How to change a domain controller's IP address

As a critical part of your IT infrastructure, domain controllers (DC) should be assigned a static IP address so that they can be reliably discovered across the network. Sometimes it’s necessary to change the IP address assigned to a DC, for instance when there’s a change of IP addressing scheme on the local subnet, and this process can cause some concern for administrators due to the critical nature of DCs. However, assuming the DC is not hosting any other roles, changing the IP address shouldn’t pose any serious difficulties.

Change the IP address

In this example, I’m going to change the IP address of a Windows Server 2012 DC. The server is additionally configured as the domain’s only DNS server.

1. Open a command prompt by right-clicking the PowerShell icon on the desktop Task Bar and select Run as Administrator.
2. Run DCDIAG and make sure the DC passes all the tests. If any problems are identified, they should be resolved before proceeding any further.
3. Right-click the network icon in the bottom right of the Task Bar and select Open Network and Sharing Center from the menu.
4. In the Network and Sharing Center, click Change adapter settings.
5. On the Network Connections screen, right-click the network adapter for which you want to change the IP address and select Properties from the menu.
6. In the Ethernet Properties dialog box, scroll down the list and double-click Internet Protocol Version 4 (TCP/IPv4).
7. In the TCP/IPv4 dialog box, change the IP address (and subnet mask if required). In this example I will also change the primary DNS server entry to the DC’s new static IP address, as the DC is also the only DNS server in the domain. Click OK to continue.
8. Click OK in the Ethernet Properties dialog box and then close the Network and Sharing Center.

Register the domain controller's new IP address

Now the IP address has been changed, we need to empty the local DNS cache and register the DC’s new IP address in DNS.

1. In the PowerShell box, run ipconfig /flushdns to remove any cached DNS entries created by the local DNS resolver.
2. Run ipconfig /registerdns to ensure the new IP address is registered by the DNS server.
3. Run dcdiag /fix to update Service Principal Name (SPN) records and check that all the tests are passed successfully.

DHCP settings will need to be changed if the DC is also a DNS server to make sure domain members pick up the DNS server’s new IP address. Don’t forget that you’ll either need to clear the local DNS cache on all member servers and clients joined to the domain or reboot them so that they resolve the new IP address to locate the DC.
If you have a distributed DNS infrastructure, you may need to wait for DNS information to replicate or force a replication. If present, subnet information in AD Sites and Services should be updated if the subnet addressing scheme is also modified. As with any major change you make to your production servers, you should test the procedure in a preproduction environment using servers with the same configuration as your production systems.

Thanks
R.karthikeyan

Blocking USB Devices and Removable Media through User based GPO

  I have seem many people asking how to block the use of USB memory sticks so people can't use them to transfer files on or off of a PC This how-to will give you a simple effective and free way to block these as well as other forms of removable media on a windows computer.

Create a GPO

The first step is to open Group Policy Management and create a new GPO.

I typically like to create 2 GPO's One for blocking read access and one for blocking write access.

By Creating 2 separate policies I can apply each individually so I can allow read access for certain groups of users while blocking write access and I can apply both policies to other groups so I can block all access.

The policy we are about to create is user based This means that it will apply to the users and not the computer. This means we can block access as need for normal users on a computer while still allowing access for other users like say IT (ourselves) so we can still do our thing without any issues.

These policies apply to all forms of removable media not just USB based media. therefor you can use them to block other media access such as CD and DVD access as well.     

Set the Desired Policy Items

In your GPO browse to the following location.

User Configuration >> Policies >> Administrative Templates >> System >> Removable Storage Access

If you look through the list of options you will see 2 choices for each media type. One choice when enabled blocks write access and the other choice blocks read access.

In my attached image i show an example of blocking all read access.

Therefor to block read access to each of these media types simply enable the deny read access item for each.
If you want to block write access enable the block write access options.
If you want to block both the enable both options.

Its really that simple.

----------------------------------------------------------------
Note:
For some reason Digital cameras require both read and write access. So if you have users that need access to a digital camera directly through the camera's USB connection they will need read and write access. Even if all they want to do is read files from the camera. However if you remove the memory card from the camera and read it with a memory card reader it only needs read access as expected.                      

 Apply the GPO

Now that you have created your GPO Policy (or policies if you want more granular control like I did) all that you need to do is apply the GPO to the Users you wish to restrict removable media for by assigning it the correct OU's.

Once applied simply wait for the policy to update on the users computer or run "gpupdate /force" to speed things up and test it out.                               

Conclusion

This is a simple and reliable way to control user access to removable media for users with the bonus of still being able to allow yourself or other special users of your choice the ability to use that same removable media

How to take DNS server backup in an AD environment

If you are an Active direc­tory admin, there is no need to men­tion the impor­tance of DNS. A DNS sever is poten­tially the sin­gle point of fail­ure in an AD envi­ron­ment… where an inter­rup­tion of its ser­vice or cor­rup­tion of any DNS records can bring the whole ser­vice down. This demands the need for a proper backup strat­egy for DNS servers.

Most pre­ferred method for tak­ing back up of DNS server is to do a sys­tem state backup. But this can­not be use­ful in many cases as it requires you to restore AD, Reg­istry set­tings, DNS etc. while busi­ness require­ment only needs you to restore the DNS server.

Also there may be cases where the sys­tem state restore cat­a­log may be cor­rupted and you could not restore it. Per­son­ally, I have faced sit­u­a­tions where the clients are com­plain­ing about cor­rupt sys­tem state back­ups where the users are not able to restore the DNS data using it. So it is always best to keep an inde­pen­dent backup of DNS server along with your nor­mal sys­tem state backup.

Before men­tion­ing how these inde­pen­dent back­ups can be taken for DNS servers, it’s worth men­tion­ing about dif­fer­ent AD zones in an AD environment.

• Pri­mary and Sec­ondary zones.

• Active direc­tory inte­grated zone.

Microsoft rec­om­mends using Active direc­tory inte­grated zone in DNS servers on an AD envi­ron­ment.

Now let’s check how inde­pen­dent back­ups can be taken on DNS server.

Pri­mary and sec­ondary zones:

Here the zone infor­ma­tion will be stored in plain text files. The backup and restore process is pretty straight for­ward where you can take a copy of text file con­tain­ing the zone infor­ma­tion using XCOPY.

The below com­mand can be used to backup.

XCOPY %SYSTEMROOT%\system32\dns c:\backup\dns /y

To restore the pri­mary and sec­ondary zone infor­ma­tion, you only need to sim­ply copy the files from the

\backup\DNS folder to the %SYSTEMROOT%\system32\dns folder

Active Direc­tory inte­grated zones:

You may be aware that the zone infor­ma­tion for Active Direc­tory inte­grated zone will be stored in AD data­base rather than as a text file. So the first step in tak­ing the backup is to export the zone infor­ma­tion to a file.

DNSCMD /zoneexport test.com backup\test.com.dns.bak

The backup file will be placed in the %systemroot%\system32\dns\backup folder, and will be named test.com.dns.bak.

You can use the backup file just cre­ated to restore the AD inte­grated zone if needed. How­ever, the restore process is bit more complex.

The restora­tion is a 2 step process.

a. You need to cre­ate a pri­mary zone by using the backup file you have cre­ated ear­lier.

b. Converting the pri­mary zone to AD inte­grated zone.

Before per­form­ing the first step, you need to copy the backup file you had cre­ated to 

%systemroot%\system32\dns folder from the backup loca­tion. Now, exe­cute the fol­low­ing com­mand.

DNSCMD /zoneadd test.com /primary /file test.com.dns.bak /load

The above com­mand will setup a pri­mary zone in the DNS server using the zone infor­ma­tion in the file test.com.dns.bak

Now, you need to con­vert the pri­mary DNS zone you just cre­ated to an AD inte­grated zone. You can use the fol­low­ing com­mand for that.

DNSCMD /zoneresettype test.com /dsprimary

Done!!

Note: If you want to enable secure dynamic updates, then you must enter the fol­low­ing command:

DNSCMD /config test.com /allowupdate 2

As a gen­eral back up guide­line is always a best prac­tice to test the integrity of the backup files at reg­u­lar inter­vals by doing test restores on any test network.

Thanks

R.karthikeyan

How to add a Second Domain Controller in Windows 2008 domain

Domain controller as server for hosting your company Active Directory (AD) is very important part of your network infrastructure. In case of its failure logging users on AD is impossible. Because of that one of the main things in planning your network infrastructure is make plan for implementing redundant domain controller in network infrastructure. In case you have it, failure of one of them does not mean that user will be unable to log on the system. Since failed domain controller is up again, backup controller will be in function of users authentication or other functions which it can have (DNS server etc.). On this way your network can stay functional, reliable and more resistible to failures.

In this article I will describe process of adding additional domain controller in your Windows network infrastructure.

First step is start dcpromo program to create new domain controller. Go to Start and type dcpromo in run field:

Click on OK. Opens first window in process of new DC creating:

When you want to add new DC Use advanced mode installation option should be unchecked because it use for Read Only Domain controller creating. In this case we want new DC with all functionalists as primary DC and read only mode is not option in that case. Click on Next.

In this window some information about operating system compatibility are displayed. Click on Next to continue.

Next window offers choosing option for add new or additional domain controller:

There are two options: to create new forest or to add DC in existing forest. If we have to add additional DC which is option described in this article Existing forest option should be checked. When this option is checked you have possibility to add new domain controller in existing domain or create new domain in existing forest. Here we want to add new DC in existing domain which will backup DC for our primary DC which exists in network. Because of that Add a domain controller to existing domain should be checked. When appropriate option are checked click on Next.

In next window domain name and network credentials for adding new DC should be set:

First, type the name of domain for which you want to add additional DC (testdomain.com in this example). After that credentials for adding DC should be chased. Main thing is that the credentials with which you adding DC should have administrative privileges. In this case we will use credentials of user from domain administrators group.

In network credentials type username and password of user which you use for promoting new DC. Then click OK.

In next step you should choose domain for which your server will be domain controller. By default, your domain will be set:

Chose default option and click Next. Opens window for site selecting.

Leave default option and click Next.

Next window is window for additional domain controller options. These are Global catalog, DNS server and Read Only Domain Controller. For additional DC you should chose DNS server and Global catalog options as it is shown on next picture:

Check DNS server and Global catalog options and click Next. Opens windows for choosing locations for database, SYSVOL and NTDS files. It is recommended to leave default options for these parameters.

Click Next. Opens window for setting restore mode password:

Restore mode account in Active Directory is different then domain administrator account. If you start domain controller in restore mode this account is used. So type password for restore mode account and click Next. Appears window with summary information about options you chose during installation additional domain controller:

When installation process is finished appears last window on which you simple should click on Finish button to finish installation process:

Now you will be prompted for restart computer and then you can log in to your new domain controller computer.

In this article I described how to set additional domain controller in our network. On this way you will make your network more reliable and stable.

Thanks
R.karthikeyan