Category Archives: Windows Server

Can I restore my Active Directory in Windows Azure?

It seems like I get loads of questions about Windows Azure and the IAAS offering we’re running these days. The last one is about how to get into DSRM (Directory Services Restore Mode), if you’ve been running your AD for a while you remember the old F8 trick during boot but in Windows Azure there’s only RDP access, so no pressing F8 then… Well, there’s a solution for everything and our engineers thought of this too, long before Windows Azure.

One big prereq for this to work out. You must have set your DSRM password to something you remember 😉

Two ways of doing this:

1) Sync with the domain administrator password: http://technet.microsoft.com/en-us/library/jj713556.aspx

2) Set it manually: http://technet.microsoft.com/en-us/library/cc754363.aspx#BKMK_examples

Once that’s done you just use bcdedit to boot into DSRM the next boot, open up CMD and type:

1) bcdedit /set safeboot dsrepair
2) shutdown –r –t 0

Once it has rebooted you can logon to your server by using “hostnameadministrator” with your DSRM password.

When you’re done restoring your AD you’ll need to make sure it boots back to normal. Open up CMD and type:

bcdedit /deletevalue {current} safeboot

On the next boot it’ll boot into Windows normally and you’re hopefully all back to normal operations!

New downloads from Microsoft

Monday morning and the downloads just pours out from Redmond!

A new beta of Windows Server 2012 Essentials is available at http://www.microsoft.com/en-us/download/details.aspx?id=30327. Now with some upped specs, from 25 users to 75. Which actually makes it quite useful. And no need to reinstall either like the old SBS.

The Virtual Machine Servicing Tool is available in a new and fresh version too. If you’re using this to keep your VM’s up to date it’s time to upgrade. Find it over at http://www.microsoft.com/en-us/download/details.aspx?id=30470.

Manage Out with Direct Access on UAG

Having implemented Direct Access with UAG (Microsoft Unified Access Gateway) at a customer location there were some questions when we were done. Their helpdesk is using SCCM (System Center Configuration Manager) and the remote management tools included, how would they go about managing the clients? Would that work even if the user wasn’t logged in? Well, after some research we found out that they could actually manage the client if someone was logged in. If nobody was, no remote management would occur.

The reason? Well, traffic initiated from the inside of the network have to go through the management tunnel if nobody is logged in. For that to happen the servers or workstations that wish to communicate have to be included in the management group. If you’re going to use a management server or workstation for your work it’ll have to be IPv6 capable too because DA / UAG won’t translate IPv4 to IPv6 for traffic initiated from the inside.

UAG configuration:

The UAG needs to include ALL the computers you want to use for remote management of DA clients where nobody is logged on. Ie using the management tunnel. As soon as a user logs on communication can occur on the user tunnel.

Client configuration:

If you’re using mobile connections you’ll need to make sure that they will register their address in DNS. If you don’t do this your clients won’t register, and you won’t be able to find them from your internal network.

(click for Lightbox)

Clients needs to have their firewall configuration updated with rules that allow the traffic you need, for example RDP. Please note that the profile you must use for this is the PUBLIC profile since that’s the one applied when the DA client is connected from the internet. You must also allow “edge traversal” for these rules to work over all tunnels.

(click for Lightbox)

More resources for manage out with Direct Access:
http://blogs.technet.com/b/edgeaccessblog/archive/2010/04/06/powerful-but-not-so-obvious-benefits-of-directaccess-manage-out-capabilities.aspx
http://blogs.technet.com/b/edgeaccessblog/archive/2009/11/17/deep-dive-into-uag-directaccess-manage-out-basics.aspx
http://technet.microsoft.com/en-us/library/ee809065.aspx

NIC Teaming in Server Core or Hyper-V Server

Update
Teaming with Intel ProsetCL
Teaming with Broadcom BACScli

If you’re running Server Core or Hyper-V Server 2008 R2 you’ve probably come across the problem of teaming nics. No matter which hardware vendor you choose, they all have they’re special way of doing things. Helping an old colleague out the other day it made me realize that it’s not as straightforward as it is in the full version, so I’ve tried it out with both Intel and Broadcom nics. Which you of course know covers the servers from both HP and Dell (where I work, shameless plug).

Installing the Broadcom software to support network teaming in Server Core / Hyper-V Server

Before you start you must install the prereq’s for the drivers, that comes down to .Net 2.0, .Net 2.0 WOW64 and SNMP.
The easiest way is to use OcSetup to install them:

Start /w ocsetup NetFx2-ServerCore
Start /w ocsetup NetFx2-ServerCore-WOW64
Start /w ocsetup SNMP-SC

The “/w” will let you wait during installation so you know when it’s finished, please note that roles/features are case sensitive for ocsetup so type it as it looks…

When that’s done you’ll need to download the 14.1.x-version of the BACS from Dell’s site and extract them to somewhere on your drive, default is c:broadcom. Navigate to the c:broadcomdriver_management_apps_installer and run setup.exe.

The wizard kicks in and when you’re done you can team your nics (and change other things too) through the c:/program files/broadcom/bacs.exe utility.

Installing the Intel software to support network teaming in Server Core / Hyper-V Server

Turns out that Intel has their own great post on the subject of command line installations which you can find at http://www.intel.com/support/network/sb/cs-016040.htm.

A short rundown otherwise is that you’ll need the setup.exe program for your nic, then you have multiple choices on how to install them. The base driver can be installed through the included pnputil.exe for Server Core or you could use the Intel setup.exe instead.

This is from Intel’s site and shows you what switches does what:

Setup.exe support the following command line parameters:

Parameter Definition
ANS Advanced Network Services
“0”, do not install ANS. If ANS is already installed, it will be uninstalled.

“1”, install ANS (default).

NOTE: If the ANS parameter is set to ANS=1, both Intel PROSet and ANS will be installed.

DMIX PROSet for Windows Device Manager
“0”, do not install Intel PROSet feature. If the Intel PROSet feature is already installed, it will be uninstalled.

“1”, install Intel PROSet feature (default).

NOTE: If DMIX=0, ANS will not be installed. If DMIX=0 and Intel PROSet and ANS are already installed, Intel PROSet and ANS will be uninstalled.

SNMP Intel SNMP Agent
“0”, do not install SNMP. If SNMP is already installed, it will be uninstalled.

“1”, install SNMP (default).

NOTE: Although the default value for the SNMP parameter is 1 (install), the SNMP agent will only be installed if:
The Intel SNMP Agent is already installed. In this case, the SNMP agent will be updated.
The Windows SNMP service is installed. In this case, the SNMP window will pop up and you may cancel the installation if you do not want it installed.

BD Base Driver and IOATDMA Driver
“0”, do not install the base driver.

“1”, install the base driver (default).

LOG [log file name]
LOG allows you to enter a file name for the installer log file. The default name is C:UmbInst.log.

-a Extract the components required for installing the base driver and I/OAT driver to C:Program FilesIntelDrivers. The directory where these files will be extracted to can be modified unless silent mode (/qn) is specified. If this parameter is specified, the installer will exit after the base driver and I/OAT driver are extracted. Any other parameters will be ignored.
-f Force a downgrade of the components being installed. NOTE: If the installed version is newer than the current version, this parameter needs to be set.

How to install the base driver on Windows Server 2008 and Windows Server 2003:

:Setup DMIX=0 ANS=0 SNMP=0

How to install the base driver on Windows Server 2008 and Windows Server 2003 using the LOG option:

:Setup LOG=C:installBD.log DMIX=0 ANS=0 SNMP=0

How to install Intel PROSet and ANS silently on Windows Server 2008 and Windows Server 2003 (32-bit version):

:Setup DMIX=1 ANS=1 /qn

How to install Intel PROSet without ANS silently on Windows Server 2008 and Windows Server 2003 x64 Edition:

:Setup DMIX=1 ANS=0 /qn

How to install components but deselect ANS for Windows Server 2008 and Windows Server 2003:

:Setup DMIX=1 ANS=0 /qn /liew C:install.log

The /liew log option provides a log file for the DMIX installation.

To install teaming and VLAN support on a system that has adapter base drivers and Intel PROSet for Windows Device Manager installed, type the command line :Setup ANS=1.