SYSTEM ADMINISTRATOR’S CASE - referred to the Cadre Restructuring Committee

Please see the JCM (DC) Standing Committee Minutes in our Website published last week. Entire issues of System Administrators raised by us in the PJCA Memorandum referred to the Cadre restructuring committee. It will be discussed in that committee. Hence the item is not discussed in PJCA meeting.

= M. Krishnan, S/G NFPE

Source : http://www.aipeup3chq.com/

Configuring Password Policy Settings in an Active Directory

Implementing Password Policy Settings Step-by-Step

• Credentials: You must be logged on as a member of the Domain Admins group.
• Tools: Active Directory Users and Computers.
• To implement password policy on computer systems that belong to an Active Directory domain
  1. Click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Users and Computers.
  2. Right-click the root container for the domain:
     
     
     
     
     Note: Screen shots in this document reflect a test environment and the information might differ from the information displayed on your screen.
  3. Select Properties from the menu that appears:
     
  4. In the properties dialog box for your domain, click the Group Policy tab, and then click New to create a new Group Policy object in the root container. Type "Domain Policy" for the name of the new policy and then click Close.
     Note: Microsoft recommends that you create a new Group Policy object rather than editing the built-in one called Default Domain Policy because doing so makes it much easier to recover from serious problems with security settings. If the new security settings create problems, you can temporarily disable the new Group Policy object until you isolate the settings that caused the problems.
  5. Right-click the root container for the domain, and then click Properties.
  6. In the properties dialog box, click the Group Policy tab, and then select Domain Policy.
  7. Click Up to move the new GPO to the top of the list, and then click Edit to open the Group Policy Object Editor for the GPO you just created.
  8. Under Computer Configuration, navigate to the Windows Settings\Security Settings\Account Policies\Password Policy folder.
     
  9. In the details pane, double-click Enforce password history, select the Define this policy setting check box, set the value of Keep password history to 24, and then click OK.
     
  10. In the details pane, double-click Maximum password age, select the Define this policy setting check box, set the value of Password will expire in to 42, clickOK, and then click OK to close the Suggested Value Changes window that appears.
      
  11. In the details pane, double-click Minimum Password Age, select the Define this policy setting check box, set the value of Password can be changed after to 2, and then click OK.
      
  12. In the details pane, double-click Minimum Password Length, select the Define this policy setting check box, set the value of Password must be at least to 8, and then click OK.
      
  13. In the details pane, double-click Password must meet complexity requirements, select the Define this policy setting in the template check box, selectEnabled, and then click OK.
      
  14. Close the Group Policy Object Editor, click OK to close your domain's properties dialog box, and then exit Active Directory Users and Computers.

Verifying New Settings

Use the following procedure to verify that the appropriate password policy settings are applied and effective in the Domain Policy GPO. Verifying the settings and their operation ensures that the correct password policies will be applied to all users in the domain.

Requirements

• Credentials: You must be logged on as a member of the Domain Admins group.
• Tools: Active Directory Users and Computers.

• To verify password policy settings for an Active Directory domain
  1. Open Active Directory Users and Computers, right-click your domain, and then click Properties.
  2. In your properties dialog box for your domain, click the Group Policy tab, select the Domain Policy GPO, and then click Edit to open the Group Policy Object Editor.
  3. Under Computer Configuration, go to the Windows Settings\Security Settings\Account Policies\Password Policy folder, and verify that your settings match the settings shown here:
     
  4. Close the Group Policy Object Editor, click OK to close the properties dialog box for your domain, and then exit Active Directory Users and Computers.
  5. Verify that users cannot specify passwords that are shorter than 8 characters, that they cannot create non-complex passwords, and that they cannot immediately change their new passwords.

Courtesy :  http://potools.blogspot.in/

Actice Directory FAQ with Answers

1. What is Global Catalog Server?

Global Catalog server is the server which keeps the stores the details of each object created in the forest. Global Catalog is the master searchable index to all objects in forest

2. Can GC Server and Infrastructure place in single server? If not explain why?

No, As Infrastructure master does the same job as the GC. It does not work together.

3. What is the size of log file which created before updating into ntds.dit and the total number of files?

Three Log files Names

Edb.log

Res1.log

Res2.log

Each initially 10 MB

4. What does SYSVOL contains?

SysVol Folder contains the public information of the domain & The information for replication

Ex: Group policy object & scripts can be found in this directory.

5. Which is service in your windows is responsible for replication of Domain controller to another domain controller.

KCC generates the replication topology.

Use SMTP / RPC to replicate changes.

6. How data will travel between sites in ADS replication?

As determined in the site connectors

7. What is the port number for SMTP, Kerberos, LDAP, and GC Server??

SMTP 25, Kerberos 88, GC 3268, LDAP 389

8. What Intrasite and Intersite Replication?

Intrasite is the replication within the same site & intersite the replication between sites

9. What is lost & found folder in ADS?

It's the folder where you can find the objects missed due to conflict.

Ex: you created a user in OU which is deleted in other DC & when replication happed ADS didn't find the OU then it will put that in Lost & Found Folder.

10. What is Garbage collection?

Garbage collection is the process of the online defragmentation of active directory. It happens every 12 Hours.

11. What System State data contains?

Contains Startup files,

Registry

Com + Registration Database

Memory Page file

System files

AD information

Cluster Service information

SYSVOL Folder

12. How do you restore a particular OU which got deleted by accident?

Go authoritative restore

13. What is IPSec Policy?

IPSec provides secure gateway-to-gateway connections across outsourced private wide area network (WAN) or Internet-based connections using L2TP/IPSec tunnels or pure IPSec tunnel mode.

IPSec Policy can be deployed via Group policy to the Windows Domain controllers 7 Servers.

14. What are different types of Group Policy?

I don't think there are types of group policies????

15. What is the order of applying Group Policy?

Local Policy.

Site Policy.

Domain Policy.

OU Policy.

16. What are the new features in Windows 2003 related to ADS, Replication, and Trust?

ADS: Can more than 5000 users in the groups

17. How to edit the Schema in ADS?

ADSI Edit

18. What is Domain Local, Global Group, Universal group?

Domain Local – Only Users with in Domain

Global groups are used to grant permissions to objects in any domain in the domain tree or forest. Members of global groups can include only accounts and groups from the domain in which they are defined.

Universal groups are used to grant permissions on a wide scale throughout a domain tree or forest. Members of global groups include accounts and groups from any domain in the domain tree or forest.

19. Diff between Global & Universal group?

Check the answer above.

20. What are the different types of Terminal Services?

User Mode & Application Mode

21. What does mean by root DNS servers?

Public DNS servers Hosted in the Internet which registers the DNS

22. What are the different records in DNS?

A – Address record

MX – Mail Server Record

NS – Name Server

CNAME – Canonical name / Alias

SOA – Start of authority

23. What is a SOA record?

Start of authority – authorized DNS in the domain

24. How does the down-level clients register it names with DNS server?

Enable the WINS integration with DNS.

25. What is RsOP?

RsOP is the resultant set of policy applied on the object (Group Policy)

26. What is default lease period for DHCP Server?

8 days Default

27. What is the process of DHCP clients for getting the ip address?

Discover – Order – Receive - Acknowledge

28. What is multicast?

Multicast scopes enable you to lease Class D IP addresses to clients for participation in multicast transmissions, such as streaming video and audio transmissions.

29. What is superscope?

Superscope enables you to group several standard DHCP scopes into a single administrative group without causing any service disruption to network clients.

30. What is the System Startup process?

Windows 2K boot process on Intel architecture.

1. Power-On Self Tests (POST) is run.

2. The boot device is found, the Master Boot Record (MBR) is loaded into memory, and its program is run.

3. The active partition is located, and the boot sector is loaded.

4. The Windows 2000 loader (NTLDR) is then loaded.

The boot sequence executes the following steps:

1. The Windows 2000 loader switches the processor to the 32-bit flat memory model.

2. The Windows 2000 loader starts a mini-file system.

3. The Windows 2000 loader reads the BOOT.INI file and displays the operating system selections (boot loader menu).

4. The Windows 2000 loader loads the operating system selected by the user. If Windows 2000 is selected, NTLDR runs NTDETECT.COM. For other operating systems, NTLDR loads BOOTSECT.DOS and gives it control.

5. NTDETECT.COM scans the hardware installed in the computer, and reports the list to NTLDR for inclusion in the Registry under the HKEY_LOCAL_MACHINE_HARDWARE hive.

6. NTLDR then loads the NTOSKRNL.EXE, and gives it the hardware information collected by NTDETECT.COM. Windows NT enters the Windows load phases.

31. What is WINS hybrid & mixed mode?

Systems that are configured to use WINS are normally configured as a hybrid (H-node) client, meaning they attempt to resolve NetBIOS names via a WINS server and then try a broadcast (B-node) if WINS is unsuccessful. Most systems can be configured to resolve NetBIOS names in one of four modes:

Broadcast (B-node)—Clients use a broadcast only to resolve names. An enhanced B-node setting has the client use an LMHOST file as well. The hex value for this setting is 0x1.

Peer-to-Peer (P-node)—Clients use WINS only to resolve names. The hex value for this setting is 0x2.

Mixed (M-node)—Clients first use a broadcast in an attempt to resolve NetBIOS names. If this fails, they attempt the resolution via the WINS server. The hex value for this setting is 0x4.

Hybrid (H-node)—Clients first use the WINS service in an attempt to resolve NetBIOS names. If this fails, they attempt the resolution via broadcast. The hex value for this setting is 0x8.

32. What is Disk Quota?

Disk Quota is the specifying the limits of usage on the disks.

==========================================================

1) What is different Editions of Windows 2003 server?

i)Standard Edition

ii)Web Edition

iii)Enterprise Edition

iv)Datacenter Edition

2) What is active directory?

Active Directory is the directory service included in the Windows Server 2003 family. Active Directory includes the directory, which stores information about network resources, as well as all the services that make the information available and useful. Active Directory is also the directory service included in Windows 2000.

3)What is the active directory database name and where it is located?

Name : NTDS.Dit located in c:\windows\ntds\

4)What is the expansion of .Dit ? Scalable size of NTDS in 2k3?

Dit – Directory Information Tree. It is scalable up to 70 TB.

5) What is schema in AD?

The Active Directory schema defines objects that can be stored in Active Directory. The schema is a list of definitions that determines the kinds of objects and the types of information about those objects that can be stored in Active Directory. Because the schema definitions themselves are stored as objects, they can be administered in the same manner as the rest of the objects in Active Directory. Normally called schema object or metadata.

6) Structure of AD in 2kX?

1)Physical structure

Sites ,Domain Controllers

2)Logical structures

Forest, Tree, Domain, OU, object

7) What are the domain functional levels in 2k3?

1)Mixed mode

2)Native mode

3)Interim mode

8) What is Global catalog and GC server?

The global catalog is the central repository of information about objects in a tree or forest. By default, a global catalog is created automatically on the initial domain controller in the first domain in the forest. A domain controller that holds a copy of the global catalog is called a global catalog server.

9) What are the functions of GC?

A) It enables a user to log on to a network by providing universal group membership information to a domain controller when a logon process is initiated.

B) It enables finding directory information regardless of which domain in the forest actually contains the data.

10) What is the active directory database engine name?

ESE (Extensible Storage Engine)

11) What are the partitions available in AD?

i) Schema partition

ii) Configuration Partition

iii) Domain Partition

iv)Application Partition

12) What are the two types of replications?

Inter-site (Site to site) and Intra-site (With in site) replications.

13) What is KCC? What is the function of the KCC?

The KCC is a built-in process that runs on all domain controllers. The KCC configures connection objects between domain controllers. Within a site, each KCC generates its own connections. For replication between sites, a single KCC per site generates all connections between sites.

14) What is the two trust protocols 2k3 using?

Kerberos V5 and NTLM

15) What are the trust relations available in 2k3?

Tree-Root , Parent- Child , Shortcut, Realm, Forest trust , External trust

16)What is the hierarchy of applying Gpo in 2k3?

It is applied from parent level to child level in AD.

i) Local GPO

ii) GPOs linked to sites

iii) GPOs linked to domains

iv) GPOs linked to OUs

17) What are the protocols used on replication?

RPC over IP (Used for synchronies transfer) , SMTP over IP (Asynchronies transfer)

18) What is the default time delay on replication?

Intra site – 15 min ( KCC automatically create the topology for Replication)

Inter-site – 1 hrs.

Security related changes replicated immediately across sites.

19) What Different tables available in NTDS database?

i) Schema table

Ii) Link Table

iii) Data table

iv)Configuration Table

19) Where is the FRS logs stored in and what is the database engine name?

c:\windows\ntfrs\jet\log, The engine used is jet database engine. Ntfrs.jdb.

20) What is tombstone object in AD? What is its life time?

Any objects deleted from Active directory will not removed from Database immediately. That object is called tombstone object. The default life time for that object is 60 days. For win 2k3 SP1 180 days

21) FSMO Roles

In a forest, there are at least five FSMO roles that are assigned to one or more domain controllers. The five FSMO roles are

Schema Master:

The schema master domain controller controls all updates and modifications to the schema. To update the schema of a forest, you must have access to the schema master. There can be only one schema master in the whole forest.

Domain naming master

The domain naming master domain controller controls the addition or removal of domains in the forest. There can be only one domain naming master in the whole forest.

Infrastructure Master:

The infrastructure is responsible for updating references from objects in its domain to objects in other domains. At any one time, there can be only one domain controller acting as the infrastructure master in each domain.

Relative ID (RID) Master:

The RID master is responsible for processing RID pool requests from all domain controllers in a particular domain. At any one time, there can be only one domain controller acting as the RID master in the domain.

PDC Emulator

The PDC emulator is a domain controller that advertises itself as the primary domain controller (PDC) to workstations, member servers, and domain controllers that are running earlier versions of Windows.

For example, if the domain contains computers that are not running Microsoft Windows XP Professional or Microsoft Windows 2000 client software, or if it contains Microsoft Windows NT backup domain controllers, the PDC emulator master acts as a Windows NT PDC.

It is also the Domain Master Browser, and it handles password discrepancies. At any one time, there can be only one domain controller acting as the PDC emulator master in each domain in the forest

============================================================

Quicker Q&A

What are the required components of Windows Server 2003 for installing Exchange 2003? - ASP.NET, SMTP, NNTP, W3SVC

What must be done to an AD forest before Exchange can be deployed? - Setup /forestprep

What Exchange process is responsible for communication with AD? - DSACCESS

What 3 types of domain controller does Exchange access? - Normal Domain Controller, Global Catalog, Configuration Domain Controller

What connector type would you use to connect to the Internet, and what are the two methods of sending mail over that connector? - SMTP Connector: Forward to smart host or use DNS to route to each address

How would you optimise Exchange 2003 memory usage on a Windows Server 2003 server with more than 1Gb of memory? - Add /3Gb switch to boot.ini

What would a rise in remote queue length generally indicate? - This means mail is not being sent to other servers. This can be explained by outages or performance issues with the network or remote servers.

What would a rise in the Local Delivery queue generally mean? - This indicates a performance issue or outage on the local server. Reasons could be slowness in consulting AD, slowness in handing messages off to local delivery or SMTP delivery. It could also be databases being dismounted or a lack of disk space.

What are the standard port numbers for SMTP, POP3, IMAP4, RPC, LDAP and Global Catalog? - SMTP – 25, POP3 – 110, IMAP4 – 143, RPC – 135, LDAP – 389, Global Catalog - 3268

Name the process names for the following: System Attendant? – MAD.EXE, Information Store – STORE.EXE, SMTP/POP/IMAP/OWA – INETINFO.EXE

What is the maximum amount of databases that can be hosted on Exchange 2003 Enterprise? - 20 databases. 4 SGs x 5 DBs.

What are the disadvantages of circular logging? - In the event of a corrupt database, data can only be restored to the last backup.

========================================================

1. What are the Default shares in Windows Server 2003?

By default, Windows automatically creates special hidden administrative shares that administrators, programs, and services can use to manage the computer environment or network. These special shared resources are not visible in Windows Explorer or in My Computer, but you can use the Shared Folders tool in Computer Management to view them. Depending on the configuration of your computer, you may see some or all the following special shared resources listed in the Shares folder in Shared Folders:

•

DriveLetter$: Root partitions and volumes are shared as the drive letter name appended with the $ character. For example, drive letters C and D are shared as C$ and D$.

•

ADMIN$: A resource that is used during remote administration of a computer.

•

IPC$: A resource that shares the named pipes that you must have for communication between programs. Note that this resource cannot be deleted.

•

NETLOGON: A resource that is used on domain controllers.

•

SYSVOL: A resources that is used on domain controllers.

•

PRINT$: A resource that is used during the remote administration of printers.

•

FAX$: A shared folder on a server that is used by fax clients during fax transmission.

Note NETLOGON and SYSVOL are not hidden shares but are instead special administrative shares. Generally, Microsoft recommends that you do not modify these special shared resources. However, if you want to remove the special shared resources and prevent them from being created automatically, you can do this by editing the registry.

1. Q) Can I changed password if my machince’s connectivity to DC who holds PDC emulator role has been fails?A) No You cant the password.

Q) i have been asked if there is set of 30 harddisk configured for raid 5 if two harddisk failed what about dataA) It depends how u had configured ur RAID its only Raid5 or with with spare if its only raid 5 then in raid5 if ur 2 nos of HDD goes then ur raid is gone.

Q) How Can i Deploy the Latest Patched in Pc through G.P. wihtout having the Admin Right in Pc.A) Create a batch file and place all the patches in the Netlogon, and deploy the batch file through GP to all the pcs so the same should take affect after restarting the pc.

Q) In Raid 5,Suppose i have 5 HDD of 10-10 GB, After configuring the Raid how much space do i have for utilise.A) -1 out of the total (eg- if u r using 5 u will get only 4 because 1 goes for parity).

Q) How Can i Resolve the Svr name through NslookupA) what exactly u want to do, nslookup command will let u know through which server u r getting routed, (eg- c:\nslookup then u will get ur domain name to which u r getting routed. and if u want to get the name of the pc/server with the ip address then u have to give the command c:\nbtstat -a ip xx-xx-xx-xx)

===========================================================

1. DHCP relay agent where to place it?

Ans: DHCP Relay agent u need to place in Software Router.

Question: How many Zones in Windows 2000 server and Windows 2003 Server ?

Ans: In Windows 2000 there are mainly 3 zones

Standard Primary — zone information is written in Txt fileStandard Secondary — copy of PrimaryActive Directory Integrated– Information stores in Active Directory

In Win2k3 one more zone is added that is Stub zone

–Stub is like secondary but it contains only copy of SOA records, copy of NS records, copy of A records for that zone. No copy of MX, SRV records etc.,With this Stub zone DNS traffic will be low

Question: What is Kerberos? Which version is currently used by Windows? How does Kerberos work?

Answer: Kerberos is the user authentication used in Win2000 and Win2003 Active Directory servers

Kerberos version in 5.0

Port is: 88

It’s more secure and encrypted than NTLM (NT authentication)

1. Which protocol is used for Public Folder?

ANS: SMTP

What is the use of NNTP with exchange?

ANS: This protocol is used the news group in exchange.

1. What is the content of System State backup?

The contents are: Boot files, system filesActive directory (if it’s done on DC)SysVol folder(if it done on DC)Certificate service ( on a CA server)Cluster database ( on a cluster server)registryPerformance counter configuration informationComponent services class registration database

Q: What are the perquisites for installation of Exchange Server?

The prerequisite are

IISSMTPWWW serviceNNTP.NET FrameworkASP.NETThen run ForestprepThen run domainprep

Question: What is Multi Master Replication?

Answer: Multi-master replication is a method of replication employed by databases to transfer data or changes to data across multiple computers within a group. Multi-master replication can be contrasted with a master-slave method (also known as single-master replication).

DFS? DFS Namespace ?

1. DFS Replication. New state-based, multimaster replication engine that is optimized for WAN environments. DFS Replication supports replication scheduling, bandwidth throttling, and a new byte-level compression algorithm known as remote differential compression (RDC).

DFS Namespaces. Technology that helps administrators group shared folders located on different servers and present them to users as a virtual tree of folders known as a namespace. DFS Namespaces was formerly known as Distributed File System in Windows 2000 Server and Windows Server 2003.

What are the four domain functional levels?

Windows 2000 MixedWindows 2000 NativeWindows Server 2003 InterimWindows Server 2003

Windows 2000 Mixed

When you configure a new Windows Server 2003 domain, the default domain functional level is Windows 2000 mixed.Under this domain functional level, Windows NT, 2000, and 2003 domain controllers are supported. However,certain features such as group nesting, universal groups, and so on are not available.

Windows 2000 Native

Upgrading the functional level of a domain to Windows 2000 Native should only be done if there areno Windows NT domain controllers remaining on the network. By upgrading to Windows 2000 Native functional level,additional features become available including: group nesting, universal groups, SID History, and the ability to convertsecurity groups and distribution groups.

Windows Server 2003 Interim

The third functional level is Windows Server 2003 Interim and it is often used when upgrading fromWindows NT to Windows Server 2003. Upgrading to this domain functional level provides support forWindows NT and Windows Server 2003 domain controllers. However, like Windows 2000 Mixed, it does not provide new features.

Windows Server 2003The last functional level is Windows Server 2003. This domain functional level only provides support forWindows Server 2003 domain controllers. If you want to take advantage of all the features included withWindows Server 2003, you must implement this functional level. One of the most important features introducedat this functional level is the ability to rename domain controllers.

source:http://sapost.blogspot.in/2010/09/actice-directory-faq-with-answers.html

Complete Windows Guide

Hello all,

Check the below link for trouble shooting Windows OS, complete information is provided by microsoft.

Click Here

 

FTP Server Creation Procedure

FTP SERVER CONFIGURATION

Ø  Computer connect with existing server (through LAN cable)

Ø  O.S. Windows 2000 Server with IE 6 & SP4 or Windows 2003

Ø  Internal (or) external modem (both end ho and so)

Ø  Parallel phone connection from existing phone (both end HO and SO)

AT HO :

1.                  Install windows 2000 server and 2003 server and create active directory.  Give server name and domain like XXXftpserver, XXXftpdomain.  Give ip number (give running number in your HO domain and not to give your existing HO server IP number)

2.                  Install modem driver and check diagnostics.

3.                  Go to control panel add and remove programs windows components wizard IIS enable all services (ftp transfer protocol ftp service)

4.                  a. Start -+ Program – Admin Tools – Internet Service Manager

b. Click Domain Name – It Shows Server Name

c. Right click the server name – select ‘new’ – select ‘ftp site’ – give name – give IP address (your computer).

d. Give TCP Port – 21 (always)

e. Give path – D:\SBFTP\Received (Create directory)

f. Give permission – read and write – click finish.

(By default created ftp site will be stopped)

g. Right click newly created FTP site – property – check IP address and TCP port and give connections ‘unlimited’.

5.                  a. Select admin tools – routers and remote access

b. Right click server name – configure routing and remote services – click manual selection.

c. Select server name – ports – right click – select property – click selected modem – configure – make tick in ‘inbound only and inbound and out bound’.

d. Give phone number of this server.

6.                  a. Select admin tools – select active directory users and computers.

b. Create a new user (like XXXftp, YYYftp…) and give the password  same in user name.

c. Right click created new user – select ‘dialin’ tab – make tick in ‘allow access’ – select ‘member of’ tab – make the user in domain user and give administrator rights to that user.

d. Create a network user as available in existing server and give Administratory rights (this domain) to that user.

7.                  Check the IIS and RRAS running correctly.

8.                  a. Install MSSQL 2000 client connectivity only (not to install full setup)

b. Click client connectivity – give the server name (existing old server name) alias

9.                  Install Bridge and Plugin. ( Latest 2.5.2 Version)

AT SOS :

10.              Install modem and create a dialup connection with username, password, and phone number created at HO level same as HO.

11.                Install bridge and Plugin (Latest 2.5.2 Version) and configure the FTP.

  

 (Please delete old ‘PATCH’ database   and create new thro ‘SB Plugin’ software)

source:http://sapost.blogspot.in/2011/01/ftp-server-creation-procedure.html

How to Install Active Directory on Windows Server 2003

1. Click Start, click Run, type dcpromo, and then click OK.

2. On the first page of the Active Directory Installation Wizard, click Next.

3. On the next page of the Active Directory Installation Wizard, click Next.

4. On the Domain Controller Type page, click Domain Controller for a new domain, and then click Next.

5. On the Create New Domain page, click Domain in a new forest, and then click Next.

6. On the New Domain Name page, in the Full DNS name for new domain box, type Testdc.com, and then click Next.

7. On the Database and Log Folders page, accept the defaults in the Database folder box and the Log folder box, and then click Next.

8. On the Shared System Volume page, accept the default in theFolder location box, and then click Next.

9. On the DNS Registration Diagnostics page, click Install and configure the DNS server on this computer and set this computer to use this DNS server as its preferred DNS Server, and then click Next.

10. On the Permissions page, click Permissions compatible only with Windows 2000 or Windows Server 2003 operating systems, and then click Next.

11. On the Directory Services Restore Mode Administrator Password page, enter a password in the Restore Mode Password box, retype the password to confirm it in the Confirm password box, and then click Next.

12. On the Summary page, confirm the information is correct, and then click Next.

13. When prompted to restart the computer, click Restart now.

After the computer restarts, log on to testdc as a member of the Administrators group.                              

How to Disable the Shutdown Event Tracker in Server 2003 / 2008?

A nice feature that can sometimes by annoying is the Shutdown Event Tracker, that allows you to comment every time you shut off a server. While I do understand the auditing requirements to have this in place on production server, this feature is unnecessary for development and test servers and can be disabled.

To disable Shutdown Event Tracker we need to open the Group Policy Editor, the Group Policy Editor can be opened from pressing "START > RUN > GPEDIT.MSC " then press ENTER

From the navigation menu on the left side navigate to "Computer Configuration > Administrative Templates > System", then on the right side double click "Display Shutdown Event Tracker"

Change the option from "Not Configured" to "Disabled" > Press "Apply" then press "OK

Note you can also use this to enable Shutdown Event Tracker in Vista although I have no idea why someone would want to do that.

A restart is not required for this change to take effect.

Source : http://mrsupport.blogspot.com/

Windows Server - Groups and Rights

 Windows Server - Groups and Rights

Group	Description	Default user rights
Account Operators	Members of this group can create, modify, and delete accounts for users, groups, and computers located in the Users or Computers containers and organizational units in the domain, except the Domain Controllers organizational unit. Members of this group do not have permission to modify the Administrators or the Domain Admins groups, nor do they have permission to modify the accounts for members of those groups. Members of this group can log on locally to domain controllers in the domain and shut them down. Because this group has significant power in the domain, add users with caution.	Allow log on locally; Shut down the system.
Administrators	Members of this group have full control of all domain controllers in the domain. By default, the Domain Admins and Enterprise Admins groups are members of the Administrators group. The Administrator account is also a default member. Because this group has full control in the domain, add users with caution.	Access this computer from the network; Adjust memory quotas for a process; Back up files and directories; Bypass traverse checking; Change the system time; Create a pagefile; Debug programs; Enable computer and user accounts to be trusted for delegation; Force a shutdown from a remote system; Increase scheduling priority; Load and unload device drivers; Allow log on locally; Manage auditing and security log; Modify firmware environment values; Profile single process; Profile system performance; Remove computer from docking station; Restore files and directories; Shut down the system; Take ownership of files or other objects.
For more User Rights : Download   /    Visit:   http://sapost.blogspot.com/

Installing Active Directory(Domain) in Windows Server 2008

Installing Active Directory Domain Services (AD-DS)

In Windows Server 2008, unlike previous server operating Systems, there is an additional step that needs to be taken before running DCPROMO to promote the server to Domain Controller and installing Active Directory on it. This step is the installation of Active Directory Domain Services (AD-DS) role on the server. In fact, the AD-DS role is what enables the server to act as a Domain Controller, but you will still need to run DCPROMO the regular way.

AD-DS can be installed in one of 3 methods:

Method 1 – Server Manager/Initial Configuration Tasks

Roles can and should be added from Server Manager (but they can also be initiated from the Initial Configuration Tasks wizard that auto-opens the first time you log on to the server).

1. Open Server Manager by clicking the icon in the Quick Launch toolbar, or from the Administrative Tools folder.
2. Wait till it finishes loading, then click on Roles > Add Roles link.

3. In the Before you begin window, click Next.

4. In the Select Server Roles window, click to select Active Directory Domain Services, and then click Next.

5. In the Active Directory Domain Services window read the provided information if you want to, and then click Next.

6. In the Confirm Installation Selections, read the provided information if you want to, and then click Next.

7. Wait till the process completes.

8. When it ends, click Close.

9. Going back to Server Manager, click on the Active Directory Domain Services link, and note that there's no information linked to it, because the DCPROMO command has not been run yet.

10. Now you can click on the DCPROMO link, or read on.
    1. To run DCPROMO, enter the command in the Run command, or click on the DCPROMO link from Server Manager > Roles > Active Directory Domain Services.
    
    2. Depending upon the question if AD-DS was previously installed or not, the Active Directory Domain Services Installation Wizard will appear immediately or after a short while. Click Next.
    
    1. In the Operating System Compatibility window, read the provided information and click Next.
    
    2. In the Choosing Deployment Configuration window, click on "Create a new domain in a new forest" and click Next.
    
    3. Enter an appropriate name for the new domain. Make sure you pick the right domain name, as renaming domains is a task you will not wish to perform on a daily basis. Click Next.
    
    Note: Do NOT use single label domain names such as "mydomain" or similar. You MUST pick a full domain name such as "mydomain.local" or "mydomain.com" and so on.
    The wizard will perform checks to see if the domain name is not already in use on the local network.
    
    4. Pick the right forest function level. Windows 2000 mode is the default, and it allows the addition of Windows 2000, Windows Server 2003 and Windows Server 2008 Domain Controllers to the forest you're creating. Read my "Understanding Windows Server 2008 Active Directory Domain and Forest Functional Levels" article for more information on that.
    
    5. Pick the right domain function level. Windows 2000 Native mode is the default, and it allows the addition of Windows 2000, Windows Server 2003 and Windows Server 2008 Domain Controllers to the domain you're creating.
    
    Note: If you select "Windows Server 2008" for the forest function level, you will Not be prompted to pick a domain function level. Read more about domain and forest function levels on my "Understanding Windows Server 2008 Active Directory Domain and Forest Functional Levels" article.
    6. The wizard will perform checks to see if DNS is properly configured on the local network. In this case, no DNS server has been configured, therefore, the wizard will offer to automatically install DNS on this server.
    
    Note: The first DCs must also be a Global Catalog. Also, the first DCs in a forest cannot be a Read Only Domain controller.
    7. It's most likely that you'll get a warning telling you that the server has one or more dynamic IP Addresses. Running IPCONFIG /all will show that this is not the case, because as you can clearly see, I have given the server a static IP Address. So, where did this come from? The answer is IPv6. I did not manually configure the IPv6 Address, hence the warning. In a network where IPv6 is not used, you can safely ignore this warning.
    
    8. You'll probably get a warning about DNS delegation. Since no DNS has been configured yet, you can ignore the message and click Yes.
    
    9. Next, change the paths for the AD database, log files and SYSVOL folder. For large deployments, carefully plan your DC configuration to get the maximum performance. When satisfied, click Next.
    
    10. Enter the password for the Active Directory Recovery Mode. This password must be kept confidential, and because it stays constant while regular domain user passwords expire (based upon the password policy configured for the domain, the default is 42 days), it does not. This password should be complex and at least 7 characters long. I strongly suggest that you do NOT use the regular administrator's password, and that you write it down and securely store it. Click Next.
    
    11. In the Summary window review your selections, and if required, save them to an unattend answer file. When satisfied, click Next.
    
    12. The wizard will begin creating the Active Directory domain, and when finished, you will need to press Finish and reboot your computer.
    
    Ok Click to restart. There you installed the new active directory
    source:www.petri.co.il
    via- sa paravur