Refresh Hosts file without rebooting

Tried this with Windows 8.1 and it is easier than you would think as it a command you should be very familiar with.

IPCONFIG /FLUSHDNS

User Template increase attributes copied

When you create a user template and copy it to create a new user only a limited number of attributes are copied

Example: Copy Office From the General tab

Suppose you have a user template and want the Office value from the general tab to remain when you create a new user by copying the template.

You can use ADSI Edit to make the attribute copy.

• Open ADSI Edit
• In the left pane right click ADSI Edit and Connect To the Schema Naming Context

• Locate the attribute name in this case Office is:
  Physical-Delivery-Office-Name
• Right Click and open Properties

• Attribute Editor Tab … locate searchFlags
• Edit and add 16 to the value
• To prevent it from copying remove 16 from the value.

I have tested with Windows 2008 R2 as shown but certain it should work with previous version as I learned from a Windows 2000 KB Article.

Where do you get the attribute names … I found some here.

http://www.jigsolving.com/ad/user-account-attributes-part-3

http://www.kouti.com/tables/userattributes.htm

Ultrasound - File Replication Service

Ultrasound - Monitoring and Troubleshooting Tool for File Replication Service (FRS)

Ultrasound is a monitoring and troubleshooting tool for the File Replication Service (FRS). FRS is a legacy technology that replicates files and folders that are stored in Distributed File System (DFS) folders or in the System Volume (SYSVOL) folder on domain controllers.

Microsoft: download

Certificate Services Installing CA

The preferred method

Microsoft best practice is to install a standalone root CA with an enterprise subordinate CA. The Standalone can then be isolated offline for enhanced security while the subordinate takes over issuing certificates.

The following videos gives a short demo of installing two CAs using server 2003 … it is a good starting point for his 2008 videos.

Microsoft CA 1 of 2 - Setup Standalone Root

Microsoft CA 2 of 2 - Enterprise Subordinate

The following video gives a short demo of CA autoenrollment using server 2003.

Microsoft CA - Autoenrollment Step-by-Step

In reality a single tier

While it is best practice to have two CAs … see above … in many instances you may only have one server at your disposal.

Single Tier PKI one CA that does all the issuing of certificates aimed at small business of up to 300.

Certificate Services 2008 R2 - Installing a Single Tier PKI

SSL in depth

Certificate Services 2008 1 of 4 - Installing a Microsoft CA

Certificate Services 2008 2 of 4 - Implementing a SSL Certificate

Certificate Services 2008 3 of 4 - Binding the SSL Certificate

Certificate Services 2008 4 of 4 - SSL Under the hood

 

Certificate Services 2008 1 of 2 - Autoenrollment (concept)

Certificate Services 2008 2 of 2 - Autoenrollment  Step By Step

Search Active Directory from the Desktop

To quickly get the AD search box up on a domain joined PC create a shortcut on the desktop with item location set to.

%SystemRoot%\SYSTEM32\rundll32.exe dsquery,OpenQueryWindow

Domain joined PC only, try to do it from a workgroup you will get:

Rearm Windows 2011 SBS Evaluation

Something always comes up when you are trying to evaluate a product and X weeks/months later you fire up the virtual machine and the Grace Period has expired.

slmgr.vbs –dli          will tell you how long the grace period is.

slmgr.vbs –rearm     will reset it.

I have tried this on a couple of product the latest being an evaluation version of Small Business Server 2011 and the grace period was reset to 30 days.

If memory serves me then it should work for Windows 2008 evaluations.

Don’t know if it works with products like Windows 8 or Server 2012.

TechNet Group Policy processing and precedence

Okay so you have local group policies on your PCs and several policies that have been setup by colleagues over time at various levels within active directory. What takes precedence, Local, Site, Domain or OU?

Order of precedence of policy types

The Local machine policies are applied first then Site, Domain and OU Polices are executed from the topmost OU down through the various child OUs until finally you execute any Policy attached to the OU that contains the computer. The Policy applied last has the greatest precedence.

What if multiple Policies are Linked to an OU, Site or Domain ? 

There is only one Local Policy on an individual PC however their can be multiple policies linked to a Site, Domain and OU levels.

Processing is in the order that is specified by the administrator, on the Linked Group Policy Objects tab for the site in Group Policy Management Console (GPMC). The last to process has the highest precedence.

For further information:

TechNet: Group Policy processing and precedence

Other Relevant TechNet Documents:

Deployment considerations for Group Policy
Controlling the Scope of Group Policy Objects using GPMC

Migrating a Web Server from IIS 6.0 to IIS 7

TechNet: Migrating a Web Server from IIS 6.0 to IIS 7

Migrating websites from IIS 6 to IIS 7 using WebDeploy 2.0

Web Deploy 3.0 - The Official Microsoft IIS Site‎

The Official Microsoft IIS Site

AD RMS Client Requirements

The Active Directory Rights Management Services (AD RMS) client is included with the Windows Vista®, Windows® 7, Windows Server® 2008, and Windows Server® 2008 R2 operating systems. If you are using Windows XP, Windows 2000, or Windows Server 2003 as your client operating system, a compatible version of the AD RMS client is available for download from the Microsoft Download Center Web site.

The AD RMS client can be used with the AD RMS server role included in Windows Server 2008 and Windows Server 2008 R2 or with previous versions of RMS running on Windows Server 2003.

Microsoft Windows Rights Management Services Client with Service Pack 2 – x86

The client support almost everything for Windows 2000 server/workstation SP4 onwards and includes 32/64 bit support.

SBS 2003: Display message at logon

Windows Server 2003 and SBS 2003 can be configured using Group Policy or a script to display a message to users when Ctrl+Alt+Del pressed to logon.
This can be used to display a terms & conditions summary or important systems messages prior to a logon attempt.

More Information:
How to configure Windows Server 2003 to display a message when users log on

SBS 2003: Windows Small Business Server 2003 R2 Transition Pack

Windows Small Business Server 2003 R2 is designed for businesses with up to 75 users or devices. If you have outgrown your SBS 2003 R2 and wish to upgrade to regular Windows Server, Exchange Server, SQL and ISA server versions. Windows Small Business Server 2003 R2 Transition Pack aids seamless movement to the full line of Windows Server products.

1. Converts your Windows Small Business Server 2003 R2 license into standard licenses for each of the individual server components, such as Windows Server 2003 Standard Edition and Exchange Server 2003 SP2.
2. Removing the design constraints of Windows Small Business Server 2003 R2, which include a 75 user or device limit, support for branch offices, and a requirement to keep Windows Small Business Server 2003 R2 as the main logon server.

Further Information:

Microsoft: Windows SBS 2003 R2 Transition Pack

Terminal Services: Imposing Session Limits

On of the most annoying problem I have as an administrator is trying to remote on to a server and finding someone has walked away from their desk with a remote session open or disconnected their session.

The best way to avoid this is to automatically close sessions by imposing time limits for Disconnected, Active and Idle sessions. This way you stand a fighting chance of getting remote access session.

Caution: Before imposing connection limits remember that some applications may require an open session. Automatically killing session may terminate an important process.

Imposing Terminal Services Session Limits

1. Start, All Programs, Administrative Tools and open Terminal Services Configuration
2. Right click RDP-Tcp and select properties
3. On the Sessions tag set time limits for
4. End disconnected sessions 30 minutes
5. Active session limit 2 – 3 hours
6. Idle session limit 2 –3 hours

Further Information:

Try attaching to the console session

My Blog: SBS 2003 Can’t Remote Control Session (ID 0)

Use Task Manager to kill of the offending session hogs under the users tab.

SBS 2003: Renaming Your Windows Domain

This is one of those SBS 2003 subjects that causes a lot of confusion. Yes Windows 2003 domains can be renamed but can you rename a Windows Small Business Server 2003 domain?

A quick examination of the documentation and it should be possible get nearer doing it and you find NO it can’t.

The problem being that you cannot rename a domain if Exchange 2003 is installed on a Domain Controller. SBS 2003 is a DC with exchange 2003 installed so the rendom tool will not work.

If you are installing SBS and have not yet installed Exchange you can use the rendom tool.

Like many you installed SBS without fully understanding your requirements. It was installed using sbsdomain.local and your external domain is abcaccountants.co.uk and you want to unify the domain names.

You have found that a single domain third party certificate is much cheaper than a multi domain cert and you want to rename the SBS domain to abcaccountants.co.uk

Step1: Ensure Domain Level is Windows 2003

Raise the default domain functional level to windows 2003 in order to rename it.  (See my post)

SBS 2003- Windows 2003 Change Domain & Forest Functional Levels

Step 2: Ensure Exchange 2003 at least SP1

Exchange 2003 must be at least service pack 1 and domain renaming is not possible if an Exchange 2000 server is in the domain

Step 3: Rename Your Windows 2003 Domain

Microsoft TechNet: What Is Domain Rename?

Microsoft TechNet: How Domain Rename Works

SBS 2003: Windows 2003 Change Domain & Forest Functional Levels

With Small Business Server 2003 there are only  two Domain Functional Levels Windows 2000 Native (default) or Windows Server 2003 and two Forest Functional Level Windows 2000 (default) or Windows Server 2003

The tool used to change the both the Domain and Forest Functional level is Active Directory Domain and Trusts

Raise the domain functional level

CAUTION: Cannot changed back to Windows 2000 native domain.

1. Log on to the SBS server with domain administrator credentials. The default Administrators account will do.
2. Click Start, All Programs, Administrative Tools and Active Directory Domains and Trusts.
3. In the console tree, right-click the domain, and then click Raise Domain Functional Level.
4. Under Select an available domain functional level, click Windows Server 2003, and then click Raise.

Note: You can also raise the domain functional level  in the Active Directory Users and Computers.

 

Raise the forest functional level

CAUTION: Cannot be change back to Windows 2000 forest functional level.

1. Log on to the SBS server with a user account that is a member of the Enterprise Administrators group. The default Administrators account is a member of this group.
2. Click Start, All Programs, Administrative Tools and Active Directory Domains and Trusts.
3. In the console tree, right-click Active Directory Domains and Trusts, and then click Raise Forest Functional Level.
4. Under Select an available forest functional level, click Windows Server 2003, and then click Raise.

Further information:

Microsoft Support: How to raise domain and forest functional levels in Windows Server 2003

Microsoft TechNet: Functional Levels Background Information

SBS 2003: Exchange 2003 Change Mode

This Blog: SBS 2003- Exchange 2003 Change Mode 

Microsoft Support: How To Convert from Mixed Mode to Native Mode in Exchange