[EX2013] Deploy MaxConcurrentApi

# deploy MaxConcurrentApi key in multiple Exchange servers
Get-Exchangeserver | foreach{Invoke-Command -ComputerName $_.fqdn -ScriptBlock {
    $registryPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters"
    $Name = "MaxConcurrentApi"
    $value = "10"

    IF(!(Test-Path $registryPath)){
        New-Item -Path $registryPath -Force | Out-Null
        New-ItemProperty -Path $registryPath -Name $name -Value $value -PropertyType DWORD -Force | Out-Null}
    ELSE {
        New-ItemProperty -Path $registryPath -Name $name -Value $value -PropertyType DWORD -Force | Out-Null}

    restart-service netlogon -Force
}}

# deploy MaxConcurrentApi key in multiple DC servers. This is captured from the “currentDomainControllers” result.
(Get-Exchangeserver servername -Status).CurrentDomainControllers | foreach{Invoke-Command -ComputerName $_ -ScriptBlock {
    $registryPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters"
    $Name = "MaxConcurrentApi"
    $value = "10"

    IF(!(Test-Path $registryPath)){
        New-Item -Path $registryPath -Force | Out-Null
        New-ItemProperty -Path $registryPath -Name $name -Value $value -PropertyType DWORD -Force | Out-Null}
    ELSE {
        New-ItemProperty -Path $registryPath -Name $name -Value $value -PropertyType DWORD -Force | Out-Null}

    restart-service netlogon -Force
}}

[WSRV] Backup AD partition

ldifde -d "<configuration container>" -f configuration.ldf 

[WSRV] List Global Catalog Servers

• nslookup
• set type=srv
• _gc._tcp.domain.local

• nltest /dsgetdc:alabama.usa /gc

• netdom query dc

• Open Active Directory Sites and Services.
• In the console tree, expand the Sites container, expand the site of the domain controller you want to check, expand the Servers container, and then expand the Server object.
• Right-click the NTDS Settings object, and then click Properties.
• On the General tab, if the Global Catalog box is selected, the domain controller is designated as a global catalog server.

[WSRV] Retrieve user details from Active Directory using SID

$strSID="S-1-5-21-500000003-1000000000-1000000003-1001"
$uSid = [ADSI]"LDAP://<SID=$strSID>"
echo $uSid


distinguishedName : {CN=John Doe,OU=Domain Admins,OU=People,OU=xxx,DC=xxx}
Path              : LDAP://<SID=S-1-5-21-500000003-1000000000-1000000003-1001>

[WSRV] Reset the Secure Channel

netdom reset /d:devgroup.contoso.com mywksta


OR


nltest /sc_verify:iammred

ipconfig /flushdns
arp -d *
Get-Service netlogon | restart-service
nltest.exe /sc_verify:<fully.qualified.domain.name.here>


OR

nltest /SC_RESET:<DomainName> - Reset secure channel for <Domain> on <ServerName>

OR

Test-ComputerSecureChannel

Test-ComputerSecureChannel -Repair

[WSRV] Provisioning a server core domain controller

powershell

$cn = hostname

netdom renamecomputer $cn /NewName:DC1

netsh interface ip set address "Ethernet" static 192.168.10.1 255.255.255.0 192.168.10.254

netsh interface ip add dns "Ethernet" 192.168.10.1

netsh interface ip add dns "Ethernet" 192.168.10.254 index=2


powershell

Install-WindowsFeature AD-Domain-Services

$SafePass = Read-Host "Password" -AsSecureString

Install-ADDSForest -DomainName domain.local -DomainNetbiosName MYDOMAIN -ForestMode Win2012R2 -DomainMode Win2012R2 -InstallDNS -NoDnsOnNetwork -SafeModeAdministratorPassword $SafePass



powershell

Add-DnsServerPrimaryZone -NetworkID "192.168.10.0/24" -ReplicationScope "Forest"


cscript C:\Windows\System32\Scregedit.wsf /ar 0

netsh advfirewall set currentprofile state off

[WSRV] Bulk change AD users password

$pwd = ConvertTo-SecureString -string "Pa$$w0rd" -AsPlainText -force

Get-ADUser -Filter * -SearchScope Subtree -SearchBase "OU=Sports,DC=domain,DC=local" | Set-ADAccountPassword -Reset -NewPassword $pwd

[WSRV] Create shortcut to "Find" in ADUC

C:\Windows\System32\rundll32.exe dsquery.dll,OpenQueryWindow

[WSRV] Filter ADUsers

Get-ADUser -Filter * | ?{($_.Name -like "*ick a*") -or  ($_.Name -like "Administrator*") } | ft name

Get-ADUser -Filter * | ?{($_.Name -notlike "*ick a*") -and ($_.Name -notlike "Administrator*") } | ft name

[WSRV] Transferring FSMO roles

https://winsvr.wordpress.com/2012/12/17/transferring-fsmo-roles-from-ws-2008r2-dc-to-ws-2012-dc/

[WSRV] LDP

• Open ldp.exe from run prompt

• Click on Connection -> Connect

• Enter Domain Controller FQDN and click OK

• Click on Connection -> Bind -> Click ok to login using Default Credentials if you logged in using Domain/Enterprise Admin account

• Click on View -> Tree to connect to Domain or Configuration Partition

• CTRL + N -> Clear the right reading pane

[WSRV] Clean up server metadata

To clean up server metadata

1. Open a command prompt.
2. Type the following command, and then press ENTER:
   ntdsutil
3. At the ntdsutil: prompt, type:
   metadata cleanup
4. Perform metadata cleanup as follows:
• If you are performing metadata cleanup by using the version of Ntdsutil.exe that is included with Windows Server 2003 SP1, at the metadata cleanup: prompt, type:
  remove selected server ServerName
  Or
  remove selected server ServerName1 on ServerName2

From <http://technet.microsoft.com/pt-br/library/cc736378(v=ws.10).aspx> 

[WSRV] Forest Trust

However, the administrators group of each domain is a domain local group, so you could add the enterprise admins group from the other forest to the administrators group of each domain. This is likely the tedious operation you were trying to avoid, but it is the easiest way to grant this permission.

For reference, check out these technet articles:

• Default groups and their scope
• Explanation of group scope semantics

De <http://serverfault.com/questions/503441/adding-enterprise-admins-group-of-forest-a-to-enterprise-admins-group-of-for> 

[WSRV] W32tm

W32tm

De <http://technet.microsoft.com/en-us/library/bb491016.aspx>

How to synchronize the time with the Windows Time service in Windows XP

De <http://support.microsoft.com/kb/307897/en-us>

Restart Windows Time service:

1. net stop w32time

2. net start w32time

Synchronize the time on a member computer in an Active Directory domain

w32tm /resync

w32tm /resync /rediscover

[WSRV] FSMO Roles

NetDOM /query FSMO






There are five FSMO roles:
• PDC emulator (one per domain): This role allows Windows Server 2003 to act as a Windows NT primary domain controller (PDC), and it provides replication support for Windows NT-based backup domain controllers (BDCs). In addition, this role assists with time and group policy synchronization.
• Infrastructure master (one per domain): This role is responsible for updating the group-to-user references whenever the members of groups change or receive new names.
• Relative ID (RID) master (one per domain): This role ensures that every object created has a unique identification number.
• Schema master (one per forest): This role is responsible for maintaining and modifying the Active Directory schema.
• Domain naming master (one per forest): This role is responsible for the addition and deletion of domains in a forest.