Upgrade Microsoft Domain Controller 2008 R2 to DC 2012 R2 with Exchange 2010 in the current environment.

Prerequisites:

1- Windows 2012 R2 fully patches

2- New Windows 2012 R2 server should be joined to the Domain controller 2008r2

After you get all the prerequisites ready, start the Server manager and click on Add roles then add the ADDS role and follow the following instructions

Install the role and the n configure it as following

Add it to the existing DC

To migrate the AD Operations Master roles. The simplest way to move these roles is via PowerShell.

On Server 2012 AD PowerShell modules, this can be done from anywhere. Simply run the following command to view you current configuration, and change them:

PS C:\> netdom query FSMO

Move-ADDirectoryServerOperationMasterRole -identity “dc1” -OperationMasterRole 0,1,2,3,4

Making sure that all the roles have been migrated :

netdom query FSMO

Adding second DC

Reference:

https://technet.microsoft.com/en-us/library/ee617229.aspx?f=255&MSPPError=-2147217396

Source: Default-First-Site-Name\DC2

******* 1 CONSECUTIVE FAILURES since 2015-03-23 19:37:45

Last error: 8524 (0x214c):

The DSA operation is unable to proceed because of a DNS lookup failu

re.

Naming Context: CN=Configuration,DC=domain,DC=local

Source: Default-First-Site-Name\DC2

******* WARNING: KCC could not add this REPLICA LINK due to error.

Naming Context: CN=Schema,CN=Configuration,DC=domain,DC=local

Source: Default-First-Site-Name\DC2

******* WARNING: KCC could not add this REPLICA LINK due to error.

Naming Context: DC=domain,DC=local

Source: Default-First-Site-Name\DC2

******* WARNING: KCC could not add this REPLICA LINK due to error.

Resolution:

After joining new DC you will see this error until the replication with the PDC and schema master is finished.

Use the repadmin /syncall to hasten the sync process.

After we changed the PDC and Schema master role server to the new DC and shut down the old DC for test. On Exchange 2010 server you might get the following error

Exchange Console

Current deployment

1. Exchange 2010
2. New DC 2012 R2 with another Additional DC installed newly.
3. Two DC 2008R2 but have been shut down for testing.

Problem:

After you shutdown or demote the old PDC or Schema master Demote Domain Controller role, Microsoft Exchange Management Console fails to retrieve any Exchange information with error message “An error caused a change in the current set of Active Directory Server settings. Restart Exchange Management console.”

Cause

Microsoft Exchange management console caches the data in the user’s profile for quick access, So whenever you try to open EMC from an existing Exchange admin profile you will get the same error.

Resolution:

Navigate to the following folder and delete the Exchange Management Console file.

%userprofile%\appdata\roaming\Microsoft\MMC\Exchange Management Console

Hope this was useful

Active Directory Recycle Bin

Starting with Windows 2008 R2, Microsoft introduced the Active Directory recycling bin. This is great for recovering objects back into AD if they are accidentally deleted. In order to use the recycle bin feature, your forest must be running with a functional level of Windows 2008 R2. If your forest is running at this level you simply run a PowerShell command to enable it.

Enable

To enable Active Directory Recycle Bin using the Enable-ADOptionalFeature cmdlet

Click Start, click Administrative Tools, right-click Active Directory Module for Windows PowerShell, and then click Run as administrator.

Below is a sample for enabling it for moh10ly.com:

Enable-ADOptionalFeature –Identity “CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=moh10ly,DC=com” –Scope ForestOrConfigurationSet –Target moh10ly.com

Restore

Once you have the Recycling Bin for Active Directory you will have to use LDP.exe to restore. By default the container with the deleted objects is not displayed. The following steps will allow you to see the container with the deleted objects.

Display Deleted Objects

Follow these steps to display the Deleted Objects container:

1. To open Ldp.exe, click Start, click Run, and then type exe.
2. On the Optionsmenu, click Controls.

3. In the Controlsdialog box, expand the Load Predefined pull-down menu, click Return deleted objects, and then click OK.

4. To verify that the Deleted Objects container is displayed:

• To connect and bind to the server that hosts the forest root domain of your AD DS environment, under Connections, click Connect, and then Bind. (U must use SSL and port 636)
• Click View, click Tree, and in BaseDN, type DC=<mydomain>,DC=<com>, where <mydomain>and <com> represent the appropriate forest root domain name of your AD DS environment.
• In the console tree, double-click the root distinguished name (also known as DN) and locate the CN=Deleted Objects, DC=<mydomain>,DC=<com>container, where <mydomain>and <com> represent the appropriate forest root domain name of your AD DS environment.

Restore Deleted Objects

Once you have enabled the container to be displayed, you can now restore deleted objects from Active Directory. Below are the steps to recover a single item from the recycle bin using LDP.exe.

Follow these steps to restore a deleted Active Directory object using Ldp.exe:

1. Open Ldp.exe from an elevated command prompt. Open a command prompt (Cmd.exe) as an administrator. To open a command prompt as an administrator, click Start. In Start Search, type Command Prompt. At the top of the Startmenu, right-click Command Prompt, and then click Run as administrator. If the User Account Control dialog box appears, enter the appropriate credentials (if requested), confirm that the action it displays is what you want, and then click Continue.
2. To connect and bind to the server that hosts the forest root domain of your AD DS environment, under Connections, click Connect, and then click Bind.

3. On the Options menu, click Controls.

4. In the Controls dialog box, expand the Load Predefined drop-down list, click Return Deleted Objects, and then click OK.

5. In the console tree, navigate to the CN=Deleted Objects

6. Locate and right-click the deleted Active Directory object that you want to restore, and then click Modify.

7. In the Modifydialog box.

8. In Edit Entry Attribute, type isDeleted.

9.Leave the Valuesbox empty.

10. Under Operation, click Delete, and then click Enter.

11. In Edit Entry Attribute, type distinguishedName.

12. In Values, type the original distinguished name (also known as DN) of this Active Directory object.

13. Under Operation, click Replace.

14. Make sure that the Extended check box is selected, click Enter, and then click Run.

A key point to understand and remember with AD Recycle Bin is that you must restore hierarchically; a parent object must be restored before a child object. If you were to delete an entire OU and all its contents, you must first restore the OU before you can restore its contents.

Modify

Clicking on Run gives an error

“Error 0x2077 Illegal modify operation. Some aspect of the modification is not permitted.”

Resolution:

Disconnect and reconnect with SSL on port 636

Enter the full Distinguished path in the Values

Click on Run again and that should work

Before

After

\

After restoring the object, I will try to login to the user’s mailbox

I’ll need to reset the user’s password after its restored.

Time to login

I had a project to migrate users from Linux Postfix mail system to Exchange 2013 but had to do it in stages in order to use it as recommended by Microsoft, The customer had Red Hat Linux Servers with Postfix integrated with Active directory for authentication.

In order to migrate the users I installed Exchange 2007 in order to use the Microsoft tool called (Microsoft Transporter Suite) and had to reset all users (850 User) passwords to use notepad file and import it in the tool in order to migrate all users in less than a week.

I searched for any powershells that would reset users passwords on Active directory but could not find anyone that would suit my scenario and customer’s security policies until I came through a tool called “Quest One activeRoles which integrates lots of useful commands into its own powershell that have to be installed on Active Directory server to reset all users passwords.

You can find the tool either from the following link:

http://www.quest.com/powershell/activeroles-server.aspx

In order to do so I have prepared a notepad file with 2 columns “Username, password” and then copied all users and their passwords below the two columns, saved the file in .csv extension then used the following script

$data = Import-csv “C:\users_pass.csv”

foreach($line in $data) {set-QADUser $line.username -UserPassword $line.password }

Click on the snapshot to enlarge it

As shown in the snapshopt above you will have to install the application first on your DC and then run the application shell “ActiveRoles Management shell for AD” as administrator then run the commands below

$data = Import-csv “C:\users_pass.csv”

foreach($line in $data) {set-QADUser $line.username -UserPassword $line.password }

Note:

Usernames in the CSV File must be according to the format in the Snapshot above or else the command won’t be recognized.

Replication After Tombstone Life Expired

As I was preparing for Exchange migration from 2010 to 2013 I had two DCs, one of those two DCs was off for about 8 months and has already passed the default tomb stone life so it was not authorized for replication in the forest.

Whenever I try to replicate the server I get the following error

Active Directory Sites and Services Error

“The following error occurred during the attempt to syncronize naming context CN=Configuration,DC=Domain,DC=Local from Domain Controller AD to Domain Controller AD2; The directory service cannot replicate with this server because the time since the last replication with this server has exceeded the tombstone lifetime. This operation will not continue.”

My FSMO roles holder and PDC is the demotesas.local domain so on this DC I will run the following command

W32tm /config /manualpeerlist:time.windows.com,0x1 /syncfromflags:manual /reliable:yes /update

And this

w32time & net start w32time & W32tm /resync /rediscover

On the additional DC

w32tm /config /syncfromflags:domhier /update

w32time & net start w32time & W32tm /resync /rediscover

Force Replication

If the above doesn’t work then I will go ahead and force replication to the tomb stoned DC by using the following command.

repadmin /regkey * +allowDivergent

Now we’ll replicate and see what happens

Problem solved

REF:

Active Directory Replication Issues After TimeSync Problems

https://social.technet.microsoft.com/Forums/windowsserver/en-US/893b09d8-636e-4f87-8260-11613a2a4e43/unable-to-replicate-between-2-dcs-error-message-exceeded-the-tombstone-lifetime?forum=winserverDS>

If you’re planning to Install Active directory on multiple DCs for backup, you can speed up this process by using the following script which is provided by Microsoft. but you’ll have to copy and paste it in notepad and save it in .ps1 extension after editing the Domain Name and Domain Netbios name.

You may also wanna change the forest mode to match the one in your environment if you already have an old DC.

# Windows PowerShell script for AD DS Deployment

#

Import-Module ADDSDeployment

Install-ADDSForest `

-CreateDnsDelegation:$false `

-DatabasePath “C:\Windows\NTDS” `

-DomainMode “Win2012” `

-DomainName “moh10ly.com” `

-DomainNetbiosName “Moh10ly” `

-ForestMode “Win2012” `

-InstallDns:$true `

-LogPath “C:\Windows\NTDS” `

-NoRebootOnCompletion:$false `

-SysvolPath “C:\Windows\SYSVOL” `

-Force:$true

Note: If you want to have a different Computer name, you will need to change that manually before you start the process below and restart after changing the computer name.

You will need to install the AD Domain Service management tools before you are able to run the powershell

Install-windowsfeature -name AD-Domain-Services –IncludeManagementTools

When the management tools are installed you can drag and drop the powershell file to powershell window and press Enter and as soon as you do that it will ask you for the SafeModeADministratorPassword.

After you press Enter it will start the installation process

When finished it will let you know that server is going to be restarted automatically.

After restarting the server, this is how the Full computer name became.

To configure Outlook autodiscover in Active directory we’ll have to do the following

First open Group Policy Management from Administrator tools, After you have opened GPO you will want to create a new GPO for this purpose then follow the steps down to continue with the configuration:

1- Create a new GPO under any OU “Organization unit” you want to apply the GPO on. Then right click on it and click on Edit…

Under User configuration -> policies -> Administrative templates: Policy right click and click “add/remove templates…”

Click Add… and browse to the Office 2010 template (I’m attaching these files below) or you can just google them.

4- Under Administrative Templates: Policy Definitions – > Classic Administrative Templates (ADM) click on MS Outlook 2010 -> Exchange and on the right pane.

Enable Automatically configure profile based on AD Primary. And Enable Configure outlook anywhere user interface options.

These steps are optional but they’ll force opening outlook in order to configure it after the Client’s PC restarts.

5- When done go to User Configuration –> Windows Settings –> Scripts -> double click on Logon on the right pane

Click on Add

Browse then

Copy the below batch file to this location and attach it ” \\domain.com\SysVol\domain.com\Policies\{34E9C6C2-FCCF-45DA-908D-65A452D049F3}\User\Scripts\Logon”

When PCs restart they’ll take the new configuration.

Note:

The Outlook.txt file is the script that will be launching the Outlook configuration panel, you will need to rename the extension file from .txt to outlook.bat before uploading it to the location in the article.

If your Exchange users have problem with Active Sync’s Autodiscover configuration or you’re intending to configure a Hybrid configuration with Microsoft office 365 Exchange Online or Your Lync/Skype for business users are having troubles signing in right after you enable users from the Lync/SfB Panel then this article is for you.

Note: For Lync you’d want to change Account (UPN) Instead of the Proxy Address Attribute for users. For each scenario it might be a different case.

Assuming that I have the following domain list, and I want to add them to my AD user’s proxy address attribute so they can use it as SMTP address

%’sAMAccountName’%@Domain1.com

%’sAMAccountName’%@Domain2.com

%’sAMAccountName’%@Domain3.com

%’sAMAccountName’%@Domain4.com

%’sAMAccountName’%@Domain5.com

%’sAMAccountName’%@cardtekcloud.onmicrosoft.com

First to add main SMTP address we’ll use the attribute %’sAMAccountName’%@Domain.com

Next to add alternative Proxy addresses we’ll use

%’sAMAccountName’%@domain.com

I’ll open ADModify.net app and select the organization that I would like to apply the changes for

I’ll select Domain from the domain list. Then choose the Domain controller and choose only to show users

Click on the green Next button then click Add to List then click Next under the user to continue

I’ll navigate to Email addresses tab to do the changes and place the domain that I would like to use.

I’ll enter whatever domain and use sAMAccountName since it matches the user’s Email address .

IMPORTANT NOTE:

It’s very important to notice that if you’d like to change the domain in the Proxy Address . You ‘ll need to choose an attribute that matches the user’s existing Proxy address username ..

To add the other domains e.g. domain2, domain3 ..etc I’ll follow the exam same steps just change the end @domain2.com.

That should be all. If you have any questions please don’t hesitate to contact me or comment.

To change the password policy we’ll have first to open Group policy management which is located in “Administrative Tools” on your DC

Right click on “Default Domain Policy” in order to change the password policy for all users within a domain.

This will open the Group Policy Management editor as you can see below where you will have to navigate to “Computer configuration -> Security Settings -> Password Policy” and there you can disable the password complexity, adjust it or change any other settings.

Next when the Group policy opens up the configuration I will go to “Account Policies” and disable the “Password must meet complexity requirements” since this is what I simply want do in my case.

After changing the policy you will need to force updating the policy on all the domain joined clients by using the command line GPupdate /force

When this is finished, all clients must be restarted in order for the group policy change to take effect.

WINDOWS POWERSHELL SCRIPT FOR AD DS DEPLOYMENT

# Windows PowerShell script for AD DS Deployment

#

Install-windowsfeature -name AD-Domain-Services –IncludeManagementTools

Import-Module ADDSDeployment

Install-ADDSForest `

-CreateDnsDelegation:$false `

-DatabasePath “C:\Windows\NTDS” `

-DomainMode “Win2012” `

-DomainName “moh10ly.com” `

-DomainNetbiosName “Moh10ly” `

-ForestMode “Win2012” `

-InstallDns:$true `

-LogPath “C:\Windows\NTDS” `

-NoRebootOnCompletion:$false `

-SysvolPath “C:\Windows\SYSVOL” `

-Force:$true

While I was doing a cross forest migration in a customer’s environment I had to make sure that of some computers’ logged in users before starting the migration process due to the customer’s policy how Computer hostnames are used.

There was about 500 computers, most of these computers don’t use their users’s names but company’s name and then a number e.g. (PC5123).

Luckily Mark Russinovich has provided the great PSTOOLS for administrators to work remotely and find out everything about user’s computers in domain without having to go physically or interact with the users.

So I had to download the tools from this link and use the following command to get the logged in user.

wmic /node:”smart0498″ ComputerSystem GET UserName

Hope you find this useful