After DC migration and changing in the PDC and Schema master role server to the new DC and shut down the old DC for test. On Exchange 2010 server you might get the following error
An error caused a change in the current set of Active Directory settings. Restart The Exchange Management Console.
Exchange Console
Current deployment
Exchange 2010
New DC 2012 R2 with another Additional DC installed newly.
Two DC 2008R2 but have been shut down for testing.
Problem:
After you shutdown or demote the old PDC or Schema master Demote Domain Controller role, Microsoft Exchange Management Console fails to retrieve any Exchange information with error message “An error caused a change in the current set of Active Directory Server settings. Restart Exchange Management console.”
Cause
Microsoft Exchange management console caches the data in the user’s profile for quick access, So whenever you try to open EMC from an existing Exchange admin profile you will get the same error.
Resolution:
Navigate to the following folder and delete the Exchange Management Console file.
In an environment where one DC exist after adding Windows 2012 R2 Servers as additional servers, Exchange 2007 doesn’t show the new servers although they also hold GC.
Research:
To locate the problem you should search the event ID (2080) which shows the populated DCs and the permissions allowed on Exchange servers
In the below screenshot, the SACL right was not provided to the new DCs due to GPO problem.
After checking sites, Replication, all is healthy and no issue with it.
3 servers (Two 2012 servers) and one DC 2003 Server
Exchange 2010 SP3 servers.
Reason:
The Default Domain Controllers Policy was not linked to the Domain Controllers OU.
Resolution:
After Linking the Domain Controllers OU to the Default Controllers policy, the SACL permission was provided without any issue.
Now Exchange is reporting healthy and can read the new DCs which allow us to demote the old DCs
Creating FTP over SSL secure server using Filezilla with Pfsense
1- First step would be by creating the groups/users you want to create.
Second click settings and go to Passive Mode settings and configure it as below, where your Public IP needs to be of the firewall that NATs the connection.
Make sure that the FTP server’s Public IP reflects the Firewall IP that you’re configuring the FTP connection on.
2- Now it’s time to configure the SSL/TLS settings
You first need to Generate a certificate in order for the connection to be secured and data to be encrypted. you can do that through the FileZilla server app it self too as you can see in the snapshot there’s an option where you can do that.
Just click Generate new certificate, fill in the information.. you can randomize it if you want just type in anything and click ok when finished and select the option according to the snapshot.
3- Firewall configuration:
In my case I’m using Open source software firewall which to be honest doesn’t vary that much from hardware firewall since they are all web based.
I’ll configure two NAT rules enabling FTP secured standard port which is (990) in my case to avoid attackers who usually target port 21. And enable FTP data port range for data exchanging between server and client which in this case needs to be a big range in order to not slow down the connection and for client to be able to open more than socket in case of big amount of data transferring.
First rule will enable incoming connection from any source to the internal LAN IP which host the FTP server on port 990 to establish the FTP secure connection.
Second rule will enable incoming connection from any source to the FTP server on LAN on data range port from 50000 to 51000.
In the destination IP , you need to set the WAN IP address which you have specified earlier in FTP Server’s Passive mode settings.
Make sure when you setup your client you set the transfer mode to passive. and here’s the result:
For File Sharing Server over HTTP you can use HFS application
You may notice that when you try to run the Sync command DirectorySyncClientCmd it doesn’t do anything and just closes right away.
If you open your Event viewer you may notice that you are getting the following event
Failed while Purging Run History
Invalid namespace
at System.Management.ManagementException.ThrowWithExtendedInfo(ManagementStatus errorCode) at System.Management.ManagementScope.InitializeGuts(Object o)at System.Management.ManagementScope.Initialize()at System.Management.ManagementObjectSearcher.Initialize()at System.Management.ManagementObjectSearcher.Get()at Microsoft.Azure.ActiveDirectory.Synchronization.DirectorySyncClientCmd.Program.PurgeRunHistory(TimeSpan purgeInterval)at Microsoft.Azure.ActiveDirectory.Synchronization.Framework.ActionExecutor.Execute(Action action, String description)at Microsoft.Azure.ActiveDirectory.Synchronization.DirectorySyncClientCmd.Program.Main(String[] args)
Cause:
This happens when the WMI object had unregistered itself which might be caused by another tool installed or uninstalled at the time when the problem started to occur.
Resolution:
To resolve the issue, you ‘ll have to run few command lines… each are explained below
mofcomp “D:\Program Files\Microsoft Azure AD Sync\Bin\mmswmi.mof”
As it shows in the command screenshot below the ‘mofcomp’ parses the MMS (FIM) wmi file and goes through the process of adding the classes to the WMI repository.
regsvr32 /s “D:\Program Files\Microsoft Azure AD Sync\Bin\mmswmi.dll”
Registers the WMI mmswmi.dll file to the server.
net stop winmgmt /y
net start winmgmt net start “IP Helper” net start “User Access Logging Service” net start “Microsoft Azure AD Sync”
D:\Program Files\Microsoft Azure AD Sync\Bin\DirectorySyncClientCmd.exe”
If you ever needed to add multiple ports or range of ports endpoints to a particular Virtual machine on Azure. you might have a difficulty doing this since it’s not allowed by design and that will require time to do this manually for range of ports. that’s where this article comes handy.
To achieve this first you will need to connect to your Azure subscription on Azure powershell. Azure PowerShell.
Run Azure powershell as an administrator and type the following cmdlet to get your subscription info
Get-AzurePublishSettingsFile
This will open a page and ask you to sign in to your Azure user account and download a file called Visual Studio Premium with MSDN-DATE-credentials.publishsettings
In the powershell you will have to navigate to where the file is located. And import the settings that have just been downloaded in that file
Import-azurepublishSettingsFile `.\Visual Studio FileLocation`
You can check for your account and Subscription, using Get-azureaccount script
Now I have setup a ubuntu Machine on Azure that hosts Openfire Chat server which requires 10000-10005 port range for the media service. On Azure Web interface the port range option is not yet supported. The only available option is through powershell which will open the required port range for us.
To do so I’ll use the following cmdlet highlighting the required information to enter
To Acquire your service name, you can simply login to Azure portal and check out All Items and see the cloud service name .. Just like the below screenshot
To Check your VMname simply navigate to Virtual machines tab and on the right side you can see the name.. I have copied it as well in the command.
Once you edited the cmdlet with your information you can enter it in the Powershell and enter
It should return something like this.
Once finished you can check Azure end point portal for the new ports configuration
Upgrade Microsoft Domain Controller 2008 R2 to DC 2012 R2 with Exchange 2010 in the current environment.
Prerequisites:
1- Windows 2012 R2 fully patches
2- New Windows 2012 R2 server should be joined to the Domain controller 2008r2
After you get all the prerequisites ready, start the Server manager and click on Add roles then add the ADDS role and follow the following instructions
Install the role and the n configure it as following
Add it to the existing DC
To migrate the AD Operations Master roles. The simplest way to move these roles is via PowerShell.
On Server 2012 AD PowerShell modules, this can be done from anywhere. Simply run the following command to view you current configuration, and change them:
******* WARNING: KCC could not add this REPLICA LINK due to error.
Naming Context: DC=domain,DC=local
Source: Default-First-Site-Name\DC2
******* WARNING: KCC could not add this REPLICA LINK due to error.
Resolution:
After joining new DC you will see this error until the replication with the PDC and schema master is finished.
Use the repadmin /syncall to hasten the sync process.
After we changed the PDC and Schema master role server to the new DC and shut down the old DC for test. On Exchange 2010 server you might get the following error
Exchange Console
Current deployment
Exchange 2010
New DC 2012 R2 with another Additional DC installed newly.
Two DC 2008R2 but have been shut down for testing.
Problem:
After you shutdown or demote the old PDC or Schema master Demote Domain Controller role, Microsoft Exchange Management Console fails to retrieve any Exchange information with error message “An error caused a change in the current set of Active Directory Server settings. Restart Exchange Management console.”
Cause
Microsoft Exchange management console caches the data in the user’s profile for quick access, So whenever you try to open EMC from an existing Exchange admin profile you will get the same error.
Resolution:
Navigate to the following folder and delete the Exchange Management Console file.
Starting with Windows 2008 R2, Microsoft introduced the Active Directory recycling bin. This is great for recovering objects back into AD if they are accidentally deleted. In order to use the recycle bin feature, your forest must be running with a functional level of Windows 2008 R2. If your forest is running at this level you simply run a PowerShell command to enable it.
Enable
To enable Active Directory Recycle Bin using the Enable-ADOptionalFeature cmdlet
Click Start, click Administrative Tools, right-click Active Directory Module for Windows PowerShell, and then click Run as administrator.
Below is a sample for enabling it for moh10ly.com:
Once you have the Recycling Bin for Active Directory you will have to use LDP.exe to restore. By default the container with the deleted objects is not displayed. The following steps will allow you to see the container with the deleted objects.
Display Deleted Objects
Follow these steps to display the Deleted Objects container:
To open Ldp.exe, click Start, click Run, and then type exe.
On the Optionsmenu, click Controls.
3. In the Controlsdialog box, expand the Load Predefined pull-down menu, click Return deleted objects, and then click OK.
4. To verify that the Deleted Objects container is displayed:
To connect and bind to the server that hosts the forest root domain of your AD DS environment, under Connections, click Connect, and then Bind. (U must use SSL and port 636)
Click View, click Tree, and in BaseDN, type DC=<mydomain>,DC=<com>, where <mydomain>and <com> represent the appropriate forest root domain name of your AD DS environment.
In the console tree, double-click the root distinguished name (also known as DN) and locate the CN=Deleted Objects, DC=<mydomain>,DC=<com>container, where <mydomain>and <com> represent the appropriate forest root domain name of your AD DS environment.
Restore Deleted Objects
Once you have enabled the container to be displayed, you can now restore deleted objects from Active Directory. Below are the steps to recover a single item from the recycle bin using LDP.exe.
Follow these steps to restore a deleted Active Directory object using Ldp.exe:
Open Ldp.exe from an elevated command prompt. Open a command prompt (Cmd.exe) as an administrator. To open a command prompt as an administrator, click Start. In Start Search, type Command Prompt. At the top of the Startmenu, right-click Command Prompt, and then click Run as administrator. If the User Account Control dialog box appears, enter the appropriate credentials (if requested), confirm that the action it displays is what you want, and then click Continue.
To connect and bind to the server that hosts the forest root domain of your AD DS environment, under Connections, click Connect, and then click Bind.
3. On the Options menu, click Controls.
4. In the Controls dialog box, expand the Load Predefined drop-down list, click Return Deleted Objects, and then click OK.
5. In the console tree, navigate to the CN=Deleted Objects
6. Locate and right-click the deleted Active Directory object that you want to restore, and then click Modify.
7. In the Modifydialog box.
8. In Edit Entry Attribute, type isDeleted.
9.Leave the Valuesbox empty.
10. Under Operation, click Delete, and then click Enter.
11. In Edit Entry Attribute, type distinguishedName.
12. In Values, type the original distinguished name (also known as DN) of this Active Directory object.
13. Under Operation, click Replace.
14. Make sure that the Extended check box is selected, click Enter, and then click Run.
A key point to understand and remember with AD Recycle Bin is that you must restore hierarchically; a parent object must be restored before a child object. If you were to delete an entire OU and all its contents, you must first restore the OU before you can restore its contents.
Modify
Clicking on Run gives an error
“Error 0x2077 Illegal modify operation. Some aspect of the modification is not permitted.”
Resolution:
Disconnect and reconnect with SSL on port 636
Enter the full Distinguished path in the Values
Click on Run again and that should work
Before
After
\
After restoring the object, I will try to login to the user’s mailbox
I’ll need to reset the user’s password after its restored.
I had a project to migrate users from Linux Postfix mail system to Exchange 2013 but had to do it in stages in order to use it as recommended by Microsoft, The customer had Red Hat Linux Servers with Postfix integrated with Active directory for authentication.
In order to migrate the users I installed Exchange 2007 in order to use the Microsoft tool called (Microsoft Transporter Suite) and had to reset all users (850 User) passwords to use notepad file and import it in the tool in order to migrate all users in less than a week.
I searched for any powershells that would reset users passwords on Active directory but could not find anyone that would suit my scenario and customer’s security policies until I came through a tool called “Quest One activeRoles which integrates lots of useful commands into its own powershell that have to be installed on Active Directory server to reset all users passwords.
You can find the tool either from the following link:
In order to do so I have prepared a notepad file with 2 columns “Username, password” and then copied all users and their passwords below the two columns, saved the file in .csv extension then used the following script
$data = Import-csv “C:\users_pass.csv”
foreach($line in $data) {set-QADUser $line.username -UserPassword $line.password }
Click on the snapshot to enlarge it
As shown in the snapshopt above you will have to install the application first on your DC and then run the application shell “ActiveRoles Management shell for AD” as administrator then run the commands below
$data = Import-csv “C:\users_pass.csv”
foreach($line in $data) {set-QADUser $line.username -UserPassword $line.password }
Note:
Usernames in the CSV File must be according to the format in the Snapshot above or else the command won’t be recognized.
As I was preparing for Exchange migration from 2010 to 2013 I had two DCs, one of those two DCs was off for about 8 months and has already passed the default tomb stone life so it was not authorized for replication in the forest.
Whenever I try to replicate the server I get the following error
Active Directory Sites and Services Error
“The following error occurred during the attempt to syncronize naming context CN=Configuration,DC=Domain,DC=Local from Domain Controller AD to Domain Controller AD2; The directory service cannot replicate with this server because the time since the last replication with this server has exceeded the tombstone lifetime. This operation will not continue.”
My FSMO roles holder and PDC is the demotesas.local domain so on this DC I will run the following command
If you’re planning to Install Active directory on multiple DCs for backup, you can speed up this process by using the following script which is provided by Microsoft. but you’ll have to copy and paste it in notepad and save it in .ps1 extension after editing the Domain Name and Domain Netbios name.
You may also wanna change the forest mode to match the one in your environment if you already have an old DC.
# Windows PowerShell script for AD DS Deployment
#
Import-Module ADDSDeployment
Install-ADDSForest `
-CreateDnsDelegation:$false `
-DatabasePath “C:\Windows\NTDS” `
-DomainMode “Win2012” `
-DomainName “moh10ly.com” `
-DomainNetbiosName “Moh10ly” `
-ForestMode “Win2012” `
-InstallDns:$true `
-LogPath “C:\Windows\NTDS” `
-NoRebootOnCompletion:$false `
-SysvolPath “C:\Windows\SYSVOL” `
-Force:$true
Note: If you want to have a different Computer name, you will need to change that manually before you start the process below and restart after changing the computer name.
You will need to install the AD Domain Service management tools before you are able to run the powershell
When the management tools are installed you can drag and drop the powershell file to powershell window and press Enter and as soon as you do that it will ask you for the SafeModeADministratorPassword.
After you press Enter it will start the installation process
When finished it will let you know that server is going to be restarted automatically.
After restarting the server, this is how the Full computer name became.
