Obscurum per Obscurius : Reference

Configuring SMS to Work on Workgroup Computers and Computers in Other Domains (LMHOSTS)

MuadDib — Sun, 19 Oct 2008 16:09:00 GMT

As described in the previous post the lab environment includes multiple forests, domains and workgroup computers. One of the nice things about SMS 2003 is the fact that once the SMS Client has been installed on a system, you "own" that system and can manage it from that day forward. In the previous post, we discussed how to use a logon script to install the SMS Advanced Client. In this post we will discuss how to configure computers that are not located within the same domain as the SMS server to be able to find the SMS Management Point (MP) and Server Locator Point (SLP).

All Windows operating systems since Windows 2000 rely on DNS for name resolution. A clients still have WINS installed to support some legacy applications but most do not. An LMHOSTS file is similar to a HOSTS file. A HOST files is used to map DNS hosts names to IP addresses. An LMHOSTS file is used to map NetBIOS names to IP addresses. NetBIOS names differ from DNS names because you can have different types of NetBIOS names (e,g, domain, workstation service etc.). The LMHOSTS files is placed in the same folder as the HOSTS file (%WINDIR%\System32\Drivers\Etc).

An example of the LMHOSTS file is shown below. Copy the code below into Notepad and save the file as LMHOSTS (no extension) to the "%WINDIR%\System32\Drivers\Etc" folder. Customize the entries to match your environment. When you see the pound (#) sign in an LMHOSTS file it is usually followed by a comment unless it is followed by one of the special directives such as PRE< DOM, INCLUDE etc. The PRE directive loads the entires into the NetBIOS name cache on startup. The DOM directive is used to indicated a domain name. The INCLUDE directive is used to include another LMHOSTS file.

In the sample file below the first three lines are comments. The fourth line pre-loads the domain name where the SMS servers is located and provides the IP address of a DC in that domain. The next line provides the name and IP address of the SMS server (SMSSERVER1). The next line provides the name of the SMS Server Locator Point (SMS_SLP) and the line that follows defines the Management Point (MP_C01). Notice the entries for the SLP/MP look very different from the others. The "\01xa" is a NetBIOS suffix and there must be exactly 15 characters between the the first quote and the backslash. For the SMS_SLP line on change the IP address to the IP of the computer hosting the SMS SLP role. For the MP, change the IP and change the SMS site code in the file from C01 to the site code of your SMS site.

<------------------------------ BEGIN LMHOSTS ----------------------------------->

# LAB LMHOSTS File
#REVISION: 2
#DATE: 10/17/2008
192.168.101.143     DC01         #PRE #DOM:LABDOMAIN1 # Lab Domain DC
192.168.101.141    SMSSVR1 #PRE
192.168.101.141   "SMS_SLP        \0x1A" #PRE
192.168.101.141   "MP_C01         \0x1A" #PRE

<------------------------------ END LMHOSTS ----------------------------------->

When you start using LMHOST files you quickly realize that trying to manage the content of these files on multiple computers because a big pain real fast. If you need to make a change, you need to update every file with the change. Fortunately the #INCLUDE directive discussed earlier enables you to use a centralized LMHOSTS file. In our lab environment we created a share on the SMS server named "SMSLMHOST" and placed the first LMHOSTS file shown above there. The LMHOSTS file shown below was placed on the computers that needed a LMHOSTS. There are two entries shown. The first one provides the name/IP of the SMS server and the second directs the client to read the master LMHOSTS file stored on the server.

<------------------------------ BEGIN LMHOSTS ----------------------------------->

192.168.101.141 SMS1 #PRE
#INCLUDE \\SMSSVR1\SMSLMHOSTS\lmhosts

<------------------------------ END LMHOSTS ----------------------------------->

REFERENCE

NetBIOS Suffixes (16th Character of the NetBIOS Name)
http://support.microsoft.com/default.aspx/kb/163409/

HOWTO: Assign SMS Advanced Client to the Isolated Secondary Site
http://support.microsoft.com/kb/555853

LMHOSTS File Information and Predefined Keywords
http://support.microsoft.com/kb/102725

Domain Browsing with TCP/IP and LMHOSTS Files
http://support.microsoft.com/kb/150800

Chapter 10 - Using LMHOSTS Files
http://www.microsoft.com/resources/documentation/windowsnt/4/server/reskit/en-us/net/sur_lmh.mspx?mfr=true

Modifying Security on Active Directory Objects using a script

MuadDib — Fri, 14 Dec 2007 22:17:00 GMT

I was working with a customer this week and we found some user objects in Active Directory had incorrect security settings. I put together a list of commands for the customer to use. I thought a few of the FOR command examples below were useful so here you go...

These command can also be used in a script. Keep in mind the FOR command syntax changes slightly (FOR /?) when used within a batch file.

DUMP CNs for all users in an OU
DSQUERY USER "ou=test accounts, dc=contoso,dc=local"

Show security for an object in Active Directory
DSACLS "cn=Jane doe1,ou=test accounts, dc=contoso,dc=local"

Show security for the SELF security principle on an object in Active Directory
DSACLS "cn=Jane doe1,ou=test accounts, dc=contoso,dc=local" | find /i "self"

Use DSACLS on list of users in a file
FOR /F "tokens=* usebackq" %i in (`type users.txt`) DO dsacls %i
(NOTE ` is a back quote found on same key as ~)

Use DSACLS on output of DSQUERY USERS <OU DN>
FOR /F "tokens=* usebackq" %i in (`dsquery user "ou=test accounts,dc=contoso,dc=local"`) DO dsacls %i
(NOTE ` is a back quote found on same key as ~)

FOR /F "tokens=* usebackq" %i in (`dsquery user "ou=test accounts,dc=contoso,dc=local"`) DO dsacls %i | find /i "self"
(NOTE ` is a back quote found on same key as ~)

Reset a user to the default permissions as defined by the schema
DSACLS "cn=jane doe1,ou=test accounts,dc=contoso,dc=local" /S (case sensitive)

Perfrom same task for all users in an OU
FOR /F "tokens=* usebackq" %i in (`dsquery user "ou=test accounts,dc=contoso,dc=local"`) DO dsacls %i /S (case sensitive)

Troubleshooting Windows Server Update Service (WSUS)

MuadDib — Sat, 30 Dec 2006 19:31:00 GMT

The creation of the Windows Update web site a few years ago revolutionized the way people with Microsoft products updated these products with the latest patches. Windows Update made it possible for a "mere mortal" to determine exactly which updates they needed to install and install them automatically. Windows Update greatly improved the the overall security of millions of Windows Desktops worldwide.

Windows Server Update Service (WSUS) is a free product from Microsoft that enables you to deploy your own Windows Update site within your own network and control which updates are installed on your equipment. With WSUS, an administrator can authorize updates for deployment after they are tested and also get detailed reports of which updates each computer needs. Another big benefit of WSUS is it enables updates to be deployed to computer while no one is logged in. The most common scenario is to have users log out each night and install patches during the off hours so the computers can be rebooted if necessary. Although WSUS can deploy patches for most Microsoft applications it is not a complete solution when it comes to maintaining a consistent configuration on all desktops and servers. For large environments, SMS should be considered because it gives you the ability to deploy, applications and Operating Systems. In addition SMS will provide detailed inventory information on the hardware and software you have in your environment.

I have been helping a customer bring their WSUS server back on line so they can get updates deployed until the SMS infrastructure they are designing has been completed. The information below is related to troubleshooting the deployment of WSUS and the Windows Update client.

Windows Update Client
WSUS requires the latest version of the Windows Update client software to be installed. Windows Server 2003 and Windows XP Service Pack 1 computers Will have the client by default. For all other you should go to Microsoft.com/downloads to get the latest WSUS client.

Links
Download Windows Server Update Services (software & documentation)
http://www.microsoft.com/windowsserversystem/updateservices/downloads/WSUS.mspx

Client Diagnostic Tool
http://download.microsoft.com/download/9/7/6/976d1084-d2fd-45a1-8c27-a467c768d8ef/WSUS%20Client%20Diagnostic%20Tool.EXE

Server Diagnostic Tool
http://download.microsoft.com/download/7/7/4/7745a34e-f563-443b-b4f8-3a289e995255/WSUS%20Server%20Debug%20Tool.EXE

WSUS w/ SP1
http://www.microsoft.com/windowsserversystem/updateservices/downloads/WSUSSP1.mspx

Troubleshooting
Most of the troubleshooting that needs to be performed with WSUS is related to the clients installing updates and/or reporting they have installed updates. Keep one thing in mind when troubleshooting, nothing happens instantly with WSUS. The product is designed to be low maintenance and to have minimal impact on the operation of the computers that are clients. Don't expect updates to be applied instantly. If you need that kinds of response, use SMS.

The WSUS client on each computer can be configured manually for small environments but Group Policy is the preferred way. The Group Policies are located at Computer Configuration > Administrative Templates > Windows Components > Windows Update. Confirm the GPO is configured with the correct server name and the GPO is linked to the correct OUs. At the client side, open a command prompt and run "GPUDATE /FORCE" (XP /2003 only) to apply the GPOs to the computer. Now type "GPRESULT" to see which GPOs are being applied to the computer. Confirm the GPO containing the WSUS settings was applied under Computer Settings.

Client Registry
There are two keys on the client that indicate that the computer is getting the WSUS settings from the GPO. The first contains the actual policy settings:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\windows\WindowsUpdate
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\windows\WindowsUpdate\AU

The second set of registry keys contains information specific to the computer such as the "SusClientId", "NextDetectionTime", "ScheduledInstallDate" etc.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update

Client Log Files
The are two locations on the local computer where information is logged for the WSUS client. The first tis the WindowsUpdate.log file located in the C:\Windows folder. This file contains a running log of all the activity the WSUS client performs.

The second log is named ReportingEvents.log and is located in the C:\Windows\SoftwareDistribution folder. Open this log file and go the the last few lines to see which updates are available for installation.

The easiest way to see what is happening is to compare the log files from a working computer to the logs on the computer you are troubleshooting.

Another area to look at is the C:\Windows\SoftwareDistribution\Download folder. This folder should contain tempo ray folder for recently downloaded updates pending installation.

Troubleshooting Steps

Confirm GPO configuration and linkage to correct OU.
You should see the computer listed in the Unassigned Computers group once it begins reporting to the WSUS server.
Confirm the "Automatic Updates" and "Background Intelligent Transfer Service" is running on client and startup is set to automatic.
Run GPUPDATE & GPRESULT on client to confirm GPOs are being applied.
Check the registry keys and confirm they exist. If they do not, their may be conflicting GPO settings. Open a blank MMC and add the RSOP snap in. Run the RSOP snap in and review the WSUS settings are being configured. If they are not, another GPO may have the WSUS settings set to "disabled" instead of "not configured".
Review Log files.
Stop and start the "Automatic Updates" and "Background Intelligent Transfer Service"services and then review the log files after a few minutes (remember, things do not happen instantly). The log files should indicate what updates are required and will be installed

Roaming User Profiles

MuadDib — Sat, 30 Dec 2006 19:20:00 GMT

A couple of my customers use Roaming User Profiles (RUP) so that a user's desktop, files and settings follow them no matter which computer they happen to be setting at. This is a very cool feature for users because no matter which computer they log onto they always have the look and feel. I have been researching some issues decided to post the information here for future reference.

314478 How to Create and Copy Roaming User Profiles in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;EN-US;314478

227260 How a slow link is detected for processing user profiles and Group Policy
http://support.microsoft.com/default.aspx?scid=kb;EN-US;227260

227369 Default Behavior for Group Policy Extensions with Slow Link
http://support.microsoft.com/default.aspx?scid=kb;[LN];227369

221833 How to enable user environment debug logging in retail builds of Windows
http://support.microsoft.com/default.aspx?scid=kb;[LN];221833

RUP Issues Resolved by XP SP2

816880 Roaming profiles may not unload after you use WMI on a Windows Server 2003-based computer or a Windows XP-based computer
http://support.microsoft.com/?kbid=816880

819536 Roaming profiles are not saved when a user logs off a Microsoft Windows 2000-based computer or a Microsoft Windows XP-based computer
http://support.microsoft.com/?kbid=819536

827878 The "Exclude directories in roaming profiles" policy stops working when you add paths
http://support.microsoft.com/?kbid=827878

830464 Group Policy does not apply roaming profiles correctly if NTuser.dat and NTuser.pol files are not synchronized
http://support.microsoft.com/?kbid=830464

840998 Changes to your roaming profile are lost when you log on to a Windows XP-based computer
http://support.microsoft.com/?kbid=840998

321936 A roaming user profile does not upload successfully, and Event ID 1000 is logged in the application log in Windows 2000
http://support.microsoft.com/?kbid=321936

831651 "The roaming profile cannot be found" error message when you log on to your network from a Windows XP-based computer
http://support.microsoft.com/?kbid=831651

Documentation

User Data and Settings Management (Great resource for RUP Information)
http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/xpusrdat.mspx

Group Policy Settings for Roaming User Profiles
http://technet2.microsoft.com/WindowsServer/en/library/8623052e-c21f-4fd9-a9a1-056779c2758f1033.mspx?mfr=true

User Profiles and Folder Redirection FAQ
http://www.microsoft.com/technet/community/en-us/management/manage_faq.mspx

Enable Remote Desktop

MuadDib — Fri, 01 Dec 2006 15:10:00 GMT

Remote Desktop is one of the greatest features added to the Windows operating system. It enables you to perform remote administration of servers from your desk or fix one of your kids computers from the couch. Of course it's only great if it is enabled on the computer you are trying to access. If you find yourself unable to connect to a remote computer because Remote Desktop has not been enabled you can enable it remotely by flipping a bit in the registry using regedt32.

Here's how:

Use regedt32 to open the registry of the remote computer.
Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server
Change fDenyTSConnections to 0x00 (0x01 disables). If the key is not there create it.

To enable Remote Assitance set HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\fAllowToGetHelp to "1"

This is old news to most of us in IT. I posted here because the information on the reg key is hard locate when you need it. I was on-site at a customer yesterday and spent 30 minutes trying to locate this in the Microsoft Knowledgebase without finding it.

Remote Desktop Connection (akaTerminal Server) Keyboard Shortcuts

MuadDib — Fri, 13 Oct 2006 18:05:00 GMT

I use Remote Desktop all day at work. It is especillay helpful when writing documentation. One of the problems I always run into is trying to remember which keyboard short you can use to capture a screen-shot in a TS session. Since I had to dig these up again today I decided to post them here where they are easy (for me) to find.

Shortcut key             Description
ALT+PAGE UP          Switches between programs from left to right.
ALT+PAGE DOWN     Switches between programs from right to left.
ALT+INSERT              Cycles through the programs in the order they were started.
ALT+HOME                Displays the Start menu.
CTRL+ALT+BREAK    Switches the client between a window and full screen.
CTRL+ALT+END         Brings up the Windows Security dialog box.
ALT+DELETE             Displays the Windows menu.
CTRL+ALT+(-)            Places a snapshot of the active window, within the client, on the Terminal server clipboard
                                 (provides same functionality as pressing PrintScrn on a local computer.)
CTRL+ALT+(+)           Places a snapshot of the entire client window area on the Terminal server clipboard
                                  (provides the same functionality as pressing ALT+PrintScrn on a local computer.)

NOTE: for last two commands use the symbol on the numeric keypad without the ().
keypad

Active Directory Troubleshooting Resources

MuadDib — Sun, 01 Oct 2006 19:50:00 GMT

Articles

Troubleshooting Active Directory—Related DNS Problems
http://blogs.msdn.com/controlpanel/blogs/posteditor.aspx?SelectedNavItem=NewPost&sectionid=7213&bpt=1

Troubleshooting Active Directory Replication Problems
http://technet2.microsoft.com/WindowsServer/en/library/4f504103-1a16-41e1-853a-c68b77bf3f7e1033.mspx

Additional Resources for Troubleshooting Active Directory
http://technet2.microsoft.com/WindowsServer/en/library/019a8a46-05eb-4969-b0e7-df48355184c11033.mspx

Repadmin Examples
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/TechRef/a103036b-5d82-4d99-8e61-23d434a8e6eb.mspx

How to configure Active Directory diagnostic event logging in Windows Server
http://support.microsoft.com/kb/314980/en-us

332199 - Domain controllers do not demote gracefully when you use the Active Directory Installation Wizard to force demotion in Windows Server 2003 and in Windows 2000 Server
http://support.microsoft.com/default.aspx?scid=kb;en-us;332199

216498 - How to remove data in Active Directory after an unsuccessful domain controller demotion
http://support.microsoft.com/default.aspx?scid=kb;en-us;216498

Troubleshooting "RPC Server is Unavailable" in Windows
http://support.microsoft.com/kb/224370/EN-US/

839880 How to troubleshoot RPC Endpoint Mapper errors in Windows Server 2003
http://support.microsoft.com/?id=839880

Improvements to Domain Controller Name Resolution in SP1
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/Operations/43e6f617-fb49-4bb4-8561-53310219f997.mspx

Useful shelf life of a system-state backup of Active Directory
http://support.microsoft.com/?id=216993

Fixing Replication Lingering Object Problems (Event IDs 1388, 1988, 2042)
http://technet2.microsoft.com/WindowsServer/en/Library/4a1f420d-25d6-417c-9d8b-6e22f472ef3c1033.mspx

Event ID 2042: It has been too long since this machine replicated
http://technet2.microsoft.com/WindowsServer/en/Library/34c15446-b47f-4d51-8e4a-c14527060f901033.mspx

Best Practices for Adding Domain Controllers in Remote Sites
http://technet2.microsoft.com/WindowsServer/en/Library/6405bc5f-b8bf-449e-b11a-f116d22f858a1033.mspx

279156 - The Effects of Setting the File System Policy on a Disk Drive or Folder Replicated by the File Replication Service
http://support.microsoft.com/default.aspx?scid=kb;en-us;279156

Recommendations for managing Group Policy administrative template (.adm) files
http://support.microsoft.com/default.aspx?scid=kb;EN-US;816662

Configuration and operational recommendations for the File Replication service in Windows Server 2003 and Windows 2000 Server - http://support.microsoft.com/Default.aspx?kbid=840675

185786 - Recommended Practices for WINS
http://support.microsoft.com/default.aspx?scid=kb;en-us;185786

How to configure an authoritative time server in Windows Server 2003
http://support.microsoft.com/kb/816042

Tools

Repadmin Examples
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/TechRef/a103036b-5d82-4d99-8e61-23d434a8e6eb.mspx

Active Directory Management Tools
http://technet2.microsoft.com/WindowsServer/en/library/4b9fbbc8-2b3d-4758-85c7-b08caf6583eb1033.mspx

Description of the DNSLint utility
http://support.microsoft.com/?kbid=321045

USing NSlookup.exe
http://support.microsoft.com/?kbid=200525

NBLookup.exe command-line tool
http://support.microsoft.com/default.aspx?scid=kb;en-us;830578

Windows Server 2003 Resource Kit Tools
http://www.microsoft.com/downloads/details.aspx?familyid=9d467a69-57ff-4ae7-96ee-b18c4790cffd&displaylang=en

Documentation

Active Directory Daily Operations Guide
http://www.microsoft.com/resources/documentation/msa/edc/all/solution/en-us/pak/sog/edcops08.mspx

DNS - Windows Server 2003 DNS

MuadDib — Sun, 01 Oct 2006 06:48:00 GMT

One of the problems I run into with DNS is I have trouble remembering what a working DNS looks like if I have not worked with it in a while. The attached screen shots show the DNS configuration of a Window Server 2003 installed as a new forest.

Forest Wide MSDCS Zone

DNS - Windows 2000 DNS Upgraded to Windows 2003

MuadDib — Sun, 01 Oct 2006 05:49:00 GMT

There are examples from the root domain and one child domain. :