DNS server loses all interfaces

Symptoms:

Cause:
Possibly by multi-homed network card

Solution:
dnscmd servername /ResetListenAddresses

Microsoft Management Console: "An attempt was made to reference a token that does not exist"

Symptoms:
"An attempt was made to reference a token that does not exist" when open Administrative Tools

Cause:
Broken Link or corrupt file

Solution:
Run a Command Prompt in ELEVATED MODE

Navigate to %WINDIR%\System32

Re-register the required DLL files using the following command:

For /F %s in ('dir /b *.dll') do regsvr32 /s %s

Synchronize Windows Server 2008 (R2) PDC time with external NTP server

PDC need to synchronize to reliable external time source and other member need to synchronize to this PDC only.

For PDC
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config\AnnounceFlags
DWORD Value, type 5

net stop w32time

w32tm /config /syncfromflags:manual /manualpeerlist:"0.pool.ntp.org,0x1 1.pool.ntp.org,0x1 2.pool.ntp.org,0x1”  /reliable:yes /update

w32tm /resync /rediscover

net start w32time

you can check result from:
- Event Viewer
- w32tm /stripchart /computer:id.pool.ntp.org /samples:2 /dataonly
  error: 0x800705B4 means timeout or no access to NTP server
- w32tm /query /configuration    and look for NTP server value
- HKLM\System\CurrentControlSet\services\W32Time\Parameters NTPServer value

to reset back to default
net stop w32time
w32tm /unregister
w32tm /register
net start w32time


For other DC
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config\AnnounceFlags

DWORD Value, type A

net stop w32time

w32tm /config /syncfromflags:DOMHIER /update

w32tm /resync /nowait /rediscover

net start w32time

Migrating 2003 AD to 2008 R2 (Part 1)

Force promote DC2 as PDC when DC1 who hold FSMO roles no longer exist

Symptoms:
Want to migrate DC from Windows 2003 server to Windows 2008 R2 server. But DC1 who hold PDC no longer exist.

Solution:
Force moving FSMO to DC2 using ntsdutil

1. ntdsutil
2. roles
3. connections
4. connect to server DC2
5. quit
6. seize PDC
7. seize schema master
8. seize RID master
9. seize infrastructure master
10. seize domain naming master
11. quit

Remove DC1 from AD using ntdsutil

1. ntdsutil
2. metadata cleanup
3. connections
4. connect to server DC2
5. quit
6. select operation target
7. list domains
8. select domain 0
9. list sites
10. select site 0
11. list servers in site
12. select server DC1
13. quit
14. remove selected server
15. Confirm by click YES in message box (make sure removing DC1 server)

Remove any trails of DC1 record in:

1. Active Directory Sites and Services
1. remove from server object
2. Active Directory Users and Computers
1. remove from server object
3. DNS
1. remove all DC1 ip records
2. remove from replicate

Export and Import a readable DHCP scope

Export:

Readable:

netsh dhcp server \\SERVERNAME dump all > filename.txt

Unreadable:

netsh dhcp server \\SERVERNAME export d:\filename all

Full Export with policies (2012) using PS with Administrator Rights

Export-DhcpServer -ComputerName SERVERNAME -File "D:\filename.xml" -Force

Import:

Full Import with policies (2012) using PS with Administrator Rights

Import DhcpServer -ComputerName SERVERNAME -File "D:\filename.xml" -Force

for New 2003 server format

netsh exec filename.txt

for 2000 server format

netsh dhcp server import filename.txt all

Authorize:

1. Activate

2. Authorized from currently authorized DHCP server

SYSVOL and NETLOGON location

SYSVOL and NETLOGON are the shared from \\DOMAIN.NAME


Share name     SYSVOL
Path              C:\WINDOWS\sysvol\sysvol
Remark            Logon server share
Maximum users     No limit
Users
Caching           Manual caching of documents
Permission        Everyone, READ
                  BUILTIN\Administrators, FULL
                  BUILTIN\Authenticated Users, FULL


Share name        NETLOGON
Path              C:\WINDOWS\sysvol\sysvol\DOMAIN.NAME\SCRIPTS
Remark            Logon server share
Maximum users     No limit
Users
Caching           Manual caching of documents
Permission        Everyone, READ
                  BUILTIN\Administrators, FULL

fSMORoleOwner location on ADSIedit

- Domain []
   -- DC (properties)

- Domain []
   -- DC
       --- CN=Infrastructure (properties)

- Schema []
   -- CN=Schema (properties)

- Configuration []
   -- CN=Partitions (properties)

Ncomputing over windows 2003 server problem and solution

Symptom

Error “Server yet not ready, try again a bit later” an error where the hpvcard.dll failed to initialize.

Solution 1

Add the following key to the host:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management]
“SessionImageSize”=dword:00000020

Solution 2

Remove Security Update KB956572 also remove update KB958690

Symptom

Error "to log on to this remote computer, you must be granted the Allow log on through Terminal Services right. By default, members of the Remote Desktop Users group have this right. If you are not a memeber of the Remote Desktop Users group or another group that has this right , or if the Remote Desktop Users group doesn not have this right, you must be granted this right manually"

Solution 1 

Add user to Remote Desktop User Group

Solution 2 

Configure the security setting in Default Domain Controller Policy GPO:

1.    Run gpmc.msc  to open the Group Policy Management console.
2.    Expand  Domain Controllers, right-click Default Domain Controller Policy, and click Edit.
3.    In the Group Policy Management Editor window, expand Computer Configuration\Windows Settings\Security Settings\Local Policies\User Right Assignment\Allow log on locally
4.    Add User or Group and click OK three times to apply the settings.
5.    Run gpupdate /force to apply the policy.

Renewing the self-signed certificate Exchange Server 2007:

Exchange Server 2007 need to renewal a self-signed certificate for use with services like SMTP,IMAP, POP, IIS and Um every one year.


1. Find out your exchange certificate thumbprint with full information and services list
Get-ExchangeCertificate -domain “yourdomain.com” | fl


2. Get a new certificate with a new expiration date and an exportable private key:
Get-ExchangeCertificate -thumbprint “your_old_thumb_print” | New-ExchangeCertificate -PrivateKeyExportable $true


3. Type Y to continue creation of certificate. It'll show new thumbprint


4.  Check services of new certificate:
Get-ExchangeCertificate -thumbprint “your_new_thumb_print” |fs


5. To add required/missing services:
Enable-ExchangeCertificate -thumbprint “your_new_thumb_print” -services IIS


6. To remove invalidates/expired certificate
Remove-ExchangeCertificate -thumbprint “your_old_thumb_print”




You need to Publish them to ISA for WebMail user
1. Using MMC from your mailserver
2. Add/Remove Snap-in > Add > Certificates > Local
3. Under Personal/Certificates, Select Your New Certificate
4. Right Click > All Tasks > Export > Next
5. Select Yes to export  the private key
6. Provide password and check required option
7. It generated PFX file
8. Generated CER and/or P7B if required
9. Import to Trust
10. Under Trust/Certificate Right Click > All Tasks > Import > Next
11. Chose the CER file
12. Same Snap-in for your ISA server
13. Right Click > All Tasks > Import > Next
14. Chose the PFX file
15. Import to trust
16. Open ISA Server Management
17. ISAServer > Firewall Policy > Webmail
18. Double click Mail Listener
19. From Certificate tab, Select Certificate
20. Select your new and active certificate then Apply

Old DHCP Servers appear in the list of Authorized servers

Symptoms:

1. You may see the old server’s name still listed when you view DHCP Authorized servers

2. You may get the following error: "There is no such object on the server” when tried to unauthorized

Solution:

Remove the objects from Active Directory using ADSIEDIT:
1. Start Adsiedit.msc.
2. Open the configuration Container.
3. Expand Services.
4. Expand Net Services.
5. On the right hand side, find a record named CN=DHCPRoot
6. Right Click the CN=DhcpRoot entry and then click Properties
7. Highlight DhcpServers Attribute and click Edit
8. Highlight the entry with the old Domain name and click Remove from DHCPServers Attribute. Click OK to close DHCPServers editor’s screen
9. Once deleted the DHCPServers value will be “not set"
10. Save the change by clicking OK and close Adsiedit.
11. Restart the DHCP server service
12. run the following command: “Netsh DHCP show server” to check
13. If the servers are still listed, run the command “netsh DHCP delete server ServerFQDN ServerIPAddress”

Symptoms:
Users who would like to prevent worms which execute without any user interaction using an “AutoRun.inf” file, can disable the Windows AutoRun feature completely with the help of the Windows group policy editor (Gpedit.msc). This would be helpful to stop USB virus spreading.

If you want to disable using GPO for all clients under Active Directory, follow instruction to access that http://iwan-it-admin-tips.blogspot.com/2009/01/domain-group-policies-edit.html

Solution:
Group Policy
>Local Computer Policy
>>Computer Configuration
>>>Administrative Templates
>>>>System
>>>>>Turn off Autoplay - Enabled

Do the same for User Configuration

For AD:
Group Policy Object Editor
>Default Domain Controllers Policy [sever name] Policy
>>Computer Configuration
>>>Administrative Templates
>>>>System
>>>>>Turn off Autoplay - Enabled

Do the same for User Configuration

How to access Domain Group Policies

Symptoms:
Need to Apply Domain Group Policies for AD Windows server 2003 R2 sp2 ?

Solution:
1. Administrative Tools > Active Directory Users and Computers.
2. In the left console tree, right-click the name of the domain to which the policy is applied, and then click Properties.
3. From Group Policy Tabs, Choose Default Domain Policy continue by click Edit Button

Beside this, you can upgrade to Group Policy Management Console (GPMC) to improve.