Loading ...

Category: Domain Name Services (DNS)

Tier 3 / Co-Managed IT- Synology DNS Server loses Domain Name Resolution

Got a email from one of our co-managed IT / Tier3 / managed RMM clients that was having issues with DNS resolution. The network consists of a Synology NAS acting as Domain Controller / DNS Server and a VM on the Synology that runs the clients main application. Several of the workstations were having an issue where they could not browse to the IP address (\\192.168.0.11\sharename)of the application server at one time and could not browse to the UNC path (\\servername\sharename) of the same server on another day. First tried setting the external forwarders to Google DNS and the Forward Policy to Forward First, but the problem resurfaced. So we dug deeper into the DNS settings and found the following:

If you look closely the IP address of the server is 192.168.0.11 and the records for DNS servers associated with the domain above and below it point to servers outside the subnet of the application server (10.0.0.2). Upon further investigation this DNS server address was blocked by the firewall because it was an old IP address scheme that was no longer in use. The current good DNS server IP addresses are 192.168.40.10 and 192.168.0.10.

Turns out the stale DNS records were the problem. Made the needed changes to the DNS records and things are working great.

If your company needs a little extra help running the IT department, then contact us to setup a co-managed IT evaluation.

Using External Certificate for RemoteApps in .Local Domain

Recently did some Tier 3 support work for another technology company that was trying to setup a Windows Server 2016 RemoteApps server in Azure that would allow connectivity to remote users for their on-premise software. The process started with creating a VPN tunnel between on-premise and Azure, but that is a discussion for a future set of blog posts. Once this connection  was in place, the company tried to use an external certificate for RemoteApps setup on the server. This would have been fine if the internal domain had not been a “.local”  address scheme. This tutorial assumes that you have already installed Remote Desktop Services on a server and configured it to use the CA provided external certificate.

Change Remote Computer Name

One of the main sticking points that caused issues with security warnings for clients connecting is they would see the warning – “The remote computer could not be authenticated due to problems with its security certificate.” The fix for this has been graciously scripted in PowerShell by someone with the handle “TP” on Technet. The script is called Set-RDPublihedName.ps1 and is used as follows:

Set-RDPublishedName "remote.domain.com"

Proper Active Directory Group

There were then issues with the login process that caused the following error:

Remote Desktop can’t connect to the remote computer “<End Resource Name>” for one of these reasons:

1) Your user account is not authorized to access the RD Gateway “<RD Gateway Server Name>”
2) Your computer is not authorized to access the RD Gateway “<RD Gateway Server Name>”
3) You are using an incompatible authentication method (for example, the RD Gateway might be expecting a smart card but you provided a password)

This was coupled with Security Log messages – “The Network Policy Server was unable to connect to a domain controller in the domain where the account is located. Because of this, authentication and authorization for the RADIUS request could not be performed.” All this turned out to be the RD Gateway was not in the proper Active Directory Group, so added the server to the RAS and IAS Servers group.

Add URL to IIS

There was then an error about not being able to find the computer name, which turned out to be a setting in IIS. Looking under Sites > Default Web Site > RDWeb > Pages click on Application Settings and change the DefaultTSGateway to the URL of the CA external certificate for RemoteApps.

Fixing RS CAP & RAP

Last error that was received was the following:

Remote Desktop can’t connect to the remote computer “computername” for one of these reasons:

1) Your user account is not listed in the RD Gateway’s permission list
2) You might have specified the remote computer in NetBIOS format (for example, computer1), but the RD Gateway is expecting an FQDN or IP address format (for example computer1.fabrikam.com or 157.60.0.1).

This turned out to be related to the RD Client Access Policy (CAP) & Remote Access Policy (RAP) under the RD Gateway Manager tool and DNS. For RD CAP, make sure that Domain Users is listed, and that Client Computer Group membership is blank. FTor RD RAP, make sure that Domain Users is listed, and that it is set to allow connection to Any Network Resource (This allows remote access). For DNS, make sure it contains a Forward Lookup Zone that points to the URL of the CA external certificate for RemoteApps and has an A record for the internal IP address of the RD server.

If your company is currently moving some of your resources to the Azure cloud or wanting to properly setup your RemoteApps server, then contact us for assistance.

ADPREP Windows 2008 R2 Server into 2003 Domain

After finishing the migration of a client to their new cloud-based Line of Business SaaS application, it was time to finally get rid of the last Windows 2003 Small Business Server that we manage. The client had a Windows Server 2008 R2 Standard server that used to be the database server for the on-premise application which was being re-purposed as the new Primary Domain Controller (PDC) for the domain. After installing the Active Directory Domain Services (ADDS) role on the new server, I went to run DCPROMO on the new server and found that it asked me to run ADPREP /FORESTPREP on the domain. Took me a little bit of searching to find the Windows 2003 Server media and ran the command successfully, but this did not do the trick – turns out I needed the Windows 2008 R2 Server media and run the ADPREP32 command several times to complete the domain preparation for the new server to be DCPROMO successfully. Extracted the support directory from the media ISO to a folder on the root of the old Windows 2003 Small Business Server and then ran the following commands in order:

ADPREP32 /FORESTPREP

This one took a long time as the server was going from Schema 31 to Schema 47.

ADPREP32 /DOMAINPREP

This one stated that I needed to run the next command, so I did.

ADPREP32 /DOMAINPREP /GPPREP

The command actually stated that the update was already applied. So went back to the Windows 2008 R2 Standard server and ran DCPROMO again which told me that I needed to run one more command.

ADPREP32 /RODCPREP

Ran this one even though I had no plans of having a Read-Only Domain Controller (RODC) in the domain. After all these commands the new server was able to be DCPROMO into the domain controller role. Now all that is left is FSMO roles, DNS, DHCP, printers and file shares.

If your company is going to use full disk encryption or has compliance requirements that you need consulting for, then contact us for assistance.

Command Line Configuring TCP/IP Addressing

Recently had an issue where a client needed to have their IP address statically assigned and the thought came to mind that my Remote Monitoring software was able to give me command line access, so I thought I would try configuring TCP/IP addressing via the command line interface and not have to interrupt the end users work. Here is how to get it done:

netsh interface ip set address name="Local Area Connection" static [static IP] [subnet mask] [default gateway] 1

That gets the IP address, subnet mask and default gateway – so what about static DNS? Here is the next step:

netsh interface ip add dns name="Local Area Connection" addr=[DNS address #1]

netsh interface ip add dns name="Local Area Connection" addr=[DNS address #2] index=2

If your company need remote assistance or help planning / maintaining / configuring TCP/IP addressing in your network infrastructure, then contact us for assistance.

Demote Windows Small Business Server

Since Microsoft is no longer making Small Business Server (SBS) as the complete package for the SMB client, it is time to migrate email to Office365 and put in a Windows Standard Server in its place. This will explain the details of how to demote Windows Small Business Server from the domain after email has been migrated, the new server should already be in place and it should be running the appropriate server service and Flexible Single Master Operation (FSMO) roles would already be migrated.

One Last Check

  • Open a Command Prompt

  • Type in – netdom query fsmo

  • Make sure that all roles are pointing to the new Domain Controller

Uninstall Exchange

  • Open Control Panel

  • Double Click on “Programs and Features” icon

  • Search the list and find the entry named something like “Microsoft Exchange Server…” right click on it and choose “Uninstall”

  • Click “Next >” button then uncheck all possible boxes then click “Next >” button

  • Once the prerequisites have cleared successfully, click “Uninstall” button

  • Finally click “Finish” button

Remove AD Certificate Services

  • Click Start button, click Administrative Tools, and then click Server Manager.

  • Click on Roles, then in the Roles Summary section, click Remove Roles.

  • In the Remove Roles Wizard, click “Next >” button

  • Clear the “Active Directory Certificate Services” check box, and then click “Next >” button

  • On the Confirm Removal Options page, review the information, and then click “Remove >” button

Demote Windows Small Business Server and Remove from Active Directory

  • On the Source Server, click Start button, click Run, type dcpromo, and then click “OK” button

  • Click “Next >” button twice. (WARNING: Do not select “Delete the domain because this server is the last domain controller in the domain.”)

  • In the Summary dialog box, you are told that Active Directory Domain Services (AD DS) will be removed from the computer and that the server will become a member of the domain. Click “Next >” button

  • Click “Finish” button and the Server will restart

  • After the Server restarts, it can then be removed from the domain into a workgroup and disconnected from the network.

To remove the Source Server from Active Directory Domain Services

  • On the new Domain Controller Server click Start button, click Administrative Tools, and then select Active Directory Users and Computers.

  • In the Active Directory Users and Computers navigation pane, expand the domain name, expand MyBusiness, expand Computers, and then expand SBSComputers.

  • Right-click the old Server name if it still exists in the list of servers, click Delete, and then click Yes.

  • Verify that the Source Server is not listed, and then close Active Directory Users and Computers.

To update the Software Updates Group Policy Object

  • On the Management Server, click Start, click Administrative Tools, and then click Group Policy Management.

  • On the User Account Control dialog box, click Continue.

  • In the Group Policy Management console, in the navigation pane, expand Forest:DomainName, expand Domains, expand DomainName, and then expand Group Policy Objects (GPO).

  • Click Update Services Server Computers Policy.

  • In the results pane, click the Scope tab.

  • In the Security Filtering section, click the object that begins with “S-1-5…” This is the old Server Security Identifier (SID).

  • Click Remove, and then click “OK” button

If your company is migrating to Office 365 and needs help to demote Windows Small Business Server, then contact us for assistance.

Archives

Categories

Plant a Seed 541-761-9549
233 Rogue River Hwy #873 Grants Pass, OR 97527
Mon-Fri: 9:00am-5:00pm
support@farmhousenetworking.com
© 2016-2022- Farmhouse Networking. All rights reserved
Terms and Conditions Privacy Policy

Evaluation Signup

[contact-form-7 id="452" title="Free Network Evaluation"]