Active Directory Security – Page 23 – Active Directory & Enterprise Security, Methods to Secure Active Directory, Attack Methods & Effective Defenses, PowerShell, Tech Notes, & Geek Trivia…

May 13 2014

How to Clean up the WinSxS Directory and Free Up Disk Space on Windows Server 2008 R2 with New Update

By Sean Metcalf in Technical Article

It’s finally here! After pages and pages of comments from you requesting the ability to clean up the WinSxS directory and component store on Windows Server 2008 R2, an update is available.

http://support.microsoft.com/kb/2852386

As a refresher, the Windows Server 2008 R2 update is directly related to my previous blog post announcing a similar fix for Windows 7 client.

The Windows 7 version of this fix introduced an additional option to the Disk Cleanup wizard that would cleanup previous versions of Windows Update files. KB2852386 adds a Disk Cleanup option on Windows Server 2008 R2, similar to the Windows 7 update.

What does this mean for Windows Server 2008 R2? After installing this update and prior to being able to perform the cleanup, the Desktop Experience feature must be installed. Why you ask? Disk Cleanup is not installed by default on Windows Server 2008 R2. It is instead a component installed with the Desktop Experience feature.

Why was the update not included as a DISM switch like Windows Server 2012 R2?

This was evaluated, however, due to the amount of changes required and the rigorous change approval process, it was not feasible to back port the functionality this way. Knowing that it would be some time before everyone could upgrade to Windows Server 2012 R2 and based on feedback from an internal survey taken of a subset of enterprise customers, it was determined that this update would still be useful in its Disk Cleanup form, even with the Desktop Experience prerequisite. We hope you agree. However, we are aware that for some of you, the Desktop Experience requirement will be a deal breaker, but decided to release it anyway hoping it will help in some instances.

How can I get the update?

The update is available on Windows Update. It can also be manually downloaded from the Microsoft Update Catalog. The KB article listed above will also direct you to a download link in the Microsoft Download Center.

Script It!

Automation

My super knowledgeable scripting cohort Tom Moser wrote a PowerShell script that automates THE ENTIRE PROCESS. Can I get a cheer? Ok. So maybe it is a bit much to expect IT admins to cheer, but can I get an appreciative grunt? The script certainly beats the alternative of doing this all manually.

You can find the script on the TechNet Script Center here:

http://gallery.technet.microsoft.com/scriptcenter/CleanMgrexeKB2852386-83d7a1ae

What does the script do?

In short, the script does the following:

1) Installs Desktop Experience, if not previously installed, and performs a reboot.

2) Sets the appropriate registry keys to automate the cleanup. The script will cleanup not only previous Windows Update files as well as Service Pack files.

3) The script then initiates the cleanup.

4) If Desktop Experience was not previously installed, the script uninstalls it.

5) Performs final reboot.

WinSxS

May 08 2014

Active Directory FSMO Placement Guidance

By Sean Metcalf in Technical Reference

FSMO Placement Guidance Summary:

Make sure the PDC is highly available and connected.
Place the PDC on your best hardware in a reliable hub site that contains replica domain controllers in the same Active Directory site and domain.
Place the Forest FSMOs on the forest root PDC (schema master & domain naming master).
Place the RID master on the domain PDC in the same domain.
If you have a single domain environment, all DCs are GCs, OR you have enabled the recycle bin (see MSDN note below), place the infrastructure master on the PDC (which likely contains the other FSMO roles as well).
Don’t move FSMOs around regularly. The PDC is targeted for a number of operations and network connections. It is best to not force clients to rediscover the PDC on a regular basis.

This means, in a single domain environment, it makes sense to place all the FSMOs on a single DC. Pick one that is highly available and well-connected. You may decide that selecting a virtual DC is the way to go since it can usually be moved to different hosts for DR/COOP reasons. Note that if you do go virtual for this DC, consider disabling VM host time synchronization.Though, there may be valid reasons for not doing so.

In a multiple domain environment, place the Forest FSMOs on the forest root PDC (schema master & domain naming master) and select one DC per domain on which to place all of the FSMOs – the PDC is a good choice assuming they are all GCs or the AD Recycle Bin is enabled.

MSDN NOTE:

When the Recycle Bin optional feature is enabled, every DC is responsible for updating its cross-domain object references in the event that the referenced object is moved, renamed, or deleted. In this case, there are no tasks associated with the Infrastructure FSMO role, and it is not important which domain controller owns the Infrastructure Master role.

From MSDN: “6.1.5.5 Infrastructure FSMO Role“

FSMO Role Information:
Continue reading

ActiveDirectory, DomainController, DomainNamingMaster, FSMO, FSMOPlacement, InfrastructureMaster, PDCEumlator, RIDMaster, SchemaMaster

May 06 2014

Windows Server 2012 MCSM Reading List

By Sean Metcalf in Technical Reading

Here’s a link to download the MCM/MCSM Directory Services Reading List document that I developed for the MCSM Directory Services (Windows Server 2012) program and was created after the MCSM Directory Services (Windows Server 2012) test questions were written.

It is based on the original one created for the MCM DS program provided to candidates.

MCSM_Directory_Reading_List_June_2013.docx

The AD Reading Library on this site also has Active Directory references worth reading and is updated occasionally.

MCM/MCSM, ReadingList

May 04 2014

Enabling and Managing the Active Directory Recycle Bin

By Sean Metcalf in Technical Reference

So, you have upgraded all your DCs in the forest to Windows Server 2008 R2 and raised the domain and forest functional levels to Windows Server 2008 R2. Congratulations!
Now what?

Yes, you have to enable the AD Recycle Bin manually by running the following PowerShell commands:

Import-Module ActiveDirectory

Enable-ADOptionalFeature –Identity ‘CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=DOMAIN,DC=com’ –Scope ForestOrConfigurationSet –Target ‘DOMAIN.com’

Note that this effectively removes the importance of the Infrastructure Master FSMO since all DCs will perform that role. From MSDN: Continue reading