Archive: ‘AD in general’ Category

Domain rename

13 comments March 8th, 2010

Domain renaming is not a daily task but a task you do if the management forces you to do it! (ie. because of a company restructure, take over etc )

There are many resources on the Internet sharing a “walk through” about this job, but I made my own documentation some years ago when I was told to rename the domain. So I just go with the flow and publish it.

To do this task your domain/forest functional level has to be at least 2003 and all DC’s need at least SP1.

Exchange 2003 SP2. This is the only version that supports a domain rename. Exchange 5.5, 2000 and 2007 is not supported and Exchange can’t be installed on a DC.

Before you proceed you do have to read the official documentation and requirements from Microsoft:  http://technet.microsoft.com/nb-no/windowsserver/bb405948(en-us).aspx

– Download the domain rename tools

– Understanding How Domain Rename Works

Step-by-Step Guide to Implementing Domain Rename

The environment consisted of:

One forest (2003 Functional level) with three domains (2003 FL, transitive trust and a parent-child trust), six DC’s (Win2003 SP1) and four Exchange servers (Win2003 SP1 with Exchange SP1).

The objective was to rename one of the three domains. (The domain without a child).

Before we started banging on the production environment, we made a test environment to test the rename and its impact on all third-part applications like Citrix, MSSQL based applications, HP Data Protector. After a month of testing and three successful renaming, we moved over to the production environment.

Preparing:

To increase your chance of a successful renaming your domain have to be in a good shape.

· Your event logs should be clean on all DC’s and Exchange servers
· “dcdiag /v /e /c” should be clean
· “netdiag /debug /v” should be clean

You need to have a domain member to act as the Control station (CS). Should be at least a Win2003 SP1 server. Log on to the control station with an enterprise admin (I guess you don’t bother the “run as” in this situation) and download the domain rename tools to this server (domainrename.exe and xdr-fixup.exe).

Install by running the domainrename.exe. It will install rendom.exe and gpfixup.exe to “C:\Program files\Microsoft Domain Rename Tools”

Copy both these files to “C:\Rename”

Now it’s time to take some System State backups of your domain controllers and keep them in a safe place.

In this documentation I will use theses domain names:

Old domain name: tottenham.int
New domain name: spurs.local

Create a new DNS zone:

· Open the DNS management consoll (dnsmgmt.msc)
· Right click “Forward Lookup Zones” > “Add new forward lookup zone”
· Call it “spurs.local” (without quotes)
· If you have a trusting domain, create the same zone as a secondary zone in the trusting domain

DNS suffix:

When you rename the domain the DNS suffix in the domain will change. Two conditions must be checked:

· The computers DNS suffix should be configured to change when the domain membership changes (default)
· No Group Policy must configured to set the primary DNS suffix to computers.

Do the renaming procedure:

Open cmd and change the directory to “C:\Rename”.

1. rendom /list

· This will create a list of the directory partitions in the forest
· Copy the “domainlist.xml” file to “domainlist-save.xml”
· Open “domainlist.xml” in Notepad and change it to the new forest description

2. rendom /showforest

· Verify that it reflect the new domain name

3. rendom /upload

· Generates the domain rename instructions
· Pushes the rename instruction to all DC’s
· Force a replication. “repadmin /syncall /APed”

4. rendom /prepare

· Verify that all DC’s are ready
· You should get an answer from all DC’s and they should NOT return an error. If they do, open “dclist.xml” (that was created in step 3). The DC’s that have reported errors will not be tagged with <state>prepared</state>. You have to troubleshoot any errors. DO NOT set the state to “prepared” manually in this file for any DCs!

You should fix any errors and re-run “rendom /prepare” until all DCs are in the “prepared” state.

5. rendom /execute

· If everything goes as planned you should get an answer from all DCs. The DCs will reboot automatically. When the DCs are back online the domain name is changed, but not the DNS suffix on the DCs itself. This has to be done manually on each DC in the renamed domain:

Add the new DNS suffix:

· netdom computername dc01.tottenham.int /add:dc01.spurs.local

Change the primary DNS suffix:

· netdom computername dc01.tottenham.int /makeprimary dc01.spurs.local

Reboot the server.

Remove the old DNS suffix:

· netdom computername dc01.spurs.local /remove:dc01.tottenham.int

Reboot the CS twice!

5.1. Exchange

(still working from the CS):

Before you proceed to the Exchange specific tasks, you got to be sure you are not going back with a domain restore.

· xdr-fixup /s:domainlist-save.xml /e:domainlist.xml /trace:TRACEFILE /changes:CHANGESCRIPT.ldf

This will create two files. changescript.ldf and restorescript.ldf. You run this command only one time (not one time per Exchange server).

· ldifde -i -f changescript.ldf

(to revert, run “ldifde -i -f restorescript.ldf”)

· Restart all Exchange servers twice

6. rendom /end

· this will unfreeze the forest


Side steps:

Reestablish external trusts and validate:

· “nltest /sc-query:foreign_domain.com” (from a DC in the renamed domain)

· “nltest /sc-query:spurs.local” (from the trusting domain)
Fix DFS topology (if you use DFS)

Fix GPO links:

gpfixup /olddns:tottenham.int /newdns:spurs.local /oldnb:tottenham /newnb:spurs /dc:dc01.spurs.local /user:administrator /pwd:password 2>1 > gpfixup.log

Look for errors in the created log.

Take a new System state of the DC’s.

Restart all other servers twice.

Verify the Exchange rename:

· xdrfixup /verify:restorescript.ldf /changes:verifycorrections.ldf

this should give you:

Verified that the server exch01.tottenham.int was renamed to exch01.spurs.local. Verify pass has completed.(it should list all Exchange servers involved in this output)

Verify/update the Recipient Update Services (RUS) which DC it should use.

If applicable, update the Active Directory Connector (ADC)

Reboot every computer in the domain twice. When it’s done. Do the last step **:

7. rendom /clean

Side steps:

· Authorize the DHCP server
· Delete the old Forward Lookup Zone from DNS
· dcdiag /v /e /c
· netdiag /debug /v
· Check Event logs

** If you have many domain member laptops out of the house during the rename, you can wait with step 7 until they have logged on the domain and rebooted twice. I think I waited a week before I ran step 7.

If you run step 7 and there are members that have not been booted twice you have to rejoin them to the domain. I made a script to keep track of computers that have not been updated with the new domain name.

''''''''''''''''''''''''''''''''''''''' Save me as a vbs file '''''''''''''''''''''''''''''''''''''''

On Error Resume Next

Const ADS_SCOPE_SUBTREE = 2

Set objFSO = CreateObject(“Scripting.FileSystemObject”)

””” Create a text file with all computers holding the old domain name

Set objResultsFile = objFSO.CreateTextFile(“C:\temp\tottenham.txt”, True)  Set objConnection = CreateObject(“ADODB.Connection”) Set objCommand = CreateObject(“ADODB.Command”) 

objConnection.Provider = “ADsDSOObject” objConnection.Open “Active Directory Provider” 

Set objCommand.ActiveConnection = objConnection objCommand.Properties(“Page Size”) = 1000 objCommand.Properties(“Searchscope”) = ADS_SCOPE_SUBTREE  

””’ Modify the query so that it responds to your domain 

objCommand.CommandText = _ “SELECT dnsHostName, distinguishedName FROM ‘LDAP://dc=spurs,dc=local'” & _ “WHERE objectCategory=’computer’ AND dnsHostName=’*tottenham.int'”

Set objRecordSet = objCommand.Execute

Do Until objRecordSet.EOF 

objResultsFile.Write objRecordSet.Fields(“dnsHostName”).Value & ” –> OU: ” objResultsFile.Write objRecordSet.Fields(“distinguishedName”).Value objResultsFile.Writeline objRecordSet.MoveNext Loop

Wscript.Echo objRecordSet.RecordCount objResultsFile.Close

'''''' EOF ''

Documenting AD

1 comment February 10th, 2010

The documentation is a vital part of the admin’s day. It’s time consuming and when there are changes to the system, it’s you who got to update the documentation.  That can be boring!

Remember that outdated (or may I call it tombstoned?!) documentation can be worse than no documentation!

If you’re a System consultant that got the job setting up a domain, it’s always nice to hand over some documentation of the domain to the company that hired you.

Don’t worry, the help is out there just waiting for you! Microsoft have a great utility called “Active Directory Topology Diagrammer”. It reads the configuration of your domain/forest and generates/updates a Visio drawing of the hole domain/forest! Including all domain controllers, global catalogs, trusts, OU structure, sites, schema version, SP level, user count and so on.

 

Just tick the checkboxes you want and hit the “Discover” button. After a few seconds the discovery completes. Go get yourself a cup of nice warm coffee,  press the “Draw” button and enjoy your coffee while ADTD populates the Visio drawing for you

This tool can also draw your Exchange organization.

Download a free copy of ADTD here

If you don’t have Visio available you can download a 60 days free trial from MS here.

Backup

No comments February 9th, 2010

When the Tottenham manager (FYI: Harry Redknapp) picks his starting 11 before a match, he also chooses 7 additional players to sit on the bench. As backups. If ie. a player gets injured during the game, he always have a backup he can use that is sitting on the bench. Just waiting to be substituted.

What do you do if you got a flat tire in the middle of nowhere, and you find out that there isn’t a spare tire in the trunk? “Sh*t, I thought I had a backup!”

An OU with dozen of user objects can accidentally be deleted. Your single DC in the domain can say goodnight anytime (yeah right, who has the guts enough to have a single DC in his domain?!). Your SYSVOL with all your fancy GPOs vanished. “Hey! Where did they go?”

So, just like everything else, a good backup can be very good to have. Even in the Active Directory world. I quote Instan at the Microsoft CSS/PSS:

As my grandfather used to say, “it’s better to have a backup you don’t need than to need a backup you don’t have”

http://blogs.technet.com/instan/default.aspx

If you don’t have a backup routine of your domain controller, then now is a good time to implement it.

A quick way to see when the last backup occurred. Open cmd and type:

repadmin /showbackup *

(Repadmin is part of the Windows 2000/2003 support tools)
http://www.microsoft.com/downloads/details.aspx?familyid=6EC50B78-8BE1-4E81-B3BE-4E7AC4F0912D&displaylang=en

I have scheduled a System state backup running every night on three of my DC’s in the domain using NTbackup (or Windows backup). (We also have a Tivoli backup running that backup the entire server…Paranoid you know 😮
I store the backup files on a network share for easy access (by the admin *).

The name you give the backup file can be in great help for other admins to do a restore.

Naming of the backup file: http://technet.microsoft.com/en-us/library/cc785766(WS.10).aspx

Schedule System state backup: http://technet.microsoft.com/en-us/library/cc759092(WS.10).aspx

If you at least have a System state backup and a disaster do occur. Then you’ll probably be able to restore your domain back on track. Just be sure that backup file have not exceeded your domain Tombstone Lifetime (60 or 180 days).

* Security around how to protect the backup is out of the scope for this entry.