Extend System Partition on a Windows Server 2003 VM using Dell ExtPart

There is no native tool that enables extending system partitions (C:\ drives) on Server 2003. There are multiple ways to perform this task, however, the only method that can be done online utilises a Dell utility called ExtPart. It can perform the extension of the system partition with no downtime although sometimes booting into Safe Mode and then running ExtPart is necessary to clear locks on the disk.
Note: This applies to Server 2003 only, newer versions of Windows do not suffer from this limitation, Disk Management as well as the diskpart are able to extend system partitions on-the-fly.

The first step is to download the ExtPart utility from this link. Click on the Download File link and save it to your desktop. The file is a self-extracting zip file called ExtPart.exe per the below:

Double-click on it and accept the default path it will extract the utility to:

Click on Unzip and the files will be extracted successfully:

To demonstrate how useful ExtPart is we will use an example whereby our demo VM has a 15 GB C:\ drive and it needs to be increased to 30 GB. A screenshot of the the current state of the C:\ drive is below:

We go into the VM settings and can see that the virtual disk is indeed 15 GB in size:

We increase the virtual disk size to 30 GB and apply the change:

Within the VM load Disk Management and select Action > Rescan Disks so that the system sees the newly added 15 GB of storage:

After the re-scan completes you will now see the extra 15 GB of unallocated space:

Now we need to run the ExtPart utility expand the C:\ drive so that it utilizes the 15 GB of unallocated space. To proceed, open the command prompt and go to the location where you extracted the ExtPart utility, in my case, C:\dell\ExtPart:

C:\>cd C:\dell\ExtPart

Then run ExtPart.exe:

C:\dell\ExtPart>extpart.exe

Enter the volume that is being expanded, in this example it is the C:\ drive so enter just C: without the backslash:

Volume to extend (drive letter or mount point): C:

Then enter the amount in MB to increase the volume by, I entered 15343:

Size to expand the volume (MB): 15343

The output will confirm the new size of the volume (C:\ drive), which is 30678 MB:

New volume size          :30678 MB (32169069568 bytes)

The full sequence of commands can be seen in the screenshot below:

When going back into Disk Management and re-scanning the disks, we can see that there is still 31 MB that is unallocated:

To add that remaining 31 MB to the C:\ drive, we go back to ExtPart and perform the same series of steps but this time add 31 MB:

Size to expand the volume (MB): 31

A screenshot of those steps is below:

Now going back into Disk Management you can see that the C:\ drive is using all of the provisioned space in the disk:

If the utility returns an error such as “the disk is not accessible” or “unable to connect to C:” then reboot the VM into Safe Mode and then run the same ExtPart commands. This is caused by various services locking the disk and preventing ExtPart from extending the volume. Booting into Safe Mode starts up the OS in a clean state, so only minimal services and drivers will run, thereby allowing ExtPart to expand the volume without interruption.

Original Link:

How to transfer or seize FSMO roles

How to transfer or seize FSMO roles

The first Microsoft Windows 2000 Active Directory (AD) domain controller in a forest is granted five FSMO roles when you run the Dcpromo.exe program and install the AD. There are two FSMO roles that are forest wide and three that are per domain. If child domains are created, the two forest wide roles do not change. A forest with two domains would have eight FSMOs; two for the forest and three domain specific FSMO roles in each domain.
The five FSMO roles are:
• Schema master – Forest wide and one per forest.
• Domain naming master – Forest wide and one per forest.
• RID master – Domain Specific and one for each domain.
• PDC emulator – Domain Specific and one for each domain.
• Infrastructure master – Domain Specific and one for each domain.
If you only have one server (like SBS) it holds all the roles, if you have multiple domain controllers there is a chance that the roles have been divided to other servers (by whomever installed the forest…).
In order to find out which server holds which role you can use the following command on one of the servers:
Ntdsutil roles Connections “Connect to server<ServerName> ” Quit “select Operation Target” “List roles for connected server” Quit Quit Quit
**replace <ServerName> with the name of one of your DC’s
OR
Open command prompt and type netdom query fsmo
To move the FSMO roles from one computer to another, you can use two different methods. You can use the first method if both computers are running. This method is a Transfer and is the method that is recommended. Use the second method if the FSMO roles holder is offline. The second method requires you to use the Ntdsutil.exe tool to seize the roles.
NOTE: Only seize the FSMO roles to the remaining Active Directory domain controllers if you are removing the FSMO role holder from the domain or forest.
Transfer FSMO roles
To transfer the FSMO roles by using the Ntdsutil utility, follow these steps:
1. Log on to a Windows 2000 Server-based or Windows Server 2003-based member computer or domain controller that is located in the forest where FSMO roles are being transferred. We recommend that you log on to the domain controller that you are assigning FSMO roles to. The logged-on user should be a member of the Enterprise Administrators group to transfer Schema master or Domain naming master roles, or a member of the Domain Administrators group of the domain where the PDC emulator, RID master and the Infrastructure master roles are being transferred.
2. Click Start, click Run, type ntdsutil in the Open box, and then click OK.
3. Type roles, and then press ENTER.
Note To see a list of available commands at any one of the prompts in the Ntdsutil utility, type? and then press ENTER.
4. Type connections, and then press ENTER.
5. Type connect to server servername, and then press ENTER, where servername is the name of the domain controller you want to assign the FSMO role to.
6. At the server connections prompt, type q, and then press ENTER.
7. Type transfer role, where role is the role that you want to transfer. For a list of roles that you can transfer, type? at the fsmo maintenance prompt, and then press ENTER, or see the list of roles at the start of this article.
For example,
To transfer the Domain Naming master role, type transfer naming master
To transfer the infrastructure master role, type transfer infrastructure master
To transfer the Domain Naming master role, type transfer pdc
To transfer the RID master role, type transfer rid master
To transfer the Domain Naming master role, type transfer schema master
Note: The one exception is for the PDC emulator role, whose syntax is transfer pdc, not transfer pdc emulator.
8. At the fsmo maintenance prompt, type q, and then press ENTER to gain access to the ntdsutil prompt. Type q, and then press ENTER to quit the Ntdsutil utility.
Seize FSMO roles
To seize or transfer the FSMO roles by using Ntdsutil, follow these steps:
2. Click Start, click Run, type ntdsutil in the Open box, and then click OK.
3. Type roles, and then press ENTER.
4. Type connections, and then press ENTER.
5. Type connect to server servername, and then press ENTER, where servername is the name of the domain controller you want to use.
6. At the server connections prompt, type q, and then press ENTER.
7. Type seize role, where role is the role that you want to seize. At the fsmo maintenance prompt, and then press ENTER,
For example,
To seize the Domain Naming master role, type seize naming master
To seize the infrastructure master role, type seize infrastructure master
To seize the Domain Naming master role, type seize pdc
To seize the RID master role, type seize rid master
To seize the Domain Naming master role, type seize schema master
Notes• Under typical conditions, all five roles must be assigned to “live” domain controllers in the forest. If a domain controller that owns a FSMO role is taken out of service before its roles are transferred, you must seize all roles to an appropriate and healthy domain controller.
If the domain controller that formerly held any FSMO role is not present in the domain and if it has had its roles seized by using the steps in this post, remove it from the Active Directory by following the procedure that is outlined in the following Microsoft Knowledge Base article: 216498 (http://support.microsoft.com/kb/216498/) How to remove data in active directory after an unsuccessful domain controller demotion.

Original Post:

Windows Memory Dump

Windows Memory Dump

Hello Techies,

It is very often we see the blue screen on the Microsoft based OS.Basically we called this blue screen as 
Blue Screen Of Death (BSOD).

I have asked the question "what is BSOD" from many guys during the interviews but usually they replied
that it happened due to RAM or HDD failure, they simply reply that in this case they will replace either RAM or HDD to fix this issue on the server. 

So today i will give a idea about this BSOD and how to analyze this issue on windows platform.

->What is BSOD ?
->The Blue Screen of Death , displayed by the Microsoft Windows family of operating systems upon encountering a critical error,of a non-recoverable nature, that causes the system to crash.Stop errors are hardware or driver related, causing the computer to stop responding in order to prevent damage to the hardware or data.

->Type of memory dump ?
->There are three type of dumps created

1. Complete Memory Dump
2. Kernal Memory Dump
3. Small Memory Dump

1. Complete Memory Dump:-A Complete Memory Dump is the largest kernel-mode dump file. This file contains all the physical and virtual memory for the machine at the time of the fault.If you select the complete memory dump option, you must have a paging file on the boot volume The Complete Memory Dump file is written to %SystemRoot%\Memory.dmp by default.The Complete memory dump option is not available on computers that are running a 32-bit operating system and that having 2 gigabytes (GB) or more of RAM (by default).

2. Kernal Memory Dump:  A Kernel Memory Dump contains all the memory in use by the kernel at the time of the crash.The dump file will be around one-third the size of the physical memory on the system. This dump will not include unallocated memory or any memory allocated to applications. It only includes memory allocated to Windows kernel.The Kernel Memory Dump file is written to %SystemRoot%\Memory.dmp by (default)

3. Small Memory Dump:- A Small Memory Dump is much smaller than the other two crash dump files. It is exactly 64 KB in size (128KB on 64-bit systems) .This kind of dump file can be useful when space is greatly limited. However, it contains very less information for the reason of the crash.

                              How to enable memory dump on a windows server

Here i am going to configure the memory dump on Win-7/server 2008

1. Right click on my computer and click on properties then click on 2. Advance system setting option on left side ,then click on 3. Advance tab, Now click on 4. setting under Startup and recovery.Below are the screenshot

Same you can configure from the registery as well from the location as mentioned below

HKLM\System\CurrentControlSet\Control\CrashControl
All the things that you can configure via GUI can be configured via registery as well.

• Write an event to the System Log checkbox = LogEvent
• Automatically Restart checkbox = AutoReboot
• Write Debugging Information drop-down = CrashDumpEnabled
• Dump File text box = DumpFile
• Overwrite any existing file checkbox = Overwrite 

                              How to Crash the server manually using keyboard

Now you have configured the memory dump on the server and now you can check as well if it is creating the memory dump file on the server or not.Also when you need to create memory dump file manually after a crash ,do the following to configure the same.

Using PS/2 keyboard :-


1. Start Registry Editor.
2. Locate the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\Parameters

3. On the Edit menu, click Add Value, and then add the following registry entry:

Name: CrashOnCtrlScroll
Data Type: REG_DWORD
Value: 1

4. Exit Registry Editor, and then restart the computer.


 Using USB keyboad:

1. Start Registry Editor.
2. Locate the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdhid\Parameters

3. Make sure that the following registry entry is enabled:

Name: CrashOnCtrlScroll
Data Type: REG_DWORD
Value: 1

4. Exit Registry Editor.

If You can generate a system memory dump by holding down the right CTRL key and pressing the SCROLL LOCK key twice. (Ctrl+Scroll lock twice)

Note: Pressing left CTRL key does not generate the system memory dump.



Will come with new Blog shortly on How to Analyze the memory dump....... ;)

Original Post:

Windows Groups and Scopes

Windows Groups and Scopes

Hi Frnz

Today I will share with you some knowledge of Windows Groups and Scopes.I have seen many people usually don't have enough idea about Groups and Scopes.

So let’s have details on this.

Group:-A group is a container that contains user and computer objects within the group. The user and computer objects are stored in the group known as group members.. Assigning the security permission for a group on a resource ensures that all members of the group receive the permission.

Types of Groups:

1. Distribution group
2. Security group

Distribution groups can be used only with e-mail applications (such as Exchange) to send e-mail to a collection of users. Distribution groups are not security-enabled, which means that they cannot be listed in Access control list.

Security groups are used to provide access to resources on a network. Security groups are also used to assign user rights in Active Directory and to assign permissions on shared resources on the network. Security groups are listed in ACLs 

Group Scopes:-

Security Group or Distribution Group are differentiate by a scope that identifies the extent to which the group is applied in the domain tree or forest.

There are three group scopes: 

         1. Domain Local

         2. Global Group

         3. Universal Group

1. Domain Local:-Members of  Domain Local Groups can include other groups and accounts from any domain and can be assigned permissions only within a domain.

·     Users can be from any domain.

·     Can have permissions only in the domain in which it is created.

2. Global Group:-Members of Global Groups can include other groups and accounts only from the domain in which the group is defined and can be assigned permissions in any domain in the forest.

·     Users can be from the domain in which we create global group

·     Can have permission on any domain 

 3. Universal Group:-Members of Universal Group can include other groups and accounts from any domain in the domain tree or forest and can be assigned permissions in any domain in the domain tree or forest.

·     Users can be from any domain

·     Can have permission in any domain

Usage of group with Domain Local Scope

Groups with domain local scope help you define and manage access to resources within a single domain.

Let’s take an example:-

You need to give ten users access to a particular folder A, you could add all ten user accounts in the folder permissions list. If, however, you later want to give the five users access to other folder B, you would again have to specify all five accounts in the permissions list for the new printer.

If you have good idea about the groups, you can simplify this administrative task by creating a group with domain local scope and assigning it permission to access the folder A. Put the ten user accounts in a group with global scope and add this group to the group having domain local scope. When you want to give the ten users access to a folder B, assign the group with domain local scope permission to access the folder B. All members of the group with global scope automatically will access to the folder B

Now you all may have question in your mind that why we used Global Group in the above scenario.
The Answer for that is “it is a best practice and recommended to use the A-G-Dl-P model when assigning permissions. 
                  A->G->Dl->P    A=Users G=Global Groups Dl=domain local P= permissions. 

What this model means is that you put "user Accounts" in to "Global groups" and then put the global groups into "Domain local" groups and then assign permissions to that Domain local group it is recommended you assign permission on Domain local group, this will be helpful in future. However you can assign permission directly to any Group but the recommended model is A-G-Dl-P

Usage of group with Global Scope

Groups with global scope usually used to manage user and computer accounts that require daily maintenance. Because groups with global scope are not replicated outside of their own domain .Accounts in a group having global scope can be changed frequently without generating replication traffic to the global catalog.The changes that are made on this will remain within the domain where it exists. By doing this you will restrict more traffic to the global catalog server.

Let’s take an example:-

In a network with two domains, A.com (India) and B.com (USA), if there is a group with global scope called GLFinance in the A.com (India) domain, there will also be a group called GLFinance in B.com (USA).
It is strongly recommended that you use global groups or universal groups instead of domain local groups when specifying permissions on domain directory objects replicated to the global catalog.

Usage of group with Universal Scope

Groups with Universal scope usually used to consolidate groups that are on different domains. To do this, add the accounts to groups with global scope and nest these groups within groups having universal scope. Using this strategy, any membership changes in the groups having global scope do not affect the groups with universal scope.

Let’s take an example:-

In a network with two domains, A.com (India) and B.com (USA), and a group having global scope called GLFinance in each domain, create a group with universal scope called UFinance to have as its members the two GLFinance groups, A.com (India) and B.com (USA). The UFinance group can then be used anywhere in the enterprise. Any changes in the membership of the individual GLFinance groups will not cause replication of the UFinance group.

Original Post:

Windows Failover Clustering

Windows Failover Clustering

Clustering

Hello Guys,

Today I am going to share little knowledge about Windows clustering.

What is server cluster?

A Server cluster is a collection of independent servers that together provide a single, highly available platform for hosting applications.

The technique that we used in Microsoft Windows to configure cluster is called Microsoft windows clustering.

Cluster Requirements? (Here I am discussing two node cluster requirements)

Note:- You can use starwind for the storage.

• Two machine with same Hardware.
• OS on both the machines having same version and same updates.
• Two-two LAN card on both the machines.
• 2 Private IP addresses for cluster Heartbeat
• 3 Public IP address, Two IPs for machine’s public interface and one IP for Cluster name.
• You must have shared storage that must be connected to all the nodes of the cluster.
• You must have Cluster application installed on both the machines. J
• The server in Cluster must use DNS server for name resolutions.
• All the servers in the cluster must be in the same Active Directory domain.
• You must be logged on to the domain with an account that has administrator rights and permissions on all servers in that cluster
  
  
  Here I will create two nodes file cluster.
  
  
  1.       Install the OS on both the nodes with same hardware and OS version, meeting the above mentioned requirements.
  2.       Add both the nodes to a domain and make them members of that domain.
  3.       Login to node with the user having rights or administrator that has rights and permissions on all the nodes in that cluster.
  4.       Make sure storage is visible in both the nodes.
  5.       Now we need to configure the cluster nodes.
  6.       Open the cluadmin.msc and then create new cluster.
  
  
  
  
  

7.   Select the domain and enter the name of the cluster (BlogTest)

8.  Now it will analyze the configuration that will check all the pre-requisites for the cluster




 


9. Now you need to enter the IP address that the clients will used to connect to cluster.





10. Now you need to enter the credentials for the domain account under which the cluster service will 
       run on the nodes,

1. 11. After going ahead with the some steps ,you will finally Finish this wizard

    12. Now your cluster is ready and now you need to add the second node in the cluster.     

1        to do this follow the below screenshot

   

13. You will get the following wizard.

14. After that you need to enter the authorized account and the node joining will 
     get start.

 
 

15. After you finish with this step you will see both the nodes in the console, Now you
     need to configure the cluster for file share.To configure this , please follow the below

16. After going through the wizard and selecting the cluster group , you will get the list of
     application that you can configure,Select the File Share.

17.After you select File Share, You will come to the next configuration page that is given 
    below and here you need to provide the share name, permissions etc.

18. After providing all the details , you can click next and then Finish.
19. After this your two node cluster is ready, you can try to make fail over :)

20. Be Happy :) if failover works otherwise google Zindabaad 

 

Original Post: 

How to recover deleted object from Active directory using LDP.exe

How to recover deleted object from Active directory using LDP.exe

Recover deleted object from Active directory using LDP.exe

Hi Guys,

Today I am here going to share the knowledge on how to recover deleted objects from Active directory using LDP.exe tool.

In my scenario I have my domain as a cluster.com and having the user vijay Sharma.

Now you need to download the tools LDP.exe. You can download the same from here.

Now I have deleted the object vijay from the Active directory.

To recover the object vijay , need to open the LDP.exe tool and perform the following


Step 1: click on connection tab and goto connect tab and enter the name of your Domain.
Step 2: Bind the connection by going to connect tab and click on bind and provide the administrator credentials.

Step 4: Now goto options tab and click on control option.

Step 5: Now in the box under load predefined select "Return deleted objects" and click on OK.

Step 6: Click on view and select tree option and in this write the DC=cluster,DC=com.

Step 7:Select the tree from the left side and expand the tree and expand the tree deleted object. (CN=Deleted Objects,DC=Cluster,DC=com)

Step 8: Select the deleted user which you wanna recover (Vijay Sharma)

Step 9: Right click on the selected user and click on modify.
Step10:In the modify box write "isdeleted" in attribute box and select the "delete" operation and click on "Enter" option.
NOTE: Do not click on "Run" option in this step.

Step11:Now write "distinguishedName" in the attribute box and select the "replace" operation and click on "Enter". Select synchronous and extended check box and click on Run.

Step12: Now the user is recovered in the same container but it will be in disable mode.

Step13: Enable the user account.

NOTE: The main limitation of using LDP.exe is that you can not restore the attributes of the objects
             Like in my case the user was member of many groups but after recovering it loose the group
             membership.


Original Post: