Server - Port to be opened about Domain controller and relative joining

During these days I faced necessity to eviscerate firewall rules for specifics projects.

At the same time if you need to find which ports are used from pcs/server to well communicate to Domain controller here they are verbosely list that I found thanks to colleague's help.

Obviously this rules need to be enabled in bidirectional way.

Domain Controller	123/UDP	W32Time
Domain Controller	135 TCP/UDP	RPC Endpoint Mapper
Domain Controller	136 TCP/UDP	Netbios
Domain Controller	137 TCP/UDP	Netbios Name Resolution
Domain Controller	138 TCP/UDP	Netbios Datagram Service
Domain Controller	139 TCP/UDP	Netbios Session Service
Domain Controller	3268/TCP	LDAP GC
Domain Controller	3269/TCP	LDAP GC SSL
Domain Controller	389/TCP/UDP	LDAP
Domain Controller	445 TCP/UDP	SMB
Domain Controller	464/TCP/UDP	Kerberos password change
Domain Controller	49152-65535/TCP/UDP	RPC for LSA, SAM, Netlogon, DFSR RPC, FRS RPC
Domain Controller	53/TCP/UDP	DNS
DNS server	53/TCP/UDP	DNS
Domain Controller	636/TCP	LDAP SSL
Domain Controller	88/TCP/UDP	Kerberos
Domain Controller	icmp reply	ping reply from DC
Domain Controller	icmp request	ping to DC
Domain Controller	TCP 1688	MS KMS Licensing
Domain Controller	TCP 5722	MS Knowledge base - file replication - RPC, DFSR, SYSVOL
Domain Controller	TCP 593	Rpc over HTTPS
DHCP server	UDP 67 - 68	DHCP relay

Exchange 20xx - Windows backup usage to backup store

You can use Windows Server Backup to backup Exchange store.

Is not excellent but it can be useful as first backup step.

1. Go to powershell:

PS C:\> Import-Module servermanager
PS C:\> Add-WindowsFeature backup

2. Select Exchange store and partition log

2. Select the VSS Settings tab and make sure that VSS full backup is chosen.  Click OK

Here they are more precise articles to go deeper on this argument:

http://www.techrepublic.com/blog/the-enterprise-cloud/back-up-exchange-2010-with-this-windows-server-2008-r2-feature/

http://exchangeserverpro.com/exchange-2010-mailbox-database-backup-restore-windows-server-backup/

Windows 7/8.X/2012/R2 - All patches Monthly rollup

Microsoft released a single Windows 7 Sp1 rollup that contain all security and non-security fixes released patches released since beginning.

http://catalog.update.microsoft.com/v7/site/Search.aspx?q=3125574

If you are going to install this one update, and then you only need new updates released after April 2016.

And since this update can be injected into Windows 7 SP1 media, it’s fully supported to mount a Windows 7 SP1 image (WIM file), then inject this update into it.

See https://technet.microsoft.com/en-us/library/dd744559(v=ws.10).aspx for the details of how to do this.

To apply this update, you must install the April 2015 servicing stack update for Windows 7 (KB3020369).

Consider that monthly non-security updates for Windows 7 SP1 and Windows 8.1 (as well as Windows Server 2008 R2 SP1, Windows Server 2012 and Windows Server 2012 R2) will be available as a monthly rollup (fixes rolled up together into a single update).

Each month, we will release a single update containing all of the non-security fixes for that month.

Original Microsoft Article:

https://blogs.technet.microsoft.com/windowsitpro/2016/05/17/simplifying-updates-for-windows-7-and-8-1/


Update rollup for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2 3161606

https://support.microsoft.com/en-us/kb/3161606

<----->

Other suggested blog articles

Recovery - Access, Excel, Word, Office and Photo recovery tools and other blog procedures

http://www.alessandromazzanti.com/2015/12/recovery-access-excel-word-office-and.html

Tips - Fix Microsoft Windows Update Issues

Microsoft creates direct links where they are steps and troubleshooting articles/tips that you could follow:

1.)Fix Microsoft Windows Update Issues

https://support.microsoft.com/en-us/gp/windows-update-issues/en-us

To speed up troubleshooting you can download this .cab

http://go.microsoft.com/fwlink/?LinkId=231149

Run now

2.) Otherwise you could follow this article and manually reset it:

How do I reset Windows Update components

https://support.microsoft.com/en-us/kb/971058

Here they are some parts:

Windows 8.1, Windows 8, and Windows 7

The Automatically diagnose and fix common problems with Windows Update troubleshooter may automatically fix the problem described in this article.  This troubleshooter fixes many problems. learn more

Run now

3.) If you need to install latest windows update agent:

perating system	Update
All supported x86-based versions of Windows 8 (KB2937636)	Download the package now.
All supported x64-based versions of Windows 8 (KB2937636)	Download the package now.
All supported x64-based versions of Windows Server 2012 (KB2937636)	Download the package now.

Stand-alone packages for Windows 7 SP1 and Windows Server 2008 R2 SP1

The following files are available for download from Windows Update.

Operating system	Update
All supported x86-based versions of Windows 7 SP1	Download the package now.
All supported x64-based versions of Windows 7 SP1	Download the package now.
All supported x86-based versions of Windows Server 2008 R2 SP1	Download the package now.
All supported x64-based versions of Windows Server 2008 R2 SP1	Download the package now.
All supported Itanium-based versions of Windows Server 2008 R2 SP1	Download the package now.

More details:

https://support.microsoft.com/en-us/kb/949104

Otherwise:

To obtain version 7.4.7600.226 of the Windows Update Agent, click one of the following links as appropriate for the operating system: 

• x86-based versions of Windows

  Download the WindowsUpdateAgent30-x86.exe package now.

  x64-based versions of Windows

  Download the WindowsUpdateAgent30-x64.exe package now.

  Itanium-based versions of Windows

  Download the WindowsUpdateAgent30-ia64.exe package now.

Release Date: Thursday, September 24, 2009

More details:

https://support.microsoft.com/en-us/kb/946928

2008/2012 - Read-Only Domain Controller (RODC)

From this Veeam article I copy and past some parts that quickly explain 2008/2012 RODC Feature:

http://www.veeam.com/blog/read-only-domain-controller-rodc-configuration-active-directory-best-practices.html

Traditional, old-school, writable domain controllers are deployed at ROBO sites so IT admin can resolve application performance. See Figure 1. This practice prevents authentication traffic from traversing the WAN (wide area network) and delays in response times. As a result, things look and feel just like the customer is seated at the main headquarters location. Unfortunately, this practice creates huge security vulnerabilities! Imagine if an unwanted, mischievous user gains physical or virtual access to the network, bidirectional replication would allow this guest to make changes that could severely impact the ENTIRE AD (active directory) forest.

A good resolution it could be the following:

In Windows Server 2008, Microsoft introduced the concept of a Read-Only Domain Controller (RODC), this allows IT to deploy AD Domain Services remotely at branch offices, without having the security worries that traditional writable domain controllers present. See Figure 2. RODCs offer inbound, *unidirectional replication and maintain a local read-only copy of all AD data and the SYSVOL folder. This benefits IT greatly because:

• It mitigates and helps remove replication concerns if a mischievous guest user gains physical or virtual access to the infrastructure
• It prevents accidental deletion of AD objects and/or the SYSVOL by admin within the branch office
• It prevents rogue applications, such as a virus, malware, spyware, from making changes to the AD schema.

*For more on Read-Only domain controllers, unidirectional replication and their benefits, visit: Microsoft TechNet.

Windows Server 2012 and higher versions simplify the deployment process by leveraging Server Manager instead of the deprecated DCPromo utility. After installing the basic AD domain services, you will immediately be prompted to take additional steps if you require the server (a VM) to become a domain controller.

Once you click Promote this server to a domain controller and choose Add to an existing forest, you'll check the checkbox called Read only domain controller (RODC) to promote the DC to a RODC

Wsus - How to migrate WSUS server on Windows 2003 mantaining same settings

If you want to migrate WSUS server from a server to another mantaining same settings here is relative procedure.

At first here is Microsoft article to install it on a 200x server.

https://technet.microsoft.com/en-us/library/cc708484(v=ws.10).aspx

About Windows Server 2012, Windows Server 2012 R2

https://technet.microsoft.com/en-us/library/cc708484(v=ws.10).aspx

After you installed wsus you set up new WSUS server be a replica of old WSUS server:



Start synchronization and download.

When it finished you need to disable synchronization:



Then you need to install on both servers this tool:

WSUS 3.0 API Samples and Tools

http://go.microsoft.com/fwlink/?LinkId=94784

http://www.microsoft.com/en-us/download/details.aspx?id=1172

- On old Server you need to go to 

C:\Program Files\Update Services 3.0 API Samples and Tools\WsusMigrate\WsusMigrationExport 

wsusmigrationexport.exe settings.xml

- Copy that file to new server at this path:

C:\Program Files\Update Services 3.0 API Samples and Tools\WsusMigrate\WsusMigrationImport

e dare il comando:

wsusmigrationimport.exe settings.xml All None

Then you need to recreate same settings, approval rule like old WSUS server.


[update 2015.13]

I had Drive corruption on WSUS drive where db and packages was downloaded.

It was impossible to remote WSUS and reinstall it, the only solution it was utilizing this Microsoft article

https://technet.microsoft.com/en-us/library/dd939818(v=ws.10).aspx

To uninstall Windows Internal Database

1. Open a command prompt.
2. Type msiexec and the following key for the operating system platform:
   • For 32-bit platforms, use:
     msiexec /x {CEB5780F-1A70-44A9-850F-DE6C4F6AA8FB} callerid=ocsetup.exe
   • For 64-bit platforms, use:
     msiexec /x {BDD79957-5801-4A2D-B09E-852E7FA64D01} callerid=ocsetup.exe

%SystemDrive%\Program Files\Update Services\Tools\WsusUtil.exe reset

==============================================================

Related articles:

Server - WSUS 3.0 SP2 and Windows 8/2012 Server issue

WSUS - errors 800B0001 on clients from 2008/2012 server with Wsus role

Wsus - Update to enable WSUS support for Windows 10 feature upgrades KB3095113

Wsus - Windows 10 problem and Update enables ESD decryption provision in WSUS in Windows Server 2012 and Windows Server 2012 R2

Microsoft - how to restore single user with AdRestore Sysinternal Utility

If you are in following scenarios:

    - User accounts, groups, computers, OUs or other objects in domain accidentally deleted.
    - No system state backup available for authoritative restoration.
    - No other DC's available.

Consider that when an object is deleted from Active Directory, it isn't actually removed but is instead marked as deleted by an internal marker called a tombstone.

You can verify Tombstone with following article:

http://technet.microsoft.com/it-it/library/cc784932%28v=ws.10%29.aspx


Consider that you can follow this articlet

How to restore deleted user accounts and their group memberships in Active Directory 

But an easily alternative would be ADrestore Utility:

http://technet.microsoft.com/en-us/sysinternals/bb963906.aspx 

After you installed ADRestore, you can restore an object by running
the command.

Before to restore any user you can launch adrestore utility and you will prompted about all object deleted during tombstone period.

Indeed following command:

ADRestore –r

ADRestore removes the 'isDeleted' TRUE attribute from tombstoned accounts and changes the RDN back to the previous path, effectively resurrecting it.
 
Consider that -r tells ADRestore to prompt the user before restoring the AD objects
to their original location.

Microsoft - Determine the tombstone lifetime for the forest

It's important know Tombstone value about your forest/domain in case you need to restore single user/Ou and so on with ADrestore.Exe utility (take a look to following blog article)

http://technet.microsoft.com/it-it/library/cc784932%28v=ws.10%29.aspx

Applied Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2, Windows Server 2008, Windows Server 2008 Foundation, Windows Server 2008 R2, Windows Server 2008 R2 Foundation, Windows Server 2012

The tombstone lifetime in an Active Directory forest determines how long a deleted object (called a “tombstone”) is retained in Active Directory Domain Services (AD DS). The tombstone lifetime is determined by the value of the tombstoneLifetime attribute on the Directory Service object in the configuration directory partition.
You can use this procedure to determine the tombstone lifetime for the forest.
Membership in Domain Users, or equivalent, is the minimum required to complete this procedure.

More details:

Gruppi predefiniti locali e di dominio 

(http://go.microsoft.com/fwlink/?LinkId=83477).

To determine the tombstone lifetime for the forest using ADSIEdit

1. Click Start, point to Administrative Tools, and then click ADSI Edit.
   
2. In ADSI Edit, right-click ADSI Edit, and then click Connect to.
   
3. For Connection Point, click Select a well known Naming Context, and then click Configuration.
   
4. If you want to connect to a different domain controller, for Computer, click Select or type a domain or server: (Server | Domain [:port]). Provide the server name or the domain name and Lightweight Directory Access Protocol (LDAP) port (389), and then click OK.
   
5. Double-click Configuration, CN=Configuration,DC=ForestRootDomainName, CN=Services, and CN=Windows NT.
   
6. Right-click CN=Directory Service, and then click Properties.
   
7. In the Attribute column, click tombstoneLifetime.
   
8. Note the value in the Value column. If the value is , the value is 60 days.
   

To determine the tombstone lifetime for the forest using Dsquery

1. Open a Command Prompt window. To open a command prompt, click Start, click Run, type cmd, and then press ENTER.
   
2. At the command prompt, type the following command, and then press ENTER:
   
   dsquery * "cn=directory service,cn=windows nt,cn=services,cn=configuration,
   dc=" –scope base –attr tombstonelifetime
   

   Be sure to replace with the actual distinguished name of the forest. For example, if your forest name is corp.proseware.com, type the following, and then press ENTER:
   
   dsquery * "cn=directory service,cn=windows nt,cn=services,cn=configuration,dc=corp,
   dc=proseware,dc=com" –scope base –attr tombstonelifetime
   

[update 2017.05.17]

From veeam article that explain how to recover deleted AD object using Veeam 

https://www.veeam.com/blog/reanimating-active-directory-tombstone-objects-best-practices-for-ad-protection.html

Here they are some articles parts:

Once the Active Directory object is deleted, it is not hard deleted from a system. As you may know, Active Directory makes the object hidden by changing its attribute isDeleted to TRUE value. Then, it drops most of the objects’ attributes, renames the object, and moves it to a special container (CN=Deleted Objects). From now on, the object has a tombstone status, and standard Active Directory utilities don’t see its presence. Then, the object is conserved within this special state for a lifetime period (60 days for Windows Server 2000/2003 and 180 days for Windows 2003 SP1/2008).  This is to ensure that the information about removal was successfully replicated across the system. Once the tombstone lifetime period is over, a special process called garbage collector physically removes the object from the database.

Here comes the question. If the tombstone object was not physically deleted within a certain amount of time, would it be possible to recover (reanimate) it? The short answer is yes. 

Server - Reset the DSRM Administrator Password

When you execute AD backup, with any Backup utility, during AD restore procedure you will be prompted about Domain Controller password creation.

So, if you have lost this password, you are unable to restore AD.

Here is relative procedure to reset this password before disaster:

Oritinal Technet Article:

http://support.microsoft.com/kb/322672/en-us 

<---------->

This article describes how to reset the Directory Services Restore Mode (DSRM) administrator password for any server in your domain without restarting the server in DSRM. Microsoft Windows 2000 uses the Setpwd utility to reset the DSRM password. In Microsoft Windows Server 2003, that functionality has been integrated into the NTDSUTIL tool. Note that you cannot use the procedure that is described in this article if the target server is running in DSRM. A member of the Domain Administrators group sets the DSRM administrator password during the promotion process for the domain controller. You can use Ntdsutil.exe to reset this password for the server on which you are working, or for another domain controller in the domain.

To Reset the DSRM Administrator Password

1. Click, Start, click Run, type ntdsutil, and then click OK.
2. At the Ntdsutil command prompt, type set dsrm password.
3. At the DSRM command prompt, type one of the following lines:
   • To reset the password on the server on which you are working, type reset password on server null. The null variable assumes that the DSRM password is being reset on the local computer. Type the new password when you are prompted. Note that no characters appear while you type the password.
     
     -or-
   • To reset the password for another server, type reset password on server servername, where servername is the DNS name for the server on which you are resetting the DSRM password. Type the new password when you are prompted. Note that no characters appear while you type the password.
4. At the DSRM command prompt, type q.
5. At the Ntdsutil command prompt, type q to exit.

APPLIES TO

• Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
• Microsoft Windows Server 2003, Standard Edition (32-bit x86)
• Microsoft Windows Small Business Server 2003 Premium Edition
• Microsoft Windows Small Business Server 2003 Standard Edition
•  
•  

<------->

About Other Server and O.S. you can follow this article too:

http://technet.microsoft.com/en-us/library/cc754363.aspx

Applies To: Windows 8, Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2008, Windows Server 2012

Tips - Transform trial Windows version to RTM

If you need to transfort your evaluation windows to RTM here are relative commands:

1. Check the version installed:
 
DISM / online / Get-CurrentEdition

If you want to verify that version can upgrade the system:
 
DISM / online / Get-TargetEditions

To upgrade you need to type:
 
DISM / online / Set-Edition: ServerVersion / ProductKey: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX / AcceptEula

[from http://epansecco.net/2014/10/21/windows-server-2012-r2-da-evaluation-version-a-rtm/]