Global Catalog

Because AD is the central component of a Windows network, network clients and servers frequently query it. In order to increase the availability of AD data on the network as well as the efficiency of directory object queries from clients, AD includes a service known as the GC. The GC is a separatedatabase from AD and contains a partial, read-only replica of all the directory objects in the entire AD forest.

Only Windows servers acting as domain controllers can be configured as GC servers. By default, the first domain controller in a Windows forest is automatically configured to be a GC server (this designation can be moved later to a different domain controller if desired; however, every forest must contain at least one GC). Like AD, the GC uses replication in order to ensure updates
between the various GC servers within a domain or forest. In addition to being a repository of commonly queried AD object attributes, the GC plays two primary roles on a Windows network:

Network logon authentication?In native-mode domains (networks in which all domain controllers have been upgraded to Win2K or later, and the domain?s functional level has been manually set to the appropriate level), the GC facilitates network logons for ADenabled clients. It does so by providing universal group membership information to the account sending the logon request to a domain controller. This applies not only to regular users but also to every type of object that must authenticate to AD (including computers).In multi-domain networks, at least one domain controller acting as a GC must be available in order for users to log on. Another situation that requires a GC server occurs when a user attempts to log on with a user principal name (UPN) other than the default. If a GC server is not available in these circumstances, users will only be able to logon to the local computer (the one exception is members of the domain administrators group, who do not require a GC server in order to log on to the network).

Directory searches and queries With AD, read requests such as directory searches and queries, by far tend to outweigh write-oriented requests such as directory updates (for example, by an administrator or during replication). The majority of AD-related network traffic is comprised of requests from users, administrators, and applications about objects in the directory. As a result, the GC is essential to the network infrastructure because it allows clients to quickly perform searches acrossall domains within a forest.

(Although mixed-mode Win2K domains do not require the GC for the network logon authentication process, GCs are still important in facilitating directory queries and searches on these networks and should therefore be made available at each site within the network.)

Virtualization Interview Questions and Answers

> What is Virtualization ?
Virtualization is the creation of a virtual (rather than actual) version of something, such as an operating system, a server, a storage device or network resources.

You probably know a little about virtualization if you have ever divided your hard drive into different partitions. A partition is the logical division of a hard disk drive to create, in effect, two separate hard drives.

Operating system virtualization is the use of software to allow a piece of hardware to run multiple operating system images at the same time. The technology got its start on mainframes decades ago, allowing administrators to avoid wasting expensive processing power.

In 2005, virtualization software was adopted faster than anyone imagined, including the experts. There are three areas of IT where virtualization is making headroads, network virtualization, storage virtualization and server virtualization.

>What are the benefits of virtualization ?
There are some well accepted and inherit benefits to using Virtualization. Here are some of them:

*Reduce the number of physical servers
*Reduce the infrastructure needed for your data center (power, cooling, battery backup, network switch ports, KVM ports and space)
*Reduce administrative overhead because servers can be administered from a single console
*Ability to bring up new servers quickly (it could take days or weeks to put in a new physical server but it could take just a few minutes to create a new virtual server from a template)
*Hardware Independence of virtual servers – a virtual server can run on any host server, regardless of the host hardware
*Because of hardware independence, you receive reduce your disaster recovery cost, complexity, and recovery time
*A “greener” datacenter & server environment due to the consolidation
Overall, lower TCO of servers

>What is a Hypervisor ?
You can think of a Hypervisor as the kernel or the core of a virtualization platform. The Hypervisor is also called the Virtual Machine Monitor. The Hypervisor has access to the physical host hardware.

Of the total amount of disk space taken for a virtualization platform (like Hyper-V or VMware ESX), the Hypervisor is, by far, the smallest part. A Type 1 Hypervisor runs on the bare metal of the hardware. Examples of a Type 1 Hypervisor are Hyper-V and ESX Server. A Type 2 Hypervisor is hosted by an operating system. Examples of a Type 2 Hypervisor are VMware Server and Microsoft Virtual Server.

.

>What is ESX Server ?
ESX Server is VMware’s flagship enterprise server virtualization platform. It comes in two versions – ESX Server and ESXi Server where the latter has no service console and is the thinnest version available. ESX Server has many optional features like VMotion and VMHA (both discussed below) and some built-in features like the VMFS file system. Most end users purchase VMware ESX Server with some set of optional features in a package called VMware Infrastructure. ESX Server is managed by the VMware Infrastructure Client. Its centralized management platform is called Virtual Center.

>What is Hyper-V ?
Codenamed "Viridian" but given the the formal name of Hyper-V, it is a hypervisor-based Windows Server virtualization platform that is included as a role of Windows Server 2008. Hyper-V enables you to consolidate workloads onto a single physical server using a broad range of services ranging from resource-intensive services like Microsoft SQL Server to third-party applications that may run on previous versions of Windows or Linux.

>What are a host, guest, and virtual machine ?

A host system (host operating system) would be the primary & first installed operating system.  If you are using a bare metal Virtualization platform like Hyper-V or ESX, there really isn’t a host operating system besides the Hypervisor. If you are using a Type-2 Hypervisor like VMware Server or Virtual Server, the host operating system is whatever operating system those applications are installed into.

A guest system (guest operating system) is a virtual guest or virtual machine (VM) that is installed under the host operating system. The guests are the VMs that you run in your virtualization platform.

Some admins also call the host & guest the parent and child.

>What products are available for Server Virtualization ?
Bare Metal Hypervisor / Native / Type 1:

VMware ESX Server
Microsoft Hyper-V
Citrix/Xen Server

Hosted in an OS / Type 2:

VMware Server
Microsoft Virtual Server
Parallels Server

Server Virtualization

Server virtualization is the masking of server resources, including the number and identity of individual physical servers, processors, and operating systems, from server users. The server administrator uses a software application to divide one physical server into multiple isolated virtual environments. The virtual environments are sometimes called virtual private servers, but they are also known as guests, instances, containers or emulations.
There are three popular approaches to server virtualization: the virtual machine model, the paravirtual machine model, and virtualization at the operating system (OS) layer.
Virtual machines are based on the host/guest paradigm. Each guest runs on a virtual imitation of the hardware layer. This approach allows the guest operating system to run without modifications. It also allows the administrator to create guests that use different operating systems. The guest has no knowledge of the host's operating system because it is not aware that it's not running on real hardware. It does, however, require real computing resources from the host -- so it uses a hypervisor to coordinate instructions to the CPU.
The hypervisor is called a virtual machine monitor (VMM). It validates all the guest-issued CPU instructions and manages any executed code that requires addition privileges. VMware and Microsoft Virtual Server both use the virtual machine model.
The paravirtual machine (PVM) model is also based on the host/guest paradigm -- and it uses a virtual machine monitor too. In the paravirtual machine model, however, The VMM actually modifies the guest operating system's code. This modification is called porting. Porting supports the VMM so it can utilize privileged systems calls sparingly. Like virtual machines, paravirtual machines are capable of running multiple operating systems. Xen and UML both use the paravirtual machine model.
Virtualization at the OS level works a little differently. It isn't based on the host/guest paradigm. In the OS level model, the host runs a single OS kernel as its core and exports operating system functionality to each of the guests. Guests must use the same operating system as the host, although different distributions of the same system are allowed. This distributed architecture eliminates system calls between layers, which reduces CPU usage overhead. It also requires that each partition remain strictly isolated from its neighbors so that a failure or security breach in one partition isn't able to affect any of the other partitions. In this model, common binaries and libraries on the same physical machine can be shared, allowing an OS level virtual server to host thousands of guests at the same time. Virtuozzo and Solaris Zones both use OS-level virtualization.
Server virtualization can be viewed as part of an overall virtualization trend in enterprise IT that includes storage virtualization, network virtualization, and workload management. This trend is one component in the development of autonomic computing, in which the server environment will be able to manage itself based on perceived activity. Server virtualization can be used to eliminate server sprawl, to make more efficient use of server resources, to improve server availability, to assist in disaster recovery, testing and development, and to centralize server administration.

Installing VMware vCenter Server

How To Configure a SQL Server ODBC Connection to a Remote Database
How to create an ODBC connection and connect vCenter Server to a preconfigured SQL Server 2005 database.

1. From your vCenter Server system desktop, select Start > Programs > Administrative Tools > Data Sources (ODBC).
2. Click System DSN tab and click Add.
3. Select the SQL Native Client driver.
4. Click Finish.
5. When prompted by the Create a New Data Source to SQL Server Wizard, enter the values below:
a. Fill in the Name field.
b. Fill in the Description. You can type in vCenter Server Database.
c. Fill in the Server field by entering the host name of the SQL Server. If you see more than one SQL server in the list, make sure that you enter the correct SQL server name.
d. The UNC user account you logged in with appears in the Login ID field.
e. For the field Connect to SQL Server to obtain default settings for the additional configuration options, leave the check box selected.
f. Change the default database to your assigned database (and not the master database).
6. Click Test Data Source. If the test does not complete successfully, back up in the ODBC wizard and verify the information you entered.
7. Click OK to return to ODBC Microsoft SQL Server Setup dialog box.
8. Click OK to return to the ODBC Data Source Administrator dialog box. Verify that your new data source appears in the list of system DSNs.
9. Click OK to close the ODBC Data Source Administrator dialog box.


How To Install vCenter Server
1. Go to location of the vCenter Server installation software.
2. Start VMware vCenter Installer:
- If you have an ISO image or physical CD-ROM mounted on the vCenter Server system’s CD-ROM drive and autorun is enabled, the installer main window appears.
- For files that are unzipped from a Zip archive or that are on a network share, open the directory containing the files and double-click autorun.exe file.
3. Click vCenter Server link.
4. When prompted by installation wizard, do the following:
a. Select the setup language and click OK.
b. Click Next (Welcome Page).
c. Click Next (End-User Patent Agreement).
d. Select I agree to the terms in the license agreement and click Next (License Agreement).
e. Type in your User Name.
f. Type in your Organization. Click Next.
g. Type in the License key and click Next.
h. If you are not connecting to a remote database, select Install a Microsoft SQL Server 2005 Express instance and click Next.
If you are connecting to a remote database, select Use an existing supported database, select your DSN and click Next.
-In the second Database Options dialog box , type in your Database Username. Enter your Database password.
-If a warning appears about reinitializing the database, select Replace my existing database with an empty one. If you are installing vCenter Server for the first time, you will not see this warning.
i. Select Use SYSTEM Account and click Next (vCenter Server Service).
j. Accept the default Destination Folder and click Next.
k. Accept the default vCenter Server Linked Mode Options and click Next.
l. Accept the defaults Configure Ports and click Next.
m. Accept the default vCenter Server JVM Memory and click Next.
n. Click Install (Ready to Install the Program).
5. When installation is complete, click Finish to exit wizard.
6. Close VMware vCenter Installer window.


How To Install the vSphere Client on the vCenter Server System
How to install the VMware vSphere Client on your vCenter Server system and verify that installation was successful.

1. Go to location of the vCenter Server installation software.
2. Start VMware vCenter Installer.
3. In Vmware vCetner Installer window, click vSphere Client to start installation wizard.
4. When prompted by the installation wizard, do the following:
a. Select the setup language.
b. Click Next (Welcome page).
c. Click Next (End-User Patent Agreement).
d. Select I agree to the terms in the license agreement and click Next.
e. Type in your User Name.
f. Type in your Organization and click Next.
g. Select your Destination Folder and click Next.
h. Click Install (Ready to Install the Program).
5. Click Finish when the installation is complete.
6. Close VMware vCenter Installer window.
7. Log in to the vCenter Server with the vSphere Client.
a. Double-click the vSphere Client icon on your vCenter Server system.
b. In the vSphere Client login dialog box, enter your vCetner Server system IP address or host name in IP address/Name and select the use Windows session credentials check box.
c. Click Login.
d. Select Install this certificate and do not display any security warnings for “<host_name>” to prevent this warning from being displayed in the future.
e. Click Ignore to proceed with the connection.
f. Click OK when the VMware Evaluation Notice window appears, warning that your evaluation license expires within 60 days.
8. Verify that the Hosts and Clusters inventory view is displayed.
9. In the vSphere Client menu bar, select File > Exit to close the vSphere Client.
10. Log out of vCenter Server system.

Microsoft Exchange server 2003/2007/2010 Interview Questions and Answers

1. What are the pre requisites to install Exchange Server 2007 ?
Microsoft .Net Framework 2.0
Microsoft ASP .Net
World Wide Web Service
MMC 3.0
Windows power shell
SMTP & NNTP service should not be installed
2. What’s the order to install Exchange Server 2007 Roles in a exchange Server 2003 organization ?
Client Access Server Role
Hub Transport Server Role
Mailbox Server Role
Unified Messaging Server role
3. What are the versions available in Exchange Server 2007 ?
There are two types of Exchange Server 2007 version release
· 64 bit – for production environment
· 32 bit – only for non-production environment
4. What are the Operating system requirements to install Exchange Server 2007 ?
Exchange Server 2007 can be installed on
· Windows Server 2003 SP2 64-bit,
· Windows Server 2003 R2 SP2 64-bit or
· Windows Server 2008 64-bit
5. What are the Active directory requirements to install Exchange Server 2007 ?
Domain functional level at least windows server 2000 native or higher
Schema Master must be run on windows 2003 server with sp1
At least one Domain Controller, in each domain with windows server 2003 sp1
At least one global catalog server in Active Directory Site which hosts exchange Server 2007
4:1 ratio of Exchange processor to global catalog server processors
6. What are the hardware requirements to install Exchange Server 2007 ?
Processor – 64 bit processor
RAM – 2 GB + 5 MB per Mailbox
Disk Space – At least 1.2 GB on the drive on which you install Exchange
- 200 MB of available disk space on the system drive
File Format – NTFS
7. What are the Software requirements to install Exchange Server 2007 ?
Following are the software prerequisites to install Exchange Server 2007
Microsoft .Net Framework 2.0
IIS
WWW
MMC 3.0
Microsoft Windows Power Shell
8. What is Transition in Exchange Server 2007 ?
Transition is the scenario in which you upgrade an existing Exchange organization to Microsoft Exchange Server 2007. To perform the transition, you must move data from the existing Exchange servers to new Exchange 2007 servers. For example, when upgrading from an Exchange Server 2003 or Exchange 2000 Server organization to an Exchange 2007 organization, you perform a transition
When transitioning to Exchange 2007, you cannot perform an in-place server upgrade on an existing Exchange server. Instead, you must install a new Exchange 2007 server into the existing organization, and then move data to the new Exchange 2007 server.
9. What is Migration in Exchange Server 2007 ?
Migration is the scenario in which you upgrade to Exchange 2007 by migrating data from a non-Exchange messaging system to Exchange 2007 or from an existing Exchange organization to a completely new Exchange organization, without retaining any of the Exchange configuration data in the first organization. For example, when merging with another company, you can perform a migration. In this scenario, you move mailboxes and data to the other company’s Exchange organization, without retaining any of the configuration data from your existing Exchange organization. Another example is when upgrading from Lotus Notes to Exchange 2007, you perform a migration. In this scenario, you must move mailboxes and data to the new Exchange 2007 organization, without retaining any of the data from the Lotus Notes organization.
The migration process includes installing a completely new Exchange 2007 organization, and then migrating mailboxes from the old messaging system to the new Exchange 2007 messaging system, using various tools for migration.
10. Is it possible to do in place upgrade from Exchange Server 2003 to Exchange Server 2007 ?
No in-place upgrade on existing Exchange server organization. Install new Exchange Server 2007 server into existing organization, and move data to new server.


11. What are the transition options available in Exchange Server 2007 ?
We can make transition in following options
Single forest to single forest – you have an existing single forest Exchange 2003 or Exchange 2000 topology, you can transition to a single forest Exchange 2007 organization
Single forest to cross forest – If you have an existing single forest Exchange 2003 or Exchange 2000 topology, you can transition to a cross-forest Exchange 2007 topology
Cross forest to cross forest – If you have an existing cross-forest Exchange 2003 or Exchange 2000 topology with Exchange servers and mailboxes in each forest, you can transition to an Exchange 2007 cross-forest topology.
Resource forest to resource forest -
Single forest to resource forest -

12. What are the considerations for Exchange Server 2007 to co exists with Exchange server 2000 and Exchange Server 2003 ?
Exchange Organization in Exchange Native Mode· Exchange Server 2007 routing group (DWBGZMFD01QNBJR) is created only for coexisting with earlier versions of Exchange.
Routing Group Connector is required between Exchange Server 2003 and Exchange Server 2007 (created during setup).
Exchange Server 2003 computers cannot interoperate with the Unified Messaging server role. Exchange 2003 mailboxes cannot be Unified Messaging–enabled.
Exchange 2003 Front-ends cannot talk to Exchange Server 2007 Mailbox Server Roles.
No in-place upgrade on existing Exchange server. Install new Exchange Server 2007 server into existing organization, and move data to new server

13. Will Front End server talk to Exchange Server 2007 Mailbox server in an Exchange organization having both exchange 2003 and exchange Server 2007 ?
Exchange Server 2003 Front-end server cannot talk to Exchange Server 2007 Mailbox Server Roles

14. What is the status of routing group connector in co existed of Exchange Server 2003 and 2007 ?
Exchange Organization in Exchange Native Mode· Exchange Server 2007 routing group (DWBGZMFD01QNBJR) is created only for coexisting with earlier versions of Exchange.
Routing Group Connector is required between Exchange Server 2003 and Exchange Server 2007 (created during setup).

15. Which service should not be installed in Exchange Server 2007 installation ?
SMTP and NNTP service should not be installed

16. What are the Exchange Server editions available ?
There are two types of Exchange Server 2007 editions available
Standard Edition
Enterprise Edition

17. What is the difference between standard and Enterprise Edition ?
Exchange 2007 functions Standard Edition Enterprise Edition
Number of Data Stores Supported 5 includes Mailbox/Public Folder 50 combination of both
Clustering support No Yes
OS Support Windows 2003 64 bit Windows 2003 64 bit

18. What to do if exchange Server 5.5 in your organization in order to upgrade to Exchange Server 2007 ?
You cannot upgrade an existing Microsoft Exchange Server version 5.5 organization to Exchange Server 2007. You must first migrate from the Exchange Server 5.5 organization to an Exchange Server 2003 or an Exchange 2000 Server organization. Then you can transition the Exchange 2003 or Exchange 2000 organization to Exchange 2007.

19. What are the Planning considerations for Client Access Server Role ?
The Client Access server role supports the Outlook Web Access, Outlook Anywhere, and Exchange ActiveSync client applications, in addition to the POP3 and IMAP4 protocols. The Client Access server role also hosts several key services, such as the Auto discover service and Exchange Web Services.
In order to have better client access functionality we have to perform a Planning consideration on Exchange Active Sync. Outlook web Access, outlook anywhere, POP3 and IMAP4 protocols and also securing client access

20. What are the Planning Considerations of Hub Transport Server Role ?
Hub Transport server role is a required role in a Microsoft Exchange Server 2007 organization that provides routing within a single organizational network by using the Active Directory directory service site. Hub Transport server role installed handles all mail flow inside the organization, apply transport rules, apply journal rules, and deliver messages to recipients’ mailboxes
We have to perform a Planning Consideration on
Topology for mail flow inside and outside the Exchange organization
Server capacity – determine how to perform performance monitor
Security – includes delegation of administrative roles and verification that IP connections are only enabled from authorized servers
Transport Features – determine the transport features that you will enable at the Hub Transport server and how they will be configured

21. What are the Planning Considerations of Mailbox Server Role ?
The Microsoft Exchange Server 2007 Mailbox server role hosts mailbox databases and provides e-mail storage and advanced scheduling services for Microsoft Office Outlook users The Mailbox server role can also host a public folder database, which provides a foundation for workflow, document sharing, and other forms of collaboration
We have to perform a planning consideration on
Sizing the database,
Planning for public folder,
Co hosting with other server roles and
Planning for clustered Mailbox server

22. What are the Planning Considerations for Edge Transport Server Role ?
Exchange Server 2007 Edge Transport server role is designed to provide improved antivirus and anti-spam protection for the Exchange organization. Computers that have the Edge Transport server role also apply policies to messages in transport between organizations. The Edge Transport server role is deployed in an organization’s perimeter network.
Edge Transport Should not be included in Active Directory
Should be installed in a Standalone Server
Edge Transport Should not be Part of the domain
ADAM Should be Installed
Pre requisites .Net framework , Windows Management Shell, MMC

Responding to Operations Master Failures

The first step in responding to the unavailability of a domain controller that is an operations master role owner is to determine the anticipated duration of the outage. If the outage is expected to be brief, the recommended response is simply to wait for the role owner to become available before performing a role-related function.

If the outage is longer, the correct response might be to seize the operations master role from a domain controller. To seize a role is to move it without the cooperation of its current owner. It is best to avoid seizing roles. The decision to seize an operations master role depends upon the role and the expected length of the outage.

Primary Domain Controller Emulator Failures
The loss of a domain controller that is the primary domain controller emulator role can be visible to any user, either users or administrators. Specifically, an end user running Windows NT Workstation3.51, or Windows NT 4.0, Windows 95, or Windows 98 without the Active Directory client, cannot change their password without communicating with the primary domain controller emulator. If the user’s password has expired, the user is not able to log on.

Therefore, you might need to repair a primary domain controller emulator failure quickly.If the primary domain controller emulator is offline for a significant period of time and the domain has users running Windows NT Workstation 3.51, or Windows NT 4.0, Windows 95, or Windows 98 without the Active Directory client, or domain controllers running earlier versions of Windows NT, you should seize the primary domain controller emulator role to the “Standby operations masterdomain controller.”

The user interface for this seizure is similar to that of a normal operations master role transfer, except it requires an extra confirmation from you. Agree to the confirmation only if you know the current primary domain controller emulator will be offline for a significant period. Later, when the original primary domain controller emulator domain controller comes back online, transfer the role back to the original role owner.

Infrastructure Master Failures
Temporary loss of a domain’s infrastructure master is not visible to end users, and is not visible to you, as an administrator, unless you recently moved or renamed a large number of accounts. Therefore, in most cases, a temporary loss of the infrastructure master is not a problem worth fixing. If you anticipate a long outage of a domain’s infrastructure master and you need to repair it, first select a domain controller that is not a Global Catalog server and that has good network connectivity to a Global Catalog server located in any domain.

Ideally, the domain controller you have chosen should be within the same site as a Global Catalog server. It is not important that the new infrastructure master be near the previous one. When you have selected the domain controller, seize the infrastructure master role to this domain controller.
The user interface for this seizure is similar to that of a normal operations master role transfer, except it requires an extra confirmation from you. Agree to the confirmation only if you know that the current infrastructure master will be offline for a very long period. Later, when the original infrastructure master comes back online, transfer the role back to the original role owner.

Other Operations Master Failures
Temporary loss of the schema master, domain naming master, or RID master is ordinarily not visible to end users, and does not usually inhibit your work as an administrator. Therefore, this is usually not a problem worth fixing. However, if you anticipate an extremely long outage of the domain controller holding one of these roles, you can seize that role to the “Standby operations master domain controller.”

But, seizing any of these roles is a drastic step; one that you would take only when the outage is permanent, as in the case when a domain controller is physically destroyed and cannot be restored from backup media. A domain controller whose schema master, domain naming master, or RID master role is seized must never come back online. Before proceeding with the role seizure, you must ensure that the outage of this domain controller is permanent by physically disconnecting the domain controller from the network.

The domain controller that seizes the role should be fully up-to-date with respect to updates performed on the previous role owner. Because of replication latency, it is possible that the domain controllermight not be up-to-date.

To check the status of updates for a domain controller, you can use the Repadmin command-line tool. The Repadmin command-line tool is a Resource Kit tool that performs replication diagnostics. It is available on the Microsoft Windows 2000 Server installation CD. Repadmin can determine whether a domain controller has the most current updates.

For more information about using the Repadmin tool, see Windows 2000 Support Tools Help, which is included on the Windows 2000 Server CD and “Active Directory Diagnostics, Troubleshooting, and Recovery” in this book.

For example, to make sure a domain controller is fully up-to-date, suppose that “server05″ is the RID master of the domain “reskit.com,” “server10″ is the “Standby operations master domain controller,” and “server12″ is the only other domain controller in the “reskit.com” domain. Using the Repadmin tool, you would issue the following commands:

C:\> repadmin /showvector dc=reskit,dc=com server10.reskit.com
New-York\server05 @ USN 2604
San-Francisco\server12 @ USN 2706

C:\> repadmin /showvector dc=reskit,dc=com server12.reskit.com
New-York\server05 @ USN 2590
Chicago\server10 @ USN 3110

Note
In the previous example, user input is in bold type.
Ignore all output lines except those for server05. Server10′s up-to-date status value with respect to server05 (server05 @ USN 2604) is larger than server12′s up-to-date status value with respect to server05 (server05 @ USN 2590), making it is safe for server10 to seize the RID master role formerly held by server05. If the up-to-date status value for server10 was less than the value for server12, you would wait for normal replication to update server10, or use the Repadmin tool’s /sync/force commands to make the replication happen immediately.

After you have determined that the role owner is fully up-to-date, you can seize the operations master role using the Ntdsutil tool as in the following example:
C:\> ntdsutil
ntdsutil: roles
fsmo maintenance: connections
server connections: connect to server10.reskit.com
binding to server10.reskit.com …
Connected to server10.reskit.com
using credentials of locally logged on user
server connections: quit
fsmo maintenance: seize RID master
Server “server10.reskit.com” knows about 5 roles
Schema – CN=NTDS Settings,CN=server04,CN=Servers,
CN=New-York,CN=Sites,CN=Configuration,DC=reskit,DC=com
Domain – CN=NTDS Settings,CN=server04,CN=Servers,
CN=New-York,CN=Sites,CN=Configuration,DC=reskit,DC=com
PDC – CN=NTDS Settings,CN=server10,CN=Servers,
CN=Chicago,CN=Sites,CN=Configuration,DC=reskit,DC=com
RID – CN=NTDS Settings,CN=server10,CN=Servers,
CN=Chicago,CN=Sites,CN=Configuration,DC=reskit,DC=com
Infrastructure – CN=NTDS Settings,CN=server12,CN=Servers,
CN=San-Francisco,CN=Sites,CN=Configuration,DC=reskit,DC=com
fsmo maintenance: quit
ntdsutil: quit
C:\>

Note
In the previous example, user input is in bold type.
For more information about specific procedures for using the Ntdsutil command-line tool, see Windows 2000 Support Tools Help, which is included on the Windows 2000 Server installation CD.

Using the Ntdsutil Tool for Role Placement
The Ntdsutil tool allows you to transfer and seize operations master roles. The Ntdsutil tool might be more convenient for operations master transfers and seizures than the graphical user interface tools, because it is simpler and quicker to enter commands than to use multiple windows.
To perform seizures of the schema master, domain naming master, and RID master roles, the Ntdsutil tool is the required method.

When you use the Ntdsutil command-line tool to seize an operations master role, the tool attempts a transfer from the current role owner first. Then, if the existing operations master is unavailable, it performs the seizure. The Ntdsutil tool provides help information when you type a question mark (?). The following is an example showing the transfer of the domain naming master role (with user input shown in bold type):
C:\> ntdsutil
ntdsutil: ?
? – Print this help information

Authoritative restore – Authoritatively restore the DIT database
Domain management – Prepare for new domain creation
Files – Manage NTDS database files
Help – Print this help information
IPDeny List – Manage LDAP IP Deny List
LDAP policies – Manage LDAP protocol policies
Metadata cleanup – Clean up objects of decommissioned servers
Popups %s – (en/dis)able popups with “on” or “off”
Quit – Quit the utility
Roles – Manage NTDS role owner tokens
Security account management – Manage Security Account Database – Duplicate SID Cleanup
Semantic database analysis – Semantic Checker

ntdsutil: roles
fsmo maintenance: ?
? – Print this help information
Connections – Connect to a specific domain controller
Help – Print this help information
Quit – Return to the prior menu

Seize domain naming master – Overwrite domain role on connected server
Seize infrastructure master – Overwrite infrastructure role on connected server
Seize PDC – Overwrite PDC role on connected server
Seize RID master – Overwrite RID role on connected server
Seize schema master – Overwrite schema role on connected server

Select operation target – Select sites, servers, domains, roles and Naming Contexts

Transfer domain naming master – Make connected server the domain naming master
Transfer infrastructure master – Make connected server the infrastructure master
Transfer PDC – Make connected server the PDC
Transfer RID master – Make connected server the RID master
Transfer schema master – Make connected server the schema master

fsmo maintenance: connections
server connections: ?
? – Print this help information
Clear creds – Clear prior connection credentials
Connect to domain %s – Connect to DNS domain name
Connect to server %s – Connect to server, DNS name or IP address
Help – Print this help information
Info – Show connection information
Quit – Return to the prior menu
Set creds %s %s %s – Set connection creds as domain, user, pwd
Use “NULL” for null password
server connections: connect to server reskit1
Binding to reskit1 …
Connected to reskit1 using credentials of locally logged on user
server connections: quit
fsmo maintenance: transfer domain naming master
Server “reskit1″ knows about 5 roles
Schema – CN=NTDS Settings,CN=RESKIT1,CN=Servers,CN=Washington,CN=Sites,CN=Configuration,DC=reskit,DC=com
Domain – CN=NTDS Settings,CN=RESKIT1,CN=Servers,CN=Washington,CN=Sites,CN=Configuration,DC=reskit,DC=com
PDC – CN=NTDS Settings,CN=RESKIT1,CN=Servers,CN=Washington,CN=Sites,CN=Configuration,DC=reskit,DC=com
RID – CN=NTDS Settings,CN=RESKIT1,CN=Servers,CN=Washington,CN=Sites,CN=Configuration,DC=reskit,DC=com
Infrastructure – CN=NTDS Settings,CN=RESKIT1,CN=Servers,CN=Washington,CN=Sites,CN=Configuration,DC=reskit,DC=com
fsmo maintenance: quit
ntdsutil: quit
Disconnecting from reskit1 …
C:\>

In the previous example, the available Ntdsutil tool commands display after entering a question mark (?). To transfer an operations master role, the roles command is entered, which displays the fsmo maintenance menu. Entering a question mark (?) displays the subcommands within the fsmo maintenance menu. Before transferring the operations master role, you must connect to the domain controller that will receive the role (“reskit1″ in the example above) by entering the connect to server subcommand. Then, after leaving the server connections mode by entering “quit”, issue the transfer domain naming master command. A confirmation pop-up window (not shown) displays for the transfer domain naming master operation.

Netdom Guide

Netdom is a command-line tool that is built into Windows Server 2008 and Windows Server 2008 R2. It is available if you have the Active Directory
Domain Services (AD DS) server role installed. It is also available if you install the Active Directory Domain Services Tools that are part of the Remote
Server Administration Tools (RSAT).
You can use netdom to:

• Join a computer that runs Windows XP Professional, Windows Vista, or Windows 7 to a Windows Server 2008 R2, Windows Server 2008,
• Windows Server 2003, Windows 2000, or Windows NT 4.0 domain.
  
  
  • Provide an option to specify the organizational unit (OU) for the computer account.
    
    
  • Generate a random computer password for an initial Join operation.
    
    
• Manage computer accounts for domain member workstations and member servers. Management operations include:
  
  
  • Add, Remove, Query.
    
    
  • An option to specify the OU for the computer account.
    
    
  • An option to move an existing computer account for a member workstation from one domain to another while maintaining
  • the security descriptor on the computer account.
    
    
• Establish one-way or two-way trust relationships between domains, including the following kinds of trust relationships:
  
  
  • From a Windows 2000, Windows Server 2003, Windows Server 2008, or Windows Server 2008 R2 domain to a Windows NT 4.0 domain.
    
    
  • From a Windows 2000, Windows Server 2003, Windows Server 2008, or Windows Server 2008 R2 domain to a Windows 2000,
  • Windows Server 2003, Windows Server 2008, or Windows Server 2008 R2 domain in another enterprise.
    
    
  • Between two Windows 2000, Windows Server 2003, Windows Server 2008, or Windows Server 2008 R2 domains in an enterprise
  • (a shortcut trust).
    
    
  • The Windows Server 2008 R2, Windows Server 2008, Windows Server 2003, or Windows 2000 Server half of an interoperable
  • Kerberos protocol realm.
    
    
• Verify or reset the secure channel for the following configurations:
  
  
  • Member workstations and servers.
    
    
  • Backup domain controllers (BDCs) in a Windows NT 4.0 domain.
    
    
  • Specific Windows Server 2008 R2, Windows Server 2008, Windows Server 2003, or Windows 2000 replicas.
    
    
• Manage trust relationships between domains, including the following operations:
  
  
  • Enumerate trust relationships (direct and indirect).
    
    
  • View and change some attributes on a trust.

Syntax
Netdom uses the following general syntaxes:
NetDom <Operation> [<Computer>] [{/d: | /domain:} <Domain>] [<Options>] NetDom help <Operation>

Commands

Command	Description
Netdom add	Adds a workstation or server account to the domain.
Netdom computername	Manages the primary and alternate names for a computer. This command can safely rename Active Directory domain controllers as well as member servers.
Netdom join	Joins a workstation or member server to a domain. The act of joining a computer to a domain creates an account for the computer on the domain, if it does not already exist.
Netdom move	Moves a workstation or member server to a new domain. The act of moving a computer to a new domain creates an account for the computer on the domain, if it does not already exist.
Netdom query	Queries the domain for information such as membership and trust.
Netdom remove	Removes a workstation or server from the domain.
Netdom movent4bdc	Renames a Windows NT 4.0 backup domain controller to reflect a domain name change. This can assist in Windows NT 4.0 domain renaming efforts.
Netdom renamecomputer	Renames a domain computer and its corresponding domain account. Use this command to rename domain workstations and member servers only. To rename domain controllers, use the netdom computername command.
Netdom reset	Resets the secure connection between a workstation and a domain controller.
Netdom resetpwd	Resets the computer account password for a domain controller.
Netdom trust	Establishes, verifies, or resets a trust relationship between domains.
Netdom verify	Verifies the secure connection between a workstation and a domain controller.

Remarks

• A trust relationship is a defined affiliation between domains that enables pass-through authentication.
  
  
• A one-way trust relationship between two domains means that one domain (the trusting domain) allows users who have accounts on theother domain (the trusted domain), access to its resources.
  
  
• The one-way trust relationship described here is helpful in master domain models, but it is not the only kind of trust relationship. When two one-way trusts are established between domains, it is known as a two-way trust. In two-way trusts, each domain treats the users from the trusted (and trusting) domain as its own users.
  
  
• By default, only the result of an operation is reported. For example, if you use the Join operation, you see output similar to the following:

success: mywksta joined to mycompany domain

• If you specify the /verbose parameter, the output lists the success or failure of each transaction that is necessary to perform the operation. For example, this time when you use the Join operation, you see output similar to the following:

success: adding machine account for mywksta to mycompany domain success: configuring lsa on mywksta success: mywksta joined to mycompany domain

• The /reboot parameter specifies that the computer being acted upon by the specified netdom operation is shut down and automatically rebooted after the completion of the operation. When you specify the /reboot parameter, the following message and a countdown timer display on the workstation screen, prior to the Restart operation:
  

The system is shutting down. Please save all work in progress and logoff. Any unsaved changes will be lost. This shutdown was initiated because the domain which this machine belongs to was changed by nnn.

• For nnn, netdom substitutes the name of the administrator that you enter by using the /uo parameter.
  
  
• The default delay before the computer restarts is 20 seconds.

Replmon.exe Command

Replmon is the first tool you should use when troubleshooting Active Directory replication issues. As it is a graphical tool, replication issues are easy to see and somewhat easier to diagnose than using its command line counterparts. The purpose of this document is to guide you in how to use it, list some common replication errors and show some examples of when replication issues can stop other network installation actions.

Symptoms of Replication Faults

• Failure to extend the schema – The Active Directory schema has to be extended for many reasons. Two of the most common are:
  • When installing an Exchange 200x server (by running setup.exe /forestprep and /domainprep)
  • When adding a 2003 Domain Controller to a Windows 2000 Active Directory network (by running adprep /forestprep and /domainprep).
  If there is a replication issue with any of the domain controllers on the Schema partition, the Schema will not allow any extension.
• Failure to DCPromo a new Domain Controller – When installing a new Domain Controller, the wizard waits until Active Directory is fully synchronised before continuing. Replication issues would cause this to hang at this point. (Although it can be forced to wait until later, this would only put off the problem).
• Installation of Active Directory aware software – Software that creates a new user account per network or writes to the Active Directory could fail or produce ambiguous errors when replication issues exist on the network.
• Any recent warnings or errors in the File Replication Service log in Event Viewer
• Any recent NTDS Replication Errors in the Directory Service log in Event Viewer

How to Use Replmon

To use Replmon logon to a Domain Controller, select Start|Run, type Replmon, and click OK. You will be presented with the following screen:

Right click on the Monitored Servers icon and select Add Monitored Server...

Select the Search the directory for the server to add radio button.

Ensure the correct domain populates in drop down list, and click Next.

Select an appropriate server from the list of Domain Controllers…

• If you know you are experiencing issues with a particular domain controller, choose that server.
• If you are checking general replication, or are not sure where the fault lies, choose the Forest Root.
• On larger networks, you will need to choose more than one server depending on the replication topology.
• (For information on viewing the replication topology, see Appendix A) …and click Finish.

If your Active Directory contains only Windows 2000 domain controllers, you will see three Directory partitions.

If your Active Directory Forest Root is Windows 2003 you will see five Directory partitions.

By expanding the + on each directory partition you will be able to see each of the server’s replication partners. Selecting one on the left shows the last replication attempt in the right hand pane.

If there are any replication issues the partitions on the domain controller the server cannot replicate with will show a red x.

Highlighting one of the problem replication partner servers will then show more verbose error messages in the logs pane explaining why it could not replicate.

Troubleshooting Replication Issues

Step 1: Check validity of replication partners
Perhaps an obvious step, but there can be replication issues when there are servers present in the replication topology that are no longer connected to the network. Look for replication agreements with non-existent servers, servers that have been forcibly removed from the domain or are simply turned off.

Step 2: Force replication
The last scheduled replication attempt could have failed for unaccountable reasons, but the failure cause may no longer be an issue. Get an accurate current understanding of the situation by right clicking on the replication partner server in each of the partitions and selecting “Synchronise with this Replication Partner”.

Then refresh the Tree view by pressing F5. Re-check the replication status in the right hand logs pane.

Step 3: General IP checks
Doesn’t matter if you’ve done them, do them all again now! From a command prompt:

• Can you ping the IP address of the destination server? e.g. Ping 192.168.3.201
  If not: The issue will either be hardware (cable, switch, NIC, check all physical connections) or incorrect configuration of a server’s (either destination or host server) IP details. Check the NIC’s IP address and Subnet Mask.
• Can you ping the netbios name of the destination server? e.g. Ping Replicadc1
  If not: The issue will be a name resolution issue. Check there is an A host entry in the domain’s Forward Lookup zone. Check the NIC IP properties and ensure the Forest Root IP is entered as the Preferred DNS Server.
• Can you ping the FQDN of the destination server? e.g. Ping Replicadc1.RMTDS.Internal
  If not: The issue will be a DNS issue. Check as above, also check the NIC’s IP Advanced Properties and ensure the correct DNS Suffix is being used. Open the DNS admin console and ensure there is a populated Forward Lookup zone for the domain.
• Can you reverse lookup the IP of the destination server? e.g. Ping –a 192.168.3.201
  If not: You have a reverse lookup zone issue. Open the DNS admin console and check for the existence of a Reverse Lookup zone per Class C IP range. e.g.


10.0.0.x Subnet
10.0.1.x Subnet

Check there is a valid PTR record for each of the Domain Controllers in the relevant Reverse lookup zone.

Appendix A – Other Replmon functions

By right clicking the server you have selected to view Replication agreements from, you will see a range of options. A few of them are detailed below.

Update Status – This will recheck the replication status of the server. The time of the updated status is logged and displayed in the right hand pane.

Check Replication Topology – This will cause the Knowledge Consistency Checker (KCC) to recalculate the replication topology for the server.

Synchronize Each Directory Partition with All Servers – This will start immediate replication for all of the server’s directory partitions with each replication partner.

Generate Status Report - Creates and saves a verbose status report in the form of a log file.

Show Domain Controllers in Domain – will show a list of all known Domain Controllers.

Show Replication Topologies - will show a graphical view of the replication topology. Click View on the menu and select Connection Objects only. Then right click each server, and select Show Intra/Inter-site connections.

Show Group Policy Object Status – shows a list of all the Domain’s Group Policies and their respective AD and Sysvol version numbers.