Directory Partitions in Active Directory:

We will discuss on the directory partitions in active directory and its purpose served in the windows domain environment. The active directory database is logically separated into directory partitions:

• Schema partition

• Configuration partition

• Domain partition

• Application partition

Each partition is a unit of replication, and each partition has its own replication topology. Replication occurs between replicas of directory partition. Minimum two directory partitions are common among all domain controllers in the same forest: the schema and configuration partitions. All domain controllers which are in the same domain, in addition, share a common domain partition.

Schema Partition

1. Only one schema partition exists per forest.

2. The schema partition is stored on all domain controllers in a forest.

3. The schema partition contains definitions of all objects and attributes that you can create in the directory, and the rules for creating and manipulating them.

4. Schema information is replicated to all domain controllers in the attribute definitions.

Configuration Partition

1. There is only one configuration partition per forest.

2. Second on all domain controllers in a forest.

3. The configuration partition contains information about the forest-wide active directory structure including what domains and sites exist, which domain controllers exist in each forest, and which services are available.

4. Configuration information is replicated to all domain controllers in a forest.

Domain Partition

1. Many domain partitions can exist per forest.

2. Domain partitions are stored on each domain controller in a given domain.

3. A domain partition contains information about users, groups, computers and organizational units.

4. The domain partition is replicated to all domain controllers of that domain. All objects in every domain partition in a forest are stored in the global catalog with only a subset of their attribute values.

Application Partition

1. Application partitions store information about application in Active Directory.

2. Each application determines how it stores, categorizes, and uses application specific information. To prevent unnecessary replication to specific application partitions, you can designate which domain controllers in a forest host specific application partitions. Unlike a domain partitions, an application partition cannot store security principal objects, such as user accounts. In addition, the data in an application partition is not stored in the global catalog.

As an example of application partition, if you use a Domain Name System (DNS) that is integrated with Active Directory you have two application partitions for DNS zones -- ForestDNSZones and DomainDNSZones:

• ForestDNSZones is part of a forest. All domain controllers and DNS servers in a forest receive a replica of this partition. A forest-wide application partition stores the forest zone data.

• DomainDNSZones is unique for each domain. All domain controllers that are DNS servers in that domain receive a replica of this partition. The application partitions store the domain DNS zone in the DomainDNSZones.

Each domain has a DomainDNSZones partition, but there is only one ForestDNSZones partition. No DNS data is replicated to the global catalog server.

The below are some useful commands related to the application partitions in NTDSUTIL,

Creating and deleting application directory partitions,

#CREATE NC dc=application,dc=example,dc=com server.example.com

Or

#CREATE NC dc=application,dc=example,dc=com null

#DELETE NC dc=application,dc=example,dc=com

Creating and deleting replicas,

#ADD NC REPLICA dc=application,dc=example,dc=com server2.example.com

Or

#ADD NC REPLICA dc=application,dc=example,dc=com null

#REMOVE NC REPLICA dc=application,dc=example,dc=com server2.example.com

Or

#REMOVE NC REPLICA dc=application,dc=example,dc=com null

Defining a replication schedule,

#SET NC REPLICATE NOTIFICATION DELAY dc=application,dc=example,dc=com 10 15

Displaying replica information,

#LIST NC REPLICAS dc=application,dc=example,dc=com

Thanks

Logan

Adding Domains to Exchange Hosting

This article explains how to add multiple domain to exchange hosting. Exchange server can be used for hosting the email account for different domains irrespective of the current domain.

For example, suppose i have implemented exchange server for domain called domain.com and user account will be xyz@domain.com. After multiple domains for exchange hosting enables to have the virtual domain email accounts such as xyz@domain1.com, xyz@domain2.com, etc.

1. Create a OU called domain1.com.

2. Create a group with the scope as Universal and type as Distribution, name it as domain1-all. Also, create an exchange email address with the same name as that of the group name(By default will have the same name).

3. Edit the domain1-all group property - edit the default smtp address from domain1-all@domain.com to domain1-all@domain1.com.

4. Create new recipient policy - name the policy as domain1.com, create new SMTP address as @domain1.com and make it as primary , leave @domain1.com as secondary.

5. Create the filter rules for domain1.com policy as below in the advanced LDAP query
(&(&(&(&(objectCategory=*)(memberOf=CN=domain1-all,OU=domain1.com,DC=domain,DC=com)))))

The analogy behind the above LDAP query is to query the object stored inside the domain1.com OU.

6. Create the GAL(Global address list) for this domain. Name the new GAL as domain1.com and in the filter rule option use advanded menu to find the Email address ends with @domain1.com option.

7. Open the ADSIEdit.msc, Choose Domain-->DC=domain,DC=com-->OU=domain1.com-->right click property-->In attribute editor section, edit uPNSuffixes to domain1.com.

8. Try to create new user, check the drop down box near the logon name button will have @domain.com and @domain1.com in the drop down list.

So we conclued that in the domain.com email server, domain1.com email domain is hosted successfully.

Thanks
Logu
logu_microsoft@hotmail.com
91-98414-99143

Hardening Exchange server

This articles list of steps that needs to be followed in the exchange server environment for hardening.

1. Basic security best practise like antivirus,secure password,correct privillage for the users,latest service packs and patches,stopping unnessary services,event logging,monitoring,basic firewall policies,good backup and restore plan,etc.

2. Full Knowledge of your infrastructure and network layouts.

3. Status of the ports that are open in the front end.

4. Aware of different types of attacks like data theft,tampering,forgery,Denial of services,Trojon horse,Virus,Spoofing,Mail-relaying,etc,.

5. Assigning proper administrative roles and delagation policy.

6. Enabling all possible logging like audit logs,security logs,SMTP, logs,http logs,etc.

7. Use of Security configuration wizard availbale server 2003 SP1.

8. Effective usage of exchnage security template based on server roles.

9. Updating the Exchange server with related updates,patches,hotfixes,service packs.

10. Maintaining strong firewall in the front end.

11. Strong SMTP settings.

12. Intelligent spam filter or other third party spam solution products.

13. Restricting the distribution list properties.

14. Securing the client.

15. ExBPA(Exchange Best Practice Analysis tool).

Thanks
Logu
logu_microsoft@hotmail.com
91-98414-99143

Exchange Backup - Online vs Offline

Hi friends,

This article explains the two different strtegy available in the exchange 2000 and 2003 server. The Netbackup is the backup tool used for backup and restore in the windows environment with excellent features.

Backup exchange 2000/2003 in 2 ways: Online backup and Offline backup.

Online Backup:

An Online backup is performed while the Information Store is still mounted and the Exchange server is operational. The Exchange is Online and available for transactions, therefore it still allows users to work without interruption. Online backups also automatically clear the database logs upon completion.

Another major advantage of the Online backup method is the fact that the Exchange store is checked for corruption at the file-system level. This check is done by verifying the checksums on each 4 KB (Kilobyte) block or page in the database. If there is a checksum failure, backup will terminate. Exchange will not allow you to back up an Exchange store with a wrong checksum in it.

Therefore, after an online backup is complete, you should check the Event Viewer to find out whether your Exchange store is corrupted. If you see a failed backup with a page read error event in Event Viewer, this may be an early indication of a problem in the database.

Offline Backup:

Offline backup is performed by shutting down the Exchange Information Store service and performing COPY procedures on the Exchange databases (Public Folder or Mailbox stores). Using an Offline Backup provides a method to restore the Exchange system to its last known state or specific "point in time", and is usually considered to be less attractive than the Online backup.

However, you may need to perform an Offline backup in the following situations:

* Your Online backup failed. You can complete an Offline backup in situations where an Online backup might fail (for example, due to an error such as a checksum1018 JET_errReadVerifyFailure).
* Your backup software does not support Exchange Online backup APIs, requiring you to dismount the Exchange 2000/2003 mailbox and public folder stores before you backup the server.

Some disadvantages to performing an Offline backup include:

* You must stop IS services (You do not need to stop the IS if you only want to backup the store, for that you can simply just dismount it. However if you want to backup the log files you do need to stop the IS service).
* Users will not be able to access their mailboxes during the offline backup.
* Log files that contain transactions already written to the database files will not be purged after the completion of the backup.
* The database is not checked for corruption during an Offline backup. You might have a corrupt database and backup sets that cannot be used to restore your server to full functionality.
* An increased chance of data loss due to files being copied to and from a backup location.

Thanks
Logu
logu_microsoft@hotmail.com
91-9841499143

Moving 2003 Domain Controller to new machine

Hi friends

This article explains the steps to be followed when moving 2003 DC from to new built server machine. In small organisation, after some period moving DC to new server hardware happens in common. The following gives you the step by step procedure for moving domain controller to the new hardware.

Let us consider the servername as oldserver and newserver and domainname as test.com. The oldserver is the PDC with active directory integrated DNS.

Initail configuration of newserver:

1. Install the server OS, latest SP and patches.
2. Join in test.com domain.

Configure as Additional DC:

Use Dcpromo to promote the newserver as the additional domain controller.

Configuring DNS Server:

Install DNS in newserver as primary active directory integrated by giving the domain name as test.com. Add oldserver as name server and also in vice versa. Allow zone transfer between the name servers. After some time, ie, once the replication is over, change the oldserver as secondary dns server. Now the name resolution part is complete.

Test Connectivity with DCDIAG:

Use Dcdiag.exe support tool to test the connectivity between the DC's.

Role Transfer:

Now using the ntdsutil, we transfer the roles from the oldserver to the newserver.

C:\ntdsutil
Ntdsutil: roles
Fsmo maintenance: connections
Server connections: connect to server servername
Server connections: q
Fsmo maintenance: Transfer domain naming master or
Transfer infrastructure master or
Transfer PDC or
Transfer RID master or
Transfer schema master


Test the role transfer succesful completion sattus using the below command

dumpfsmos servername (here in our eg, dumpfsmos newserver)

Now, the newserver is your primary domain controller for the domain test.com

Thanks

Logu
logu_microsoft@hotmail.com
91-98414-99143

Quick Reboot - Exchange 2000 or 2003 / DC Server

The reboot time of exchange server machine generaly takes time and in Domian controller it takes more time. To enable the quick reboot for the exchange server follow the below steps.

1. Create a batch file called ExchShutdown.bat.

Open notepad and type the following
net stop MSExchangeES /y
net stop MSExchangeIS /y
net stop MSExchangeMTA /y
net stop MSExchangeSA /y
net stop WinHttpAutoProxySvc /y

2. Open the gpedit.msc
Computer settings --> windows settings --> Scripts(startup/shutdown) --> right pane - shutdown properties --> add --> Choose ExchShutdown.bat

3. Close all and run gpupdate to refresh the group policy.

The procedure is completed.

Thanks
Logu
logu_microsoft@hotmail.com
91-98414-99143

IMF - Intelligent Message Filter

Hi friends

This articles explains the functions, working and configuration of IMF in windows exchange mail environment.

IMF:
Microsoft Exchange Intelligent Message Filter is a product developed by Microsoft to help companies reduce the amount of unsolicited commercial e-mail (UCE), or spam, received by users.

Intelligent Message Filter is based on Microsoft SmartScreen Technology from Microsoft Research. By using e-mail characteristics tracked by SmartScreen technology, Intelligent Message Filter can help determine whether each incoming e-mail message is likely to be spam. Based on this likelihood, you can choose to block e-mail messages at the gateway or at the mailbox store.

Avialability:
IMF is one of the new feature available in exchange 2003 when compared with exchange 2000.

In Exchange Server 2003 with SP2:
It is an integral part of the SP2 pack. IMF is located in the path Exchange System Manager --> Global settings --> message delivery --> properties.

In Exchange Server 2003 with SP1:
It is also an integral part of the SP1 pack. But, IMF is located in the path System Manager --> Administrative groups --> First administrative group --> servers --> active servername --> Protocols --> SMTP --> Intelligent Message Filtering --> properties.

In Exchange Server 2003 without SP1/SP2:

1. Download ExchangeIMF.msi file from the microsoft site.
2. Accept the License Agreement, and in the screen, select to install both the Management Tools for IMF and the IMF Functionality.
3. Click Finish.
4. Restart the services SMTP, NNTP, Exchange POP3, Exchange IMAP, Exchange Routing engine and FTP publishing services.

Configuring IMF:

Configuring Intelligent Message Filter involves two settings:

1. Gateway Blocking Configuration - In Gateway Blocking Configuration, you establish a threshold based on a spam confidence level (SCL) rating above which the gateway server takes action on the message. You also define the type of action you want the gateway to take.

2. Store Junk E-mail Configuration - In Store Junk E-mail Configuration, you define the thresholds based on an SCL rating that Microsoft Exchange 2003 mailbox stores use to determine whether to deliver messages to a user's Inbox or Junk E-mail folder.

Thanks

Logu
logu_microsoft@hotmail.com
91-98414-99143

Configuring SSL for IIS

Hi friends,

This article explains how to configure your IIS based website to communicate with the secure socket layer shortly called as SSL. The SSL enable us to have the secure website in turn also for the access of user's mailbox from the OWA from the Internet world. The SSL works in close with the CA called Certificate Authority. Here i am going to explain SSL website building with the basic standalone root certificate available with the server 2003 add remove components.

Install Certificate Authority:

Go to add / remove components and install the Certificate services.

Configuring Website:

1. Open IIS console
2. Right click the Website (here Default website)
3. Directory security
4. Server certificate
5. New server certificate
6. Immediate request options
7. Give the appropriate name, organization name and unit, common name
8. Leave the default port number and other values.
9. Select the appropriate certificate
10. On the Certificate Request Submission page, click Next to submit the request, and then click Finish to complete the wizard.


Enabling the SSL to the Website:

1. Open IIS console
2. Right click the Website (here Default website)
3. Directory security and click Edit.
4. click the Require secure channel (SSL) check box, click the Require 128-bit encryption check box, and then click OK.
5. Make sure Basic authentication is alone checked.

Testing:

Open your browser and then try out any possible urls.
For eg http://localhost/exchange
When you try the above option it will throw an error.
But, if you try with SSL option https://localhost/exchange , it works.

Thanks
Logu
logu_microsoft@hotmail.com
91-98414-99143

Group policy update forcing

Hi friends

To force the client machine to get the recent group policy from the server use the below options,

For 2000 Clients :

* SECEDIT /REFRESHPOLICY MACHINE_POLICY /ENFORCE:

Immediately imposes group policy object settings located within the "machine" node of relevant group policy objects.

* SECEDIT /REFRESHPOLICY USER_POLICY /ENFORCE:

Immediate imposes group policy object settings located within the "User" node of the relevant group policy objects

For XP Clients:

gpupdate - To update the group policy in the client machine.

gpresult - To view the resultant set of applied policy to the client machine from the server.

Thanks

Logu
logu_microsoft@hotmail.com
91-98414-99143

Server NT Vs Server 2000

Hi friends

This articles give the compare and contrast chart of features between server NT and server 2000. The following points in each category makes comparison respectively.

SERVER NT:

1. SAM(Security account manager) database for user acc creations
2. No AD
3. PDC, BDC(has no write permission) env
4. No fsmo roles
5. Dhcp works independently
6. No ICS,NAT,VPN,RRAS,ATM
7. No IE 4.0 and IE 5.0
8. No NLB and Clustering
9. No predictable end to end ,QOS
10. No IAS,RADIUS,Kerberos V5
11. No EFS
12. No development support
13. No terminal services
14. No IIS 5.0 ,ASP
15. No IPP(Internet printing protocol)
16. No disk quota,DFS,etc

SERVER 2000 :

1. No SAM Database, inspite AD is used
2. AD Env (adv features integrates features like ease mgmt,centralized replication,etc)
3. PDC,ADC environment
4. Fsmo(flexible single master operation role) for replication b/w DC
5. Dhcp works paralelly with dns and AD
6. ICS,NAT,VPN,RRAS,ATM are added features
7. IE 4.0 and IE 5.0 supports Http compression
8. Supports NLB(network load balancing) and Clustering
9. Has predictable end to end ,QOS(quality of services)
10. Has improved authentication strategy like IAS,RADIUS,Kerberos V5
11. Support EFS(Encryption file system)
12. Has development support (VB 6.0)
13. Has terminal services
14. IIS 5.0, ASP are present
15. IPP(Internet printing protocol) are present
16. Disk quota mgmt,DFS are available

Thanks

Logu
logu_microsoft@hotmail.com
91-98414-99143

Windows Shortcut Run Commands:

Hi friends,

I have seen many system administrator use to work fast while using their desktops and used to admire it. They never use mouse or surf through the start menu for reaching the particular application. So this article gives you the idea about the shortcuts for the run commands.

Working of Run Commands:

Each and every application will be having a executable file for its application and the respective core content will be stored in some executable path. Initially PATH variable will be set in the environmental variable settings tab.
(in my PC, it may have more values also in your PC)
$PATH = C:\Program Files\Support Tools\;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\WBEM;
C:\WINNT\Microsoft.NET\Framework\v2.0.50727;C:\sbin\svn\bin;C:\Program Files
\QuickTime\QTSystem\

Creating Shortcuts:

Creating shortcuts of your wish for particular application and for folders or files is also possible. Let me give a quick example suppose you want to create a shortcut for particular folder in some path.

1. Create folder say c:\shortcuts
2. Open Environmental settings tab of your computer and add "c:\shortcuts" to $PATH.
3. Right Click the folder you want to make shortcuts and create shortcut.
4. Rename the shortcut if you wish.
5. Paste the shortcut into "c:\shortcuts"

To test Open --> Run --> "shortcut name" . It will open the folder for which we have created the shortcut before.

Some Windows Run Commands:

1. Accessibility Controls - access.cpl
2. Add Hardware Wizard - hdwwiz.cpl
3. Add/Remove Programs - appwiz.cpl
4. Administrative Tools - control admintools
5. Automatic Updates - wuaucpl.cpl
6. Bluetooth Transfer Wizard - fsquirt
7. Calculator - calc
8. Certificate Manager - certmgr.msc
9. Character Map - charmap
10. Check Disk Utility - chkdsk
11. Clipboard Viewer - clipbrd
12. Command Prompt - cmd
13. Component Services - dcomcnfg
14. Computer Management - compmgmt.msc
15. timedate.cpl - ddeshare
16. Device Manager - devmgmt.msc
17. Direct X Control Panel (If Installed)* - directx.cpl
18. Direct X Troubleshooter - dxdiag
19. Disk Cleanup Utility - cleanmgr
20. Disk Defragment - dfrg.msc
21. Disk Management - diskmgmt.msc
22. Disk Partition Manager - diskpart
23. Display Properties - control desktop
24. Display Properties - desk.cpl
25. Display Properties (w/Appearance Tab Preselected) - control color
26. Dr. Watson System Troubleshooting Utility - drwtsn32
27. Driver Verifier Utility - verifier
28. Event Viewer - eventvwr.msc
29. File Signature Verification Tool - sigverif
30. Findfast - findfast.cpl
31. Folders Properties - control folders
32. Fonts - control fonts
33. Fonts Folder - fonts
34. Free Cell Card Game - freecell
35. Game Controllers - joy.cpl
36. Group Policy Editor (XP Prof) - gpedit.msc
37. Hearts Card Game - mshearts
38. Iexpress Wizard - iexpress
39. Indexing Service - ciadv.msc
40. Internet Properties - inetcpl.cpl
41. IP Configuration (Display Connection Configuration) - ipconfig /all
42. IP Configuration (Display DNS Cache Contents) - ipconfig /displaydns
43. IP Configuration (Delete DNS Cache Contents) - ipconfig /flushdns
44. IP Configuration (Release All Connections) - ipconfig /release
45. IP Configuration (Renew All Connections) - ipconfig /renew
46. IP Configuration (Refreshes DHCP & Re-Registers DNS) - ipconfig /registerdns
47. IP Configuration (Display DHCP Class ID) - ipconfig /showclassid
48. IP Configuration (Modifies DHCP Class ID) - ipconfig /setclassid
49. Java Control Panel (If Installed) - jpicpl32.cpl
50. Java Control Panel (If Installed) - javaws
51. Keyboard Properties - control keyboard
52. Local Security Settings - secpol.msc
53. Local Users and Groups - lusrmgr.msc
54. Logs You Out Of Windows - logoff
55. Microsoft Chat - winchat
56. Minesweeper Game - winmine
57. Mouse Properties - control mouse
58. Mouse Properties - main.cpl
59. Network Connections - control netconnections
60. Network Connections - ncpa.cpl
61. Network Setup Wizard - netsetup.cpl
62. Notepad - notepad
63. Nview Desktop Manager (If Installed) - nvtuicpl.cpl
64. Object Packager - packager
65. ODBC Data Source Administrator - odbccp32.cpl
66. On Screen Keyboard - osk
67. Opens AC3 Filter (If Installed) - ac3filter.cpl
68. Password Properties - password.cpl
69. Performance Monitor - perfmon.msc
70. Performance Monitor - perfmon
71. Phone and Modem Options - telephon.cpl
72. Power Configuration - powercfg.cpl
73. Printers and Faxes - control printers
74. Printers Folder - printers
75. Private Character Editor - eudcedit
76. Quicktime (If Installed) - QuickTime.cpl
77. Regional Settings - intl.cpl
78. Registry Editor - regedit
79. Registry Editor - regedit32
80. Remote Desktop - mstsc
81. Removable Storage - ntmsmgr.msc
82. Removable Storage Operator Requests - ntmsoprq.msc
83. Resultant Set of Policy (XP Prof) - rsop.msc
84. Scanners and Cameras - sticpl.cpl
85. Scheduled Tasks - control schedtasks
86. Security Center - wscui.cpl
87. Services - services.msc
88. Shared Folders - fsmgmt.msc
89. Shuts Down Windows - shutdown
90. Sounds and Audio - mmsys.cpl
91. Spider Solitare Card Game - spider
92. SQL Client Configuration - cliconfg
93. System Configuration Editor - sysedit
94. System Configuration Utility - msconfig
95. System File Checker Utility (Scan Immediately) - sfc /scannow
96. System File Checker Utility (Scan Once At Next Boot) - sfc /scanonce
97. System File Checker Utility (Scan On Every Boot) - sfc /scanboot
98. System File Checker Utility (Return to Default Setting) - sfc /revert
99. System File Checker Utility (Purge File Cache) - sfc /purgecache
100. System File Checker Utility (Set Cache Size to size x) - sfc /cachesize=x
101. System Properties - sysdm.cpl
102. Task Manager - taskmgr
103. Telnet Client - telnet
104. User Account Management - nusrmgr.cpl
105. Utility Manager - utilman
106. Windows Firewall - firewall.cpl
107. Windows Magnifier - magnify
108. Windows Management Infrastructure - wmimgmt.msc
109. Windows System Security Tool - syskey
110. Windows Update Launches - wupdmgr
111. Windows XP Tour Wizard - tourstart
112. Wordpad - write
113. Microsoft Outlook - Outlook
114. Microsoft Word - Winword
115. Acrobat Reader - Acrord32
116. Active Dir Users and Comp - Dsa.msc
117. Routing and remote access - Rrasmgmt.msc
118. DNS - Dnsmgmt.msc
119. Add/remove Programs - Appwiz.cpl
120. Display property - Desk.cpl

Thanks

Logu
logu_microsoft@hotmail.com
91-98414-99143

Server 2003 Important New Features:

Hi friends

This article gives you the best and short view about new features available with the Server 2003 family when compared with the prior Server 2000.

List Of New Features:

1. Improved forest/Domain functional level mode like domain, forest and interim forest modes.
2. ADMT V2(active directory migration tool) with inter forest password migration and scripting support.
3. Domain and Domain Controller renaming.
4. Cross forest transitive kerberos trust.
5. Enhanced smart card authentication.
6. Software restriction policies(trusted binaries allowed based on path,hash and digital signature).
7. IP V6 Support.
8. Flexible wireless authentication.
9. DNS – Stub zones and conditional forwarding.
10. IPSec (features like IPSec NAT traversal, IPSec support in netsh, IPSec RSOP, IPSecMON in MMC).
11. Enhanced NLB (NLBMGR and ISA Server load balancing).
12. Storage services – Volume shadow copy support.
13. IIS 6.0 (features like kernel mode http and IGMP V3).

Thanks
Logu
logu_microsoft@hotmail.com
91-9841499143