The BHC Blog » Microsoft Windows

Fixing Active Directory DNS (_msdcs, _sites, _tcp, _udp)

Jesse — Thu, 23 Apr 2009 22:58:42 +0000

Have you ever accidentally deleted the AD DNS settings such as _msdcs, or installed AD and then needed to add a DNS server? How do you get AD to build it’s DNS settings. As you know AD is very tightly bound to DNS so if those settings are not there, DNS is probably going to cause a world of hurt moving forward.

Never fear, this can easily be fixed. To fix this, download the Windows Support Tools :

After installing the support tools, verify your dns on the server is set correctly. Generally I set domain controllers to have their DNS boxes BLANK.. (ie they use themselves to resolve DNS. If they cannot find the DNS entry they seek, they use the root servers to do recursive queries.).

To check dns, goto TCP/IP properties of your Local Area Connection.. and in the “Use the following DNS server addresses:” set this value to blank. It should give you a message when you hit ok that it is using localhost as the DNS server.

Now goto the command prompt and in c:\program files\support tools run :

dcdiag /fix

then run

netdiag /fix

Finally run

ipconfig /flushdns
ipconfig /registerdns
net stop server
net start server

If you refresh your DNS you should now have all your entries in DNS that you need for AD to work properly.. The above command verify more than just fixing the DNS issues, but it doesnt hurt to run them and the dcdiag and netdiag will make sure your AD / DNS are the way they need to be.

One other note. Net stop server stop more than just DNS .. it also stops Netlogon and Distributed File systems. THESE SERVICES DO NOT START BACK UP ON THEIR OWN– so after you’ve done the steps above I recommend either a quick reboot or if you cant do that go into service and start any automatic services that are stopped (such as netlogon and distributed file systems.. Your server should now work fine!

Now sit back and relax.

_______________________________________
PLEASE HELP BY BOOKMARKING OUR SITE...

HOWTO: Getting Group Policy Updates to External Users

Jesse — Mon, 19 Jan 2009 17:35:46 +0000

I recently had an issue where I needed to get an external user joined back to the domain even though the users was outside the network. This can be a challenging task if you dont know the trick.

The trick to getting an external computer to join an internal network is the switch user button.

First, have the user login to the local admin account.
After the user has logged in, have him connect to the company VPN. The computer is now joined to the internal company network as if he were anyone else in the office.
If you need to join the computer to the domain, you can now follow the standard steps in computer properties to join the doman. Then reboot and repeat process (steps 1-2).
After the computer is joined to the doman, or if you’re just trying to get him to login with a domain account, now have him hit switch user, and login to his domain account. As long as the vpn connection is still active, you should be able to login to the the domain account and also get new group policy settings pushed to the machine.

Once the the user has logged into the domain once, he should not need to vpn in again to login a second time as his domain credentials will now be cached on the machine. You now have a remote profile for this user that uses the Corporate Domain.

If you have any questions or comments, please feel free to comment below. Also, if you found this article helpful please digg or del.icio.us this site.

_______________________________________
PLEASE HELP BY BOOKMARKING OUR SITE...

HOWTO: Transfer files and VM’s to ESXi server

Jesse — Sat, 18 Oct 2008 23:54:01 +0000

ESXi server by VMWare is a very powerful on-the-metal virtual machine environment. However, it is somewhat confusing to many first time users. Unlike most Operating Systems, or even hosts, there is no User Interface on the actual server- Instead everything is done remotely.

The question then becomes, how do you transfer pre-existing vm’s to the datastore? On first glance it appears you can only create new machines or access VM’s that are on a network share.

However, there is an easier way! The best way I’ve found to copy VM’s to to the data store is to copy them via SSH/SCP.

In order to do this, you need to turn on the SSH server that is built into the base OS:

First, login to console 1 : (press ctrl-alt-f1)
Type in : unsupported and press enter.
You should now see a tech support warning and a prompt to login.
Login as root and enter your password.
you should now have a root linux hash ( # )
Edit /etc/inetd.conf using vi editor (vi /etc/inetd.conf)
and remove the comments in front of the ssh section (remove the # signs. You may have to hit i to enter insert mode. esc will get you out of insert mode. )
Save the file (Shift-ZZ)
and reboot (init 6)

You can now use a program like winSCP to copy files to and from your vmware server.

——————————————————-

UPDATE:

A couple additions I will mention… First, before you copy files to your ESXi server you must setup a datastore. Which will be done from the VMWare Infrastructure Client. (if you havent done so already, browse to your vmware server from another client — http://ESXiServerName or IP. then download and install the vmware client.)

Once inside the VMWare Infrastructure Client, Click on the Configuration Tab, then click on “Storage” in the hardware section.

Once the storage menu has been displayed, click “add storage” in the top right corner of the screen. Follow the steps to create the local datastore.

Once the datastore is created, you can access it via ssh using WinSCP which can be found here :

http://winscp.net/eng/download.php

connect via ssh, your new datastore can be found here:

/vmfs/volumes/DATASTOREGUID (it’s a long string of numbers)/

then just drop your vm’s here in a folder. They will show up in the ESXi console.

_______________________________________
PLEASE HELP BY BOOKMARKING OUR SITE...

SSL not working in IIS

Jesse — Tue, 09 Sep 2008 17:06:43 +0000

If you have recently moved an IIS server to another IP, you will sometimes find SSL sometimes no longer works. This is because IIS does not always correctly update its configuration files.

If you go to properties on an IIS site, you will see what IP the site is currently using (such as all unassigned) and what ports the server is listening on (such as 80 and 443) …

Even if these settings are correct, you should click on the advanced button next to ip address and make sure the ip address and port settings are correct for both regular http and ssl. I recently had an issue on a server where the main page looked perfect, but IIS has failed to correctly update the IP Address for the ssl section meaning it no longer served https requests for the site.

In addition, another useful tool for diagnosing port / ip issues within iis is netstat. If you run netstat -a from the command prompt, you will see all ports and IP’s the server is listening on and what service is using the port. It can help you diagnose what is happening if a particular service fails to bind properly.

_______________________________________
PLEASE HELP BY BOOKMARKING OUR SITE...