HackBlog

Considerations when Installing a new Windows Server 2008 forest

• You must make forest and domain functional level decisions that determine whether your forest and domain can contain domain controllers that run Windows 2000 Server, Windows Server 2003, or both. To read more about forest and domain functional levels please refer to the links below.
• Domain controllers running the Microsoft Windows NT Server 4.0 operating system are NOT supported with Windows Server 2008.
• Servers running Windows NT Server 4.0 are NOT supported by domain controllers that are running Windows Server 2008, meaning you MUST have additional DCs running Windows 2000/2003 to support older NT 4.0 servers.
• The first Windows Server 2008 domain controller in a forest must be a global catalog server and it cannot be an RODC.

Considerations when Installing a new Windows Server 2008 domain in an existing Windows 2000/2003 forest

• Before you create a new Windows Server 2008 domain in a Windows 2000/2003 forest, you must prepare the forest for Windows Server 2008 by extending the schema (that is, by running ADPREP /forestprep). To read more about ADPREP please refer to the links below or my "Windows Server 2008 ADPREP" article.
• You must make domain functional level decisions that determine whether your domain can contain domain controllers that run Windows 2000 Server, Windows Server 2003, or both. To read more about forest and domain functional levels please refer to the links below.
• I recommend that you host the PDC emulator operations master role in the forest root domain on a domain controller that runs Windows Server 2008. For more information about FSMO Roles, please read my "Understanding FSMO Roles in Active Directory" and "Transferring FSMO Roles" articles.

General considerations

Installing Active Directory Domain Services (AD-DS)

Method 1 – Server Manager/Initial Configuration Tasks

1. Open Server Manager by clicking the icon in the Quick Launch toolbar, or from the Administrative Tools folder.
2. Wait till it finishes loading, then click on Roles > Add Roles link.

1. In the Before you begin window, click Next.

1. In the Select Server Roles window, click to select Active Directory Domain Services, and then click Next.

1. In the Active Directory Domain Services window read the provided information if you want to, and then click Next.

1. In the Confirm Installation Selections, read the provided information if you want to, and then click Next.

1. Wait till the process completes.

1. When it ends, click Close.

1. Going back to Server Manager, click on the Active Directory Domain Services link, and note that there's no information linked to it, because the DCPROMO command has not been run yet.

1. Now you can click on the DCPROMO link, or read on.
   1. To run DCPROMO, enter the command in the Run command, or click on the DCPROMO link from Server Manager > Roles > Active Directory Domain Services.
   
   1. Depending upon the question if AD-DS was previously installed or not, the Active Directory Domain Services Installation Wizard will appear immediately or after a short while. Click Next.
   
   Note: The Advanced features of DCPROMO will be discussed in a future article.

• An NTFS partition with enough free space
• The Domain Admin's username and password
• The correct operating system version
• A NIC
• Properly configured TCP/IP (IP address, subnet mask and - optional - default gateway)
• A network connection (to a hub or to another computer via a crossover cable)
• A persistent and un-interrupted connection with the domain's existing DC
• An operational DNS server which holds the relevant SRV Record information for the AD domain and forest
• The Domain name for the domain that you want to join
• The Windows 2000 CD media (or at least the i386 folder)
• Brains (recommended, not required...)

Step 1: Configuring the computer's TCP/IP settings

Configure TCP/IP

1. Click Start, point to Settings and then click Control Panel.
2. Double-click Network and Dial-up Connections.
3. Right-click Local Area Connection, and then click Properties.

1. Click Internet Protocol (TCP/IP), and then click Properties.

1. Assign this server a static IP address, subnet mask, and gateway address (optional). Enter the DNS server's IP address in the Preferred DNS server box.

1. Click Advanced.
2. Click the DNS Tab.
3. Select "Append primary and connection specific DNS suffixes"
4. Check "Append parent suffixes of the primary DNS suffix"
5. Check "Register this connection's addresses in DNS". If this Windows 2000-based DNS server is on an intranet, it should only point to its own IP address for DNS; do not enter IP addresses for other DNS servers here. If this server needs to resolve names on the Internet, it should have a forwarder configured.
6. Click OK to close the Advanced TCP/IP Settings properties.
7. Click OK to accept the changes to your TCP/IP configuration.
8. Click OK to close the Local Area Connections properties.

Step 2: Running DCPROMO

1. Click Start, point to Run and type "dcpromo".

1. The wizard windows will appear. Click Next.

1. Choose Additional Domain Controller for an existing domain and click Next.

1. In the Network Credentials window enter the username and password for a Domain Admin in the domain you're trying to join. also enter the full DNS domain name. Click Next.

1. Accept the Database and Log file location dialog box (unless you want to change them of course). The location of the files is by default %systemroot%\NTDS, and you should not change it unless you have performance issues in mind. Click Next.

1. Accept the Sysvol folder location dialog box (unless you want to change it of course). The location of the files is by default %systemroot%\SYSVOL, and you should not change it unless you have performance issues in mind. This folder must be on an NTFS v5.0 partition. This folder will hold all the GPO and scripts you'll create, and will be replicated to all other Domain Controllers. Click Next.

1. Enter the Restore Mode administrator's password. You can leave it blank but whatever you do - remember it! Without it you'll have a hard time restoring the AD if you ever need to do so. Click Next.

1. Review your settings and if you like what you see - Click Next.

1. See the wizard going through the various stages of installing AD. Whatever you do - NEVER click Cancel!!! You'll wreck your computer if you do. If you see you made a mistake and want to undo it, you'd better let the wizard finish and then run it again to undo the AD.

1. If all went well you'll see the final confirmation window. Click Finish.

1. You must reboot in order for the AD to function properly. Click Restart now.

Step 3: Checking the AD installation

1. First, see that the Administrative Tools folder has all the AD management tools installed.

1. Run Active Directory Users and Computers (or type "dsa.msc" from the Run command). See that all OUs and Containers are there. See that your DC is listed in the Domain Controllers Container.

1. Run Active Directory Sites and Services. See that you have a site named Default-First-Site-Name, and that in it your server is listed along with the other DC in the domain/forest.

1. Open the DNS console. See that your new DC has registered itself in the 4 SRV Record folders.

1. Check the NTDS folder for the presence of the required files.

1. Check the SYSVOL folder for the presence of the required subfolders.

1. Check to see if you have the SYSVOL and NETLOGON shares, and their location.

Free Tool to Simplify IP Address Management

Toss your spreadsheets into the recycling bin! SolarWinds Free Tool, IP Address Tracker, lets you track an unlimited number of IP addresses for a unified, at-a-glance view of our entire IP address space.

• See which IP addresses are in use, and which aren't
• Eliminate manual errors, while ensuring that IP addresses are listed in the right place
• Determine the last time an IP address was used
• Pre-populate key statistics like DNS and response time

Download FREE IP Address Tracker from SolarWinds Now!

Windows Azure Infrastructure Services. Scalable on-demand infrastructure.

1. In GPEdit.msc (or any other GPO Editor window you're using) click on View > Filtering.

1. Click to un-select the "Only show policy settings that can be fully managed" check-box. Click Ok.

1. Now you will be able to see the new settings in the right pane:

1. You can now configure any of the above settings:

Performing an Offline Defragmentation

Activate Instance NTDS

Compact to c:\Windows\NTDS\temp

Conclusion

The Problem: Access Denied when Viewing Event Logs Remotely

Figure 1: Connecting to a Remote Computer

Figure 2: Select Computer to View Event Logs on

Figure 3: Access Denied Error Message when Viewing Event Logs Remotely

The Solution: Granting DNSAdmins to the Event Log Readers Group

Figure 4: Adding DNSAdmins to the Event Log Readers Group

Figure 5: Access Granted to DNSAdmins

The Problem: Access Denied to DNS Event Logs

Figure 6: Access Denied error when Viewing DNS Event Logs

Figure 7: DNS Management Console works find

Figure 8: Unable to Access DNS Event Logs

The Solution: Granting Remote Access to DNS Event Logs

1. Open Command Prompt with elevated permissions (Run as Administrator), and run the following command:

   wevtutil gl "DNS Server" > C:\Temp\DNS_Server.txt

   Note: Change the path to fit your needs.
   By the way, if you need to perform the same trick on other custom or application logs, you can find out the name of the log by running the following command and examining the resulting text file for the exact name syntax:

   wevtutil el > C:\Temp\All_Logs.txt

2. Next open the text file from the above path, and look for the channelAccess: entry.
   
   Figure 9: ChannelAccess entry
3. Now we need to find the SID of the DNSAdmins group. To do so, if the logged on user is a member of that group, you can find the SID by typing the following command (assuming this is Windows Server 2008 R2 or Windows 7):

   whoami /groups | find /i "dnsadmins"

   The result should look something like this:

   PETRI-LAB\DnsAdmins                    Alias            S-1-5-21-3903327414-3371247034-3746192915-1102 Mandatory group, Enabled by default, Enabled group

   Naturally, the domain name and SID will differ, but you get the point…
   You can also use other tools such as PSGetsid from Sysinternals.
   Copy the SID, we’ll need it in a moment.
4. Going back to the text file, append the following text string to that long line:

   (A;;0x1;;;XXX)

   Where XXX is the SID you’ve copied from above.
   In this case, I will append the following line:

   (A;;0x1;;;S-1-5-21-3903327414-3371247034-3746192915-1102)

   
   Figure 10: Adding Your SID
5. Next, copy the entire text from the O:BAG… part till the end of the line (including your recent addition):

   O:BAG:SYD:(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x5;;;SO)(A;;0x1;;;IU)(A;;0x1;;;SU)(A;;0x1;;;S-1-5-3)(A;;0x2;;;LS)(A;;0x2;;;NS)(A;;0x2;;;S-1-5-33)(A;;0x1;;;S-1-5-21-3903327414-3371247034-3746192915-1102)

6. And finally, run the following command in the Command Prompt, pasting the above string just after the /ca: parameter:

   wevtutil sl "DNS Server" /ca:O:BAG:SYD:(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x5;;;SO)(A;;0x1;;;IU)(A;;0x1;;;SU)(A;;0x1;;;S-1-5-3)(A;;0x2;;;LS)(A;;0x2;;;NS)(A;;0x2;;;S-1-5-33)(A;;0x1;;;S-1-5-21-3903327414-3371247034-3746192915-1102)

   
   Figure 11: Run the command
   You can now close the text file, we don’t need it anymore. No need to save it.
   
   Going back to the management workstation, open Event Viewer or open DNS management console as the DNSManager user, and behold, you can now view the DNS Event Logs:
   
   Figure 12: Problem solved, the DNS Event Logs show up
   
   Figure 13: Problem solved, the DNS Event Logs show up

Summary

In our next blog post, we will show you how to add these settings to Group Policy in order to configure them for multiple servers.