ApplicationXtender and Active Directory

I manage an ApplicationXtender server which is used to manage documents for compliance and accounting purposes. We used to work with a local user database but few years back we switched to the AD synced mode which uses the local logged user. This way I win twice: The password is more secure since it is changed by the domain policy AND the user is not prompt with login screen for ApplicationXtender. A rare win win.

My password policy require the users to change their domain password every 3 month. 14 days before due date they start getting these daily reminders.
When a user forget to change it (or just ignore it on purpose) and the 14 days pass all connectivity to any network resources is lost. When the password is changed work is not interrupted and is not affected. Well, this morning I found this to have one exception...

When you change the password for the user while he is logged in ApplicationXtender will not connect. Testing the Data Source connectivity is successful and yet the client hang. Logging off and then logging back with the new password fixes the problem. I agree that it's weird but hey, I didn't write the program...

Group Policy Preferences in Windows 2008

Today I want to go over the new Group Policy Preferences that come with 2008 server.
I recently added a 2008 server in my shop and the new options are exciting!
I think it is a major improvement that worth the upgrade. The fact that you only need one server to use it make it even more appealing.
Check this great video to get a first look.
The management screen is split to Policies - where most of the old options stay and Preferences with the new options.
The next option level is sorted to 2:
Windows Settings - contain everything that required scripting in the past
Control Panel Settings - contain everything that was changeable via... Control Panel

I find the most exciting feature to be Scheduled Tasks. Yes, it is not fancy or new but it is something useful that wasn't there and actually change my life as an administrator. I can configure tasks for PCs or Servers anywhere, anytime without physically getting there. That is a major time saver.
Other features that got better and I find useful include:
Devices - allow you to enable\disable devices
Folder Options - changing the settings of a specific folder
Power Options - much better control on the power options, this make green look greener
Services - allow you to change Service configuration

Another major change is Item-level targeting, a concept that apply changes only under specified set of conditions. With Item-level targeting you can compare Registry keys, use a range of IP addresses, rely on the local PC language or domain name and few other targeting options.

Requirements:
As I said before, you do not have to upgrade all your servers, 1 2008 server would be enough.
To manage from Windows 2003 server or Vista (and Windows 7) Remote Server Administration Tools (RSAT) is required
Client side require Group Policy preferences client-side extension (CSE)

This is another step to make our life easier and make tasks easier. The domain environment is much more manageable under this new set of tools.
I just wonder if it is becoming so easy to manage the domain what would happen to us, does our expertise still count?

Domain Trust – part III

Part I covered the basic concept of Domain Trust.
Part II covered the different Trust types.
Now it’s time to go over Trust related troubleshooting skills

The first step is determining the type of Trust. There are few ways to complete this task:
Active Directory Domains and Trusts console - The Domain ‘Properties’ box has a Trusts tab with all available Trusts for the Domain

Active Directory Users and Computers console – For the Domain, the View menu has an ‘Advanced Features’ option. The ‘System’ container has a list of objects; we’re looking here at the ‘Trusted Domain’ type.

NLTEST - Resource kit tool that can display Trusts (among other data). The following command will show all trusted domain:
NLTEST /server:server name /trusted_domains

ADSI Edit – Another Resource kit tool that can do the job. Expanding the domain in question and browsing to the System class properties will give you the list of Trusted domains.

Each of these provides significant data on the Trusts and related problems. Make sure you’re familiar with each one of them and capable of using them if required.

WinNT presented a great tool that survived till this day: NLTEST
NLTEST test secure channels between domain controllers that trust other domains.
Though it is a WinNT document, this tool work great on every domain level and like the previous list, it is a very important tool that should be available and used by any domain admin.

“Restricted Groups” in Group Policy

Ever had to add users to a local admin group but had no access to the computer? Add a special user account in the Administrator group of every computer on the network for remote administrative functions?
Group Policy Restricted Groups enables you - as the administrator - to configure group memberships on the client computers or member servers. Cool. Useful!!!

The “Restricted Groups” option allow 2 types of settings:

Members
Members Of

Members– This setting allows you to control the members of the group that you specify for the policy. The members can include both user and group accounts. When you configure the members of a group, it will overwrite the existing membership of the group and replace the members with those specified within the GPO. If you were to configure this setting and leave the members blank, then the group would not have any members after the GPO applied to the computer.

Member Of – This setting allows you to control which other groups the specified group has membership in. All groups that you configure in this interface must meet the approved group nesting rules. Therefore, you can’t configure a local group to have membership in another group, since local groups can’t be placed in Active Directory groups, nor placed in other local groups. If the list of groups in this section is left blank, it will not remove the specified group from any existing groups, it will just not place it in additional groups.

Simple yet an efficient time saver.

Derek Melber wrote a good security piece on restricted groups

Domain Trust – part II

Part I covered the basic concept of Domain Trust. Now it’s time to go over the different Trust types.

Two-way trust is the most common type and the easiest to understand.
In a Windows forest any 2 domains trust each other both ways and they are transitive trusts. That said, any new child domain you create within the forest is automatically trusted and trusting.
The result of a Two-way trust is that any authentication requests can be passed between the two domains, users from one domain can access resources in domain B if they have the permissions to do so without any additional login (based on the local domain authentication they have already done in their own domain).
Two-way trust within a forest root or domain tree is always transitive. (‘ll get there in a minute)

One-way trust uses the same authentication concept but unlike the Two-way trust, here one domain access the other domain’s resources but do not allow that other domain to use its own resources. One-way trust relationships are always nontransitive.
One-way trust can be established with another forest (Win2000\2003\2008), WinNT domain or Kerberos Realms (aka non-Windows environments)

Transitive trusts exist between 2 domains in the same forest. In Transitive trust the trust can be extended outside of the two domains. That means that if domain A trust domain B and domain B trust domain C, domain A will also trust domain C. simple.

There is however a way to go around and create other types of transitive trusts:
Shortcut trust - used to shorten the trust path in a large and complex environment, connect two domains in the same domain tree or forest. Like the name indicate, it doesn’t create anything new but shorten the way the user has to go through getting to the destination domain.
Forest trust – transitive trust between two forest root domains.
Realm trust - transitive trust between an AD domain and a non-windows environment using Kerberos V5 realms

Nontransitive trust is a trust restricted only to the two participating domains. This trust cannot flow beyond these two domains boarders. A nontransitive trust is always One-way but it can be tweaked by creating 2 One-way trusts that make it an actual two-way trust.
Nontransitive trust is used when connecting WinNT domains and for a forest trust to one out-of-the-forest domain when you do not want the entire 2nd forest to be trusted.

There are 2 types of nontransitive trust:
External trust - created between a Windows 2000\2003\2008 domain and a Windows NT domain or a Windows domain in another forest.
Realm trust - nontransitive trust between an AD domain and a non-windows environment using Kerberos V5 realms

In part III I’ll show some Trust related troubleshooting skills that every admin should have

Domain Trust – part I

Aladdin asked princess Jasmine for her trust and she, by the look of his eyes opened her heart to him and trusts him. Unfortunately real life doesn’t work like tales and we can’t trust anyone we don’t know just because they ask for it, even if they look good…
I noticed (on my favorite forums) that this is a repeated subject, not always easy to understand for new administrators and I will try to simplify the subject while keeping the important techie details.

Domain Trust is a sharing concept that aims to ease the management of trust in the Active Directory world (aka the real world). It allows 2 separate groups that trust each other to share resources. It makes life easier for administrators 2 times: first at the point where they can share resources with other groups and second as they reduce the number of logins a user has to deal with (and as a result, reduce the number of helpdesk calls).

Scenario (or, what does it good for):
Companies A & B merged but want to keep the network as is. You have to allow users from both companies to share files and printers. Establishing a trust between the 2 domains (actually forests) will simplify the process from a long tedious permission setup to a 5 minutes trust build up.

How does it work?
In this post I’ll go over some of the basic concepts and later will go over different type of trusts (One-way, Two-way, Transitive, Nontransitive)
A trust relationship is defined by a secret key that is shared by both forests and domains and that gets updated on a regular basis. That said, when you configure a trust all you have to do is have the same password on both ends and let the system do the rest. The rest is based on the NTLM and Kerberos authentication protocols and on Windows-based authorization and access control mechanisms.
Active Directory domain controllers authenticate users and applications by using one of two protocols: either the Kerberos version 5 authentication protocol or the NTLM authentication protocol. When two Active Directory domains or forests are connected by a trust, authentication requests made using these protocols can be routed to provide access to resources in both forests.
Every trust has a secure channel through which trust participants communicate. They use the trust password to secure their communication. If the secure channel between them is broken, you need to reset it/reset the trust password.
Trusts have a user account in Active Directory which can be seen via ADSIEdit. The user account for the Trust is stored in the BuiltIn ”Users” container under the domain root. The most useful and powerful tool to test trusts is Nltest.exe, one of the oldest guys in the area but still kicking!

In part II I'll go over different Trust types
In part III I'll go over some troubleshooting options

Guidelines for a good Backup plan

I had to restore a file this morning using my B2D job. While I had no problems and everyone is happy I found it to be the perfect opportunity to go over my backup plan. It can’t hurt.

I backup 3 data types:
Email (Domino Server)
User data (aka files)
Active Directory

I’m using Backup Exec for all my backup jobs and most of the time I’m happy with the performance.

Domino backup is done using the Domino agent. Using this article as a reference I backup the Lotus\Domino\Data folder. Weekly cycle to tape with daily full backup to disk provide a strong backup. One important note that helps me keeping the backup in reasonable size is old users nsf files. When a user leave the company we still need to keep the mailbox (compliance, compliance, compliance) but it is not changing and there is no point in backing the same file every day. I have this folder with old nsf files that I backup once a quarter or after an employee left and the file was moved (that require shutting down the server so waiting for few mailboxes to pile up is a smart move).

User data files like emails change on a daily basis but unlike a mailbox that is one file that changes daily, there are thousands of different file that only few of them get changed daily or even weekly. I personally do not like the differential backup schema so I keep a full backup over the weekend and daily incremental backup on top of it. I also keep a full daily backup for important directories, those with critical data and frequent changes. Just in case. That is one of the big advantages of a small shop.

Active Directory is in IT perspective the most critical backup. Using this as a reference guideline it is important to understand the core idea: System State backup is the heart of AD backup and MUST be properly backed up.
Active Directory MUST be backed up in FULL BACKUP mode.
A good backup includes at least the system state and the contents of the system disk. Backing up the system disk ensures that all the required system files and folders are present so you can successfully restore the data.

One last aspect of a good backup plan is testing. You should recover random files on a regular basis. You do not want to be in the position where someone deleted an important file and you can’t restore it!