Forcing Authoritative & Non-Authoritative synchronization for FRS replicated data

There may come a time when you need to perform a full synchronization of FRS data. The steps below outline both an authoritative and non-authoritative synchronization.


Non-Authoritative mode Restore - Downloads a fresh copy of the FRS data
1. Stop the File Replication Service Service
2. Edit the following registry key and set the BurFlags value to D2
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore/Process at Startup
3. Restart the File Replication Service Service
4. Open event viewer and check the File Replication Service source you should see a 13565 Event logged to signal that a non-authoritative restore has started. When the process has completed a 13516 event is logged to signal FRS is operational.

Authoritative mode Restore - Downloads a fresh copy of the FRS data
1. Stop the File Replication Service Service on all downstream partners.
2. On the authoritative node edit the following registry key and set the BurFlags value to D4
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore/Process at Startup
3. Restart the File Replication Service Service
4.  Open event viewer and check the File Replication Service source you should see a 13566 Event logged to signal that a authoritative restore has started. When the process has completed a 13516 event is logged to signal FRS is operational.




Reference:
http://support.microsoft.com/kb/290762

Whats new in Windows 2016 Directory Services

Whats new in Windows 2016 Directory Services

Windows 2016 will be released later this year and along with it a few additions will be added to the Directory Services piece. Below are a few of the notable additions that i am looking forward to.

New Features
1. Group Membership Expiration - You will be able to add a user to a group for a certain period of          time. The one drawback is this feature requires windows server 2016 functional level.
2. Azure AD Join -
3. Deprecation of the File Replication service
4. Deprecation of Windows Server 2003 Functional Level

Deleting Message from Exchange Mailboxes with Powershell

From time to time it may become necessary to search a users mailbox for a message or delete a specific message from a mailbox. Below are a few powershell commands you can use with Exchange 2010 to search a mailbox for a particular email message.



Delete All Messages with a specific subject
get-mailbox -identity "SOURCEMAILBOX" -resultsize unlimited | search-mailbox -SearchQuery "Subject:"SUBJECTSTRING"" -DeleteContent

Delete All messages with a specific attachment
get-mailbox -identity "SOURCEMAILBOX" -resultsize unlimited | search-mailbox -SearchQuery "attachment:FILENAME.DOCX" -DeleteContent

Search Mailbox by subject and date and copy the message out of the source mailbox into the targetmailbox
get-mailbox -identity "SOURCEMAILBOX" -resultsize unlimited |  search-mailbox -SearchQuery "subject:""SUBJECTSTRING"" Sent:"MMDDYYYY" -TargetMailbox DESTINATIONMAILBOX -TargetFolder TARGETFOLDER –LogOnly -LogLevel Full

Search Mailbox by subject and date and copy the message out of the source mailbox into the targetmailbox and then delete the email from source mailbox
get-mailbox -identity "SOURCEMAILBOX" -resultsize unlimited |  search-mailbox -SearchQuery "subject:"SUBJECTSTRING" Sent:"MMDDYYYY" -TargetMailbox DESTINATIONMAILBOX -TargetFolder TARGETFOLDER –LogOnly -LogLevel Full -deletecontent

Managing Local Administrator Passwords on Windows Workstations

Microsoft offers the Local Administrator Password Solution (LAPS) to allow administrators to set random and unique passwords on each workstation/server joined to active directory. This tool works by installing a small application on the client machine and then configuring a GPO to apply the specific settings for the password format and expiration intervals. Below are the steps required to configure LAPS.


Server Setup 

1. Download LAPS from https://support.microsoft.com/en-us/kb/3062591
2. Run the install on your management workstations and select the three items under the management tools and select next to complete the install.
3. Next run the following command to extend the schema to add the ms-Mcs-AdmPwd & ms-Mcs-AdmPwdExpiration attributes to the computer objects class

4. Next run the following command to set the permission to allow the computer account to update itself and allow domain admins to reset the password.

Customizing the AD FS Sign-In Page

If you are not happy with the default design of the AD FS Sign-In page you can use the commands below to update the page. Below are a few of the commands that i have used to customize the page but other options are available.

Default Sign-in Page:

Change Company Name

You can change the company name with the following powershell command:

Set-AdfsGlobalWebContent -CompanyName "New Company Name"

Change Company Logo

When changing the company logo Microsoft recommends the dimensions for the logo to be 260x35 @96 dpi with a file size no larger than 10KB.

Set-AdfsWebTheme -TargetName default -Logo @{path"c:\images\logo.png"}


Change Graphic on the left

To change the image on the left you can use the following powershell cmdlet. Microsoft recommends that the illustration be 1420x1080 @96 dpi and no larger than 200KB.

Set-AdfsWebTheme -TargetName default -Illustration @{path="c:\images\illustration.png"}

Add a description to sign-in page

You can use the following powershell command to change the description on the sign in page. The text for "signInPageDescriptionText" paramter supports html tags.

Set-AdfsGlobalWebContent -SignInPageDescriptionText "For assistance please visit our support site here.
"

Additional Resources:
https://technet.microsoft.com/en-us/library/dn280950.aspx

SAML Authentication with Jive 8.0 and Active Directory Federation Services 2.0

Overview:
This document outlines the process required to configure Jive 8.0 to work with Active Directory Federation Services 2.0.
This document only outlines how to setup a new installation of Jive to authenticate using ADFS it does not outline how to migrate from
an alternate authentication source to ADFS.


Assumptions:
1. Active Directory Federation Services 2.0 on Windows 2012 R2 is installed
2. AD FS will be using Active Directory to authenticate users.
3. Jive 8.0 (Jive 7 & 6 *should* work also) is installed
4. Your Jive instance must be using https for this to work

Configuring ADFS

1. Open AD FS console and expand trust relationships and right click on the Relying party trusts and select Add relying party trust
2. Click start and on the next screen enter the URL for your Jive SP Metadata in the first section. By default the URL is "https:///saml/metadata"

3. Type a displayname to identify this trust. Click Next
4. On the multi-factor authentication step makre sure "I do not want to configure multifactor authentication settings....." is selected and click next.

5. Accept the default option "Permit all users to access this relying party" and click next

Finding Expensive LDAP queries in LDS or Active Directory

Overview

This is a quick guide on how to find expensive & inefficient LDAP queries running against Active Directory or Lightweight Directory Services.

Steps

1. While the CPU is running high change the following registry key to "5"

1. HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Diagnostics\15 Field Engineering  

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Diagnostics\15 Field Engineering

2. Update or create the following registry values to the desired threshold in miliseconds. (Data Type Should be DWORD) The values below are the default values.

1. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters\Expensive Search Results Threshold  = 10,000  
2. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters\Inefficient Search Results Threshold = 1,000  
3. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters\Search Time Threshold (msecs) = 30,000  

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters\Expensive Search Results Threshold  = 10,000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters\Inefficient Search Results Threshold = 1,000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters\Search Time Threshold (msecs) = 30,000

3. Let that run for a period of time during the high CPU issues.
4. Open the Directory Services Log
5. The events with 1644 as the eventID should give you an idea of where the traffic is coming from and what queries are being ran against the server.

Note: Dont forget to change the "15 Field Engineering" value back to 0 when you are done troubleshooting.

Understanding Proxy Authentication with multiple domains in AD LDS

Understanding Proxy Authentication with multiple domains in Active Directory LDS


What is Proxy Authentication?

Proxy Authentication allows a user to authenticate against an AD LDS instance while using the password that is stored in Active Directory. In AD LDS you can use AdamSync.exe to create a UserProxy or UserProxyFull object in AD LDS. The Proxy object in AD LDS looks like a traditional user object however it does not have a password stored on it. When an application is pointed to the AD LDS instance and tries to authenticate the AD LDS server pass the SID and password to the domain controller to verify the credentials are correct.


Proxy Authentication with Multiple Domains

ADMT Unable to create or merge object

Problem:

Recently i was migrating a large group of user accounts from one domain to another and the ADMT tool crashed on me unexpectedly. When i restarted the tool one of the accounts gave me the following error "2014-07-01 09:40:15 WRN1:7665 Unable to create or merge object 'CN=John Doe,OU=Users,DC=Domain,DC=com' as another instance of ADMT is currently creating or merging the same object." After searching online i figured out the following steps to resolve this issue.

Resolution:

WMIC Tips

Overview

WMIC (Windows Management Instrumentation Command-Line) extends WMI for operation from several command-line interfaces and through batch scripts.

Command Examples

-- Display installed applications

Restoring ActiveDirectory Objects

Description

     This document provides tips for restoring Active Directory objects if the Active Directory Recycle Bin is enabled.

Tips

Granting Non-Admin Users permission to manage specific services

Granting Non-Admin Users permission to manage specific services
1. Login as an administrator 
2. Install subinacl.exe (http://www.microsoft.com/en-us/download/details.aspx?id=23510)
3. Open a command prompt
4. Navigate to c:\program files (x86)\Windows Resource Kits\Tools\
5. Below are examples of the syntax to use to grant permissions to a particular service
   - SUBINACL /SERVICE \\MachineName\ServiceName /GRANT=[DomainName\]UserName[=Access]
   - subinacl.exe /service \\localhost\gupdate /GRANT=domain.com\username=F
   - subinacl.exe /service \\localhost\VMTools /GRANT=domain.com\username=F
6. Log out the administrator and let the end user log back in.

Valid Access Values
 F : Full Control
 R : Generic Read
 W : Generic Write
 X : Generic eXecute
 L : Read controL
 Q : Query Service Configuration
 S : Query Service Status
 E : Enumerate Dependent Services
 C : Service Change Configuration
 T : Start Service
 O : Stop Service
 P : Pause/Continue Service
 I : Interrogate Service
 U : Service User-Defined Control Commands

Removing PGP WDE from the command line in OS X or Linux.

Removing PGP Whole Disk Encryption from the command line in OS X or Linux.
These steps were performed on OS X 10.7 * 10.8 but should on other versions also.

First Verify that the drive is encrypted and get the disk number
1. Go to command line and type "sudo pgpwde --status"
2. You should see a response saying either the "Encryption Process is running in the background." or something stating the drive is fully encrypted.

Steps to decrypt
1. Open the command line and type "sudo pgpwde --decrypt --disk # --passphrase ''
2. type "sudo pgpwde --status" and you should see "Encryption removal process is running in the background"
3. Continue to monitor the "sudo pgpwde --status" command until the decryption is complete.

If you reboot and notice that the PGP BootGuard is still showing even after decrypting run the following command.
1. Go to command line and type "sudo pgpwde --unstrument --disk 0"

Removing PGP from command line in Windows

First Verify that the drive is encrypted and get the disk number
1. Go to command line and type "sudo pgpwde --status"
2. You should see a response saying either the "Disk 0 is Encrypted" or "Encryption Process is running in the background."
3. Make a note of the disk number

Steps to decrypt
1. Open the command line and type and navigate to the pgp folder inside of Program Files(x86)
2. Type the following command "pgpwde --decrypt --disk #  --passphrase "universalpassword"
3. Type "pgpwde --status" and you should see "Encryption removal process is running in the background"

3. Continue to monitor the "sudo pgpwde --status" command until the decryption is complete.

Embedding Encrypted Passwords in Powershell Scripts

Description: Use the following steps to convert a password into an encrypted string that can be embeded in a powershell script.

1. Use the following commands to create the encrypted string. Note: the encrypted string output is based on the user that is logged in so you will have to run these commands as the service account you are using if the service account is going to be running your script.

• $password = ""
• $secure = ConvertTo-SecureString $password -force -asPlainText
• $encrypted = ConvertFrom-SecureString $secure
• write-host $encrypted

2. Copy the encrypted string above into your powershell script. 

• $encrypted = "01000000d08c9ddf0115d1118c7a00c04fc2......................................"

3. Now convert that string to a secure string in your powershell script

• $password = ConvertTo-SecureString -String $encrypted

4. Create a new credential object

• $cred = New-Object System.Management.Automation.PSCredential $username, $password

5. Now you can use the new credential object in your script.

example:  Invoke-Command -credential $cred -computername "" -scriptblock {get-host}

Enabling LDAP over SSL with AD LDS

Enabling LDAP over SSL with AD LDS

1. Create a new server authentication/Web server certificate. LINK
2. Import the certificate into the Certificates store for the local service of the instance. LINK
3. Grant Read permission on the server authentication certificate to the same account that the LDS service is running as typically "Network Service" account
4. Open the C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys folder and verify that "Network Service", "Administrators" & "System" have read access to all of the certs.
5. Verify SSL is required on the LDS instance:

• Open ADSI Edit and connect to the configuration partition of the LDS instance
• Navigate to CN=Directory Service,CN=Windows NT, CN=Services
• Right click on CN=Directory Service and select properties
• Click the msDS-Other-Settings attribute and select edit
• Verify this value is set to 1 RequireSecureProxyBind

  6.   Restart the LDS Instance.
  7.   Use LDP.exe to test SSL

• Open ldp.exe
• Click connection -> Connect
• Enter the FQDN of the server
• Change the port. (Default is 636)
• Check the box for SSL
• Click ok to connect.

Configuring AD LDS to sync with Multiple AD Domains

Problem

- You have user accounts in two domains that you would like to be able to authenticate from an application that can only look at one LDAP server at a time.

Prerequisites
- Windows 2008 R2
- 2 Active Directory Domains with a trust between the two

Solution:

Installing OS X Applications from the command line

1. SSH to the workstation
2. Mount the disk image (.dmg) file by using the hdiutil
     "hdiutil mount application.dmg"
3. Navigate to the folder that was mounted in the previous command. (Should be inside /Volumes)
     "cd /Volumes/application/"
4. Use the installer application to install the package
     "sudo installer -pkg application.pkg -target LocalSystem"
5. Unmount the disk image

     "hdiutil umount "/Volumes/application/"

Advanced Google Search Tips

Google is an indispensable tool for IT professionals looking for assistance troubleshooting tech issues. Below are a few handy google search techniques i use on a regular basis to help find relevant search results quickly.


1. Search for keywords within a specific site.
Google: dog site:www.animals.com

2. Search based on File Type
Google: linux introduction filetype:ppt

3. Exclude a word from searches by adding a dash (-) before a word
Google: jaguar speed -car

4. Include similar words by adding a tilde sign (~)
Google: ~food facts

5. Search for website title
Google: intitle: jaguar

6. Access Blocked or Unavailable websites using Google Cache
Google: cache:www.tmz.com

7. Search within a range of numbers
Google: cars 30..50 mpg

Connecting to a wireless network from OS X command line.

Connecting to a wireless network from OS X command line.

The 'networksetup' utility is very powerful for making network changes to an OS X workstation. Below is the syntax for connecting a machine to a wireless network from the command line.

$networksetup -setairportnetwork Airport [router SSID] [password]



Additional Resources:
https://developer.apple.com/library/mac/#documentation/Darwin/Reference/ManPages/man8/networksetup.8.html

Take photos with FaceTime Camera from command line in OS X

Take photos with FaceTime Camera from command line in OS X


Have you ever wanted to snap a photo with your FaceTime camera from the command line in OS X? Now with the help of a small program called ImageSnap you can.

1. Download ImageSnap LINK
2. unzip the file using tar -xvf imagesnap.tar
3. run the imagesnap 
4. It will create a file called snapshot.jpg