Because AD is using kerberos authentication, there is a limit of 5 minutes in time difference between client and the DC (this is to prevent a certain type of authentication attacks). The time is checked during the generation of the authentication package.
Following AD design, member servers and computers will sync time with their target logon server. Use "Set Logonserver" to see the target logon server.
Domain controllers will sync time with the PDC of the domain. and the PDC of the domain will sync its time with the parent domain PDC and so on. and the forest root PDC should sync with a reliable external/internal time source.
To check PDC : netdom query fsmo
To check time sync server : w32tm /monitor
To sync with reliable time source:
w32tm /config /manualpeerlist:192.5.41.41 /syncfromflags:manual /reliable:yes /update
net stop w32time
net start w32time
**Note : "net time" command is not accurate to determine the time sync server.
Ace Fekay's Active Directory, Exchange and Windows Infrastructure Services Blog gives a very detailed explanation on the time services and the command to reset some of the problems.
My discussion with Ace on the time service matter
Tuesday, February 9, 2010
Thursday, February 4, 2010
Server 2008 Terminal Server / Remote Desktop
Trying to implement a Terminal server on server 2008 with 5 user CAL.
Apparently the terminal server has now been renamed to remote desktop Host... :P
(My guess the change is in 2008 R2)
Anyway, got the role installed, however stuck at creating connections. It keeps giving me the error
"New connection needs to has unique connection type, transport type and network protocol"
Not sure how to solve this as the connection is the first connection, so it should be unique.
And the server is not joined to domain yet, so registering the license in AD DS seems to be not an option now.
============
Guess will have to join the server to domain first. then work from there. FML.
============
OK. Got the TS server up.
1. Add remote desktop server role on the server. Select remote desktop Host and Remote Destkop licensing server (if you haven't got any licensing server in the environment).
2. Restart is part of the adding role process
3. Once server is up, you can choose to join the server to the domain (depending on your network design). The licensing server will be added into AD DS service records as one of the TS licensing server for the domain.
4. Navigate to the Administrator tools > TS licensing server, you should see that the TS license server is not activated. Right click select "activate server"
5. Go thru the activation process by contacting microsoft via web/phone/automatic. (I used web)
6. You will need the server ID which is provided in the console, as well as your company details to complete the registration
7. Once registration is completed, a license key will be given to activate the server
8. Once server is activated, you can proceed to install the user/device CAL on the TS licensing server.
9. Follow the options to install user/device CAL, go thru the same web page for activation and select install user/device CAL.
10. You will need the agreement type and agreement number to complete the installation.
11. Once complete you will get a license number which needs to be keyed in at the activation console to install the CALs.
12. Once keyed in, registration is completed and you can navigate into the TS licensing server console to see the configured user/device CALs.
13. To configure the RDP connections, go to Remote Session Host Configuration.
14. The RDP-Tcp is created by default. You may edit the properties to allow more users per session.
15. Only administrators/users/user groups under Remote Desktop Users will be able to login onto the server. Check the Remote Desktop Users group under server manager > Configuration > Local Users and Groups > Groups
For some screenshots:
Installing the Terminal Services License Server
Apparently the terminal server has now been renamed to remote desktop Host... :P
(My guess the change is in 2008 R2)
Anyway, got the role installed, however stuck at creating connections. It keeps giving me the error
"New connection needs to has unique connection type, transport type and network protocol"
Not sure how to solve this as the connection is the first connection, so it should be unique.
And the server is not joined to domain yet, so registering the license in AD DS seems to be not an option now.
============
Guess will have to join the server to domain first. then work from there. FML.
============
OK. Got the TS server up.
1. Add remote desktop server role on the server. Select remote desktop Host and Remote Destkop licensing server (if you haven't got any licensing server in the environment).
2. Restart is part of the adding role process
3. Once server is up, you can choose to join the server to the domain (depending on your network design). The licensing server will be added into AD DS service records as one of the TS licensing server for the domain.
4. Navigate to the Administrator tools > TS licensing server, you should see that the TS license server is not activated. Right click select "activate server"
5. Go thru the activation process by contacting microsoft via web/phone/automatic. (I used web)
6. You will need the server ID which is provided in the console, as well as your company details to complete the registration
7. Once registration is completed, a license key will be given to activate the server
8. Once server is activated, you can proceed to install the user/device CAL on the TS licensing server.
9. Follow the options to install user/device CAL, go thru the same web page for activation and select install user/device CAL.
10. You will need the agreement type and agreement number to complete the installation.
11. Once complete you will get a license number which needs to be keyed in at the activation console to install the CALs.
12. Once keyed in, registration is completed and you can navigate into the TS licensing server console to see the configured user/device CALs.
13. To configure the RDP connections, go to Remote Session Host Configuration.
14. The RDP-Tcp is created by default. You may edit the properties to allow more users per session.
15. Only administrators/users/user groups under Remote Desktop Users will be able to login onto the server. Check the Remote Desktop Users group under server manager > Configuration > Local Users and Groups > Groups
For some screenshots:
Installing the Terminal Services License Server
Tuesday, February 2, 2010
Exchange 2003 : Sender Filtering
Got to know that exchange 2003 actually has an built-in spam filter feature.
It is located under global settings > message delivery > properties
Under here you can find a few options to help anti-spam.
Tried out the sender filtering today and it actually helps you to block email from specific sender email address or domain.
1. Specify the email in the filter
2. apply
3. go to email server > protocol > smtp properties
4. click on advanced
5. edit the port 25
6. apply sender filtering.
7. OK
The filter will apply for incoming emails.
Helpful link:
http://www.msexchange.org/tutorials/Sender-Recipient-Filtering.html
It is located under global settings > message delivery > properties
Under here you can find a few options to help anti-spam.
Tried out the sender filtering today and it actually helps you to block email from specific sender email address or domain.
1. Specify the email in the filter
2. apply
3. go to email server > protocol > smtp properties
4. click on advanced
5. edit the port 25
6. apply sender filtering.
7. OK
The filter will apply for incoming emails.
Helpful link:
http://www.msexchange.org/tutorials/Sender-Recipient-Filtering.html
Wednesday, October 14, 2009
HIS/SNA server : How does HIS client search for sponsor servers.
Had a project in with the Bank to help migrate 4 HIS servers from token ring connections into Ethernet connections.
========================
Environment:
========================
4 x HIS 2000 servers
2 of the server are in 1 HIS subdomain (HISPROD) and the other 2 servers are in another HIS subdomain (HISCOLD)
The 2 set of servers has the same PU/LU configuration. The main purpose is to have the 2nd set to be on standby mode.
Servers were running on Token Ring connections, which talks to a switch, which then talks to mainframe. Each server has 3 token ring adapters, hence 3 connections to the switch.
Main objective is to migrate all 4 servers to ethernet connections and make sure they are functional in Ethernet environment.
========================
Planning:
========================
1. 2 of the servers are production servers. The other 2 are standby. Hence the plan is to get 2 standby servers into ethernet connection first, then migrate production users to connect to standby servers. Monitor connections for 2 weeks, then change productions servers to ethernet connections and migrate users back to production servers.
2. The migration will be using DNS repointing, meaning User querying for production servers' IP will be directed to Standby servers' IP
2. Migration need to be done 2 servers at the same time. This is due to the fact that they are both in 1 HIS subdomain. When HIS client is searching for a sponsor server, it will actually look at the sponsor server list setup on the client.
a. when it hits the first server, it will query for the LU that it is suppose to connect, if the LU resides in any HIS servers within the HIS subdomain, the client will be pointed to contact the HIS server directly.
b. If the LU is not in any HIS servers within the HIS subdomain, the client will refer back to the HIS client sponsor server list for the next server to connect.
** This is a key point why HIS servers within the same HIS subdomain needs to be migrated together. **
========================
Implementation
========================
1. Make sure both set of servers has the same SNA configurations. Export and import snacfg.
a. export sna configuration out. "snacfg /print > c:\snacfg.txt"
b. Modify snacfg.txt to fit the target servers configuration. (e.g. server name, remote host address ... )
c. Delete SNADLC settings (since the target servers already has that)
d. Delete server settings (since the target servers already has that)
e. Delete everything after the last workstation config (this includes printer, tnserver etc...)
f. copy the modified snacfg.txt to target server and import. "snacfg @snacfg.txt"
g. Normaly error will gives u the target line number, so just go back to the snacfg.txt to check
h. If there is no error, the import will be completed. Verify at SNA manager console.
2. Modify DNS to repoint servers.
a. identiy which zone DNS users are querying.
b. Change DNS settings to point to the new IP in each of the zone.
c. Wait for replication to complete to all your DNS servers. This will roughly be the AD convergence time if you're using AD integrated DNS. You can write a batch script to query all your DNS servers for the particular Host record. nslookup
d. Wait for IP cache on client's PC to update. This will by default be 1 hour.
3. Shutdown original 2 HIS servers and turn on the target 2 HIS servers.
4. Verify all PU connections are active.
5. Get user to verify.
========================
Environment:
========================
4 x HIS 2000 servers
2 of the server are in 1 HIS subdomain (HISPROD) and the other 2 servers are in another HIS subdomain (HISCOLD)
The 2 set of servers has the same PU/LU configuration. The main purpose is to have the 2nd set to be on standby mode.
Servers were running on Token Ring connections, which talks to a switch, which then talks to mainframe. Each server has 3 token ring adapters, hence 3 connections to the switch.
Main objective is to migrate all 4 servers to ethernet connections and make sure they are functional in Ethernet environment.
========================
Planning:
========================
1. 2 of the servers are production servers. The other 2 are standby. Hence the plan is to get 2 standby servers into ethernet connection first, then migrate production users to connect to standby servers. Monitor connections for 2 weeks, then change productions servers to ethernet connections and migrate users back to production servers.
2. The migration will be using DNS repointing, meaning User querying for production servers' IP will be directed to Standby servers' IP
2. Migration need to be done 2 servers at the same time. This is due to the fact that they are both in 1 HIS subdomain. When HIS client is searching for a sponsor server, it will actually look at the sponsor server list setup on the client.
a. when it hits the first server, it will query for the LU that it is suppose to connect, if the LU resides in any HIS servers within the HIS subdomain, the client will be pointed to contact the HIS server directly.
b. If the LU is not in any HIS servers within the HIS subdomain, the client will refer back to the HIS client sponsor server list for the next server to connect.
** This is a key point why HIS servers within the same HIS subdomain needs to be migrated together. **
========================
Implementation
========================
1. Make sure both set of servers has the same SNA configurations. Export and import snacfg.
a. export sna configuration out. "snacfg /print > c:\snacfg.txt"
b. Modify snacfg.txt to fit the target servers configuration. (e.g. server name, remote host address ... )
c. Delete SNADLC settings (since the target servers already has that)
d. Delete server settings (since the target servers already has that)
e. Delete everything after the last workstation config (this includes printer, tnserver etc...)
f. copy the modified snacfg.txt to target server and import. "snacfg @snacfg.txt"
g. Normaly error will gives u the target line number, so just go back to the snacfg.txt to check
h. If there is no error, the import will be completed. Verify at SNA manager console.
2. Modify DNS to repoint servers.
a. identiy which zone DNS users are querying.
b. Change DNS settings to point to the new IP in each of the zone.
c. Wait for replication to complete to all your DNS servers. This will roughly be the AD convergence time if you're using AD integrated DNS. You can write a batch script to query all your DNS servers for the particular Host record. nslookup
d. Wait for IP cache on client's PC to update. This will by default be 1 hour.
3. Shutdown original 2 HIS servers and turn on the target 2 HIS servers.
4. Verify all PU connections are active.
5. Get user to verify.
Subscribe to:
Posts (Atom)