Archive for November 2012

Forbered AD Schema Update til Windows Server 2012

I forbindelse med Schema update til Windows Server 2012, er der en række punkter man kan tjekke forinden.

Først, se nedenstående link omkring generel AD information
http://blogs.technet.com/b/ashleymcglone/archive/2012/01/03/everything-you-need-to-get-started-with-active-directory.aspx

Herefter kan man lave et AD Health Check som følger.

Tjek eventlog på samtlige DC’ere for warnings og errors og vurder dem individuelt.

Kør herefter Best Practices Analyzer (AD DS BPA) mod det eksisterende AD miljø.
http://technet.microsoft.com/en-us/library/dd391875(v=ws.10).aspx

Lav generel AD diagnostics med DCDIAG. Her vil man også kunne se problemer med AD replikering.

Dette kan gøres via nedenstående kommando, som tjekker alle DC’erne.
DCDIAG /V /C /D /E /s:WIN-DC-01 > c:\dcdiag.log

Når man kigger logfilen igennem, vil man kunne se 4 fejl med ”The RPC server is unavailable”.
Dem kan man ignorere ifølge nedenstående MS artikel.

DCDIAG.EXE /E or /A or /C expected errors
http://support.microsoft.com/kb/2512643

For tjek af AD replikering kan man også beytte GUI toolet Active Directory Replication Status Tool.
http://www.microsoft.com/en-us/download/details.aspx?id=30005

2012_Domain_Upgrade_012012_Domain_Upgrade_02

Hvis man har glemt DSRM Administrator password, er det tid til at resette det nu. Se nedenstående link hvordan det skal gøres.
How To Reset the Directory Services Restore Mode Administrator Account Password in Windows Server 2003
http://support.microsoft.com/kb/322672

Afslut med at lave en valid system state backup af dine Domain Controllere. Dette kan gøres med nedenstående kommando.
wbadmin start systemstatebackup -backuptarget:\\ServerName\SharedFolder -quiet

Tjek at backup er gået  godt i command vinduet og Evetloggen. Test herefter backuppen i et test-miljø.

Backup_01Backup_02

For mere info til System State Backup se disse links.
Wbadmin start systemstatebackup
http://technet.microsoft.com/en-us/library/998366c1-0a64-45e6-9ed3-4c3f5b8406f0

Error message when you try to perform a system state backup in Windows Server 2008 and Windows Server 2008 R2
http://support.microsoft.com/kb/944530

Hvis noget skulle gå galt i forbindelse Schema Update, hvilket jeg aldrig har oplevet, så kan man forinden forberede sig på en forest recovey, som kan ses her.
Windows Server 2008: Planning for Active Directory Forest Recovery
http://www.microsoft.com/en-us/download/details.aspx?id=16506

Active Directory Forest Recovery
http://social.technet.microsoft.com/wiki/contents/articles/7668.active-directory-forest-recovery-en-us.aspx

Man er nu klar til Schema Update som kan udføres med Adprep som man gjorde tidligere (gælder dog kun for x64) eller med den nye Active Directory Domain Services Configuration Wizard.

Schema Update via Adprep (2 trins update) se nedenstående info. Kræver stadigvæk en account med Enterprise/Schema admin rettigheder.

Fra udpakket ISO eller medie eksekver nedenstående fra stien <Media Drive:>\support\adprep\adprep.exe. Det er denne metode jeg har benyttet i mit test miljø.

adprep.exe /forestprep
adprep.exe /domainprep

adprep.exe /domainprep /gpprep (Hvis du har kørt denne command tidligere i forbindelse med Schema Update fra 2003 til feks, 2008/2008 R2, skal den ikke køres igen)

Adprep "not a valid Win32 application" error on Windows Server 2003, 64-bit version
http://support.microsoft.com/kb/2743367

Citat:
Adprep.exe integration

Beginning with Windows Server 2012, there is only one version of Adprep.exe (there is no 32-bit version, adprep32.exe). Adprep commands are run automatically as needed when you install a domain controller that runs Windows Server 2012 to an existing Active Directory domain or forest.

Although adprep operations are run automatically, you can run Adprep.exe separately. For example, if the user who installs AD DS is not a member of the Enterprise Admins group, which is required in order to run Adprep /forestprep, then you might need to run the command separately. But, you only have to run adprep.exe if you are planning to in-place upgrade your first Windows Server 2012 domain controller (in other words, you plan to in-place upgrade the operating system of a domain controller that runs Windows Server 2012).

Adprep.exe is located in the \support\adprep folder of the Windows Server 2012 installation disc. The Windows Server 2012 version of adprep is capable of executing remotely.

The Windows Server 2012 version of adprep.exe can run on any server that runs a 64-bit version of Windows Server 2008 or later. The server needs network connectivity to the schema master for the forest and the infrastructure master of the domain where you want to add a domain controller. If either of those roles is hosted on a server that runs Windows Server 2003, then adprep must be run remotely. The server where you run adprep does not need to be a domain controller. It can be domain joined or in a workgroup.

Schema Update via GUI (Active Directory Domain Services Configuration Wizard). Man bliver her promtet for en account med Enterprise/Schema admin rettigheder.

Upgrade your Active Directory from 2008 to Windows Server 2012
http://autodiscover.wordpress.com/2012/09/06/upgrade-your-active-directory-from-2008-to-windows-server-2012-microsoft-winserv2012/

Introducing the first Windows Server 2012 Domain Controller (Part 1 of 2)
http://blogs.technet.com/b/askpfeplat/archive/2012/09/03/introducing-the-first-windows-server-2012-domain-controller.aspx

Introducing the first Windows Server 2012 Domain Controller (Part 2 of 2)
http://blogs.technet.com/b/askpfeplat/archive/2012/09/06/introducing-the-first-windows-server-2012-domain-controller-part-2-of-2.aspx

Upgrading an Active Directory Domain from Windows Server 2008 or Windows Server 2008 R2 to Windows Server 2012
http://msmvps.com/blogs/mweber/archive/2012/07/27/upgrading-an-active-directory-domain-from-windows-server-2008-or-windows-server-2008-r2-to-windows-server-2012.aspx

Efter Schema Update kan man tjekke den nye version (56) med nedenstående kommando
dsquery * cn=schema,cn=configuration,dc=win,dc=local -scope base -attr objectVersion

Dette er også dokumenteret i nedenstående MS artikel.
How to find the current Schema Version
http://support.microsoft.com/kb/556086

Hvis man ser eventid 1153 efter Schema Update til Windows Server 2012, så kan de ignorers i følge nedenstående MS artikel.
Error message when you run the ForestPrep, PrepareSchema, or PrepareAD command in Exchange Server: "Invalid Superclass. Inheritance Ignored"
http://support.microsoft.com/default.aspx?id=268329

Det hele kan afsluttes med at man flytter FSMO rollerne samt Windows time services over på den nye 2012 Domain Controller.
Yderligere referencer til ovenstående:

What’s New in Active Directory Domain Services Installation and Removal
http://technet.microsoft.com/en-us/library/hh472161.aspx

How to view and transfer FSMO roles in Windows Server 2003 (Gælder også for 2008 R2 og Server 2012)
http://support.microsoft.com/kb/324801

How to configure an authoritative time server in Windows Server (Gælder også for Server 2012)
http://support.microsoft.com/kb/816042

For den server der har PDC Emulator rollen skal man afvikle nedenstående kommandoer fra en admin prompt, for at angive den som ny time server.

w32tm /config /manualpeerlist:"0.dk.pool.ntp.org 1.dk.pool.ntp.org 2.dk.pool.ntp.org" /syncfromflags:manual /reliable:yes /update
w32tm /resync /nowait /rediscover
net stop w32time
net start w32time

På den gamle PDC Emulator skal man ligeledes afvike nedenstående kommandoer for at demote den som time server.

w32tm /config /syncfromflags:domhier /reliable:no /update
net stop w32time
net start w32time

Tjek Eventloggen (Eventid 143) på den nye PDC Emulator at den opfatter sig selv som time server for den opdateret AD forest.

Time_Server_01

Hvis de andre Domain Controllere eller domain servere har problemer med at få tiden fra den nye time server, kør nedenstående kommandoer.

w32tm /config /syncfromflags:domhier /update
W32tm /resync /rediscover
net stop w32time

net start w32time

Office 365 – Admin Task Wiki

Dette link er et must have for alle Office 365 admins. Man får her informationer omkring de ting man skal forberede i forbindelse med O365 opgraderinger m.m.
http://community.office365.com/en-us/wikis/administration/admin-tasks.aspx

Her er der også info til vigtige opdateringer man skal fortage inden 1 januar 2013

Update generic Mail Exchange (MX) records by 1 January 2013
Upgrade to the 64-bit version of Directory Synchronization by 1 January 2013

Description of the Outlook 2010 update: November 13, 2012

Microsoft har udsendt en samlet Outlook 2010 rollup, som indholder nedenstående hotfixes, samt en række nye fixes.
Sikre dig at du har denne Outlook 2010 Rollup med i din SCCM eller WSUS.

Description of the Outlook 2010 hotfix package (Outlook-x-none.msp): April 24, 2012
http://support.microsoft.com/kb/2598318

Description of the Outlook 2010 hotfix package (Outlook-x-none.msp): June 26, 2012
http://support.microsoft.com/kb/2598374

Description of the Outlook 2010 hotfix package (Outlook-x-none.msp): August 28, 2012
http://support.microsoft.com/kb/2687351

Description of the Outlook 2010 hotfix package (Outlookintl-xx-xx.msp): August 28, 2012
http://support.microsoft.com/kb/2687396

Description of the Outlook 2010 hotfix package (Outlook-x-none.msp): October 30, 2012
http://support.microsoft.com/kb/2687608

Description of the Outlook 2010 hotfix package (Outexum-x-none.msp): October 30, 2012
http://support.microsoft.com/kb/2687620

Download den nye rollup her.
Description of the Outlook 2010 update: November 13, 2012
http://support.microsoft.com/kb/2687623

Gode guides til Windows 8 og Windows Phone 8

Disse guides kan være rigtige gode for brugerne i en given virksomhed, i forbindelse med indførelse af Windows 8 og Windows Phone 8.

Start it up and see what’s new
http://windows.microsoft.com/en-US/windows-8/get-started

New keyboard shortcuts for Windows 8 and Windows RT
http://windows.microsoft.com/en-US/windows-8/new-keyboard-shortcuts#1TC=t1

Windows 8 Accessibility Tutorial Guide
http://www.microsoft.com/en-us/download/details.aspx?id=35751

Office Mobile
http://www.windowsphone.com/en-US/how-to/wp8/office/office-hub

Internet Explorer 10 – Enhanced Protected Mode

Så lige nedenstående info omkring Blackhole og Exploit.

Blackhole” Exploit Kit Activity Peaks as Exploit Activity on the Internet Reaches New Heights
http://blogs.technet.com/b/security/archive/2012/11/12/blackhole-exploit-kit-activity-peaks-as-exploit-activity-on-the-internet-reaches-new-heights.aspx

Exploit Activity at Highest Levels in Recent Times: The Importance of Keeping All Software Up To Date
http://blogs.technet.com/b/security/archive/2012/11/06/exploit-activity-at-highest-levels-in-recent-times-the-importance-of-keeping-all-software-up-to-date.aspx

I den forbindelse vil jeg lige linke til info omkring IE 10 nye sandbox i form af Enhanced Protected Mode.

Internet Explorer 10 gets a new sandbox : Enhanced Protected Mode
http://www.julien-manici.com/blog/ie10-new-sandbox-enhanced-protected-mode-windows-8/

Enhanced Protected Mode
http://blogs.msdn.com/b/ie/archive/2012/03/14/enhanced-protected-mode.aspx

Understanding Enhanced Protected Mode
http://blogs.msdn.com/b/ieinternals/archive/2012/03/23/understanding-ie10-enhanced-protected-mode-network-security-addons-cookies-metro-desktop.aspx