Prerequisite updates for Internet Explorer 11

Prerequisite updates for Internet Explorer 11

Microsoft Data Classification Toolkit

This Solution Accelerator is designed to help enable an organization to identify, classify, and protect data on their file servers. The out-of-the-box classification and rule examples help organizations build and deploy their policies to protect critical information on the file servers in their environment.

Microsoft Data Classification Toolkit

Refresh Hosts file without rebooting

Tried this with Windows 8.1 and it is easier than you would think as it a command you should be very familiar with.

IPCONFIG /FLUSHDNS

Active Directory Recycle Bin Step-by-Step Guide

Active Directory Recycle Bin helps minimize directory service downtime by enhancing your ability to preserve and restore accidentally deleted Active Directory objects without restoring Active Directory data from backups, restarting Active Directory Domain Services (AD DS), or rebooting domain controllers.

When you enable Active Directory Recycle Bin, all link-valued and non-link-valued attributes of the deleted Active Directory objects are preserved and the objects are restored in their entirety to the same consistent logical state that they were in immediately before deletion. For example, restored user accounts automatically regain all group memberships and corresponding access rights that they had immediately before deletion, within and across domains.

Active Directory Recycle Bin is functional for both AD DS and Active Directory Lightweight Directory Services (AD LDS) environments.

Extract for TechNet for full article see link below

TechNet: Active Directory Recycle Bin Step-by-Step Guide

Deploying a GlobalNames Zone (GNZ)

A common requirement in computer networks is the ability to resolve simple, single-label names. The use of single-label names makes it possible for a computer to access hosts such as file and Web servers by using short, easy-to-remember names instead of the fully qualified domain names (FQDNs) that form the default naming convention for Domain Name System (DNS). To make the use of single-label names possible, many networks deploy Windows Internet Name Service (WINS) technology and servers in their environment. As a name resolution protocol, WINS is an alternative to DNS. It is an older service that uses NetBIOS over TCP/IP (NetBT). WINS and NetBT do not support Internet Protocol version 6 (IPv6) protocols; therefore, they are being phased out in many networks.

To help network administrators migrate to DNS for all name resolution, the DNS Server role in Windows Server 2008 supports a specially named zone, called GlobalNames. By deploying a zone with this name, you can have the static, global records with single-label names, without relying on WINS. These single-label names typically refer to records for important, well-known and widely-used servers—servers that are already assigned static IP addresses and that are currently managed by IT-administrators using WINS.

The GlobalNames zone is not designed to be a complete replacement for WINS. You should not use the GlobalNames zone to support the name resolution of records that are dynamically registered in WINS, records which typically are not managed by IT administrators. Support for these dynamically registered records is not scalable, especially for larger customers with multiple domains or multiple forests.

This is an extract from a TechNet article see the link below for the full article.

TechNet: Deploying a GlobalNames Zone

Additional references

• Understanding Zones
• Understanding Zone Types
• Change the Zone Replication Scope
• Understanding DNS Zone Replication in Active Directory Domain Services

Securing Accounts After an RODC Is Stolen

Having work for large organisations with many branch offices it was not an infrequent event to have equipment stolen.

From experience … the people that stole your kit know you will be sending out new kit so they will return for that.

Read Only Domain Controllers (RODC) are designed for insecure environments .. so what do you do if one gets nicked … you follow the procedure on the link below to disable the stolen RODC and reset the passwords on any cached user accounts.

TechNet: Securing Accounts After an RODC Is Stolen

Managing AD LDS using PowerShell

Microsoft Active Directory Lightweight Directory Services (AD LDS) is an independent mode of Active Directory that provides dedicated directory services for applications.

MSDN: Active Directory Lightweight Directory Services

AD LDS can use many of the familiar tools used to manage Active Directory Directory Services (AD DS) even when it comes to using the AD PowerShell Module there is a feeling of “deja vu”.

On the link below you will find a list of Active Directory cmdlets that can be used to manage AD LDS instances.

Windows 2008 R2: Managing AD LDS using the AD PowerShell Module

Ensuring that group policy is applied before logon

By default group policies are applied asynchronously - Fast Logon Optimization . The upshot is that if you update a policy users may logon before the latest policy is applied and it may take a couple of logons before current settings are applied.

I am messing about with GPOs in a test environment so I don’t want to have to constantly rebooting PC or perform multiple logons attempts.

Disable Fast Logon Optimization by using the following

Create or update and existing group policy attached to the OU housing the computers and edit the following.

Computer Configuration
  Policies
    Administrative Templates
      System
        Logon

Enable: Always wait for the network at computer startup and logon

Delegate Permissions for Group Policy

TechNet: Delegate Permissions for Group Policy

Redirecting the users and computers containers

By default Active Directory places user accounts, computer accounts, and groups in CN=objectclass containers.

Redirecting the default container for user, computer, and security groups to an organizational unit permits Group policies to be applied.

Microsoft considers it "best practice" to place security principals into an organizational unit hierarchy that mirrors your organizational structure, geographic layout, or administration model.

Redirect Users

redirusr <DN path to alternate OU>

redirusr ou=myusers,DC=contoso,dc=com

Redirect Computers

redircmp <DN path to alternate OU>

redircmp ou=mycomputers,DC=contoso,dc=com

Redirecting the users and computers containers in Active Directory domains

Considerations

Windows Server 2003 domain functional level or higher required.

The default User and Computer containers are protected against accidental deletion remember to ensure that you do the same with your new OUs.

 

User Template increase attributes copied

When you create a user template and copy it to create a new user only a limited number of attributes are copied

Example: Copy Office From the General tab

Suppose you have a user template and want the Office value from the general tab to remain when you create a new user by copying the template.

You can use ADSI Edit to make the attribute copy.

• Open ADSI Edit
• In the left pane right click ADSI Edit and Connect To the Schema Naming Context

• Locate the attribute name in this case Office is:
  Physical-Delivery-Office-Name
• Right Click and open Properties

• Attribute Editor Tab … locate searchFlags
• Edit and add 16 to the value
• To prevent it from copying remove 16 from the value.

I have tested with Windows 2008 R2 as shown but certain it should work with previous version as I learned from a Windows 2000 KB Article.

Where do you get the attribute names … I found some here.

http://www.jigsolving.com/ad/user-account-attributes-part-3

http://www.kouti.com/tables/userattributes.htm

Ultrasound - File Replication Service

Ultrasound - Monitoring and Troubleshooting Tool for File Replication Service (FRS)

Ultrasound is a monitoring and troubleshooting tool for the File Replication Service (FRS). FRS is a legacy technology that replicates files and folders that are stored in Distributed File System (DFS) folders or in the System Volume (SYSVOL) folder on domain controllers.

Microsoft: download

Active Directory Shadow Groups

Simply: You have an OU in active directory … add any user accounts in the OU to a group … in addition you want to maintain the membership when accounts are added or removed from the OU.

The following link includes examples using the ds* commands and PowerShell to populate and maintain Shadow Groups.

Shadow Groups in Active Directory

It should be possible to expand these examples to include the user accounts from other OUs or to use Identity Attributes rather than OU.

Cmdlet Reference for Windows Server 2008 R2

Powershell Cmdlet help for Windows Server® 2008 R2 roles and features

TechNet: Cmdlet Reference for Windows Server 2008 R2

PowerShell determine what version is installed

What version of PowerShell is installed on a machine

Open PowerShell and type Get-Host

Windows 7 – version 2.0

Windows 8 – version 3.0

http://technet.microsoft.com/en-us/library/bb978526.aspx

Update GPO templates to manage Windows 8

You’ve added some Window 8 PCs and possibly Windows Server 2012 to your existing Windows Server 2008 R2 enterprise … okay so how do you access the additional features with Group Policy?

Looking at a Group Policy setting in Windows 8 Windows 8 GPO Blocking Connection Accounts … I got to thinking … I’m doing this from Windows Server 2012 … more realistically I will be adding Windows 8 machines to a Windows Server 2008 environment.

How do I update the group policy template files?

My only caveat … I have still to do the testing … will the new templates work with the old admin tools.

Windows 7, Windows Server 2008 R2 Group Policy Central Store

Administrative Template files for Windows 8 & Windows Server 2012

Upgrading the ADMX Central Store files from Windows 7/2008R2 to Windows 8/2012

Certificate Services Installing CA

The preferred method

Microsoft best practice is to install a standalone root CA with an enterprise subordinate CA. The Standalone can then be isolated offline for enhanced security while the subordinate takes over issuing certificates.

The following videos gives a short demo of installing two CAs using server 2003 … it is a good starting point for his 2008 videos.

Microsoft CA 1 of 2 - Setup Standalone Root

Microsoft CA 2 of 2 - Enterprise Subordinate

The following video gives a short demo of CA autoenrollment using server 2003.

Microsoft CA - Autoenrollment Step-by-Step

In reality a single tier

While it is best practice to have two CAs … see above … in many instances you may only have one server at your disposal.

Single Tier PKI one CA that does all the issuing of certificates aimed at small business of up to 300.

Certificate Services 2008 R2 - Installing a Single Tier PKI

SSL in depth

Certificate Services 2008 1 of 4 - Installing a Microsoft CA

Certificate Services 2008 2 of 4 - Implementing a SSL Certificate

Certificate Services 2008 3 of 4 - Binding the SSL Certificate

Certificate Services 2008 4 of 4 - SSL Under the hood

 

Certificate Services 2008 1 of 2 - Autoenrollment (concept)

Certificate Services 2008 2 of 2 - Autoenrollment  Step By Step

Windows CA 2008 and IE10 Error

When messing around with Certificate Services on Windows Server 2008 R2 and trying to connect to the CA’s certsrv folder in the browser I got the error:

“The Web Browser does not support the generation of certificate requests”

The problem is related to IE 10; if I switch to compatibility mode no problem.

TechNet: Windows PKI Blog

News and information for public key infrastructure (PKI) and Active Directory Certificate Services (AD CS) professionals.

Using Certificates for IPsec Authentication

In a previous post IPsec Overview there is an example of securing Telnet with IPsec. This link to a TechNet Video takes the Telnet example further by using Certificates for IPsec Authentication.

TechNet Video: Using Certificates for IPsec Authentication

Messing about with NetSH AdvFirewall

Reset Firewall to Default

If you are going to mess about with your firewall the first thing you want to know is how to reset it to default

netsh advfirewall reset

Export/Import Settings

The second thing you should know is probably the last thing you would have though about. If you are going to mess around with an already successfully configured firewall then you may want to save the current settings and reimport them.

netsh advfirewall export "c:\wfconfig.wfw" 
netsh advfirewall import "c:\wfconfig.wfw"

It’s not a bad idea if you are messing about with NetSH in general to export the configuration. Not all “learning” is done with easily revertible test VMs … most of the important lesson we learn tend to be on live systems.

Firewall Off & On Test

If I switch the firewall off will this work … NO … better switch it back on then.

netsh advfirewall set allprofiles state off
netsh advfirewall set allprofiles state on