Sebagian dari teman-teman pasti sudah mengetahui apa itu Active Directory Domain Services yang ada pada Windows

Server 2008, dikarenakan di portal kita ini, sudah ada yang pernah menuliskan mengenai blogs ini, yang akan saya bagikan juga

adalah perbandingannya dengan Windows Server 2003. Apabila pada windows Server 2003 ketika kita dcpromo atau ingin

menjadikan sebuah server sebagai Domain Controller, kita tinggal mengetikan dcpromo dan menjalankannya pada run.

Sebenarnya di Windows Server 2008 sama saja kita juga installasi active directory dengan mengetik dcpromo kemudian

terinstall active directory, akan tetapi di Windows Server 2008 akan menginstall terlebih dahulu Active Directory Domain and

Services yang kemudian apabila setelah install server role ini, kita cancel wizard nya maka akan terdapat AD User and

Computer, AD Sites and Services, AD Domain and Trusts dan AD Schema pada Administrative tools, berbeda dengan

Windows Server 2003 ketika kita jalankan dcpromo maka akan langsung masuk ke wizards tidak installasi Server Roles

seperti ini terlebih dahulu.

Dengan adanya AD DS client komputer juga bisa menggunakan user account yang sudah di create untuk melakukan

authentikasi ke AD DS, untuk akses ke network resource seperti file server atau print server juga authenticate nya melalui

AD DS. Misalnya apakah user ini terdaftar dalam group tertentu, atau secara individu user tersebut diperbolehkan akses ke

folder tertentu. Server roles(AD FS, AD RMS dan AD CS) yang lain tergantung kepada AD DS untuk provide informasi

mengenai user dan network resource yang ada dalam Active Directory. Adapun juga beberapa fungsi baru dari AD DS, yaitu

Read Only Domain Controller yang selama ini sering kita bahas diportal wss-id kita ini, ketika mendefrag domain controller

nya tanpa harus menstop service dari AD nya, tidak seperti DC 2003 kita harus menstop service nya terlebih dahulu.

Secara konsep Active Directory 2003 dengan AD 2008 hampir sama, inti dari Active Directory adalah Active Directory

Domain and Services, karena tanpa adanya ini, maka Server Roles yang lain tidak akan berfungsi dengan sempurna. Disini

kita mengerjakan semua tentang Active Directory.

Adapun beberapa wizard Active Directory Domain and Services sendiri sama saja seperti pada Windows Server

2003 sebelumnya :

1. Active Directory User and Computer digunakan untuk me-manage(create, modify ataupun remove) objek-objek(OU, User,

computer, Group, printer dan lain-lain) yang ada pada Active Directory dengan  menggunakan GUI(Graphics User Interface),

2. Active DIrectory Site and Services digunakan untuk membuat site dan mengatur replikasi antar Domain Controller.

3. Active Directory Domain and Trusts digunakan untuk membuat trust antar domain dan untuk me-raise forest functional level

dan domain functional level, terdapat salah satu FSMO roles yang bisa kita pindahkan dari satu DC ke DC yang lainnya.

4. Active Directory Schema digunakan untuk menambahkan, mengubah ataupun juga menghapus class atau attribut yang

ada pada Active Directory.

Selain Fungsi diatas Active Directory Domain and Services juga mempunyai beberapa fitur, antara lain :

1. Centralized Directory memudahkan Network admin untuk mengatur jaringannya dengan menggunakan single Directory

yang terpusat.

2. Single Sign On Access bisa mengakses beberapa resources dengan menggunakan satu buah user account saja,

contohnya User bobby bisa mengakses file server, print server dan fax server.

3. Integrated Security AD DS berkolaborasi dengan Windows Server 2008 security bisa mengecek langsung security permission

yang ada pada setiap client yang join baik itu merupakan, Windows NT, 98, 2000, XP dan Vista.

4. Scalability kita bisa menambahkan server AD DS yang baru apabila pada Windows Server 2003 kita namakan Additional

Domain Controller(ADC). AD DS Server baru akan melakukan replikasi dari AD DS yang lama, sehingga user bisa  login ke

AD DS yang paling dengan wilayah mereka.

5. Common Management Interface, Microsoft Management Console(MMC) yang digunakan untuk mendeploy AD DS dan

melakukan maintenance terhadap Active Directory yang sudah ada.

AD DS terbentuk dari 2 bagian, yaitu Physical Component dan Logical Component

Physical Component AD DS :

1. Data Store : tempat dimana data itu tersimpan(dimana kita install Active Directory disitulah data store nya).

contohnya : ntds.dit file yang tersimpan di %SystemRoot%\NTDS folder

2. Domain Controller : sebuah Server yang kita install Active Directory,  maka kita sebut sebagai Domain Controller

    didalamnya juga menyediakan Authentication dan authorization access ke resources tertentu, replikasi update antar

Domain Controller.

3. Global Catalog Server : yang didalamnya terdapat global catalog, global catalog sendiri bisa berisi query yang

paling sering digunakan oleh objek, misalnya user login, menyimpan trust antar domain dalam satu forest. tempat

dimana kita mengaktifkan global catalog disebut global catalog server.

4. Read Only Domain Controller : Domain Controller yang kita hanya bisa read only, tanpa bisa melakukan perubahan

di dalamnya.

5. Sites : penempatan Domain controller, yang ditujukan untuk replikasi antar Domain Controller tersebut. Apabila beda

site kita bisa melakukan scheduling, apabila satu site maka bisa langsung replikasi, kita juga bisa membagikan ip-subnet

pada setiap Domain Controller.

AD DS Replication : mengkopi semua update yang ada AD DS database ke semua Domain Controller yang lainnya bisa

dalam satu domain atau dalam satu forest. AD Replication juga memastikan semua DC mempunyai informasi yang sama,

menggunakan Multimaster Replication Model(bisa diubah di setiap DC yang writeable dan updatenya dikirim ke DC yang lain).

Replikasi bisa di manage dengan membuat Site.

Logical Component dari AD DS :

1. AD DS Schema : terdiri dari 2 bagian, yaitu class objek : mendefinisikan objek baru yang bisa kita buat pada Active

Directory (contohnya computer class dan user class), attribut objek : Informasi apa saja yang bisa disimpan pada setiap

class objek (contohnya pada user class terdapat display name, email address, dll).\

2. AD DS objek : merupakan bagian terkecil dari AD DS, yang didalamnya terdapat user, computer, printer, group(digunakan

untuk pengelompokan dan memberikan permission), dan lainnya.

3. Organizational Unit(OU) : merupakan Object container atau tempat penampungan objek, setiap objek yang ada dalam AD DS

bisa kita letakkan dalam 1 OU, OU juga berisi OU lainnya.

4. Domain : digunakan mengelompokan untuk memanage Active Directory objek dalam satu organisasi. Bisa juga untuk

memberikan policy tertentu pada satu OU yang didalamnya bisa terdapat objek-objek yang lain,

Pada satu(1) Domain pasti ada minimal 1 Domain Controller yang terinstall, dalam satu DC hanya bisa ada satu Domain.

5. Domain Tree : Susunan Hirarki dari domain-domain dalam satu forest, yang penulisan namanya contiguous dengan parent

nya(contohnya parent nya contoso.com, childnya as.contoso.com).

6. Forest : merupakan keseluruhan dari AD DS, termasuk didalamnya domain, domain tree, schema, objek maupun OU.

How to Backup the Domain Controller(s)

Obviously, before you can restore your domain, you have to back it up first.  Mainly what we’re interested in backing up is the System State of a Domain Controller.  So what is the System State?

The System State of your server includes the Registry, the Boot files, some System files, the Active Directory service, and other components.  (Read more about it here.)  You can not pick and choose between which components are backed up during a System State backup.  It’s an all or nothing situation.

Since this includes the whole of your Registry, you have to understand that this includes the information about the original System’s installed hardware.  This may complicate the restore process somewhat.  If you backed the System State from DC on an HP Proliant DL380 G5 series server… and attempt to restore it on a Dell PowerEdge T100… you will most likely have issues with booting up the OS afterwards because the hardware set is significantly different.

As part of your DR plan, I recommend making a point of documenting the hostname, IP address, Operating System, Service Pack level, and the hardware make/model of each of your domain controllers.  You may find this information useful when the time comes.

These instructions are going to use the hostname “DC123” as name of the domain controller, and assume that you want to run your System State backup every day at 3:00am.

Login to your domain controller, and perform the following steps:

1. Create a C:\Backup\ folder.
2. Click Start — All Programs — Accessories — System Tools — Backup.
3. Click [Next] — Select Backup Files and Settings — [Next].
4. Select Let me choose what to back up — [Next].
5. Expand My Computer — Check System State — [Next].
6. Set the location of the backup file to C:\Backup\ folder.      Set the Name of the Backup to “DC123 System State”.
7. Click [Next] — [Advanced] — Select Normal — [Next].
8. Check the Verify Data after Backup box — [Next].
9. Select Replace the existing backups — [Next].
10. Select Later — Set the Job Name to “DC123 System State”.
11. Click [Set Schedule] — Schedule the job to run Daily at 3:00am.
12. Click [OK] — Enter a set of user credentials — [OK].
13. Click [Next] — Enter a set of the user credentials — [OK] — [OK] — [Finish].

The actual backup job itself will probably take somewhere between 15 – 30 minutes to run.  Then, you can backup the C:\Backup\ folder to tape.  Personally, I had preferred to schedule another task that would launch at 4:00am to “robocopy” (which can be found as part of the Windows Server 2003 Resource Kit Tools download) each of the backup files to another server where they were all dumped to tape a few hours later.

You only really need to backup 1 domain controller for this to work, but then your pretty much locked into a single hardware set when it comes time to do the restore.  Since I was never sure what kind of hardware I would have available to me when it came time to do the restores, I tried to make a practice of housing each domain controller on a different model of server… and backing each of them up individually.  Each backup ran me somewhere between 600 – 800 MB of disk space (which is rather a small pittance by today’s standards).

Yes, this was probably a significant amount of overkill on my part.  However, I find that the more paranoid you are, the better prepared you tend to find yourself.  And I tend to be rather paranoid about things like DR.

How to Restore the Domain Controller(s)

Now let’s pretend that a disaster has struck!

You’ve retrieved your tapes from off-site storage and acquired your target hardware, so let’s get to work!  (Remember that matching the hardware to the DC restore would be best, but you can make substitutions.  It’s not an exact science, so some experimentation may be required.)

Note:  These instructions are written with a few assumptions in mind.

1. We assume that your entire domain has been leveled by some catastrophic event.
2. We assume that your domain controllers are running a Windows 2003 operating system.
3. We assume that whomever is doing the work knows the login credentials (from the original domain) to the domain’s Administrator account or a user account that is a member of both the domain’s “Domain Admins” and “Schema Admins” groups.

1. Build a stand-alone Windows 2003 server, and bring it up to the same Service Pack level as the original DC.
2. Name the server with the same hostname as your original DC.
3. Restore your System State backup files from tape, and copy them to the new server’s local hard disk.
4. Reboot the server.
5. After POST, hit [F8] and select to boot into “Directory Services Restore Mode (Windows domain controllers only)”.
6. Click Start — All Programs — Accessories — System Tools — Backup.
7. Click [Next] — Select Restore files and settings — [Next] — Browse to the location of the backup file — [Next].
8. Expand File – System State Backup — Check the System State box — [Next].
9. Click [Advanced] — Select Original Location — [Next] — [OK] — Select Leave existing files (Recommended) — [Next].
10. Check the boxes for:*  Restore Security Settings       *  Restore junction points, but not the folder and file data       *  Preserve existing volume mount points       *  When restoring replicated data sets, mark the restored data as the primary data for all replicas
11. Click [Next] — [Finish].
12. After the restore is completed, click [Close] — [Yes] to reboot the system.

If your server hardware is significantly different from the original DC, then you may experience difficulty with the boot to the GUI.  If this is the case, then you might be able to still recover the OS by booting into Safe Mode or by booting to an original Windows 2003 OS CD to perform a Repair.

Once you get into the GUI, you will need to login using the local Administrator password from the original DC.

Now you will be able to seize the FSMO roles.  (Note:  After each “seize” command, click [Yes] and allow 3-5 minutes for the task to complete.)

1. Click Start — Run — NTDSUTIL — [OK].
2. Type the following commands into NTDSUTIL.roles       connections       connect to server DC123       q       seize domain naming master       seize infrastructure master       seize PDC       seize RID master       seize schema master       q       q

Next, confirm that your DC is a Global Catalog server.

1. Launch AD Sites and Services      (C:\Windows\System32\dssite.msc)
2. Expand Sites – Default-First-Site-Name – Servers – DC123.
3. Right-click and select NTDS Settings — On the General tab, verify that the Global Catalog box is checked.
4. Perform a clean reboot of the system.

Now we’ll clean the old domain controllers out of the AD database.

1. Click Start — Run — NTDSUTIL — [OK].
2. Type the following commands into NTDSUTIL.metadata       cleanup connections       connect to server DC123       quit       select operation target       list domains       select domain <#>       list sites       select site <#>       list servers in site       select server <# of bad DC>       quit       remove selected server       quit
3. Launch Active Directory Sites and Services(C:\Windows\System32\dssite.msc).
4. Expand Sites – Default-First-Site-Name – Servers.
5. Right-click on <bad DC hostname> — Select Delete.
6. Launch Active Directory Users and Computers (C:\Windows\System32\dsa.msc).
7. Expand the domain — Open the Domain Controllers container.
8. Right-click on <bad DC hostname> — Select Delete.
9. Select The domain controller is permanently offline and can no longer be demoted using Active Directory Installation Wizard (DCPROMO).
10. Click [Delete] — [Yes] to confirm.

Your domain should now be successfully restored, but don’t consider yourself finished at this point.  This restored server should be considered hinky at best, and should not be kept as a long-term solution.

Before doing anything else, I recommend that you build a 2nd “clean” domain controller alongside this restored 1st DC.  Then, transfer the FSMO roles to the 2nd DC.  Finally, demote the 1st DC to a member server and retire it from the domain.  That will hopefully ensure that your domain is running on a clean and stable DC that you can rely upon.  Then, build a new 2nd DC to ensure some redundancy.

Congratulations!  Your domain is restored.  Now get to work on restoring everything else.

This article describes how to reset the Directory Services   Restore Mode (DSRM) administrator password for any server in your domain   without restarting the server in DSRM. Microsoft Windows 2000 uses the Setpwd utility to reset the DSRM password. In Microsoft Windows Server 2003, that functionality has been integrated into the NTDSUTIL tool. Note that you cannot use the procedure   that is described in this article if the target server is running in DSRM. A   member of the Domain Administrators group sets the DSRM administrator password   during the promotion process for the domain controller. You can use   Ntdsutil.exe to reset this password for the server on which you are working, or   for another domain controller in the domain.

To Reset the DSRM Administrator Password

1. Click, Start, click Run, type ntdsutil, and then click OK.
2. At the Ntdsutil command prompt, type set dsrm password.
3. At the DSRM command prompt, type one of the following lines:
   • To reset the password on the server on which you are working, type reset password on server null. The null variable assumes that the DSRM password is being reset on the local computer. Type the new password when you are prompted. Note that no characters appear while you type the password.
     -or-
   • To reset the password for another server, type reset password on server servername, where servername is the DNS name for the server on which you are resetting the DSRM password. Type the new password when you are prompted. Note that no characters appear while you type the password.
4. At the DSRM command prompt, type q.
5. At the Ntdsutil command prompt, type q to exit.

open ADUC and do the following.

Right-click Saved Queries and click the New-Query option Type in a name for your saved query, such as Find all Non expiring PW Users Click the Define Query button Under the Find drop-down list, select Custom Search Click the Advanced tab Type in (objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=65536) Click the OK button to save the custom entry, then click on the OK button to save the query Now you should see all users with the flage pw never expires

Click the Export List button from the top of the ADUC windows and save to txt file.

User-Account-Control attribute

Create batch file :

for /F “tokens=1,2,3,4 delims=,” %%i in (freshmen09.csv) do dsadd user “cn=%%j %%i,ou=2013,ou=students,dc=[domain],dc=org” -samid %%k -pwd “%%l” -upn %%k@[domain].org -fn “%%j” -ln “%%i” -display “%%j %%i” -memberof “cn=GL 2013,ou=2013,ou=students,dc=[domain],dc=org” -disabled no -mustchpwd yes -hmdrv U: -hmdir “\\[network home directory]\2013\%%k”

Create .csv file contain 4 columns : Last Name, First Name, Username, Password

• Creates a user for each row in the file,
• Puts them into the desired OU,
• Sets the password,
• Adds them as a member of a group,
• Enforces that the password must be changed when the user first logs in,
• Sets the home directory to the appropriate place on our network share.

LogParser Studio has recently been released and is a long awaited release at that. It now provides a GUI interface for LogParser utility with Windows server and Windows desktop systems.

Log Parser Studio is a utility that allows you to search through and create reports from your IIS, Event, EXADB and others types of logs. It builds on top of Log Parser 2.2 and has a full user interface for easy creation and management of related SQL queries.

You can download LogParser Studio from Microsoft site:  http://gallery.technet.microsoft.com/Log-Parser-Studio-cd458765