Dynamic DNS Updates & How to Get it to Work with DHCP, Scavenging, Static Entries & their Timestamps, the DnsUpdateProxy Group, and DHCP Name Protection

Posted on August 13, 2016 by Ace Fekay

It’s me again. I originally posted this in 4/2006, and updated throughout the years, but I still get questions from time to time asking why updates are not working, especially PTR. Well, I thought it’s time for an update and to just offer a summary in the beginning, because in this day and age, no one wants to read! A quick Facebook read the first line and click “Like,” seems to be the norm.  Well, I will also offer the nitty gritty below the summary for those who want to read.

 

Topics Covered:

  1. Preface: The entity that registers the record into DNS, owns the record
  2. Summary: How to configure DHCP & Dynamic DNS Updates
  3. Scavenging Defined
  4. DNS Timestamp and Scavenging (and info on the dnsTombstoned Attribute)
  5. Scavenging Refresh & NoRefresh Settings must be less than the DHCP Lease Period
  6. DHCP Conflict Detection
  7. DHCP Lease has a “pen” or “pencil” Icon
  8. Records & timestamps, and the lack of timestamps
  9. Related Links

    Preface:

    Dynamic DNS Update Basics:

  10. This is the part that many do not understand. Please read thoroughly before asking me why your PTR updates don’t work.

     

    1. By default, ALL Windows 2000 and newer machines statically configured machines will register their own A record (hostname) and PTR (reverse entry) into DNS.

    Yep. That’s the basic rule. And yea, I had to state Windows 2000 and newer, because this stuff doesn’t apply to older Windows versions.

    2. If set to DHCP, a Windows 2000, 2003 or XP machine, will request DHCP to allow the machine itself to register its own A (forward entry) record.

    But DHCP will register its PTR (reverse entry) record.

    3. If Windows 2008/Vista, 2008 R2, Windows 2012 R2, Windows 7, 8, 8.1, 1, and all future releases, the DHCP server always registers and updates client information in DNS

    Note: “This is a modified configuration supported for DHCP servers running Windows Server 2008 and DHCP clients. In this mode, the DHCP server always performs updates of the client’s FQDN, leased IP address information, and both its host (A) and pointer (PTR) resource records, regardless of whether the client has requested to perform its own updates.”
    http://technet.microsoft.com/en-us/library/dd145315(v=WS.10).aspx

    4. The entity that registers the record in DNS, owns the record.

    Note:  “With secure dynamic update, only the computers and users you specify in an ACL can create or modify dnsNode objects within the zone.

    By default, the ACL gives Create permission to all members of the Authenticated User group, the group of all authenticated computers and users in an Active Directory forest. This means that any authenticated user or computer can create a new object in the zone.

    Also by default, the creator owns the new object and is given full control of it.
        Secure Dynamic Update
        http://technet.microsoft.com/en-us/library/cc961412.aspx

     

    Reference:

    Updating DNS Resource Records
    https://technet.microsoft.com/en-us/library/ff631099%28v=ws.10%29.aspx

    How to configure DNS dynamic updates in Windows Server 2003.
    http://support.microsoft.com/kb/816592

    Using DNS servers with DHCP (Contains information on the DnsUpdateProxy group and its usage)
    http://technet.microsoft.com/en-us/library/cc787034 (WS.10).aspx

    ===============================================================

    Summary: How to configure DHCP & Dynamic DNS Updates

    1. Configure DHCP Credentials.

       The credentials only need to be a plain-Jane, non-administrator, user account.
       But give it a really, REALLY strong password.

    2. Set DHCP to update everything, whether the clients can or cannot.

    3. Set the zone for Secure & Unsecure Updates. Do not leave it Unsecure Only.

    4. Add the DHCP server(s) computer account to the Active Directory,  Built-In DnsUpdateProxy security group.

       Make sure ALL other non-DHCP servers are NOT in the DnsUpdateProxy group.
       For example, some folks believe that the DNS servers or other DCs not be running DHCP should be in it.
       They must be removed or it won’t work.
       Make sure that NO user accounts are in that group, either.
       (I hope that’s crystal clear – you would be surprised on the number of responses I get asking if the DHCP credentials should be in this group.)

    5. On Windows 2008 R2 or newer, DISABLE Name Protection.

    6. If DHCP is co-located on a Windows 2008 R2, Windows 2012 R2, and all future Windows versions Domain Controllers:

       You must secure the DnsUpdateProxy group by running the following command:
       dnscmd /config /OpenAclOnProxyUpdates 0

    7. Configure Scavenging on ONLY one DNS server. What it scavenges will replicate to others anyway.

    8. Set the scavenging NOREFRESH and REFRESH values combined to be equal or greater than the DHCP Lease length.

    Just to be crystal clear, this means that if the lease is an 8 day lease, than  NOREFRESH should be 4 (four) and REFRESH should be 4 (four) so when you add them together, they are not greater than the lease length.

     

    ===============================================================

    Caveat with the DHCP service out-of-the-box configuration

    The goal is to keep DNS clean without duplicate records.

    When a client shuts down, and later returns past the lease time, it may get a different IP address. With the default settings, a duplicate A record gets registered by DHCP with the client’s new IP. This is because the client will not update itself due to the current record in DNS is beyond the lease period. This happens even though DHCP registered the record. This is because DHCP doesn’t own the record, the client does, even though DHCP registered it.

    DHCP Option 081:

    The way to get around this is you can configure DHCP’s Option 081 to update the record for all client, no matter if the client asks or not. To configure DHCP Option 081, you must look at the DHCP server properties, under the DNS Tab in DHCP properties. Despite it being a DHCP Option, it’s not found in a DHCP server, scope or class option.

  11. .

    Overview to make this work:

    • DHCP must own the record, not the client. This is done by configuring DHCP to register all DHCP clients, whether the client supports Dynamic Updates or not.
      • As long as DHCP owns the record, can keep the records in the FLZ and RLZ up to date when the client renews its lease, same IP or different IP.
      • Otherwise you’ll see duplicate A and PTR records in DNS, whether scavenging is enabled or not.
    • Configure DHCP credentials by creating a plain-Jane, Domain User account. It doesn’t have to be an administrator account.
    • Add the DHCP Server object in Active Directory to the DnsUpdateProxy group.
    • In addition, I suggest to enable DNS scavenging to remove stale records, which will keep the zone clean.

    .

    How do we configure DHCP for this to work??

    Summary to Configure Credentials and add the DHCP server to the DnsUpdateProxy group.

    Windows 2008 R2 or newer:

    You have a new feature to prevent Name Squatting: DHCP Name Protection, you still need to configure Credentials and add the server to the DnsUpdateProxy group.

  12. Add the DHCP server to the Active Directory, Built-In DnsUpdateProxy security group.
  13. Configure DHCP Credentials.
  14. Configure Name Protection.
  15. If DHCP is co-located on a Windows 2008 R2 DC, you must secure the DnsUpdateProxy group by running the following:
    dnscmd /config /OpenAclOnProxyUpdates 0 

    Note: Configuring DHCP credentials AND using the DnsUpdateProxy group, and forcing DHCP to update all records, will also allow DHCP to register Win9x machines, as well as non-Windows machines, such as Linux, OSx (BIND based), and other Unix flavors, and update the records when they get renewed with a different IP.

  16. Scroll down to the Name Protection section for more specifics and references,

    For Windows 2008 and older:

    To force DHCP to own and control all records it updates into the DNS zone, there are two parts of the procedure:

    1. Add the DHCP server to the Active Directory, Built-In DnsUpdateProxy security group.
    2. Configure DHCP Credentials.

    .

    Step by Step procedure:

    Step 1: To add the DHCP server’s computer account to the DnsUpdateProxy Group  

      • In ADUC, add the DHCP server’s computer properties to the DnsUpdateProxy security group.

        • In ADUC, click on the Built-In container.
        • Scroll down to the DnsUpdateProxy group.
        • Right-click DnsUpdateProxy group, choose properties
        • Click ADD –  make sure that the search criteria is set to look for computer objects,
        • Either type in the DHCP server’s name and click Check Name or click on Advanced, then click on FIND, and scroll down to the DHCP server name.
        • Once you see the DHCP server’s computer object, highlight it
        • Click OK.

    Step 2: Force DHCP to register all records, Forward and PTR, whether a client machine can do it or not:

    See screenshots below to configure the Option 081 settings under DHCP properties, DNS tab

    Step 3: Configure other DHCP Options as needed

    Suggested basic DHCP options:

    • Set the Connection Specific Suffix DHCP Option 015 to the AD domain name (such as example.com).
    • Set Option 006 to only the internal DNS servers.
    • Option 003 to your router

    Step 4: Configure the zone for Secure Updates Only:

    Credentials and the DnsUpdateProxy group will be used to register them.

    Step 5: Configure DHCP Credentials. Note – you can do this on 2008 R2 and newer, if you chose not to use .    

        • In AD, create and configure a dedicated Domain User account to use as credentials in DHCP.
        • The user account does not need any elevated rights, a normal user account is fine.
        • Choose a very strong password.
        • Set the password so it does not expire.

    Then configure DHCP with the credentials you created:

    For Windows 2003:

    • Open the DHCP Console:

    • Right-click the DHCP servername

    • Choose Properties.
    • Click the Credentials button
    • Provide the account’s credentials

    In Windows 2008 and 2008 R2:

    • Select IP Scope
    • Choose Properties
    • Select the Advanced tab
    • Click the Credentials button
    • Provide the account’s credentials.

    For Windows 2000:

    • It must be done with the Netsh command. Windows 2003 and newer can also be done with the Netsh command, if you desire.

    .

    Note and warning: about using the DnsProxyUpdate group on a DC

    • We normally shy away from adding a DC to the DnsProxyUpdate group, as it weakens security including the DC records if DHCP is on a DC. However, in many cases, there’s not much of a choice.
    • Windows 2008 R2 and newer gives you the option to use the DHCP Name Protection Feature, but as stated above, you still need to configure credentials and add the server to the DnsUpdateProxy group.
    • When DHCP is running on a Windows 2008 R2 domain controller, you must secure the DnsUpdateProxy group by running the following:
      dnscmd /config /OpenAclOnProxyUpdates 0

    .

    Note on older, pre-existing records in DNS:

    After configuring the above provedure, the credentials and DnsUpdateProxy group configuratuion will not update current or delete duplicate records. You must delete them manually to allow DHCP to take care of all new records moving forward.

    Also, it will allevaite another issue – If DHCP is on a DC, it will not overwrite the original host record for a machine getting a new lease with an IP previoulsy belonging to another host. 

    If there is a problem with PTRs getting updated even after configuring credentials, please see this article:

    DHCP server processes expired PTR resource records in Windows Server 2003
    http://support.microsoft.com/kb/837061

    .

    Step by step screenshots:

    Windows 2003:

    .

    .

    .

    Windows 2008 & Windows 2008 R2:

    .

    .

    DHCP Name Protection

    If you have Windows 2008 R2 or Windows 2012 R2, in addition to configuring the DNS tab to force registration, you still must configure credentials and add the server to the DnsUpdateProxy group. If DHCP is on a Windows 2008 R2 DC, to protect the DC when using the DnsUpdateProxy group, you must secure the group by running:

    dnscmd /config /OpenAclOnProxyUpdates 0

    Using  “DHCP Name Protection.” will register A and PTR record on behalf of a client, and will prevent a workstation (non-Windows) Name Squatting, meaning using a name that another machine (non-Windows or Windows) client that DHCP already registered , from registering it’s name. DHCP will give that duplicate named client an IP, but it will not register it into DNS. 

    Quoted from the following link:

    “Name squatting occurs when a non-Windows-based computer registers in Domain Name System (DNS) with a name that is already registered to a computer running a Windows® operating system. The use of Name Protection in the Windows Server® 2008 R2 operating system prevents name squatting by non-Windows-based computers. Name squatting does not present a problem on a homogeneous Windows network where Active Directory® Domain Services (AD DS) can be used to reserve a name for a single user or computer.”

    DHCP Step-by-Step Guide: Demonstrate DHCP Name Protection
    “Name squatting occurs when a non-Windows-based computer registers in Domain Name System (DNS) with a name that is already registered to a computer running a Windows® operating system. The use of Name Protection in the Windows Server® 2008 R2 operating system prevents name squatting by non-Windows-based computers. “
    http://technet.microsoft.com/en-us/library/ee404786(v=ws.10).aspx

    Configuring DHCP Name Protection
    http://technet.microsoft.com/en-us/library/dd759188.aspx

    DHCP: The DNSupdateproxy group must be secured if Name Protection is enabled on any IPv4 scope
    http://technet.microsoft.com/en-us/library/ee941099(WS.10).aspx

    DHCP: Credentials for DNS update should be configured if secure dynamic DNS update is enabled and the domain controller is on the same host as the DHCP server
    http://technet.microsoft.com/en-us/library/ee941099(WS.10).aspx

    .

    To configure Name Protection:

    • Right-click IPv4, choose Properties
    • Click on the DNS tab
    • Click “Configure”
    • Check the box, “Enable Name Protection”

    You can optionally select it on IPv6, too. No harm done, whether you have IPv6 scopes or not.

    .

    You will notice that once you enable it:

    • Except the “Enable DNS Dynamic Updates according to the settings below,” checkbox, everything else under the DNS tab will be grayed out.
      • This is because the Name Protection feature takes over these functions, and will force register everything, so these settings are no longer used.
    • If you have multiple IPv4 scopes, once set at the IPv4 level, it will apply to all IPv4 scopes.
      • If you don’t want it to apply to all scopes, you can selectively disable the setting under each scope, or don’t enable it at the IPv4 level, and selectively enable it on a per scope basis.

    .

    Here’s a screenshot of where to enable it:

    .

    Screenshot of DNS Tab (which is actually Option 081), which grays out. This is because Name Protection took over these functions:

    .

    If you have multiple IPv4 scopes, once set at the IPv4 level, it will apply to all IPv4 scopes.

    Back to top of page>

    .=================================================================

    Scavenging Defined

    Misconceptions about Scavenging

    There are some misconceptions prompting fears that Scavenging will remove everything in your zone, includind servers. Please understand, the main thing that scavenging works on is the timestamp. If there is no timestamp, such as a manually created, static record, it will not get scavenged. Also, if all servers, including DCs, are automatically updating their own record, then there is no fear of losing their records, because for one, their records (timestamps) are current, therefore scavenging won’t touch them, and two, Windows Servers by default will update their records every 24 hours, with the exception of domain controllers at every 60 minutes. Therefore, even if they were to scavenge these records, assuming the time stamp has ever been reached, the machines will refresh themselves anyway!

    DNS UPdate Interval is based on Operating System and Windows Server Role:

    By default, statically configured clients and remote access clients that do not rely on the DHCP server for DNS registration, will re-register their A & PTR records dynamically and periodically every 24 hours. This applies to Windows 2000 Professional and all newer operating systems.
    For domain controllers, due to the importance of keeping up to date and accurate SRV and other records, the Netlogon service will attempt to update these records every 60 minutes.
    By default, on a computer that is running Windows XP/2003 or newer, the DefaultRegistrationRefreshInterval key value controls this (except Windows 2000, whichdoes not have this key but can be added), and is set by default to 1 day. This is true regardless of whether the computer is a client or a server, except domain controllers, which are every 60 minutes.
    You can use the following registry subkey to modify the update interval:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DefaultRegistrationRefreshInterval
    Data type: REG_DWORD
    Range: 0x0 – 0xFFFFFFFF seconds
    Default value: 0x15180 (86,400 seconds = 24 hours) for Windows 2000 Professional
    Default value: 0xE10 (3,600 seconds = 1 hour) for Windows 2000 Server and Windows Advanced Server
    Scope: Affects all adaptors
    This specifies the time interval between DNS update registration updates.
    The default Time To Live (TTL) value used for dynamic registrations is 20 minutes. You can use the following registry subkey to modify the TTL value:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DefaultRegistrationTTL

    .

    In Summary:

    • Scavenging is a feature that will remove expired records based on their Timestamps.
    • Scavenging is not enabled by default.
    • Scavenging will NOT remove statically configured records, the ones you manually create unless you run dnscmd /AgeAllRecords, which will stamp them making them eligible for scavenging (more below on this). Without running this command, DNS will scavenge dynamically updated records that have reached their time stamp. To look at the time stamps of a record using Windows 2003 DNS, put the DNS console “view” in the menu to Advanced View, then look at the individual record properties, and you will see the time stamp. If using Windows 2008 or or newer, it will show up in the console as a separate column.

    .

    Scavenge Refresh and No Refresh vs DHCP Lease period

    Scavenging Refresh and No Refresh settings must be equal to or less than the lease period. For example, using  the default DHCP lease period of 8 days with a 7day scavenge setting, is perfect. If you lower the lease, you need to lower the scavenge settings. If you are using a 4 hour lease, well, that’s a tough one, because the lowest you can go with scavenging is 1 day, and may provide inconsistent results.

    And please bear in mind, as already stated, scavenging will not remove statically configured records, (the ones you’ve manually created). It will scavenge updated records that have reached their time stamp. However, if you run dnscmd /AgeAllRecords, it will timestamp all records, making them eligible for scavenging.More on this in the next section, Static records.

    To set aging and scavenging properties for a DNS server using the DNS Console:

    1. In the DNS console, right-click the DNS server name, and choose “Set Aging/Scavenging for All Zones.
    2. Select the Scavenge stale resource records check box.
    3. You can now either choose to set Scavenging for all zones, or choose No, and manually set each zone individually. I suggest setting it for all zones.
    4. It’s recommended to go with the defaults of 7 days. If you choose to change it, it should reflect and stay in line with DHCP’s lease times. Now I’ve never found anything specific stating this, but keeping the scavenge setting to the lease minus one day, ensures that records will be deleted one day before lease renewal so it will be deleted if that record were actually not in use by a client, and has expired. If still in use, it will go through the scavenging refresh period and scavenge lifetime until the next expiration time.
    5. Once you’ve set scavenging, all records that have a time stamp will be aged,  will get scavenged. This does not include static records, because static records do not have a time stamp.

    Excample of a dynamically created record:

    .

    Static Records:

    Static records will not get scavenged, since they have a 0 time stamp. When viewing a static record, it will show as the following:

    However, regarding static records, if you use force age all records using the dnscmd /AgeAllRecords. If the “Delete the record when it becomes stale” box was checked at time of the record creating, it will set a TimeStamp on it, which will make it eligible for scavenging. Therefore, if you have an static records, host, cnames, etc, they will get scavenged, and I advise to take inventory of your static entries if you run this command. I would suggest not to, and just allow scavenging to take it’s time to do its thing. Be PATIENT!!!!

    .

    You MUST BE PATIENT!!

    .

    Rough formula to go by: NoRefresh + Refresh * 2 + the point in time during the 3 day scavenge period.

    Here’s a chart showing when events occur with a 3-day NoRefresh, 3 day Refresh, and 3 day Scavenging. (Graphics from Don’t Be Afraid of Scavening. You must be patient):

    If you look at the chart, based on scavenging settings of a 3 day NoRefresh and 3 day Refresh, then it becomes eligible for scavenging the day after these two pass, so it will be the 7th day. Then it waits for the next scavenge cycle (I kind of call it the garbage collection point), which is somewhere withing the next 72 hours (based on the NoRefresh). So based on this chart, starting at 1/1/2008, the record becomes eligible on 1/7/2008, then it’s deleted (scavenged) on, in this case, on 1/10/2008, at 6am during the next 72 hour scavenge cycle. The 72 hour scavenge cycle in this case, is based on the 3day scavenge setting..

    That was a total of about 10-11 days, but it could have happened, as you can see in the chart, anytime between the 10th day and the 14th day.

    .

    image

    .

    If you choose the default 7 day setting may take up to 4 weeks + 1 day (29 days) for scavenging to take place.

    .

    .

    AD Integrated zones – Where do you set it? – Enable it only on one server, and the timestamp will replicate with AD replication

    In summary, with using AD integrated zones, you just enable scavenging on one server, then the time stamp will replicate to other servers with the normal AD replication process. When AD integrated zones are involved, DNS uses an additional mechanism to control replicating the records’s time stamp behavior through the dnsTombstoned attribute.

    In addition, regarding enabling it on one server, Josh Jones [MSFT] quotes (in his blog, “Don’t be afraid of DNS Scavenging” ):

    “Although you can set every server hosting the zone to scavenge I recommend just having one. The logic for this is simple: If the one server fails to scavenge the world won’t end. You’ll have one place to look for the culprit and one set of logs to check. If on the other hand you have many servers set to scavenge you have many logs to check if scavenging fails. Worse yet, if things start disappearing unexpectedly you don’t want to go hopping from server to server looking for 2501 events.”

    For more specifics, and to not duplicate Josh Jones’ efforts, please read his blog for specific info – “Don’t be afraid of DNS Scavenging

    Don’t be afraid of DNS Scavenging, Josh Jones [MSFT], 19 Mar 2008 6:49 PM
    http://blogs.technet.com/b/networking/archive/2008/03/19/don-t-be-afraid-of-dns-scavenging-just-be-patient.aspx

    .

    AD Integrated Zones and Scavenging – How does it do it? It uses the AD attribute called, “dnsTombstoned”

    Good article by Guy Teverovsky [MSFT], explaining how AD handles scavenging with records in an AD integrated zone, as well as what happens if say a machine who’s record is marked as dnsTombstoned, but the machine is reinstalled, which now has a new SID, and how it can’t update the original record –  the original host record is not removed immediately:

    DNS Scavenging internals (or what is the dnsTombstoned attribute) for AD Integrated zones, by Guy Teverovsky [MSFT], 23 Sep 2010
    http://blogs.technet.com/b/isrpfeplat/archive/2010/09/23/dns-scavenging-internals-or-what-is-the-dnstombstoned-attribute-for-ad-integrated-zones-dstombstoneinterval-dnstombstoned.aspx

    .

    Other articles on Scavenging:

    Optimizing your network to keep your DNS squeaky clean
    http://blogs.technet.com/b/networking/archive/2009/02/09/optimizing-your-network-to-keep-your-dns-squeaky-clean.aspx

    .

    Enable Scavenging Screenshots

    Screenshots showing enabling scavenging with the default 7 Day NoRefresh, and 7 Day Refresh. Note that scavenging will not kick in until 1 day after these two periods combined, meaning 15 days later. And if you also notice, that after I enabled them, and ran dnscmd /AgeAllRecords, the static records still didn’t show as stamped. Eventually they will. That’s the “being patient” part.

    .

    1.
    https://qis15w.sn2.livefilestore.com/y1pK2oaDPwDuWcOKuruFE_mG60DX_JdOD9PUVuj8YEvK9bo-HK1WMPfHg3_smfglSU6RuKpxkxvZkP1mgb0AFJD_WZ-yUEOo6np/1.%20Set%20Aging-Scavenging%20for%20all%20zones.jpg?psid=1

    .

    2.
    https://qis15w.sn2.livefilestore.com/y1pjeNJXBaiplqSW8EK6KEbWLD7awc19PpsNJEF6S5456DDriVTJUvCAsIH6EbpHb6zu3at6n2jZVN9BuOMVbNZdJQCCzFYi5I8/2.%20Using%20default%207%20day%20scavenge%20settings.jpg?psid=1

    .

    3.
    https://qis15w.sn2.livefilestore.com/y1pBwESri4t7Ru2PHdykn2_lJm6yxE_QejQVUZP1ROdPqEnd6KenfqyHrYAtU8Vori8WyElUTu_3AjAPe6egZIyK6FuO_yRlJU8/3.%20Chose%20to%20apply%20this%20to%20all%20AD%20integrated%20zones.jpg?psid=1

    .

    4.
    https://qis15w.sn2.livefilestore.com/y1pXZk5kHkkl6EvfrcSprvdxp80i2WdPYaOy5M6uo98Gj5t1Heop_AR2cWXXaCof3yxQ6ORbxUBVAT1C_iDc9hUuymzdwZy2psz/4.%20%20You%20can%20see%20when%20scavenging%20will%20kick%20in%20-%201%20day%20after%20the%207%20day%20No-refresh%20and%207%20day%20Refresh%20period.jpg?psid=1

    .

    5.
    https://qis15w.sn2.livefilestore.com/y1pZdhGtBL_KWnpNMUTcSDkQWF21Ws8y_pkGvfQIZIp4GrHesAv-vl2uyrIhMu2MYm-3SyBa566R_ymHa9ja_ORyEce-cd2U09U/5.%20Set%20aging%20on%20contoso.com%20zone.jpg?psid=1

    .

    6.
    https://qis15w.sn2.livefilestore.com/y1pkkRp01cx-ArzkC6hZ9SW1L2QwKOYK6lWRN5hE0NywrwCKD4a3fNTiwKuWLDIAoM9x0pCK3Z1b5tEZYVICF9qOoSecKMytReK/6.%20DNS%20Server%20Properties%2C%20Advanced%20Tab%2C%20Checked%20Enable%20Automatic%20Scavenging%20of%20stale%20records.%20This%20basically%20turns%20it%20on.jpg?psid=1

    .

    7.
    https://qis15w.sn2.livefilestore.com/y1pInNfBbD8vssqF85PS8-Sgg-60yXVzmxA910iEz_yS2NlY5b8rRUJrr-KlP9dO79XdRksQvHmlrFCNz4FRWAjZmUDNjmguTq9/7.%20Ran%20dnscmd%20ageallrecords.jpg?psid=1

    Note of Caution: T\the only problem with running this command, is it will timestamp all static records making them eligible for scavenging. Therefore, you may NOT want to do this.

    .

    8.
    https://qis15w.sn2.livefilestore.com/y1pPWlVIC7sDUQkjxinOJhT0nEGJRi4Y_Gctkg_inp2g3ZiMJMSLM16uz_e7GQPEJ7zFqnx2T03n0eRnyZuF8m3Dudp0kdAPQfG/8.%20Restarted%20DNS%20%20although%20this%20is%20not%20necessary.jpg?psid=1

    .

    9.
    https://qis15w.sn2.livefilestore.com/y1pD3XxvDENwxCwEzOVPbngly9Hb29y3Dq1esQItYpXWif5wiBfdBDn19r-O1lGYzGYApi8gEjCb83BvJP9JRXCCXeW-tjzTZUQ/9.%20NYC-DC1%20still%20shows%20as%20static.jpg?psid=1

    Note on the screenshot below (quoted from Don’t Be Afraid of Scavening. You must be patient)::
    “The Scavenging Period is how often this particular server will attempt to scavenge. When a server scavenges it will log a DNS event 2501 to indicate how many records were scavenged. An event 2502 will be logged if no records were scavenged. Only one server is required to scavenge since the zone data is replicated to all servers hosting the zone.

    Tip: You can tell exactly when a server will attempt to scavenge by taking the timestamp on the most recent EventID 2501 & Event ID 2502 events and adding the Scavenging period to it.

    Image from: http://blogs.technet.com/blogfiles/networking/WindowsLiveWriter/DNSscavengingiseasy.Havingpatienceishar_C6E0/image_14.png

    .

    Moral of the story: Be Patient!!

    Back to top of page>

    =================================================================

     

    DNS Time stamp and Scavenging

    If the record was manually created, it won’t show a time stamp, however, if the record was dynamically registered, it will show a time stamp. If you manually create a record, the checkbox will not be checked to scavenge, however if it was dynamically registered, it will be checked.
    As for the server entries (such as from a DC), if you allow auto registration, which is done by default, and it gets scavenged, it gets re-registered anyway by the DC’s Netlogon service (for the SRV, LdapIpAddress and GcIpAddress records) and the operating system (for the A and PTR records). Unless you are seeing something going on that is affecting your environment, the default settings work fine, at least they do for me for all of my customers and installations I’ve worked in that I’ve set scavenging and forced DHCP to own the records so it can update the records it had registered at lease refresh time.

    Regarding the Active Directory dnsTombstoned Attribute

    DNS Scavenging internals (or what is the dnsTombstoned attribute) for AD Integrated zones
    Discuss the internal processing of DNS Scavenging.
    http://blogs.technet.com/b/isrpfeplat/archive/2010/09/23/dns-scavenging-internals-or-what-is-the-dnstombstoned-attribute-for-ad-integrated-zones-dstombstoneinterval-dnstombstoned.aspx

    dnsTombstoned Records clean-up:
    Everyday at 2AM (non-configurable) the DNS server scans all DNS integrated zones in AD and determines whether the tombstoned record is ready to be deleted. The default retention time of the tombstoned records is 7 days. This value can be changed by the DsTombStoneinterval value (dnscmd w2k8r2dc01 /config /DsTombstoneInterval value) or by editing the registry under HKLM\CCS\Services\DNS\Parameters Value Name:DsTombstoneInterval

    Value Type: DWORD). The value is in seconds.

    At that point the DNS deletes the record.

    Back to top of page>

    =================================================================

     

    Scavenging Refresh and No Refresh Settings Must be less than the DHCP Lease Period

    The scavenging period must be set less than the lease time. The way you have it currently set, you have two different settings but both are beyond the lease time. Due to both of these settings being different and beyond the lease time, is why you are getting inconsistencies, as I previously mentioned.

    For example: The 7 and 7 day intervals work hand in hand with a default DHCP lease time of 8 days. DHCP renewals are half the lease interval right, whcih is 4 days. If it doesn’t get renewed, then it waits until 87.5% of the lease time to renew, which is at the 7th day. If it doesn’t get renewed, then the lease is lost, and the DHCP client will attempt to get a new lease. Once the lease is lost at the 7th day, then if you left scavenging set to default, it will clean out that old lease entry from DNS in all zones it existed in.

    Therefore, if you have an 8 hour lease, you’ll need to set scavenging for 1 day, but that is not a recommended setting. It’s simply too low. Also an 8 hour lease tries to renew at 50% of the lease time, and if unsuccessful, at 87.5% of the lease time, which is at the 7th hour. Scavenging needs to be set below that, but scavenging settings are in days, which is at 24 hours intervals, so there’s no possible way to set it below the lease time.

    Also, a lease time of 8 hours, or even 4 hours, as I’ve heard some admins have set it to, is really an aggressively short lease and can cause other problems elsewhere, such as with WINS and replication partners. I’ve seen errors in WINS in a partnership scenario where the data is constantly changing and WINS simply couldn’t keep up with the changes between partners.

    My suggestion is at least that if you want to keep an aggressively short lease, to at least make the lease period 2 days and scavenging 1 day.

    However, I’ve been in environments with the default 8 day lease and 7 day scavenging settings, along setting either using credentials so DHCP owns all records it updates, or using the DnsProxyUpdate group, and it works fine. If a laptop gets a record at 8am on a Monday, but unplugs and goes home and comes back on Thursday, the laptops will attempt to get the same lease. If the laptop doesn’t come back until Tuesday the following week, it will get a new lease and new IP, since DHCP owns the record, it simply updates it in DNS for the forward and reverse zones.

    To properly make it work using the DnsProxyUpdate group or using credentials, you must force DHCP to update ALL RECORDS, whether the client knows how to update or not or requests it or not (the bottom setting). This will force DHCP to own ALL records. If you do not set these settings, and the scavenging period is more than the lease, unexpected results will occur.

    Scenario: Choosing a Short DHCP Lease Time of 8 hours

    If you reduce the DHCP lease to 8 hours, a number of things can occur, such as increased AD Tombstoning of DNS entries, which will increase the AD NTDS.dit file size, as well as possibly an inconsistency with the records in DNS, as well as issues with WINS trying to keep up with the changes, which will be evident with WINS Event log error entries.

    Also keep in mind, with any DHCP client no matter what operating system, uses the DORA method, that is Discovery, Offer, Request, and Acknowledgement. The point in time a client will ask for a lease refresh is at the 50% mark, where it uses RA, or Request (for the current lease config it has), and Acknowledgment. If it can’t get it at the 50% mark after 3 attempts, it will wait until 7/8 of the lease time to broadcast out a refresh request until the end of the lease period. If it doesn’t get a renewal at the end of lease, the client machine removes the current config from its interface and has no IP.

    Therefore with an 8 hour lease, the refresh time is at 4 hours. That needs to be taken into account with additional traffic, and how DNS updates, as well as how WINS handles it with the constant requests coming through.

    Regarding the WINS issue, I’ve seen this once at a customer site years ago. It’s always stuck to the back of my mind to keep this in mind when such a short lease is desired. I found  a default lease works fine, as long as scavenging is enabled (using default settings as well), including if the DHCP server is on a DC, adding the DHCP server to the DnsUpdateProxy group, or to alleviate the security issues with such as move, to rather supplying credentials for DHCP, so it owns all records it registers into DNS, in order so it can update the records as they change. Otherwise, expect issues to occur.

    (The following, which goes into much more detail of what is actually occuring, was compiled and posted by Chris Dent in the Microsoft DNS newsgroup.)


    Why would one choose 8 hours? Possibly to handle many laptops coming in and out of the network. So you would think a shorter lease time would work. However, keep in mind with any lease time, the point at which a client will ask for a lease refresh is at 50% of the lease time. Therefore, the client machine will asking for a refresh every four hours.

    This will result in a high rate of change in DNS, which may lead to a large number of tombstoned DNS entries. It would seem reasonable to reconsider the DHCP Lease duration, 8 hours is, after all, extremely short.

    Essentially you have:

    • The amount of AD Tombstoned Data is increasing because of Stale DNS records
    • The number of Stale DNS Records is high because of the (potential) rate of change of records in both Forward and Reverse Lookup
    • The rate of change must be somewhat proportional to changing leases in DHCP

    The DNS Record lifecycle:

    1. An A record is created (as a dnsNode in AD).
    2. When the Timestamp is no longer updated, and the Aging Intervals passes it’s aged setting, the A Record becomes Stale.
    3. Stale Records are removed from the active DNS system, and the AD dnsTombstoned attribute is set to TRUE.
    4. Tombstoned record exists for value of the DsTombstoneInterval attribute, which is 7 days by default.
    5. The DnsNode object is moved to the Deleted Objects for the length of time of the tombstoneLifetime attribute value.

    Note : The Active Directory Tombstone Lifetime is listed in the schema.ini and will be set during the promotion of the very first DC in the forest based on the Windows version used to install the first DC. This value does not change after upgrading all domain controllers to newer Windows versions or by changing the Domain or Forest Functional Levels. The entry in the schema.ini “tombstoneLifetime=<number of days>”  and can be changed. Therefore, this will tell you what the value is depending on what Windows operating system was used to install the very first domain controller in your infrastructure:

    • If the very first DC was installed using a Windows 2003 with integrated SP1 CD or newer, the Tombstone Lifetime Value is 120 days.
    • If the very first DC installed in the forest is Windows 2000 (any Service Pack), or Windows 2003 (pre-Windows 2003 SP1), the Tombstone LIfetime is 60 days.

    The values can be changed. Please read the following for information on how to change it:

    Active Directory Lingering Objects, Journal Wraps, Tombstone Lifetime, and Event IDs 13568, 13508, 1388, 1988, 2042, 2023
    (Scroll down to “Active Directory Tombstone Lifetime”)
    http://msmvps.com/blogs/acefekay/archive/2011/12/27/active-directory-lingering-objects-journal-wraps-tombstone-lifetime-and-event-ids-13568-13508-1388-1988-2042-2023.aspx

    Therefore, you either need to reduce the rate of change by increasing the lease duration, or deal with the inaccuracy in DNS, by limiting the Aging and Scavenging settings, or deal with an increasing directory size to store all this additional data. The directory size should level out eventually, when you reach the point where the number of tombstoned records being flushed is equal to the number being created.

    Back to top of page>

    DHCP Conflict Detection

    When DHCP provides a lease to a client, it tries to determine if there are no conflicts with another machine using the IP, which may have been inadvertently configured with a static IP configuration not realizing the IP is withing the Lease Scope.

    DHCP uses pings for conflict detection.

    Enable address conflict detection
    http://technet.microsoft.com/en-us/library/cc737924(WS.10).aspx

    DHCP Best Practices
    Look for: “Use server-side conflict detection on DHCP servers only when it is needed”
    http://technet.microsoft.com/en-us/library/cc780311(WS.10).aspx

    DHCP Server Conflict Detection
    http://technet.microsoft.com/en-us/library/cc958918.aspx

    I’ve been asked a few times in the past if DHCP Conflict detection pings are the same as the pings when one uses a command prompt to ping a host. The answer to that is yes.

    To expand, the term “ping” is short for “Packet Internet Groper.” Pings are based on ICMP packets, just as you would ping an IP address, the DHCP server does the same to detect conflicts. It’s sumamrized in the following link by searching the sentence, “When conflict detection attempts are set, the DHCP server uses the Packet Internet Groper (ping) process …”

    DHCP Server Conflict Detection
    http://technet.microsoft.com/en-us/library/cc958918.aspx

    Specific info on the Ping command:

    Ping – General Summary
    http://en.wikipedia.org/wiki/Ping

    Internet Control Message Protocol – Technical Summary
    http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol

    Back to top of page>

    =================================================================

     

    DHCP Lease has a “pen” or “pencil” Icon

    If a record shows up in the DHCP Lease list with a pen icon, it means that a write is pending. If it doesn’t disappear, it may mean it is trying to register into a zone that does not exist on the DNS servers. This happens in cases where the client machine is not joined to the domain and has a missing or different Primary DNS Suffix than the zone in DNS.

    Registration can only occur into a zone that exists on DNS and that zone updates have been configured to allow updates.

    If this is the case, go into the client machine’s IP properties, and perform the following:

    • On the DNS tab in TCP/IP Advanced properties, clear the “Register this connection’s addresses in DNS”
    • Clear the  “Use this connection’s DNS suffix in DNS registration” check boxes,
    • The DHCP Server will fill these in for you and register using the domain name in Option 015.

    Reference:

    DHCP console icons reference
    http://technet.microsoft.com/en-us/library/cc784812(WS.10).aspx

    Back to top of page>

    =================================================================

     

    Records & timestamps, and the lack of timestamps

    If the record was manually created, it won’t show a time stamp, however, if the record was dynamically registered, it will show a time stamp. My guess is the records you are referring to were manually created. If you manually create a record, the checkbox will not be checked to scavenge, however if it was dynamically registered, it will be checked.

    I just tested this with Windows 2003 DNS. When I had built a few servers for a customer and let them auto register, they had a timestamp and the scavenge checkbox was checked. For the records I manually created, such as internal www records, and others, they did not have a time stamp and were not checked to scavenge.

    Even if you allow auto registration, which I do by default, and it gets scavenged, it gets re-registered anyway by the OS. Unless you are seeing something going on that is affecting your environment, the default settings work fine, at least they do for me for all of my customers and installations I’ve worked in that I’ve set scavenging and forced DHCP to own the records so it can update the records it had registered at lease refresh time.

    Back to top of page>

    Related Links

    How to configure DNS dynamic updates in Windows Server 2003.
    http://support.microsoft.com/kb/816592

    Using DNS servers with DHCP (Contains information on the DnsUpdateProxy group and its usage)
    http://technet.microsoft.com/en-us/library/cc787034 (WS.10).aspx

    Using DNS Aging and Scavenging
    Aging and scavenging of stale resource records are features of Domain Name System (DNS) that are available when you deploy your server with primary zones.
    http://technet.microsoft.com/en-us/library/cc757041(WS.10).aspx

    Microsoft Enterprise Networking Team : Don’t be afraid of DNS, Mar 19, 2008
    DNS Scavenging is a great answer to a problem that has been nagging everyone since RFC 2136 came out way back in 1997.
    http://blogs.technet.com/networking/archive/2008/03/19/don-t-be-afraid-of-dns-scavenging-just-be- patient.aspx

    How DHCP Technology Works
    http://technet.microsoft.com/en-us/library/cc780760(WS.10).aspx

    From Ulf B. Simon Weidner:
    DHCP, DNS and the DNSUpdateProxy-Group
    I had a discussion in the Newsgroups lately about DHCP and the DNSUpdateProxy-Group which is used to write unsecured DNS-Entries to a DNS-Zone which only …
    http://msmvps.com/ulfbsimonweidner/archive/2004/11/15/19325.aspx

    And from Kevin Goodnecht:
    Setting up DHCP for DNS registrations
    http://support.wftx.us/setting_up_dhcp_for_dns_registra.htm

    317590 – HOW TO Configure DNS Dynamic Update in Windows 2000 and DNSUpdateProxy Group:
    http://support.microsoft.com/kb=317590

    816592 – How to configure DNS dynamic updates in Windows Server 2003:
    http://support.microsoft.com/kb/816592

    Follow up discussion on the DNSUpdateProxy-Group:
    http://msmvps.com/ulfbsimonweidner/archive/2005/03/26/39841.aspx
    ==================================================================

    Back to top of page>

     

    More to come… Comments are welcomed.

    ==================================================================

    Summary

    I hope this helps!

    Published 8/13/2016

    Ace Fekay
    MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
    Microsoft Certified Trainer
    Microsoft MVP – Directory Services

    clip_image002622[2][2][2] clip_image004622[2][2][2] clip_image006622[2][2][2] clip_image008622[2][2][2] clip_image010622[2][2][2] clip_image012622[2][2][2]

    Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php

    This posting is provided AS-IS with no warranties or guarantees and confers no rights.

    PowerShell Script to Search Netlogon for a Specific List of Script files to Replace or Alter Drive Mappings

    Updates/Edits:

    10/12/2015: I’ve updated the script to allow multiple, simultaneous changes for a list of bat files, and no need to manually add “.bat” to the list of user account samAccount names.

    Prologue

    Yes, it’s me again, Ace Fekay.

    You’ve already *probably* read my recent blog:

    PowerShell Script to Search Netlogon logon scripts and Replace Drive Mappings – 9/10/2015
    http://blogs.msmvps.com/acefekay/2015/09/10/script-to-search-netlogon-logon-scripts-and-replace-drive-mappings/

    That blog is about searching all script files that end with *.bat, and make changes to the files.

    This time we’re going to run something similar, but for a strict list of specific files (user logon scripts) for a list of users. This came about when a request came in to remove access to 140 users and remove their drive mappings, and another request to alter access for 120 users’ scripts.

    To remove drive mapping is easy. The following shows our normal mapping method in each script:

    :: Access has been provided by Ace Fekay on 10/3/2015 with approval in Ticket# 123456
    net use t: /del
    net use t: \\contoso.com\sharename

    And for the ones we are removing access, we can keep the net use t: .del to delete the mappings when the user logs on, but we want to comment out the mapping, as such:

    ::Access Removed per Ace Fekay in Ticket# 123456 – net use x: \\contoso.com\SomeShareName$

    And of course, this is based on reading a list of script.bat file names in a text file appropriately called, “SomeShareNameRemoveMappingsUserListBat.txt.”

    Have fun!

    Script:

    – Updated script: 10/11/2015:

    # *************************************************************************************
    # If this is a migration, first run the robocopy script to copy all data
    # Then run the netlogon report script to see how many bat files in netlogon
    #    reference OldServerName
    # Then run this script to replace any reference to OldServerName in the batch
    #    files for each share.
    # *************************************************************************************
    # Modified by Ace Fekay 10/11/2015
    #
    # Changes:
    #    Input file just needs to be samAccount names and no longer need .bat suffixed
    #    Allows to change multiple scripts as long as they have a common name,
    #    such as the server name
    #    Accommodates if the multiple users have different mapped drive letters.
    #
    # *************************************************************************************

    get-credential

    # Used for testing – $Path = “\\contoso.com\NETLOGON\test-RemoveMapping2”

    $Path = “\\contoso.com\NETLOGON”
    $WhatAmIlookingFor = “contoso.com”

    #This grabs the list of user UserAccounts from the input file.
    $SourceListOfUserAccounts = “C:\PSScripts\Netlogon Search and Replace\UserFileList.txt”

    #Example of UserFileList.txt:
    # username1
    # username2
    # username3
    # etc

    cd $Path
    $RemoveMappedDriveFromUserList = (get-content $SourceListOfUserAccounts)
    $UserCount = 0
    $MappingsRemoved = 0

    Foreach ($User in $RemoveMappedDriveFromUserList) {

    #This will annotate/suffix “.bat” to the end of each user name
    $UserScript = $User+”.bat”
    $UserCount++

    $file = get-content $UserScript

        #only modify files that contain the string $WhatAmILookingFor
        if (Select-String -InputObject $file $WhatAmIlookingFor){

    $MappingsRemoved++

        $file = $file -replace “net use .?\: \\\\contoso.com\\ShareName1″,”::Mapped Drive Access Removed by Ace Fekay per Ticket# 123456 – net use ?: \\contoso.com\ShareName1
        $file = $file -replace “net use .?\: \\\\contoso.com\\ShareName2\$”,”::Mapped Drive Access Removed by Ace Fekay per Ticket# 123456 – net use ?: \\Malvern\output$ \\contoso.com\ShareName2$
        $file = $file -replace “net use .?\: \\\\contoso.com\\ShareName3″,”::Mapped Drive Access Removed by Ace Fekay per Ticket# 123456 – net use ?: \\contoso.com\ShareName3

    # *************************************************************************************
    # Previous stuff I kept here for future reference but commented out:
    #    $file = $file -replace “\\\\OldServerName\\ShareName1$”,”\\contos.com\ShareName1$”
    #    $file = $file -replace “\\\\OldServerName\\ShareName2″,”\\contos.com\ShareName2”
    #    $file = $file -replace “\\\\OldServerName\\ShareName3″,”\\contos.com\ShareName3”
    #    $file = $file -replace “\\\\OldServerName\\ShareName4″,”\\contos.com\ShareName4”
    #    $file = $file -replace “\\\\OldServerName\\ShareName5″,”\\contos.com\ShareName5”
    #    $file = $file -replace “\\\\OldServerName\\ShareName6″,”\\contos.com\ShareName6”
    #    $file = $file -replace “\\\\OldServerName\\ShareName7″,”\\contos.com\ShareName7”
    #    $file = $file -replace “\\\\OldServerName\\ShareName8″,”\\contos.com\ShareName8”
    #    $file = $file -replace “\\\\OldServerName\\ShareName9″,”\\contos.com\ShareName9”
    # *************************************************************************************
       
    #comment out net time statements if they exist
        $file = $file -replace “^net time”,”REM net time”
       
    #write out the changes
        Set-Content -Value $file -Path $UserScript
        write-host $UserScript “was changed to” $file
        }
    }

    write-host “Total users:” $UserCount
    write-host “Total Mappings removed:” $MappingsRemoved
    # *************************************************************************************
    # *************************************************************************************

    – Old script prior to 10/10/2015:

    # *************************************************************************************
    # If this is for post-migration, first run the robocopy script to copy all data
    # Then run the netlogon search report script to see how many script.bat files in netlogon reference SomehareName
    # Then run this to replace any reference to SomeShareName to TheNewShareName or even just to disable the share or shares.
    # Highly modified by Ace Fekay 10/3/2015
    # *************************************************************************************

    get-credential

    $Path = “\\contoso.com\NETLOGON”

    # This code snippet gets all the files in $Path that end in “.bat”.
    cd $Path

    $RemoveMappedDriveFromUserList = (get-content “C:\PSScripts\Netlogon Search and Replace\SomeShareNameRemoveMappingsUserListBat.txt”)
     
    $UserCount = 0
    $MappingsRemoved = 0

    Foreach ($User in $RemoveMappedDriveFromUserList) {
    $UserCount++
    $file = $RemoveMappedDriveFromUser

    # Only modify files that contain the string “SomeShareName”
        if (Select-String -InputObject $file “SomeShareName”){

    $MappingsRemoved++

    # Note that the following is doing a number of things, such as commenting out mappings that they are no longer permitted to use,
    # providing comments, changing or updating sharenames, etc.
        $file = $RemoveMappedDriveFromUser
        $file = $file -replace “net use g\: \\\\contoso.com\\SomeShareName\$”,”::Access Removed per Ace Fekay in Ticket# 123456 – net use g: \\contoso.com\SomeShareName$”
        $file = $file -replace “net use X\: \\\\contoso.com\\SomeShareName\$”,”::Access Removed per Ace Fekay in Ticket# 123456 – net use x: \\contoso.com\SomeShareName$”
        $file = $file -replace “net use z\: \\\\contoso.com\\SomeOldShareName\$”,”net use z: \\contoso.com\SomeNewShareName$”
        $file = $file -replace “\\\\OldServerName\\ShareName1$”,”\\contoso.com\ShareName1$”
        $file = $file -replace “\\\\OldServerName\\ShareName2$”,”\\contoso.com\ShareName2$”
        $file = $file -replace “\\\\OldServerName\\ShareName3$”,”\\contoso.com\ShareName3$”
        $file = $file -replace “\\\\OldServerName\\ShareName4$”,”\\contoso.com\ShareName4$”
        $file = $file -replace “\\\\OldServerName\\ShareName5$”,”\\contoso.com\ShareName5$”

    # Comment out net time statements
        $file = $file -replace “^net time”,”REM net time”
       
    # Write out the changes
        Set-Content -Value $file -Path $_;
        }
    }

    write-host “Total users:” $UserCount
    write-host “Total Mappings removed:” $MappingsRemoved
    # *************************************************************************************

     

    More to come…

    Comments are welcomed.

    ==================================================================

    Summary

    I hope this helps!

    Published 10/3/2015

    Ace Fekay
    MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
    Microsoft Certified Trainer
    Microsoft MVP – Directory Services

    clip_image002622[2][2][2] clip_image004622[2][2][2] clip_image006622[2][2][2] clip_image008622[2][2][2] clip_image010622[2][2][2] clip_image012622[2][2][2]

    Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php

    This posting is provided AS-IS with no warranties or guarantees and confers no rights.

    Migrate Files to a new File Server using RoboCopy, IP addresses, and Relative Paths using the Administrative Shares

    Prologue

    Ace Fekay here again.

    You might say to yourself this is some really simple stuff. Sure, it might be, for the pro. As many of you know, I’m an avid Active Directory and Exchange server engineer/architect, and an MVP in Active Directory.

    Therefore with AD, Exchange, and Office 365, you will find that scripting comes into play more and more with your daily tasks.  The main reason I’m posting simple scripts is that to get the job done, I just needed an arsenal of simple quickie scripts when called upon a simple task, such as this one, when tasked to quickly get a list of users in a group.

    I hope this, and my future scripts, especially with Office 365, help you out.

    Scope

    This is one method to migrate data from one file server to another. I have one method that I will post later, that does it by the share names. This is to just get the two closer to having the same data before I run the final script.

    DFS

    Keep in mind, we use DFS. I will already have created a new target to the new file server for the current share, but keep the new targets disabled until ready to cut over.

    However, when we cut over the target to the new server, we would like to shut off the shares on the source (old) server, to prevent anyone from using it. Of course, we’ve already communicated to the user base the migration schedule.

    Therefore, since the shares will be deleted, we must rely on running this by using IP addresses and relative paths from the default administrative shares (c$, d$, etc).

    Share and NTFS Permissions Backup

    Yes, absolutely! You definitely want to back up your Share and NTFS permissions on this server just in case something happens! The following link is a great article to show you how to do it:

    How to Back Up and Restore NTFS and Share Permissions
    http://blogs.technet.com/b/askds/archive/2008/11/24/how-to-back-up-and-restore-ntfs-and-share-permissions.aspx

    Easy? Nah…

    Many may say this is simple stuff. Sure, for the seasoned scripter, which I’m not, The main reason I’m posting this, and I will be posting much more, including Office 365 scripts, is that I had to look it up. I’ve found various websites that provide how-tos, but when it comes to handling variables and piping, I’ve found there is no one place to get various examples and have found myself looking at multiple places to get this info, including my colleagues, who are extremely adept at scripting. With many place, I also see elaborate scripts that do more than what I need. They are fabulous blogs and websites, but sometimes I need the simple one-liners to perform day to day stuff.

    Script:

    /

    # Uses relative paths
    # Make sure you change directory to where your script is located on the computer you are running this before running
    #
    # =========================================================================================
    #Function: Get the Total Size of Folder

    function Get-Size
    {
         param([string]$pth)
         “{0:n2}” -f ((gci -path $pth -recurse | measure-object -property length -sum).sum /1mb) + ” mb”
    }
    # =========================================================================================
    #
    cd “C:\PSScripts\OldServerName”

    $SourceServerNetBIOSName =     “OldServerName”
    $SourceServerIP =         “10.100.200.200”
    $DestinationServerName =     “NewFileServer.contoso.com”

    #**************************************************************************************
    #Ignore this section
    #Test files with only one share

    #Note: This section was a test to see if I can get this script to work if there is only one share.
    #I could not get it to work with one share. The reason is there must be two (2) or more shares for
    #this to work, because I’m using an array. There is no such thing as a single array.

    #$SourceServerPath =            @()
    #$SourceServerShares =          @()
    #$DestinationServerShareNames = @()

    #$SourceServerPath =            Get-Content ‘.\OldServerName-Share-paths-test.txt’
    #$SourceServerShares =          Get-Content ‘.\OldServerName-SourceSharesList-test.txt’
    #$DestinationServerShareNames = Get-Content ‘.\OldServerName-DestinationSharesList-test.txt’

    #Ignore this section
    #**************************************************************************************

    $SourceServerPath =            Get-Content ‘.\OldServerName-Share-paths.txt’
    $SourceServerShares =          Get-Content ‘.\OldServerName-SourceSharesList.txt’
    $DestinationServerShareNames = Get-Content ‘.\OldServerName-DestinationSharesList.txt’

    $LogDestinationFolder = “.\Logs”
    $LogfileName = $SourceServerNetBIOSName+”.txt”
    $LogFileAndPath = $LogDestinationFolder+”\”+$LogfileName

    # Checks for existence of a directory for log files if not, one gets created.
    If (!(Test-Path -Path $LogDestinationFolder)){
        New-Item -ItemType directory -Path $LogDestinationFolder
    }

    write-host “Total Share count = ” $SourceServerShares.count

    for ($i = 0; $i -lt $SourceServerShares.count; $i++){

        $srcpath = $SourceServerPath[$i] -replace ‘(.*):’,’$1$’
        #$srcpath = $SourceServerPath -replace ‘(.*):’,’$1$’
        $dstpath = $DestinationServerShareNames[$i]

        $FullSourcePath = “\\”+$SourceServerIP+”\”+$srcpath
        $FullDestPath = “\\”+$DestinationServerName+”\”+$dstpath

        write-host “”
       
        if ((Test-Path $FullSourcePath) -and (Test-Path $FullDestPath))
        {
            $log = $LogDestinationFolder + “\” + $SourceServerNetBIOSName + “-” + $SourceServerShares[$i] +”.txt”
            write-host “Current share’s log:” $Log
           
            robocopy $FullSourcePath $FullDestPath /E /R:1 /W:1 /TEE /log:$log | Out-String

        #This is trying different switches – Ignore
            #robocopy $FullSourcePath $FullDestPath /MIR /copy:DT /W:5 /R:1 /V /IT /FP /NFL /TS  /log:$log | Out-String

        #This was a local drive to drive attempt – Ignore
        #robocopy e:\users y: /copy:DATSO /E /R:1 /W5 /TEE /log:c:\robocopy.log

        write-host “Source path is: ” $srcpath
            write-host “Full Source Path is: ” $FullSourcePath
        write-host “Destination path is:” $dstpath
            write-host “Full Destination path is: ” $FullDestPath

            $SharesProcessedSoFar = $i + 1
            write-host “Shares processed so far =” $SharesProcessedSoFar ” out of a total share count of ” $SourceServerShares.count
            write-host “”
            Write-Host “”
        }

        else

        {
            write-host “Problem with: ”           $srcpath         “Destination sharename is:”     $dstpath
            write-host “Referencing full Source Path:” $FullSourcePath  “Destination Path:”         $FullDestPath
            $SharesProcessedSoFar = $i + 1
            write-host “Shares processed so far =” $SharesProcessedSoFar ” out of a total share count of ” $SourceServerShares.count
        }
    }
    write-host “Total Shares processed = ” $SourceServerShares.count

    More to come…

    Comments are welcomed.

    ==================================================================

    Summary

    I hope this helps!

    Published 10/3/2015

    Ace Fekay
    MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
    Microsoft Certified Trainer
    Microsoft MVP – Directory Services

    clip_image002622[2][2] clip_image004622[2][2] clip_image006622[2][2] clip_image008622[2][2] clip_image010622[2][2] clip_image012622[2][2]

    Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php

    This posting is provided AS-IS with no warranties or guarantees and confers no rights.

    Office 365 PowerShell Fun with Calendars

    Published 9/13/2015

    Prologue

    Ace Fekay here again.

    You might say to yourself this is some really simple stuff. Sure, it might be, for the pro. As many of you know, I’m an avid Active Directory and Exchange server engineer/architect, and an MVP in Active Directory.

    Therefore with AD, Exchange, and Office 365, you will find that scripting comes into play more and more with your daily tasks.  The main reason I’m posting simple scripts is that to get the job done, I just needed an arsenal of simple quickie scripts when called upon a simple task, such as this one, dealing with mailbox permissions.

    I hope this blog and my future scripts blogs, especially with Office 365, help you out.

    Scope

    These are a few examples of dealing with every day requests for calendar administration. Sure, you can do it from your web based, Office 365 tenant dashboard, but what fun is that?

    And yes, this is simple stuff. The main reason I’m posting this, and I will be posting much more, including Office 365 scripts, is that I had to look it up. I’ve found various websites that provide how-tos, but when it comes to handling variables and piping, I’ve found there is no one place to get various examples and have found myself looking at multiple places to get this info, including my colleagues, who are extremely adept at scripting. With many place, I also see elaborate scripts that do more than what I need. They are fabulous blogs and websites, but sometimes I need the simple one-liners to perform day to day stuff.

    Open PowerShell session and Login – Of course you first have to open a PowerShell session to your tenant account

    Open a PowerShell window.
    Run the following:
    $MySession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell/ -Credential $AceCred -Authentication Basic -AllowRedirection

    This will prompt you to login using your credentials.
    Then run:
    import-pssession $MySession

    To be able to run Start-OnlineCoexistenceSync Dirsync – on a DC

    After you make any changes in your local AD, instead of waiting for the dirsync schedule to run, you can manually run a dirsync on your onprem AD to force a sync:

    Command Prompt
    cd “C:\Program Files\Microsoft Online Directory Sync”
    Run:
    .\DirSyncConfigShell.psc1

    Or just run:
    “C:\Program Files\Microsoft Online Directory Sync\DirSyncConfigShell.psc1”
    Then run:
    Start-OnlineCoexistenceSync  or invoke-dirsync

    To view the dirsync log, click on the DirSync icon in task bar that opens the Synchronization Service Manager. If it’s not on the task bar, it can be found in:

    “C:\Program Files\Microsoft Online Directory Sync\SYNCBUS\Synchronization Service\UIShell\miisclient.exe”

    ===========================================================

    General Calendar Commands

    To view the rights on a calendar:

    get-mailboxfolderpermission MarySmith@contoso.com:\Calendar

    To add rights to a calendar for a user, JohnDoe, and providing him “Editor” access rights:

    Add-MailboxFolderPermission -Identity Office.Vacation.Calendar@contoso.com:\Calendar -User JohnDoe@contoso.com -AccessRights Editor

    To remove JohnDoe’s rights from a calendar:

    remove-mailboxfolderpermission -Identity Office.Vacation.Calendar@contoso.com:\Calendar -User JohnDoe@contoso.com

    Rule to move anything with subject, “Sent by Microsoft Exchange Server 2013” to a folder called, “Rejected Calendar Notifications”

    New-InboxRule “Sent by Exchange 2013” -Mailbox MarySmith@contoso.com -MyNameInToBox $true -FlaggedForAction Any -SubjectOrBodyContainsWords “Sent by Microsoft Exchange Server 2013” -MoveToFolder “Rejected Calendar Notifications” -StopProcessingRules

    New-InboxRule “SendOnBehalf Sent by Exchange 2013” -Mailbox JohnDoe -MyNameInToBox $true -FlaggedForAction Any -SubjectOrBodyContainsWords “Sent by Microsoft Exchange Server 2013” -MoveToFolder “Rejected Calendar Notifications” –StopProcessingRules

    Create a shared calendar in Office 365 without creating it in our Active Directory so we don’t get charged for a license.

    This is an example for creating a shared calendar called “Ace’s Cancelled Meetings” with a username of AceCancelledMeetings.

    1. New-Mailbox -Name “AceCancelledMeetings” -DisplayName “Ace’s Cancelled Meetings” -Share

    If required:
    2.  UserPrincipalName: AceCancelledMeetings@YourDomain.onmicrosoft.com

    Give permissions for Mary Smith (MarySmith) to access the calendar.
    3.  Add-MailboxfolderPermission AceCancelledMeetings:\Calendar -user “MarySmith” -AccessRights editor  

    Give permissions for John Doe (JohnDoe) to access the calendar.
    4.  Add-MailboxfolderPermission AceCancelledMeetings:\Calendar -user “JohnDoe” -AccessRights editor  

    Give permissions for John Smith (JohnSmith) to access the calendar:
    5. Add-MailboxfolderPermission AceCancelledMeetings:\Calendar -user “JohnSmith” -AccessRights editor

    Get permissions Examples for a calendar:

    PS C:\Windows> (Get-MailboxFolderPermission JohnDoe:\Calendar) | select user

    Output:

    User
    —-
    Default
    User One
    User Two
    User Three
    User Four
    User Five
    User Six
    User Seven
    User Eight

    To display the accessrights for a calendar:

    PS C:\> (Get-MailboxFolderPermission JohnDoe:\Calendar) | select user,accessrights

    User                AccessRights
    —-                ————
    Default                {AvailabilityOnly}
    User One            {Reviewer}
    User Two            {Reviewer}
    User Three            {Reviewer}
    User Four            {Reviewer}
    User Five            {Reviewer}
    User Six            {Editor}
    User Seven            {Editor}
    User Eight            {Editor}
    User Nine            {Owner}

    PS C:\> get-MailboxFolderPermission -Identity ConfRoom1:\Calendar

    FolderName           User        AccessRights
    ———-           —-        ————
    Calendar             Default        {AvailabilityOnly}
    Calendar             Anonymous        {None}
    Calendar             Ace Fekay        {Editor}
    Calendar             User One        {PublishingEditor}
    Calendar             User Two        {PublishingEditor}
    Calendar             User Three        {PublishingEditor}
    Calendar             User Four        {PublishingEditor}
    Calendar             User Five        {Editor}

    Office 365 Alias issues

    If the user’s alias, such as “JohnDoe,” doesn’t work, run the following to find and use the identifier Microsoft assigned to the user:
    get-mailbox JohnDoe@contoso.com
        For example, the above query returned:   
            JohnDoe_8672d315f2
        Therefore, I had to run the following command to add permissions for that user:
        Add-MailboxFolderPermission -Identity ConfRoom22:\Calendar -User “JohnDoe_8672d315f2” -AccessRights Reviewer

    Command to Add permissions to one Calendar for multiple users (list of users) importing a list of users in a text file and piping the command:

    Get-Content c:\Scripts\users.txt | foreach {Add-MailboxFolderPermission -Identity Classroom2:\calendar -User $_ -AccessRights Editor}

    Content of “users.txt:”
    UserOne@contoso.com
    UserTwo@contoso.com
    UserThree@contoso.com
    UserFour@contoso.com
    UserFive@contoso.com
    UserSix@contoso.com
    UserSeven@contoso.com
    UserEight@contoso.com

    If you need to change the permissions on the calendar for a set of user, use the same format except use the ‘set-calendar’ command:

    Get-Content c:\Scripts\users.txt | foreach {Set-MailboxFolderPermission -Identity Classroom2:\calendar -User $_ -AccessRights Editor}

    If you need to give a single user permissions to multiple calendars:

    This is giving MikeSmith@contoso.com access to multiple calendars

    Get-Content C:\Scripts\ListOfCalendars.txt | foreach {Add-MailboxFolderPermission -Identity $_ -User MikeSmith@contoso.com -AccessRights Editor}

    Content of “ListOfCalendars.txt:”

    HospitalFloor1West@contoso.com:\Calendar
    HospitalFloor1East@contoso..com:\Calendar
    HospitalFloor1South@contoso..com:\Calendar
    HospitalFloor1North@contoso..com:\Calendar
    HospitalFloor2West@contoso..com:\Calendar
    HospitalFloor2East@contoso..com:\Calendar
    HospitalFloor2South@contoso..com:\Calendar
    HospitalFloor2North@contoso..com:\Calendar

    To provide permissions to multiple calendars for a list of users.

    There are two variables in this scenario.

    First you must bring in the list of users into memory. In this case, the users are in filename, “ListOfUsers.txt.” Now run the following to bring the users

    Pull the list into memory:
    PS C:\> $users= get-content C:\Scripts\ListOfUsers.txt

    If you like, you can double check and see what’s in the file you just pulled in by simply typing in the variable name and hit enter:

    PS C:\> $users
    UserOne@contoso.com
    UserTwo@contoso.com
    UserThree@contoso.com
    UserFour@contoso.com
    UserFive@contoso.com
    UserSix@contoso.com
    UserSeven@contoso.com
    UserEight@contoso.com
    etc

    You can also run the following format to get the same info on the file:

    PS C:\> $users | get-member
    UserOne@contoso.com
    UserTwo@contoso.com
    UserThree@contoso.com
    UserFour@contoso.com
    UserFive@contoso.com
    UserSix@contoso.com
    UserSeven@contoso.com
    UserEight@contoso.com
    etc
     
    Then you bring the list of rooms into memory, “ListOfRooms.txt”
    PS C:\> $resources = get-content c:\Scripts\ListOfRooms.txt

    Then to see what’s in the file, run:
    PS C:\> $resources

    ConfRoom1
    ConfRoom2
    ConfRoom3
    ConfRoom4
    ConfRoom5
    ConfRoom6
    ConfRoom7
    ConfRoom8
    etc

    Now let’s take a look at what the calendar processsing is for one of the rooms:
        PS C:\>  Get-CalendarProcessing ConfRoom1

    Identity                                                     AutomateProcessing
    ——–                                                     ——————
    ConfRoom1                                                    AutoUpdate

    To get more information about the calendar processing data for the room:
        PS C:\> Get-CalendarProcessing ConfRoom1 | fl

    RunspaceId                          : <snipped>
    AutomateProcessing                  : AutoUpdate
    AllowConflicts                      : False
    BookingWindowInDays                 : 180
    MaximumDurationInMinutes            : 1440
    AllowRecurringMeetings              : True
    EnforceSchedulingHorizon            : True
    ScheduleOnlyDuringWorkHours         : False
    ConflictPercentageAllowed           : 0
    MaximumConflictInstances            : 0
    ForwardRequestsToDelegates          : True
    DeleteAttachments                   : True
    DeleteComments                      : True
    RemovePrivateProperty               : True
    DeleteSubject                       : True
    AddOrganizerToSubject               : True
    DeleteNonCalendarItems              : True
    TentativePendingApproval            : True
    EnableResponseDetails               : True
    OrganizerInfo                       : True
    ResourceDelegates                   : {}
    RequestOutOfPolicy                  : {}
    AllRequestOutOfPolicy               : False
    BookInPolicy                        : {}
    AllBookInPolicy                     : True
    RequestInPolicy                     : {}
    AllRequestInPolicy                  : False
    AddAdditionalResponse               : False
    AdditionalResponse                  :
    RemoveOldMeetingMessages            : True
    AddNewRequestsTentatively           : True
    ProcessExternalMeetingMessages      : False
    RemoveForwardedMeetingNotifications : False
    MailboxOwnerId                      : ConfRoom1
    Identity                            : ConfRoom1
    IsValid                             : True
    ObjectState                         : Changed

    And now the moment you’ve been waiting for: Run the following command to set Calenar Processing settings for multiple users for multiple calendars:

    PS C:\> $resources | foreach {Set-CalendarProcessing $_ -AutomateProcessing autoaccept -bookinpolicy $users}

    Another example providing Editor rights to a list of calendars

    This is for the IT-Rooms where we must give a list of users “Editor” permissions to a list mailbox Calendars.

    List of users are in file:    c:\Scripts\ListOfUsers.txt
    List of mailbox room calendars    c:\ListOfRooms.txt

    =====
    1. Pull the list of users into memory first:
    $users= get-content c:\Scripts\ListOfUsers.txt

    Run $users to see what’s in the file to be sure:
    $users
    or
    $users | get-member

    =====
    2. Pull in the rooms or calendars into memory:
    $resources = get-content c:\ListOfRooms.txt

    If you want, run this to see what’s in that file:
    $resources
    or
    $resources | get-member

    If you want, run this to see what calendar processing is currently set on one of the rooms:
    get-CalendarProcessing ConfRoom1 | fl

    =====
    3. Run it:

    $resources | foreach {Add-MailboxFolderPermission -Identity $_:\calendar -User $Users -AccessRights Editor}

    =====
    Or just create a DL, and add the list of users to the DL, then run the following:

    This gives the group ConfRoomSchedulers@contoso.com “Editor” access rights on the rooms listed in the file ListOfRooms.txt:

    Get-Content ListOfRooms.txt | foreach {Add-MailboxFolderPermission -Identity $_ -User ConfRoomSchedulers@contoso.com -AccessRights Editor}

    ListOfRooms.txt contains:
    ConfRoom1@contoso.com:\calendar
    ConfRoom2@contoso.com:\calendar
    ConfRoom3@contoso.com:\calendar
    ConfRoom4@contoso.com:\calendar
    ConfRoom5@contoso.com:\calendar

    Change the “Default” user on a list of calendars (rroms) or users to “None.”

    Get-Content c:\Scripts\ListOfRooms.txt | foreach {Set-MailboxFolderPermission -Identity $_:\Calendar -User Default -AccessRights None}

    Removing Permissions for a folder (calendar in this example)

    Remove-MailboxFolderPermission -Identity <mailbox>:\Calendar –User <Mailbox-that-will-be-removed-from-Calendar-Permissions>
    remove-MailboxfolderPermission ConferenceRoom1 -user “John Doe” -AccessRights editor
    remove-MailboxfolderPermission ConferenceRoom1:\Calendar -user “JohnDoe”

    Then confirm with:
    get-MailboxFolderPermission -Identity ConferenceRoom1:\Calendar

    Create a conference room. Do not allow anyone to book the room other than the people that have access rights to the room:

    Set-Calendarprocessing VeryImportantConfRoom7thFloor@contoso.com -AddAdditionalResponse $true -AdditionalResponse “<p><strong><font color=red

    size=4>Scheduling request denied.</strong><font></p><p><font color=blue size=4>Reason code: You are not authorized to schedule meetings or

    appointments in the Very Important Conference Room 7th Floor. If you must book an entry in the room, please submit a request to either Mary Smith,

    John Doe, or Robert Redford. Thank you.</p><p>Your Company’s IT Department.</font></p>”

    More to come…

    Comments are welcomed.

    ==================================================================

    Summary

    I hope this helps!

    Published 9/13/2015

    Ace Fekay
    MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
    Microsoft Certified Trainer
    Microsoft MVP – Directory Services

    clip_image002622[2] clip_image004622[2] clip_image006622[2] clip_image008622[2] clip_image010622[2] clip_image012622[2]

    Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php

    This posting is provided AS-IS with no warranties or guarantees and confers no rights.

    Office 365 PowerShell Fun with Mailbox Permissions

    Published 9/11/2015

    Prologue

    Ace Fekay here again.

    You might say to yourself this is some really simple stuff. Sure, it might be, for the pro. As many of you know, I’m an avid Active Directory and Exchange server engineer/architect, and an MVP in Active Directory.

    Therefore with AD, Exchange, and Office 365, you will find that scripting comes into play more and more with your daily tasks.  The main reason I’m posting simple scripts is that to get the job done, I just needed an arsenal of simple quickie scripts when called upon a simple task, such as this one, dealing with mailbox permissions.

    I hope this blog and my future scripts blogs, especially with Office 365, help you out.

    Scope

    These are a few examples of dealing with every day requests for mailbox delegation and permissions administration. Sure, you can do it from your web based, Office 365 tenant dashboard, but what fun is that?

    And yes, this is simple stuff. The main reason I’m posting this, and I will be posting much more, including Office 365 scripts, is that I had to look it up and there is no one place to get all of this at the simple level. All I see are elaborate scripts that do more than what I needed. Hence, my posts.

    Open PowerShell session and Login – Of course you first have to open a PowerShell session to your tenant account

    Open a PowerShell window.
    Run the following:
    $MySession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell/ -Credential $AceCred -Authentication Basic -AllowRedirection

    This will prompt you to login using your credentials.

    Then run:
    import-pssession $MySession

    To be able to run Start-OnlineCoexistenceSync Dirsync – on a DC

    After you make any changes in your local AD, instead of waiting for the dirsync schedule to run, you can manually run a dirsync on your onprem AD to force a sync:

    Command Prompt
    cd “C:\Program Files\Microsoft Online Directory Sync”
    Run:
    .\DirSyncConfigShell.psc1

    Or just run:
    “C:\Program Files\Microsoft Online Directory Sync\DirSyncConfigShell.psc1”
    Then run:
    Start-OnlineCoexistenceSync  or invoke-dirsync

    To view the dirsync log, click on the DirSync icon in task bar that opens the Synchronization Service Manager. If it’s not on the task bar, it can be found in:

    “C:\Program Files\Microsoft Online Directory Sync\SYNCBUS\Synchronization Service\UIShell\miisclient.exe”

    ===========================================================

    To find who has been delegated to a mailbox

    Get-Mailbox JohnDoe@contoso.com | fl displayname, GrantSendOnBehalfTo

    To see the whole list of delegated users:

    PS C:\Windows> Get-Mailbox JohnDoe@contosl.com | select -expandproperty GrantSendOnBehalfTo
    Output:
    user1
    user2
    user3
    user4
    user5
    user6

    Or you can run this, too:

    PS C:\Windows> (Get-Mailbox JohnDoe@contoso.com|).grantsendonbehalfto
    Output:
    user1
    user2
    user3
    user4
    user5
    user6

     

    Remove Mike Smith as a delegate – example:

    First find the permission:

    This will give you a summary list:
    get-mailboxpermission –identity Dept1-Shared-Mailbox | ft

    This will give you a full list:
    Get-MailboxPermission -identity Dept1-Shared-Mailbox | fl

    Then remove it:

    Remove-mailboxpermission -identity Dept1-Shared-Mailbox -user NAMPRD999\Mike.Smith8047888747747123 -AccessRights FullAccess -Inheritance All

    Remove-mailboxpermission -identity Dept1-Shared-Mailbox -user NAMPRD999\Mike.Smith8047888747747123 -AccessRights SendAs -Inheritance All

    To find who has FullAccess Permissions on a Mailbox

    There are two ways the results can be displayed:

    • FT – Format Table – One big summarized list
    • FL – Format List – in sections with detail

    using FT

    get-mailboxpermission JohnDoe@contoso.com | ft

    Output example:

    Identity                   User                 AccessRights        IsInherited Deny
    ——–                    —-                      ————        ———– —-
    JohnDoe               NT AUTHORITY\SELF    {FullAccess, Rea… False       False
    JohnDoe               S-1-5-21-24478488… {FullAccess}        False       False
    JohnDoe               NAMPRD05\jar02546… {FullAccess}        False       False
    JohnDoe               NAMPRD05\FullAcce… {FullAccess}        False       False
    JohnDoe               NAMPRD05\Administ… {FullAccess}        True        True
    JohnDoe               NAMPRD05\Domain A… {FullAccess}        True        True
    JohnDoe               NAMPRD05\Enterpri… {FullAccess}        True        True
    JohnDoe               NAMPRD05\Organiza… {FullAccess}        True        True
    JohnDoe               NT AUTHORITY\SYSTEM  {FullAccess}        True        False
    JohnDoe               NT AUTHORITY\NETW… {ReadPermission}    True        False
    JohnDoe               PRDMGT01\View-Onl… {ReadPermission}    True        False
    JohnDoe               NAMPRD05\Administ… {FullAccess, Del… True        False
    JohnDoe               NAMPRD05\Domain A… {FullAccess, Del… True        False
    JohnDoe               NAMPRD05\Enterpri… {FullAccess, Del… True        False
    JohnDoe               NAMPRD05\Organiza… {FullAccess, Del… True        False
    JohnDoe               NAMPRD05\Public F… {ReadPermission}    True        False
    JohnDoe               NAMPRD05\Exchange… {FullAccess, Rea… True        False
    JohnDoe               NAMPRD05\Exchange… {FullAccess, Del… True        False
    JohnDoe               NAMPRD05\Managed … {ReadPermission}    True        False

    using FL

    get-mailboxpermission JohnDoe@contoso.com | fl

    Output Example:

    RunspaceId      : aaa56ea5-574b-45dc-8489-d85a2013bc58
    AccessRights    : {FullAccess, ReadPermission}
    Deny            : False
    InheritanceType : All
    User            : NT AUTHORITY\SELF
    Identity        : JohnDoe
    IsInherited     : False
    IsValid         : True
    ObjectState     : Unchanged

    RunspaceId      : aaa56ea5-574b-45dc-8489-d85a2013bc58
    AccessRights    : {FullAccess}
    Deny            : False
    InheritanceType : All
    User            : S-1-5-21-2447848828-1310731447-1641304557-6207581
    Identity        : JohnDoe
    IsInherited     : False
    IsValid         : True
    ObjectState     : Unchanged

    RunspaceId      : aaa56ea5-574b-45dc-8489-d85a2013bc58
    AccessRights    : {FullAccess}
    Deny            : False
    InheritanceType : All
    User            : NAMPRD05\jar02546711232540629
    Identity        : JohnDoe
    IsInherited     : False
    IsValid         : True
    ObjectState     : Unchanged

    RunspaceId      : aaa56ea5-574b-45dc-8489-d85a2013bc58
    AccessRights    : {FullAccess}
    Deny            : False
    InheritanceType : All
    User            : NAMPRD05\FullAccessAdmin
    Identity        : JohnDoe
    IsInherited     : False
    IsValid         : True
    ObjectState     : Unchanged

    RunspaceId      : aaa56ea5-574b-45dc-8489-d85a2013bc58
    AccessRights    : {FullAccess}
    Deny            : True
    InheritanceType : All
    User            : NAMPRD05\Administrator
    Identity        : JohnDoe
    IsInherited     : True
    IsValid         : True
    ObjectState     : Unchanged

    etc

    Other tidbits:

    ===========================

    To display FullAccess on a Mailbox

    Get-MailboxPermission JohnDoe | Where { ($_.IsInherited -eq $False) -and -not ($_.User -like “NT AUTHORITY\SELF”) } | Select Identity,user,AccessRights | fl

    ===========================

    This will display SendOnBehalf:

    Get-RecipientPermission JohnDoe | Where { ($_.IsInherited -eq $False) -and -not ($_.Trustee -like “NT AUTHORITY\SELF”) } | Select Trustee,AccessControlType,AccessRights | fl

     

    ===========================

    View SendAs:

    Get-RecipientPermission JohnDoe | where {($_.Trustee -ne ‘nt authority\self’) -and ($_.Trustee -ne ‘Null sid’)} | select Identity,Trustee,AccessRights | fl

    ==========================

    View all “Send As permissions” you’ve configured in your organization

    Careful running this on a really large tenant or you will tie up the bandwidth and get throttled.

    Get-RecipientPermission | where {($_.Trustee -ne ‘nt authority\self’) -and ($_.Trustee -ne ‘Null sid’)} | select Identity,Trustee,AccessRights

    ============================

    Display a list of recipient’s that have FULL ACCESS permission on other recipient’s

    Get-RecipientPermission JohnDoe | Where { ($_.IsInherited -eq $False) -and -not ($_.Trustee -like “NT AUTHORITY\SELF”) } | Select Trustee,AccessControlType,AccessRights | fl

    ============================

    Display a list of recipient’s that have FULL ACCESS permission on other recipient’s

    $a = Get-Mailbox $a |Get-MailboxPermission | Where { ($_.IsInherited -eq $False) -and -not ($_.User -like “NT AUTHORITY\SELF”) -and -not ($_.User -like ‘*Discovery Management*’) } | Select Identity, user, AccessRights | fl

    =============================

    Revoke “Send As” Permissions

    Remove-RecipientPermission <Identity>  -AccessRights SendAs -Trustee <Identity>
    Remove-RecipientPermission John   -AccessRights SendAs -Trustee Suzan

    Adjustments & Improvements – To avoid the need for confirmation, we can add the option: “-Confirm:$False”
    Remove-RecipientPermission John -AccessRights SendAs -Trustee Suzan -Confirm:$False

     

    More to come…

     

     

    Comments are welcomed.

    ==================================================================

    Summary

    I hope this helps!

    Published 8/17/2015

    Ace Fekay
    MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
    Microsoft Certified Trainer
    Microsoft MVP – Directory Services

    clip_image002622 clip_image004622 clip_image006622 clip_image008622 clip_image010622 clip_image012622 clip_image014622

    Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php

    This posting is provided AS-IS with no warranties or guarantees and confers no rights.

    Script to Search Netlogon logon scripts and Replace Drive Mappings

    Prologue

    Ace Fekay here again!

    Once again, As many of you know, I’m an avid Active Directory and Exchange server engineer/architect, and an MVP in Active Directory. And why am I posting simple stuff, you ask. Well, because we need to use this stuff day to day, that’s why.

    Yea, this may be simple, but you’d be surprised who may struggle with it, like I did. I had to get help from a colleague who put the bulk of this together. I first had an idea with my beginner’s mentality to do it a little differently, but when I saw what he suggested, I said, hmm, I still have lots to learn.

    I hope this, and my future scripts, especially with Office 365, help you out.

    Scope

    After migrating shares from one server to another server using a Robocopy script (that I’ll post later), we needed to change the drive mappings in the logon scripts in the Netlogon share.

    Keep in mind, we already have a robust DFS in place. The new sharename has targets to the old server. However, we needed to change any logon scripts still referencing the old server by either NetBIOS or by FQDN (OldServer.domain.com).Well, with 28,000 scripts, that’s something we’re not going to do manually.

    This script replaces any mappings using the old server name, “OldServer” such as either \\olderserver\sharename or \\oldserver.contoso.com\sharename, to the new DFS name, \\contoso.com\NewShareName.

    Code

    This works fine. Watch the word-wrap in the blog.

    # First run the robocopy script to copy all data
    # Then run the netlogon report script to see how many bat files in netlogon reference OldServer
    # Then run this script to replace any reference to “OldServer” to the new DFS sharename in the batch files for each share.
    # By Ace Fekay and a colleague, who put together the bulk of this together.
    # I added counters and report to the screen.
     
    # If you need to run it as a different users, un-remark the following
    # get-credential

    $Path = “\\contoso.com\NETLOGON\”
    $FilesAltered = 0
    $FilesProcessed = 0
     
    # This code snippet gets all the files in $Path that end in “.bat”.
    cd $Path

    Get-ChildItem -Filter “*.bat” | foreach{
    $file = Get-Content $_
     
        #only modify files that contain the string “OldServer”
        if (Select-String -InputObject $file “OldServer”){
     
        $file = Get-Content $_
        $file = $file -replace “\\\\OldServer\\Users”,”\\contoso.com\\OldServer-Users”
        $file = $file -replace “\\\\OldServer.contoso.com\\users”,”\\contoso.com\OldServer-User”
        $file = $file -replace “\\\\OldServer\\Department”,”\\contoso.com\\OldServer-Department”
        $file = $file -replace “\\\\OldServer.contoso.com\\Department”,”\\contoso.com\OldServer-Departmentt”
        $file = $file -replace “\\\\OldServer\\GDrive”,”\\contoso.com\OldServer-GDrive”
        $file = $file -replace “\\\\OldServer\\FDrive”,”\\contoso.com\OldServer-FDrive”
        $file = $file -replace “\\\\OldServer\\HDrive”,”\\contoso.com\OldServer-HDrive”
        $file = $file -replace “\\\\OldServer\\Share2\$”,”\\contoso.com\OldServer-Share2$”
        
    #comment out any net time statements, if they exist
        $file = $file -replace “^net time”,”REM net time”
        
    #write out the changes
        Set-Content -Value $file -Path $_;
        Write-Host $_.Name
        write-host $file
        Write-Host “”
        $FilesAltered++
       }
    $FilesProcessed++
    }
    Write-Host $FilesAltered ” altered out of a total of” $FilesProcessed “files processed.” 
     

    Comments are welcomed.

    ==================================================================

    Summary

    I hope this helps!

    Published 9/9/2015

    Ace Fekay
    MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
    Microsoft Certified Trainer
    Microsoft MVP – Directory Services

    clip_image002622 clip_image004622 clip_image006622 clip_image008622 clip_image010622 clip_image012622 clip_image014622

    Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php

    This posting is provided AS-IS with no warranties or guarantees and confers no rights.

    Get-QADGroupMember to CSV

    Prologue

    Ace Fekay here again.

    You might say to yourself this is some really simple stuff. Sure, it might be, for the pro. As many of you know, I’m an avid Active Directory and Exchange server engineer/architect, and an MVP in Active Directory.

    Therefore with AD, Exchange, and Office 365, you will find that scripting comes into play more and more with your daily tasks.  The main reason I’m posting simple scripts is that to get the job done, I just needed an arsenal of simple quickie scripts when called upon a simple task, such as this one, when tasked to quickly get a list of users in a group.

    I hope this, and my future scripts, especially with Office 365, help you out.

    Scope

    I needed to get a user membership list from a global group called, “Marketing Dept,” into a CSV. Group scope doesn’t matter. I just need a list of the members because the share owner that the group is controlling access, needed a list to ensure that it’s current and to clean up any disabled accounts from users that have left the company.

    And yes, this is simple stuff. The main reason I’m posting this, and I will be posting much more, including Office 365 scripts, is that I had to look it up and there is no one place to get all of this at the simple level. All I see are elaborate scripts that do more than what I needed. Hence, my posts.

     

    I usually kick it off with a get-credential because I run this from my workstation logged on with my non-admin account. And because I work in a multi-forest, multi domain environment, I must connect to the specific domain where the group exists.

    Of course, we must add the PS Quest snap-in. In addition, I use the “-NoTypeInformation” switch to suppress the silly “Type” data that shows up in the output.

    Code

    get-credential
    add-pssnapin Quest*
    connect-qadservice domain2
    Get-QADGroupMember “Marketing Dept” | Select-Object DisplayName,Name,AccountIsDisabled | Export-Csv c:\output\Domain2-MarketinDept.csv –NoTypeInformation

    Comments are welcomed.

    ==================================================================

    Summary

    I hope this helps!

    Published 8/17/2015

    Ace Fekay
    MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
    Microsoft Certified Trainer
    Microsoft MVP – Directory Services

    clip_image00262 clip_image00462 clip_image00662 clip_image00862 clip_image01062 clip_image01262 clip_image01462

    Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php

    This posting is provided AS-IS with no warranties or guarantees and confers no rights.

    PowerShell: Getting AD groups of one User and Add them to a List of Other Users

    Prologue

    Ace here again. Yep, me again. I’ve been on the sidelines lately with a big mail migration, then changed roles to the AD and Windows management side of things.

    Part of what I do is perform necessary file maintenance (FSRM, DFS, fileserver migration, etc.), and of course, respond to tickets for requests or issues.

    One request that came in was for 16 new users that are to have identical group memberships as a current user. I looked at the group membership of the user in question and saw he was part of 11 or 12 groups. Hmm, and he wants this done for 16 users? I could sit there and add group to each user one at a time. Nah, too much work.

    So I thought to try to do it programmatically, because who knows when this will come up again.

    Script

    It’s pretty straight forward.

    #===========================================================================================
    # This was created for a ticket request to mimic one user, SomeSamAccountUsername, group membership to add to a list of user accounts.
    # By Ace Fekay 7/15/2015
    #
    # First, get a memberOf for SomeSamAccountUsername and save it to a file called c:\PSScripts\SomeSamAccountUsername-grouplist.txt
    #     Run Get-QADMemberOf SomeSamAccountUsername
    #
    #     Copy and paste the output from the screen to the file
    #     In the file, keep the DN values and delete everything else.
    #
    # Second, get a list of the user accounts that you want adjusted from the ticket owner
    #     Then save the list in another text file called c:\PSscripts\Usernames.txt
    #     Prefix the user accounts with the domain name, such as philly\username
    #
    # Third, read the first user in the list, then add the groups to that user, then read the next user in the list, repeat.
    #===========================================================================================

    # The next line adds all of the Quest tools.

    Add-PSSnapIn Quest *
    Get-QADMemberOf SomeSamAccountUsername

    #===========================================================================================
    # Sample output from Get-QADMemberOf SomeSamAccountUsername:
    #===========================================================================================
    #
    #Name                           Type            DN                                                                                                            
    ##
    #Domain Users                   group           CN=Domain Users,OU=IT,DC=philly,DC=contoso,DC=com                                                       
    #Deployment Technician          group           CN=Deployment Technician,OU=IT,DC=philly,DC=contoso,DC=com                                         
    #Desktop-Technician             group           CN=Desktop-Technician,OU=IT,DC=philly,DC=contoso,DC=com                                                     
    #AddComputerToDomain            group           CN=AddComputerToDomain,OU=IT,DC=philly,DC=contoso,DC=com                                               
    #Vendor-A-contractors           group           CN=Vendor-A-contractors,OU=IT,DC=philly,DC=contoso,DC=com                                               
    #General-Group                  group           CN=General-Group,OU=IT,DC=philly,DC=contoso,DC=com                                                            
    #Wireless-Users                 group           CN=Wireless-Users,OU=IT,DC=philly,DC=contoso,DC=com                                                
    #Group-B                        group           CN=Group-B,OU=IT,DC=philly,DC=contoso,DC=com                                                                
    #IT-Staff                       group           CN=IT-Staff,OU=IT,DC=philly,DC=contoso,DC=com                                                      
    #IT-Admins                      group           CN=IT-Admins,OU=IT,DC=philly,DC=contoso,DC=com                                                     
    #IT-Technicians                 group           CN=IT-Technicianss,OU=IT,DC=philly,DC=contoso,DC=com                                                   
    #Client-Support                 group           CN=Client-Support,OU=IT,DC=philly,DC=contoso,DC=com   

    # #=================================================================================================
    # Sample of what C:\PSScripts\groupmembership\SomeSamAccountUsername-grouplist.txt  will look like:
    # #=================================================================================================
    # CN=Domain Users,OU=IT,DC=philly,DC=contoso,DC=com                                                       
    # CN=Deployment Technician,OU=IT,DC=philly,DC=contoso,DC=com                                         
    # CN=Desktop-Technician,OU=IT,DC=philly,DC=contoso,DC=com                                                     
    # CN=AddComputerToDomain,OU=IT,DC=philly,DC=contoso,DC=com                                               
    # CN=Vendor-A-contractors,OU=IT,DC=philly,DC=contoso,DC=com                                               
    # CN=General-Group,OU=IT,DC=philly,DC=contoso,DC=com                                                            
    # CN=Wireless-Users,OU=IT,DC=philly,DC=contoso,DC=com                                                
    # CN=Group-B,OU=IT,DC=philly,DC=contoso,DC=com                                                                
    # CN=IT-Staff,OU=IT,DC=philly,DC=contoso,DC=com                                                      
    # CN=IT-Admins,OU=IT,DC=philly,DC=contoso,DC=com                                                     
    # CN=IT-Technicians,OU=IT,DC=philly,DC=contoso,DC=com                                                   
    # CN=Client-Support,OU=IT,DC=philly,DC=contoso,DC=com  
    #=================================================================================================

    #===========================================================================================
    # Sample of what C:\PSScripts\groupmembership\List-Of-Usernames.txt username list will look like:
    #==========================================================================================
    # philly\username1
    # philly\username2
    # philly\username3
    # philly\username4
    # philly\username5
    # philly\username6
    # philly\username7
    # philly\username8
    # philly\username9
    # philly\username10
    # philly\username11
    # philly\username12
    # philly\username13
    # philly\username14
    # philly\username15
    # philly\username16
    #==========================================================================================

    $GroupList = get-content C:\PSScripts\groupmembership\SomeSamAccountUsername-grouplist.txt 
    $UsernameList = get-content C:\PSScripts\groupmembership\List-Of-Usernames.txt

    # Now pull in each user one a time:
    Foreach ($Username in $UsernameList)
    {
     
    # Now pull in each group one at a time and add them to the user
       Foreach ($Group in $GroupList)
      
    # Add the group to the user 
        {
        Add-QADGroupMember  -Identity $Group -Member $Username
       
    # Write out on the screen what username is and what group they were added to:
        write-host $Username “has been added to ” $Group
       
    # Repeat for next group until all groups are done.
       }
      
    # Repeat for the next user
    }
    #===========================================================================================
    # That’s it!
    #===========================================================================================

     

     

    Summary

    I hope this helps!

    Published 7/27/2015

    Ace Fekay
    MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
    Microsoft Certified Trainer
    Microsoft MVP – Directory Services

    clip_image00262 clip_image00462 clip_image00662 clip_image00862 clip_image01062 clip_image01262 clip_image01462

    Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php

    This posting is provided AS-IS with no warranties or guarantees and confers no rights.

    FRS to DFS-R Migration

    Understand FRS to DFS-R Migration Stages
    From MOC 6425C p12.70 – 12.73

    Because SYSVOL is critical to the health and functionality of your domain, Windows does not provide a mechanism with which to convert from FRS to DFS-R replication of SYSVOL instantly. In fact, migration to DFS-R involves creating a parallel SYSVOL structure. When the parallel structure is successfully in place, clients are redirected to the new structure as the domain’s system volume. When the operation has proven successful, you can eliminate FRS.

    Migration to DFS-R therefore consists of four stages or states:

    0 (start). The default state of a domain controller. Only FRS is used to replicate SYSVOL.

    1 (prepared). A copy of SYSVOL is created in a folder called SYSVOL_DFSR and is added to a replication set. DFS-R begins to replicate the contents of the SYSVOL_DFSR folders on all domain controllers. However, FRS continues to replicate the original SYSVOL folders and clients continue to use SYSVOL.

    2 (redirected) SYSVOL share is redirected to SYSVOL_DFSR for client use.
    SYSVOL is still replicated by FRS for failback.

    3 (eliminated). Replication of the old SYSVOL folder by FRS is stopped. The original SYSVOL folder is not deleted. Therefore, if you want to remove it entirely, you must do so manually.

    You move the DCs through these stages or states, by using the DFSMig command. You will use three options with dfsrmig.exe:

    • getglobalstate state
      The setglobalstate option configures the current global DFSR migration state, which applies to all domain controllers. The state is specified by the state parameter, which is 0–3. Each domain controller will be notified of the new DFSR migration state and will migrate to that state automatically.
    • getglobalstate
      The getglobalstate option reports the current global DFSR migration state.
    • getmigrationstate
      The getmigrationstate option reports the current migration state of each domain controller. Because it might take time for domain controllers to be notified of the new global DFSR migration state, and because it might take even more time for a domain controller to make the changes required by that state, domain controllers will not be synchronized with the global state instantly. The getmigrationstate option enables you to monitor the progress of domain controllers toward the current global DFSR migration state.

    If there is a problem moving from one state to the next higher state, you can revert to previous states by using the setglobalstate option. However, after you have used the setglobalstate option to specify state 3 (eliminated), you cannot revert to the earlier states.

    To migrate SYSVOL replication from FRS to DFS-R, perform the following steps:

    1. Open the Active Directory Domains and Trusts snap-in.
    2. Right-click the domain and choose Raise Domain Functional Level.
    3. If the Current domain functional level box does not indicate Windows Server 2008, select Windows
    Server 2008 or Windows Server 2008 R2 from the Select an available domain functional level list.
    4. Click Raise. Click OK twice in response to the dialog boxes that appear.
    5. Log on to a domain controller and open a command prompt.
    6. Type dfsrmig /setglobalstate 1.
    7. Type dfsrmig /getmigrationstate to query the progress of domain controllers toward the Prepared
    global state. Repeat this step until the state has been attained by all domain controllers.
    This can take 15 minutes to an hour or longer.
    8. Type dfsrmig /setglobalstate 2.
    9. Type dfsrmig /getmigrationstate to query the progress of domain controllers toward the
    Redirected global state. Repeat this step until the state has been attained by all domain controllers.
    This can take 15 minutes to an hour or longer.
    10. Type dfsrmig /setglobalstate 3.
    After you begin migration from state 2 (prepared) to state 3 (replicated), any changes made to the
    SYSVOL folder will have to be replicated manually to the SYSVOL_DFSR folder.
    11. Type dfsrmig /getmigrationstate to query the progress of domain controllers toward the
    Eliminated global state. Repeat this step until the state has been attained by all domain controllers.
    This can take 15 minutes to an hour or longer.
    12. For more information about the dfsrmig.exe command, type dfsrmig.exe /?.

     

    More info on migration steps:

    SYSVOL Replication Migration Guide: FRS to DFS Replication
    http://technet.microsoft.com/en-us/library/dd640019(WS.10).aspx

    Migrate a Domain-based Namespace to Windows Server 2008 Mode – Applies To: Windows Server 2008 R2
    “To migrate a domain-based namespace from Windows 2000 Server mode to Windows Server 2008 mode, you must export the namespace to a file, delete the namespace, recreate it in Windows Server 2008 mode, and then import the namespace settings. To do so, use the following procedure.”
    http://technet.microsoft.com/en-us/library/cc753875.aspx

    Why Migrate?

    1. “Access-based enumeration– Access-based enumeration allows users to see only files and folders on a file server to which they have permission to access. This feature is not enabled by default for namespaces (though it is enabled by default on newly-created shared folders in Windows Server 2008), and is only supported in a DFS namespace when the namespace is a standalone namespace hosted on a computer running Windows Server 2008, or a domain-based namespace by using the Windows Server 2008 mode.”

    Above quoted from:
    Distributed File System – Why migrate?
    http://technet.microsoft.com/en-us/library/cc753479(WS.10).aspx

    Enable Access-Based Enumeration on a Namespace
    http://technet.microsoft.com/en-us/library/dd919212(WS.10).aspx
     
    2. Cluster support – DFS Namespaces in Windows Server 2008 supports creating stand-alone namespaces on a failover cluster from within the DFS Management snap-in. To do so, specify a failover cluster on the Namespace Server page of the New Namespace Wizard.

    3. Improved command-line tools – DFS Namespaces in Windows Server 2008 includes an updated version of the Dfsutil command and the new Dfsdiag command, which you can use to diagnose namespace issues.

    Changes and improvements to Dfsutil:
    http://go.microsoft.com/fwlink/?LinkId=136572

    Dfsdiag:
    http://go.microsoft.com/fwlink/?LinkId=136571

    4. Windows Server 2008 mode domain-based namespaces – Windows Server 2008 includes the ability to create a domain-based namespace in Windows Server 2008 mode. Doing so enables support for access-based enumeration and increased scalability. The domain-based namespace introduced in Windows® 2000 Server is now referred to as “domain-based namespace (Windows 2000 Server mode).”

    To use the Windows Server 2008 mode, the domain and domain-based namespace must meet the following minimum requirements:
         – The forest uses the Windows Server 2003 or higher forest functional level.
         – The domain uses the Windows Server 2008 or higher domain functional level.
         – All namespace servers are running Windows Server 2008.

    If your environment supports it, choose the Windows Server 2008 mode when you create new domain-based namespaces. This mode provides additional features and scalability, and also eliminates the possible need to migrate a namespace from the Windows 2000 Server mode.

    For information about migrating a namespace to Windows Server 2008 mode, see
    Migrate a Domain-based Namespace to Windows Server 2008 Mode.
    http://technet.microsoft.com/en-us/library/cc753875(WS.10).aspx

    5. Content Freshness – DFS Replication in Windows Server 2008 has a new feature called Content Freshness, which prevents a server that was offline for a long time from over-writing fresh data when it comes back online with stale (out-of-date) data.

    6. Improvements for handling unexpected shutdowns – In Windows Server 2008, DFS Replication now allows for quicker recovery from unexpected shutdowns. Unexpected shutdowns can occur because of the following reasons:
         – Unexpected shutdown of DFS Replication: This could occur if the DFS Replication process crashes, is ended, or stops because there are insufficient resources.
         – Unexpected shutdown of the computer: This could occur if the computer crashes or loses power while DFS Replication is running.
         – Unexpected shutdown of the volume: This could occur if the volume hosting a DFS Replication content set loses power, is disconnected, or is forced to dismount.
    Unexpected shutdowns of the computer and the volume can cause the NTFS file system to lose changes which have not been copied to disk. Therefore the DFS Replication database can become inconsistent with the on-disk file system state.

    On Windows Server 2003 R2, an unexpected shutdown may force DFS Replication to perform a complete database rebuild, which can be very time consuming. DFS Replication in Windows Server 2008 usually does not need to rebuild the database following unexpected shutdowns, and thus recovers much more quickly.

    7. DFS Replication performance improvements – DFS Replication in Windows Server 2008 includes the following performance improvements:
         – Faster replication both for small and large files.
         – Initial synchronization completes faster.
         – Better network bandwidth utilization on LANs and high latency networks such as WANs.

    8. Propagation report – DFS Management in Windows Server 2008 includes a new type of diagnostic report called a propagation report. This report displays the replication progress for the test file created during a propagation test.

    9. Replicate now – DFS Management now includes the ability to force replication to occur immediately, temporarily ignoring the replication schedule.
         To force replication immediately
           1. In the console tree, under the Replication node, select the appropriate replication group.
           2. Click the Connections tab.
           3. Right-click the member you want to use to replicate, and then click Replicate Now.

    10. Support for Read-Only Domain Controllers – In Windows Server 2008, DFS Replication supports Read-Only Domain Controllers (RODCs).
    For more information about RODCs, see http://go.microsoft.com/fwlink/?LinkId=96517.

    11. SYSVOL replication using DFS Replication – DFS Replication replaces the File Replication Service (FRS) as the replication engine for replicating the AD DS SYSVOL folder in domains that use the Windows Server 2008 domain functional level.

    =================================================================

    Summary

    I hope this helped you to easily configure your time service and what to do if it didn’t work.

    Ace Fekay
    MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
    Microsoft Certified Trainer
    Microsoft MVP – Directory Services

    clip_image002[6][2] clip_image004[6][2] clip_image006[6][2] clip_image008[6][2] clip_image010[6][2] clip_image012[6][2] clip_image014[6][2]

    Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php

    This posting is provided AS-IS with no warranties or guarantees and confers no rights.

    After Delegating Permissions for an Organizational Unit (OU) in Active Directory Users and Computers (ADUC), Create a Custom MMC or Custom RSAT

    Prologue

    Note- this was put together and fast published and there may be errors. Check back for updates when I add RSAT info.

    Ace here again. Yep, me again. This scenario comes up time to time. Sure, you can use the RSAT tools, but here an old fashioned, truly tried method that works nicely so a delegated OU admin can only see and do what they need to do in their OU.

    Scope

    After you Delegate Permissions in to a limited admin in Active Directory, such as the ability to reset passwords, you may want to create a custom ADUC MMC (console or custom taskpad)  for the delegated admin to control the portion of AD (the OU) they are allowed or delegated in.

    For Windows 2003 AD – but it will work in 2008 and newer

    The last time I set this up for a customer, involved a snap-in for each ‘location’ OU, I allowed to retain the rt-click context, and the tree view available in the custom console (left pane and right pane), but I removed everything else including the file menu buttons and such. So under View, Customize, uncheck everything except the top one that says Console Tree. This way they can’t go up level or click any of the things in there. But they will have the right-click feature.
     
    You can also choose to remove the left hand pane (tree view).

    MMC v2 and v3 are the same:

    • Start/run/mmc, hit enter
    • File, Add-Remove Snap-in, Add ADUC
    • Drill down under the domain to the OU you want.
    • Right-click on that OU, choose new window from here.
    • A new window pops up with the OU in the left pane and the contents in the right pane.
    • Close the original ADUC window leaving the new window open that you’ve just created.
    • Expand the window to take up the whole console. – This will keep them in this section and they will not be able to go up levels and are ‘stuck’ in this OU.
    • Select View/Customize
    • Uncheck everything but Console Tree.
    • File/Options Choose Console Mode, then select:

    User mode: Limited Access single window
    Check: Do not Save Changes to this console
    Uncheck: Allow the user to customize views
    Save it.

    • Logon as a test user that was delegated permissions and test it.

    If you want to eliminate the ability for the delegated admin to right-click on a user account, uncheck the Console Tree above, then change the console view by right-clicking on the OU, choose New Task View, and choose a vertical or horizontal list, then choose to create a new task, menu command, highlight a user account, choose reset password, or anything else in the right column, choose an icon, and finish.

    Copy the .MSC file via a UNC connected to the delegated person’s XP workstation’s \Documents and Settings\username\desktop folder, or if Windows Vista or newer, in the C:\users\username\desktop folder.

    Keep in mind, the Active Directory Administration Center, RSAT tools or AdminPak tools, depending on what operating system version the client side is, needs to be installed on the workstation for the ADUC binaries to be available for this task pad to work.

     

    For Windows 2003/Windows XP using the AdminPak tools just for the ADUC snap-in, nothing else:

    Copy over the following three DLLS from the 2003 or newer DC you are on, to their client’s system32 folder. All three of these are needed on a 2003 DC or newer, or the ADUC won’t open. However, on an XP or newer machine, you only need two. If I were to allow users to change passwords and create a custom MMC for just that OU, then all I need is adprop.dll and dsadmin.dll, otherwise you need all three.

    • adprop.dll (for object properties)
    • dsadmin.dll (ability to alter object properties)
    • dsprop.dll (for object properties related to directory services)

    Then you can use PSEXEC (one of the PSTools available free at Microsoft) to remotely register the DLLs listed below on their workstation using the regsrv32.exe utility.
    Download PsExec v1.98, by By Mark Russinovich, Published: April 28, 2009
    http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx

    • psexec \\machinename regsvr32 adprop.dll
    • psexec \\machinename regsvr32 dsadmin.dll
    • psexec \\machinename regsvr32 dsprop.dll

    Here are some screenshots at the following link:

    Create Taskpads for Active Directory Operations:
    http://www.petri.co.il/create_taskpads_for_ad_operations.htm

    ===============================================

    For AD on Windows 2008 and newer:

    You can use the ADAC & RSAT Tools, or you can use the above method.
    Note: ADAC does not have a feature to break down specific tools to create a custom console as shown above.

     

    For the Active Directory Administration Center and the RSAT tools:

    For the Related links below for the new AD Admin Center. However, the Admin Center does not have the feature to break down just specific tools to create a custom console as shown above.

    Active Directory Administration Center (ADAC):

    Active Directory Administrative Center: Getting Started
    http://technet.microsoft.com/en-us/library/dd560651(WS.10).aspx

    Active Directory Administrative Center — a New AD interface for Win7 and Win 2008  and newer
    http://techibee.com/active-directory/active-directory-administrative-center-a-new-ad-interface-for-win7-and-win-2008/290

    Learn New Features in Active Directory Administrative Center
    http://www.enterprisenetworkingplanet.com/windows/article.php/3887136/Learn-New-Features-in-Active-Directory-Administrative-Center.htm

    Description of Remote Server Administration Tools for Windows 7:
    http://support.microsoft.com/default.aspx/kb/958830

    Remote Server Administration Tools for Windows 7:
    http://technet.microsoft.com/en-us/library/ee449475(WS.10).aspx

    Remote Server Administration Tools for Windows 7
    http://www.microsoft.com/downloads/details.aspx?FamilyID=7D2F6AD7-656B-4313-A005-4E344E43997D&displaylang=en

    Customizing – Installing Remote Server Administration Tools (RSAT) for Windows 7
    http://www.petri.co.il/remote-server-administration-tools-for-windows-7.htm

    ==================================================================

    Summary

    I hope this helps!

    Last updated – 2/2006, refined a bit 9/3/2014

    Ace Fekay
    MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
    Microsoft Certified Trainer
    Microsoft MVP – Directory Services

    Facebook Twitter 

    LinkedIn clip_image005[7][2][2][2] clip_image001[4][2][2][2] clip_image001[5][3][2][2][2] clip_image001[7][4][2][3][2] clip_image001[9][3][2][3][2] clip_image001[12][3][2][3][2]

    Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php

    This posting is provided AS-IS with no warranties or guarantees and confers no rights.