory Administrator account password without login into your Active Directory ? . In this post , I will explain in a step by step mode how you can do this using only  your Windows installation media which can be used to reset the Administrator account password if forgotten and you have no other user(s) with privilege(s) to do the reset.

For this tutorial I will use a virtualized domain controller with Windows Server 2008 R2 with SP1 as Operating System.

Here is the detailed procedure :

• Mount Windows Server 2008 R2 ISO/DVD 

• Restart your domain controller and choose to boot from DVD when prompted

• At “Install Windows”  click next

How to find the current Exchange Server Schema Version

In a previous post I showed how to determine the current version of Schema version for Active Directory for this one I will show how to determine the Schema version for Exchange server.

In contrary to Active Directory , installing of a higher in service pack within the same edition can cause schema version change , as you can see below ( I added Forest ObjectVersion and Domain ObjectVersion as a bounce ) :

Exchange edition	Schema version	Forest objectVersion attribute of Organization container	Domain objectVersion attribute on Microsoft Exchange System Objects
Exchange 2000 RTM	4397	-	4406
Exchange 2000 SP3	4406	-	4406
Exchange 2003 RTM	6870	6903	6936
Exchange 2003 SP1	6870	6903	6936
Exchange 2003 SP2	6870	6903	6936
Exchange 2007 RTM	10628	10666	10628
Exchange 2007 SP1	11116	11221	11221
Exchange 2007 SP2	14622	11222	11221
Exchange 2007 SP3	14625	11222	11221
Exchange 2010 RTM	14622	12640	12639
Exchange 2010 SP1	14726	13214	13040
Exchange 2010 SP2	14732	14247	13040

Now , here are how to find your current Exchange Schema version ( for all , replace data in italic with yours )

How to find the current Active Directory Schema Version

The schema contains formal definitions of every object class that can be created in an Active Directory forest. The schema also contains formal definitions of every attribute that can or must exist in an Active Directory object.

During Domain Controllers upgrade , a mandatory step which is Schema extending must take place which changes ( increases ) the number of Schema version.

In this post I will show all the possible ways – according to my knowledge – by which you can identify your current Active Directory Schema version.

First of all , here is a list for Schema versions relative to Windows editions :

Windows Edition	Schema Version
Windows 2000 RTM with all Service packs	13
Windows Server 2003 RTM with all Service packs	30
Windows Server 2003 R2 RTM with all Service packs	31
Windows Server 2008 RTM with all Service packs	44
Windows Server 2008 R2 RTM with all Service packs	47
Windows Server 2012 RC	56

Now , here are how to find your current Active Directory Schema version ( for all , replace data in italic with yours )

• Using GUI : by using either ADSIEdit / LDP.exe , navigate to :

  "CN=Schema,CN=Configuration,DC=itguydiaries,DC=net"

Monitor Group Membership Changes in a real-time manner

One of the common security issues for IT admins is monitoring Active Directory groups memberships , so a notification is raised for each time a member is added to a group .

Most of admins assume that an expensive monitoring system must be in place in order to accomplish this task , fortunately this is a wrong  assumptions . All you need is the following  :

Enable account management audit :

• On a domain controller open Start > Administrative Tools > Group Policy Management
• Create a new Group Policy Object ( GPO ) linked to domain controllers OU with a descriptive name [ For my lab I named it Audit Account Management ]

• Edit the newly created GPO as follow : Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Audit Policy , then set enable for Audit account management at least for success 

Finally, Microsoft did it : Active Directory Replication Status Tool

One of Active Directory's strengths is its distributed nature. Since its architecture is spread across multiple domain controllers (DCs), AD scales extremely well and is highly fault tolerant to domain controller errors. However, the highly sophisticated replication engine that keeps AD data consistent across all these DCs is dependent on many other systems such as basic network topology, firewall configurations, and DNS. Active Directory topics are the highest call volume generator for Microsoft's Customer Support Services, and replication failures generate among the highest call volumes within the AD support area.

ReplMon was one of the common tools that was used to monitor and analyze replication patterns within AD infrastructure so an admin can figure where the errors were originated and hence proceed with fixing.

Although ReplMon was a useful tool  Microsoft replaced it with the command line RepAdmin tool with the release of Windows Server 2008.

Opposite to the GUI tool ( ReplMon ) , the command line tool RepAdmin was not as easy for use for most admins with its multiple switches and parameters.

In order to make AD admins life easier , Microsoft – finally - released Active Directory Replication Status ( ADREPLSTATUS ) tool .

Moving Operations Masters using MoveOperationMasters.ps1 PowerShell script

You may be familiar with the traditional ways to transfer FSMO [ Flexible Single Operation Masters ] roles but how about by using PowerShell ?  By now you should just know that PowerShell can do everything the GUI can do … well at least that is the way it feels to me.

As we know that we have five operation masters as listed below [ Two per Active Directory forest ( 1,2 ) and three per Active Directory domain (3,4 and 5 ) ]

1. Schema Master
2. Domain Naming Master
3. Domain PDC Emulator Master
4. Infrastructure Master
5. RID Master

In order to assist admins with FSMO moving I have made a simple script which simplifies the moving of FSMO.

Is my Active Directory Backed Up?

Nothing bites you back harder than bad backups in a situation in which you need to restore stuff in Active Directory . Few days ago, I was on a visit to one of our clients , he asked me "Is there is a fast way that I can use to confirm that my Active Directory Database was backed up ?" , I answered "Yes , there is". 

Although backing up of Active Directory database can be performed using tons of ways , a simple command can be used to assure that your Active Directory database was backed up, which is :

Recover Active Directory Objects using Active Directory Recycle Bin

Recovering deleted objects was one of the hardest issues for Active Directory admins as it requires performing of an authoritative restore for Active Directory backup [ Authoritative restore includes performing of a non-authoritative restore followed by using of NTDSutil to mark certain Active Directory objects as authoritative objects so it can not be overwritten during post restore replication sync. ] 

Active Directory Recycle Bin helps minimize directory service downtime by enhancing your ability to preserve and restore accidentally deleted Active Directory objects without restoring Active Directory data from backups, restarting Active Directory Domain Services (AD DS), or rebooting domain controllers.

In this post I’ll show you how to raise functional level , enable Active Directory Recycle Bin and finally restore a deleted Active Directory object [ User object ] 

First : Set forest to Windows 2008 R2 mode :

This can be accomplished using  Active Directory Domain and Trusts snap-in or Active Directory module for PowerShell by using the following command :

Set-ADForestMode [-Identity] <ADForest> [-ForestMode] <ADForestMode>

 

In Active Directory module for PowerShell you can verify the result by executing Get-ADForest | FL Name,ForestMode cmdlet

For my lab environment :

  Set-ADForestMode -Identity itguydiaries.net -ForestMode Windows2008R2Forest

Useful commands for Active Directory Groups management

With command line tools a lot of complex tasks can be accomplished easily and efficiently; I'll state below two of common tasks that admins may need to perform in Active Directory and explain how to perform those tasks in the easiest way.


Tasks :

1. Copy group's membership from one user to another one
2. Copy all members from one group to another group

To show you to perform these tasks ,I'll set two scenarios - one for each task - and demonstrate how to accomplish each of them . our scenarios are:

1. TestUser1 is a domain user who is member of two groups [ TestGroup1 & TestGroup2 ] . We require that TestUser2 - a newly created domain user - to be a member of all Active Directory groups that TestUser1 is member in it.
2. TestGroup3 includes the following members [ TestUser3 : TestUser7 ] ,those users are required to be added to another group named TestGroup4.

Here is a screen shoot indicating that all objects [ TestUsers & TestGroups ] are located at TestOU.

Sysvol migration from FRS to DFS-R in a nutshell

Windows Server 2008 introduced DFS-R as a new technology for Sysvol replication . It this post I'll illustrate the migration from the old , commonly used replication technique [ File Replication Service - RFS ] to the newly introduced replication technique [ Distributed File System Replication - DFS-R ].

First of all a question arise "Why to migrate your sysvol ?"

The answer simply is , by using DFS-R for your sysvol you gain the following benefits : 

   

• Efficient, scalable and reliable file replication protocol which has been tested extensively to ensure data consistency in multi-master replication scenarios.

• Differential replication of changes to files using the Remote Differential Compression (RDC) algorithm, which enhances efficiency in branch office scenarios.
• Flexible scheduling and bandwidth throttling mechanisms. 
• Self-heals from USN journal wraps and database corruptions – end user intervention and monitoring requirement is minimal. 
•  Provides a new UI management tool (MMC snap-in) for ease of administration. 
• Provides built in health monitoring tools for ease of monitoring deployments. 
• Improved support for Read Only Domain Controllers.