Loading ...

Category: Active Directory

Easily Transfer FSMO Roles Between DCs

To understand the need to transfer FSMO roles it is necessary to understand FSMO. As per Wikipedia – “Flexible Single Master Operations (FSMO) is a specialized domain controller (DC) set of tasks, used where standard data transfer and update methods are inadequate. Active Directory (AD) normally relies on multiple peer Domain Controllers, each with a copy of the AD database, being synchronized by multi-master replication. The tasks which are not suited to multi-master replication, and are viable only with a single-master database, are the FSMOs.”

When adding a new DC to a domain it often becomes the primary DC which means that a transfer FSMO roles will need to migrate. There are several ways to get this done, but this is by far the easiest I have found. Run the following PowerShell script from the new DC:

Move-ADDirectoryServerOperationMasterRole -Identity “[New DC Computer Name]” –OperationMasterRole PDCEmulator,RIDMaster,InfrastructureMaster,SchemaMaster,DomainNamingMaster

That command came from and special thanks go out to The Lazy Admin Blog.

Missing Active Directory Attribute Editor Tab

Ran into this issue a couple times now while migrating Small Business Server (SBS) clients from on-premis Exchange to Office365. After setting up the DirSync tool on the server, to add an email alias to a user’s Office 365 account it needs to be setup in the Active Directory Attribute Editor tab under the proxyAddresses attribute. The easiest way to do this is add a record as follows:

Add the Active Directory Attribute Editor Tab in Small Business Server

smtp:[useralias@yourcompany.com]

into the proxyAddresses section of the Attributes tab:

Active Directory Attribute Tab

This is normally easy to do and then run a manual DirSync to add the alias to the user’s Office 365 account, but what if the Attributes tab is missing? It is time to break out the ADSIedit tool again to make the needed changes to the way these pages are displayed. Here are the steps to get it done:

  • open ADSIedit.msc
  • Right click on ADSIedit and choose “connect to”
  • Under connection point select “select a well known Naming context” and in that window choose “Configuration”
  • Under computer leave as “Default (Domain or server that you logged into)” then click OK
  • Expand CN=configuration, DC=[your domain], DC=local
  • Expand CD=DisplaySpecifiers
  • Click on CN=your language. (The language # can be found on http://support.microsoft.com/kb/324097 for example US English is 409, so CN=409)
  • In the right hand window locate CN=User-Display right click and choose properties
  • Locate AdminPropertyPages, highlight it and click “edit” and add the line

11,{c7436f12-a27f-4cab-aaca-2bd27ed1b773}

  • In the right hand window locate CN=Computer-Display right click and choose properties
  • ocate AdminPropertyPages, highlight it and click “edit” and add the line

12,{c7436f12-a27f-4cab-aaca-2bd27ed1b773}

  • In the right hand window locate CN= Default-Display right click and choose properties
  • Locate AdminPropertyPages, highlight it and click “edit” and add the line

4,{c7436f12-a27f-4cab-aaca-2bd27ed1b773}

Make sure to click on the View menu in Active Directory Users and Computers to choose the Advanced Features option if not already selected to see these newly added Active Director Attribute Editor Tab in the display.

Change Office 365 Distribution Group Restriction

If an Office 365 Distribution Group is being synced from on-premise Active Directory environment then you cannot receive emails to that group from an external source by default. If you try to change the setting in Office 365 the following error appears:

The action ‘Set-DistributionGroup’, ‘RequireSenderAuthenticationEnabled’, can’t be performed on the object ‘[Your Distribution Group]’ because the object is being synchronized from your on-premises organization. This action should be performed on the object in your on-premises organization.

Office 365 Distribution Group Error

This can be changed using the ADSIEdit tool. Navigate through the Active Directory hierarchy and find the Distribution Group then right click and choose Properties. Scroll down to “msExchRequireAuthToSendTo” and change the setting to FALSE. Run a manual DirSync to effect the changes in Office 365.

Office 365 Distribution Group - ADSI Edit

Setup Microsoft Mobile Device Management (MDM)

Recently had some issues where another tech company was unable to properly setup MDM for their clients, so reviewed the documentation and their current efforts then came to the conclusion that they had skipped a couple steps in the initial setup that were causing the issue. Here is the proper initial setup steps:

Activate Mobile Device Management in Office 365

1. Sign in to Office 365 as an administrative user
2. Click on the Admin pane
3. Click on Mobile Management on the list to the left hand side
4. Click on the “Get Started” button
5. Wait awhile (5 minutes to 2 hours) for the setup to complete

Configure Initial Domain DNS Settings

1. Back in the Mobile Management section, look for the red x circle and click on “Manage settings”
2. First to configure custom DNS needed for automatic configuration, click on the “Set up” next to “Configure domains for MDM”
3. Click on the primary domain used for Autodiscover, etc. then click on “Domain settings”
4. Under “Domain purpose” click on “Change domain purpose”
5. Put a check next to “Mobile Device Management for Office 365” then click on “Next”
6. Take note of the following cname records:

enterpriseregistration enterpriseregistration.windows.net 3600
enterpriseenrollment enterpriseenrollment.manage.microsoft.com 3600

7. Enter these into the customers custom DNS records along with any others that are listed on that page which weren't entered previously.
8. Return to this page to confirm that the DNS settings have changed properly.

Configure Apple Push Notification (APN) Certificate

1. Back in the Mobile Management section, look for the red x circle and click on “Manage settings”
2. Click on “Set up” next to “Configure an APNs Certificate for iOS devices” to request the needed certificate to manage Apple devices.
3. Click on “Download your CSR file” to save the file locally then click “Next”
4. Click on “Apple APNS Portal” to open the Apple Push Certificates Portal
5. Sign in with a valid (hopefully domain associated) Apple ID
6. Click on the “Create a Certificate” button
7. Agree to the Terms of Use
8. Upload the Certificate Signing Request (CSR) that was save locally earlier
9. Download the new Mobile Device Management certifcate and save it locally
10. Go back to the “Install Apple Push Notification Certificate” page and click “Next”
11. Upload the new Mobile Device Management certifcate tjat was saved locally from Apple

Configure Basic Mobile Device Management Policy

1. Create a Security Group in Active directory that will be used to apply the MDM policy and run DirSync manually.
2. Back in the Mobile Management section, click on “Manage device security policies and access rules”
3. Click on the + to add a new policy
4. Give the policy a name and click “Next”
5. On the pop-up page leave the defaults and check next to “Require managing email profile (required for selective wipe on iOS)”
6. Also select “Block access and report violation” to keep users off the network until they comply with the new policy then click “Next”
7. On the following page there are additional option that give additional security but are not required, when done click “Next”
8. Change selection to “Yes” and chose the Security Group in Active Directory that will be used for MDM enforcement then click “Next”
9. Click on “Finish” to begin enforcing this new policy

The next time any user opens an associated Office App on their supported devices it will ask them to start the enrollment process which goes through a compliance check which usually requires them to delete their current Exchange Active Sync profile to continue.

Special thanks to the guys at ExchangeServerPro.com for their blog entry with the basics. Also a thanks to the Microsoft Office Blog Team for their detailed look at MDM policy setup.
If your company is using Office 365 or has a Bring Your Own Device (BYOD) policy which need mobile device management, then contact us for assistance.

Office 365 Email Distribution Group

Had a client that was using Office 365 Directory Synchronization (DirSync) to manage their users / groups in Office 365 via the local Active Directory which meant that there was not end-user manageability of those groups. A user asked to have a new email distribution list created that they could manage, so performed the following to make that happen:

Create an Office 365 Email Distribution Group

1. Open Active Directory Users and Computers.
2. Navigate to where in the hierarchy that the Distribution Group will be created.
3. Right click on the Organizational Unit where it is to be created and choose New then Group.
4. Give the Group a name and leave the default Group scope of Global and change Group type to Distribution then click OK button.
5. Double click on the new group to open it. Type in the email address to use then click on the Attribute Editor tab.
6. Scroll down and double click on the proxyAddresses item. Add the email in the format SMTP:[username@domain.com] then click on the Add button and OK button.
7. Click on the Managed By tab and click on the Change button to search for the user who will be the group administrator.
8. Click OK button then run a manual DirSync to send the changes to the cloud.
9. Open the group administrators Outlook.
10. Click on the Address Book button.
11. In the Address Book drop down list choose the Global Address Book (this may take some time to download the update).
12. Find the newly created Distribution Group and double click to open then click on the Modify Members button to add users.
If your company is using Office 365 and needs end users to manage their Office 365 Email Distribution Group, then contact us for assistance.

Corrupt User Profile

Had a client that allows a third party bookkeeper to login remotely to one of their workstations where their accounting software is installed. This user expressed that “all of a sudden” they were unable to see any desktop icons or work with the Start menu properly. Once remotely connected into the system with the bookkeeper found an error message that access to the redirected desktop was denied. Tried changing permissions on the Desktop folder, tried renaming the folder and letting a fresh login recreate them on the server, and tried renaming the local profile folder then another login to recreate those as well. Then I finally remembered the solution – it was a corrupt user profile in the registry:
z

Registry Edit to fix Corrupt User Profile Issues

HKLM\SOFTWARE\Microsoft\Windows NT\ CurrentVersion\ProfileList

Remember to look through this list and find the user in question, export the key (aka backup) and then remove the entire folder containing their profile. One more reboot and login fixed the issue successfully. Thanks to following Microsoft TechNet Article for the details on the fix.
If your company is using remote access or have issues with a corrupt user profile, then contact us for assistance.

Mistakes Importing Active Directory User List

Had a lower level technician try to import a large Active Directory user list of incoming freshman into a high school’s Active Directory via Powershell and mistakes were made. Basically there was no UserPrincipalName created which made logon to workstations difficult. Here is the PowerShell script used to fix the issue:

Powershell Script to Import Active Directory User List

Import-Module ActiveDirectory
$ADUsers = Get-ADUser -Filter * -SearchBase ‘OU=Employees,DC=Domain,DC=local’
foreach ($ADUser in $ADUsers) {
$GivenName = $ADUser.GivenName
$SurName = $ADUser.Surname

if (($GivenName -ne $null) -or ($SurName -ne $null))
{
$newSAM = $GivenName.Substring(0,1).ToLower() + $SurName.ToLower()
$newUPN = $newSAM + “@domain.local”

Set-ADUser $ADUser -SamAccountName $newSAM -UserPrincipalName $newUPN

Write-Host “Changes to the user $($GivenName) $($SurName) were made!”
}
}

For ideas on how to correctly import a large number users into Active Directory, look at how to format the spreadsheet and then how to write the PowerShell script at these links.
If your company is using Active Directory User List for import or need help managing / maintaining your active directory domain, then contact us for assistance.

Office 365 / Active Directory User Changes Name

There is often the case that a female user will have a name change due to change in marital status. Here is the basics of how to change their name in both Active Directory and Office 365.

Active Directory User Changes Name objects

  1. Open Active Directory Users and Computers
  2. Find the user needing the changed name, right click on them and choose the “Rename” option.
  3. Change the user’s name as needed then press Enter then in the window that opens make all the further changes needed and click the “OK” button.
  4. Click on the View menu at the top and check the “Advanced Features” option.
  5. Double click on the users new name to open their Properties. Change the email address if needed in the General tab.
  6. Choose the “Attribute Editor” tab, scroll down the list to “proxyAddress” attribute and double click it. Click on the current SMTP:old.email@company.com and click the “Remove” button then change it to a smtp:old.email@company.com then click the “Add” button.
  7. Type in SMTP:new.email@company.com for the user and then click the “Add” button. Click the “OK” button on this window and the one beneath it.
  8. Make sure to also rename the users Redirected Folder if there is one created via Group Policy
  9. Run a manual sync of the DirSync tool via the Microsoft Forefront Identity Manager console.

Changes to Office 365

  1. Make sure the Windows Azure Active Directory Module for Windows PowerShell is installed properly
  2. Open Windows Azure Active Directory Module for Windows PowerShell as administrator
  3. Type in the following to run signed scripts for Exchange Online:

    Set-ExecutionPolicy RemoteSigned

  4. Type in the following to enter the administrative credentials for Office 365:

    $creds = Get-Credential

  5. Enter the Office 365 Administrator credentials then click “OK” button.
  6. Type in the following to connect to Office 365 via PowerShell:

    Import-Module MsOnline

    Connect-MsolService -Credential $creds

  7. Type in the following to connect to Exchange Online via Powershell:

    $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell/ -Credential $creds -Authentication Basic -AllowRedirection

    Import-PSSession $Session

  8. Type in the following to change the username for login to Office 365:

    Set-MsolUserPrincipalName -UserPrincipalName old.email@company.com -NewUserPrincipalName new.email@company.com

  9. Login to the portal as administrator and make sure the changes have take effect.

If your company has an Active Directory user changes name in your domain or Office 365 user changes name, then contact us for assistance.

DFS Folder Redirection Engineering

A huge thanks to Joseph Moody from DeployHappiness for these wonderful guides on how to deploy DFS Folder Redirection in an organization using Distributed File Services as a methodology for file sync between sites. I made some modifications to the DFS Replication to use site link costing and fail back for the remote sites to avoid the multiple data target issues seen in his notes.

Three Part DFS Folder Redirection Series

If your company is thinking about using DFS Folder Redirection or needs help planning out multi-site server network topology, then contact us for assistance.

Demote Windows Small Business Server

Since Microsoft is no longer making Small Business Server (SBS) as the complete package for the SMB client, it is time to migrate email to Office365 and put in a Windows Standard Server in its place. This will explain the details of how to demote Windows Small Business Server from the domain after email has been migrated, the new server should already be in place and it should be running the appropriate server service and Flexible Single Master Operation (FSMO) roles would already be migrated.

One Last Check

  • Open a Command Prompt

  • Type in – netdom query fsmo

  • Make sure that all roles are pointing to the new Domain Controller

Uninstall Exchange

  • Open Control Panel

  • Double Click on “Programs and Features” icon

  • Search the list and find the entry named something like “Microsoft Exchange Server…” right click on it and choose “Uninstall”

  • Click “Next >” button then uncheck all possible boxes then click “Next >” button

  • Once the prerequisites have cleared successfully, click “Uninstall” button

  • Finally click “Finish” button

Remove AD Certificate Services

  • Click Start button, click Administrative Tools, and then click Server Manager.

  • Click on Roles, then in the Roles Summary section, click Remove Roles.

  • In the Remove Roles Wizard, click “Next >” button

  • Clear the “Active Directory Certificate Services” check box, and then click “Next >” button

  • On the Confirm Removal Options page, review the information, and then click “Remove >” button

Demote Windows Small Business Server and Remove from Active Directory

  • On the Source Server, click Start button, click Run, type dcpromo, and then click “OK” button

  • Click “Next >” button twice. (WARNING: Do not select “Delete the domain because this server is the last domain controller in the domain.”)

  • In the Summary dialog box, you are told that Active Directory Domain Services (AD DS) will be removed from the computer and that the server will become a member of the domain. Click “Next >” button

  • Click “Finish” button and the Server will restart

  • After the Server restarts, it can then be removed from the domain into a workgroup and disconnected from the network.

To remove the Source Server from Active Directory Domain Services

  • On the new Domain Controller Server click Start button, click Administrative Tools, and then select Active Directory Users and Computers.

  • In the Active Directory Users and Computers navigation pane, expand the domain name, expand MyBusiness, expand Computers, and then expand SBSComputers.

  • Right-click the old Server name if it still exists in the list of servers, click Delete, and then click Yes.

  • Verify that the Source Server is not listed, and then close Active Directory Users and Computers.

To update the Software Updates Group Policy Object

  • On the Management Server, click Start, click Administrative Tools, and then click Group Policy Management.

  • On the User Account Control dialog box, click Continue.

  • In the Group Policy Management console, in the navigation pane, expand Forest:DomainName, expand Domains, expand DomainName, and then expand Group Policy Objects (GPO).

  • Click Update Services Server Computers Policy.

  • In the results pane, click the Scope tab.

  • In the Security Filtering section, click the object that begins with “S-1-5…” This is the old Server Security Identifier (SID).

  • Click Remove, and then click “OK” button

If your company is migrating to Office 365 and needs help to demote Windows Small Business Server, then contact us for assistance.

Archives

Categories

Plant a Seed 541-761-9549
233 Rogue River Hwy #873 Grants Pass, OR 97527
Mon-Fri: 9:00am-5:00pm
support@farmhousenetworking.com
© 2016-2022- Farmhouse Networking. All rights reserved
Terms and Conditions Privacy Policy

Evaluation Signup

[contact-form-7 id="452" title="Free Network Evaluation"]