Windows 2008 has bring two more function level to domain controller compatibility in Microsoft Domain World. More and more, I consider the function level or mode ( for exchange ) as part of backward compatibility that Windows has to deal with when new mode is co-exist with olde mode and replace the old mode eventually. The consequence of raise function level / mode is that you can not have a old version domain controller join in this domain/forest/exchange organization any more. That is it, raising the function level lose the backward compatibility when come to what version of domain control can join in the same active directory.
Of course, raising function level is not a reversible change. You can not roll back the change. The raise open up the advance feature the new version come with.
Note: Network clients can authenticate or access resources in the domain or forest without being affected by the Windows Server 2003 domain or forest functional levels. These levels only affect the way that domain controllers interact with each other.
Daniel Petri has an excellent article cover this topic.
http://www.petri.co.il/understanding_function_levels_in_windows_2003_ad.htm
Showing posts with label Active Directory. Show all posts
Showing posts with label Active Directory. Show all posts
Friday, June 26, 2009
Thursday, June 18, 2009
csvde utility can import/export AD objects but not able to modify
This link below contain best example and learning points on CSVDE utility to create AD objects in a batch import/export way.
http://www.computerperformance.co.uk/Logon/Logon_CSVDE_Export.htm
I have used the /i switch to import about 500 plus objects , and it finished in a flash of time. The process also create a log that is easy to read and useful. For export, the permission is "list content" so normal user account that allow to brower AD object such as computer /printer/user will be able to use this tool to export a huge list of information. I often compare this tool with Adexplorer snapshot taken function. Each has its advantage to use.
http://www.computerperformance.co.uk/Logon/Logon_CSVDE_Export.htm
I have used the /i switch to import about 500 plus objects , and it finished in a flash of time. The process also create a log that is easy to read and useful. For export, the permission is "list content" so normal user account that allow to brower AD object such as computer /printer/user will be able to use this tool to export a huge list of information. I often compare this tool with Adexplorer snapshot taken function. Each has its advantage to use.
Steps to restore a system state for Active Directory
How to restore for AD? you cannot restore the System State Data while the
Active Directory is running. Thus, you need to boot the computer into Directory
Services Restore Mode. This is similar to Safe Mode and will not start the Active
Directory. Be aware that during this time the machine won't act as a DC and won't
perform functions such as authentication. To restore the System State Data after
starting the computer in Directory Services Restore Mode:
1. Start NT Backup.
2. Select the Restore tab.
3. Select the backup media, and select System State.
4. Click Start Restore.
5. Click OK in the confirmation dialog box.
6. Reboot the computer into normal mode.
Active Directory is running. Thus, you need to boot the computer into Directory
Services Restore Mode. This is similar to Safe Mode and will not start the Active
Directory. Be aware that during this time the machine won't act as a DC and won't
perform functions such as authentication. To restore the System State Data after
starting the computer in Directory Services Restore Mode:
1. Start NT Backup.
2. Select the Restore tab.
3. Select the backup media, and select System State.
4. Click Start Restore.
5. Click OK in the confirmation dialog box.
6. Reboot the computer into normal mode.
Active Directory restore and ntdsutil.exe
Because Active Directory uses multimaster replication to synchronize all the DC
databases throughout an Active Directory domain, performing a normal restore is not
sufficient when objects such as user accounts, groups, or organizational units get
accidentally deleted or incorrectly modified. All objects in Active Directory are assigned
Update Sequence Numbers (USNs) that determine which objects are the most up to date
when replication occurs between DCs. After you perform a normal, or nonauthoritative,
with older USNs will become deleted again when the DC is restarted in normal mode and
replication takes place. To ensure that the restored Active Directory objects do not get
deleted again via replication, you must use the ntdsutil.exe command-line tool to mark
the restored Active Directory objects as authoritative while the computer is still in
Directory Services Restore Mode. Run this tool before the server restart.
When an object is marked for authoritative restore its update sequence number is changed so that it is higher than any other update sequence number in the Active Directory replication system.
This will ensure that any replicated or distributed data that you restore is properly
replicated or distributed throughout your organization.
databases throughout an Active Directory domain, performing a normal restore is not
sufficient when objects such as user accounts, groups, or organizational units get
accidentally deleted or incorrectly modified. All objects in Active Directory are assigned
Update Sequence Numbers (USNs) that determine which objects are the most up to date
when replication occurs between DCs. After you perform a normal, or nonauthoritative,
with older USNs will become deleted again when the DC is restarted in normal mode and
replication takes place. To ensure that the restored Active Directory objects do not get
deleted again via replication, you must use the ntdsutil.exe command-line tool to mark
the restored Active Directory objects as authoritative while the computer is still in
Directory Services Restore Mode. Run this tool before the server restart.
When an object is marked for authoritative restore its update sequence number is changed so that it is higher than any other update sequence number in the Active Directory replication system.
This will ensure that any replicated or distributed data that you restore is properly
replicated or distributed throughout your organization.
How to promote a domain controller from backup media
When you install a domain controller for the new branch office, the DCPROMO
process needs to replicate a copy of the Active Directory from an existing domain
controller. Due to the need to minimize network traffic, Window Server 2003 offers
the DCPROMO /ADV option. This is used to promote a domain controller and copy
the Active Directory from a backup copy. To deploy an additional domain
controller in an existing domain, you can either let replication copy domain
information from an existing source domain controller over the network or you can
use the install from media feature, new in Windows Server 2003. Install from media
allows you to pre-populate Active Directory with System State data backed up from
an existing domain controller. This backup can be present on local CD, DVD, or
hard disk partition. Installing from media drastically reduces the time required to
install directory information by reducing the amount of data that is replicated over
the network. Installing from media is most beneficial in environments with very
large domains or for installing new domain controllers that are connected by a slow
network link. To use the install from media feature, you first create a backup of
System State from the existing domain controller, and then restore it to the new
domain controller by using the Restore to Alternate location option.
To install Active Directory on the second domain controller:
1. Log on to the Windows Server 2003-based member server.
2. If you want to copy domain information from restored backup files, at the command
line, type: dcpromo /adv
References:
http://www.microsoft.com/resources/documentation/WindowsServ/2003/all/deployguide/en-us/Default.asp?u
process needs to replicate a copy of the Active Directory from an existing domain
controller. Due to the need to minimize network traffic, Window Server 2003 offers
the DCPROMO /ADV option. This is used to promote a domain controller and copy
the Active Directory from a backup copy. To deploy an additional domain
controller in an existing domain, you can either let replication copy domain
information from an existing source domain controller over the network or you can
use the install from media feature, new in Windows Server 2003. Install from media
allows you to pre-populate Active Directory with System State data backed up from
an existing domain controller. This backup can be present on local CD, DVD, or
hard disk partition. Installing from media drastically reduces the time required to
install directory information by reducing the amount of data that is replicated over
the network. Installing from media is most beneficial in environments with very
large domains or for installing new domain controllers that are connected by a slow
network link. To use the install from media feature, you first create a backup of
System State from the existing domain controller, and then restore it to the new
domain controller by using the Restore to Alternate location option.
To install Active Directory on the second domain controller:
1. Log on to the Windows Server 2003-based member server.
2. If you want to copy domain information from restored backup files, at the command
line, type: dcpromo /adv
References:
http://www.microsoft.com/resources/documentation/WindowsServ/2003/all/deployguide/en-us/Default.asp?u
AD and Server system recovery
From Directory Services Restore Mode you can choose whether to do an authoritative or
non-authoritative restore of the Active Directory database.
During a normal restore operation, Backup operates in non-authoritative restore mode.
This means that any data you restore, including Active Directory objects, will have their
original update sequence number. The Active Directory replication system uses this
number to detect and propagate Active Directory changes among the servers in your
organization. Thus, any data that is restored non-authoritatively will appear to the Active
Directory replication system as though it is old, which means the data will never be
replicated to your other servers. Instead, if newer data is available from your other
servers, the Active Directory replication system will use this to update the restored data.
Following is the procedure to recover from a system failure using ASR: ( note that ASR only backup necessary system data that can recover a system, and it doesn't backup user data; thus this is not need to be routine backup plan)
1. Collect the following:
1. The Windows 2003 CD-ROM.
2. The ASR floppy disk.
3. The ASR backup media.
2. Boot from the Windows 2003 CD-ROM.
3. Press F2 at the beginning of text mode setup, when prompted.
4. When prompted, insert the ASR floppy disk.
5. Follow the on-screen instructions.
6. Continue to follow the on-screen instructions
A: System State - The System State data includes the registry, COM+ Class Registration
database, files under Windows File Protection, and system boot files. Depending on the
configuration of the server, other data may be included in the System State data. For
example, if the server is a certificate server, the System State will also contain the
Certificate Services database. If the server is a domain controller, Active Directory and
the SYSVOL directory are also contained in the System State data.
C: NETLOGON is used for backward compatibility with Windows NT 4.0 and Windows
9x computers that do not have the Active Directory client software installed.
D: NTDSutil is used to recover deleted objects in Active Directory by marking those
objects as authoritative, following a normal, or non-authoritative, restore of the System
State with the Backup Utility. The ntdsutil command is used to perform an authoritative
restore of Active Directory. The ntdsutil is used to mark the restored Active Directory database as authoritative.
- Configure Volume shadow copy and deploy client software to user via GPO
Volume shaow copies are used to provide copy data at a given point in time.
To use shadow copies, client computers need special software installed.
The Previous Versions Client can be installed through a Windows Installer Package
that is located on your Windows Server 2003 machine in \system32\clients\twclient\
of the systemroot directory (typically named WINDOWS).After it is installed, this
tool enables users to access previous versions of files that were included in a shadow
copy.
You can deploy the Previous Versions Client installation package through Group Policy.
When performing a backup, the Windows Server 2003 Backup utility by default creates a
volume shadow copy, which is a duplicate of the volume at the time the copy process
began. This enables the Backup utility to back up all selected files, including those that
are currently open by users or the operating system. Because the Backup utility uses a
volume shadow copy, it ensures that all selected data is backed up and any open files are
not corrupted during the process. If "Disable Volume Shadow Copy" check box is checked, files that is open or in use is skipped when the backup is performed.
non-authoritative restore of the Active Directory database.
During a normal restore operation, Backup operates in non-authoritative restore mode.
This means that any data you restore, including Active Directory objects, will have their
original update sequence number. The Active Directory replication system uses this
number to detect and propagate Active Directory changes among the servers in your
organization. Thus, any data that is restored non-authoritatively will appear to the Active
Directory replication system as though it is old, which means the data will never be
replicated to your other servers. Instead, if newer data is available from your other
servers, the Active Directory replication system will use this to update the restored data.
Following is the procedure to recover from a system failure using ASR: ( note that ASR only backup necessary system data that can recover a system, and it doesn't backup user data; thus this is not need to be routine backup plan)
1. Collect the following:
1. The Windows 2003 CD-ROM.
2. The ASR floppy disk.
3. The ASR backup media.
2. Boot from the Windows 2003 CD-ROM.
3. Press F2 at the beginning of text mode setup, when prompted.
4. When prompted, insert the ASR floppy disk.
5. Follow the on-screen instructions.
6. Continue to follow the on-screen instructions
A: System State - The System State data includes the registry, COM+ Class Registration
database, files under Windows File Protection, and system boot files. Depending on the
configuration of the server, other data may be included in the System State data. For
example, if the server is a certificate server, the System State will also contain the
Certificate Services database. If the server is a domain controller, Active Directory and
the SYSVOL directory are also contained in the System State data.
C: NETLOGON is used for backward compatibility with Windows NT 4.0 and Windows
9x computers that do not have the Active Directory client software installed.
D: NTDSutil is used to recover deleted objects in Active Directory by marking those
objects as authoritative, following a normal, or non-authoritative, restore of the System
State with the Backup Utility. The ntdsutil command is used to perform an authoritative
restore of Active Directory. The ntdsutil is used to mark the restored Active Directory database as authoritative.
- Configure Volume shadow copy and deploy client software to user via GPO
Volume shaow copies are used to provide copy data at a given point in time.
To use shadow copies, client computers need special software installed.
The Previous Versions Client can be installed through a Windows Installer Package
that is located on your Windows Server 2003 machine in \system32\clients\twclient\
of the systemroot directory (typically named WINDOWS).After it is installed, this
tool enables users to access previous versions of files that were included in a shadow
copy.
You can deploy the Previous Versions Client installation package through Group Policy.
When performing a backup, the Windows Server 2003 Backup utility by default creates a
volume shadow copy, which is a duplicate of the volume at the time the copy process
began. This enables the Backup utility to back up all selected files, including those that
are currently open by users or the operating system. Because the Backup utility uses a
volume shadow copy, it ensures that all selected data is backed up and any open files are
not corrupted during the process. If "Disable Volume Shadow Copy" check box is checked, files that is open or in use is skipped when the backup is performed.
Subscribe to:
Posts (Atom)