Microsoft released a KnowledgeBase article titled “ADDSDeployment module with the -Whatif argument shows incorrect DNS results”

This KnowledgeBase article describes unexpected behavior in the PowerShell Cmdlets within the ADDSDeployment PowerShell module when you use the -WhatIf argument without specifying the -installdns argument.

The situation

When you use one of the PowerShell Cmdlets from the Windows PowerShell ADDSDeployment module (notably Install-AddsForest, Install-AddsDomain or Install-AddsDomainController with the -WhatIf argument, incorrect results are displayed for the output for a Domain Name System (DNS) server.

For example, when you use the following PowerShell line:

Install-ADDSForest –WhatIf –DomainName corp.domain.tld SafeModeAdministratorPassword: Secr3ts4All

The output would look like:

What if: Create a new Active Directory forest with the name 'corp.domain.tld'. Configure this server as the first Active Directory domain controller in a new forest. The new domain name is "corp.domain.tld". This is also the name of the new forest.

The NetBIOS name of the domain: Automatically calculated
Forest Functional Level: DefaultDomain
Functional Level: Automatically calculated
Additional Options: Global catalog: Yes DNS Server: No Database folder: C:\Windows\NTDS Log file folder: C:\Windows\NTDS SYSVOL folder: C:\Windows\SYSVOL

The password of the new domain Administrator will be the same as the password of the local Administrator of this computer.

Notice in this output that the entry for DNS Server is No. Despite this output, the DNS server is installed and configured as expected when the forest is created.

What really happens

The promotion process calculates a DNS server installation automatically if you do not specify the -installdns:$true or -installdns:$false arguments. However, the -whatif output is not displayed correctly when you don’t specify the -installdns argument. The output is correct only when the -installdns argument is explicitly specified.

Despite the output when the -installdns argument is not specified, the following actions regarding installing DNS Servers are true:

For a new forest, DNS server is always configured.
For a new domain or for an additional domain controller in an existing domain, the DNS server is configured if the domain or parent domain Start of Authority (SOA) records are hosted in an existing Active Directory Domain Services (AD DS) zone.

Related blogposts

I’ll be presenting at Objectives 2012, the Dutch Windows 8 and Windows Server 2012 Partner Launch Event

Concluding

When sizing Windows Server 2012-based Domain Controllers, use the information on TechNet to perform capacity planning for Active Directory Domain Services.

Related Downloads

Active Directory Sizer

The situation

On Windows Server 2008 R2 and Windows Server 2012-based Domain Controllers, after a reboot, you encounter the following two error events in the System log:

The cause

This can occur if the Netlogon (netlogon) service is not explicitly started before the Windows Time (W32Time) service is started. In both Windows Server 2008 R2 and Windows Server 2012, the Windows Time (W32Time) service is not marked as a dependency for the Netlogon (netlogon) service.

The resolution

You can safely ignore these errors, as the Windows Time (W32Time) service will attempt to start again if it does not start the first time.

In this series

Active Directory in Hyper-V environments, Part 1
Active Directory in Hyper-V environments, Part 2
Active Directory in Hyper-V environments, Part 3
Active Directory in Hyper-V environments, Part 4
Active Directory in Hyper-V environments, Part 5
Active Directory in Hyper-V environments, Part 6

Designing and implementing an Hyper-V environment can be challenging. Placement of Active Directory Domain Controllers requires additional consideration, especially in Hyper-V Failover Cluster scenarios where Active Directory membership for the cluster nodes is strictly needed.

Windows Server 2012, in Active Directory terms, is a big step forward. We’ve been over the majority of the new features in Active Directory Domain Services on this blog before, so now it’s time to talk about the implications on support policies.

In this blog post, I’ll discuss the newly supported setups in terms of Hyper-V Failover Clustering, beyond the need to apply the hotfix from KnowledgeBase article 2784261, as discussed in Part 7 of this series.

Active Directory Domain Services and Failover Clustering

Failover Cluster nodes require Active Directory membership. In environments without Domain Controllers and/or extra physical iron to place Domain Controllers onto, this poses a challenge.

The old guidance

Microsoft has advised against re-using Failover Cluster nodes as Domain Controllers for years. Their official stance was:

It is not recommend to combine the Active Directory Domain Services role and the Failover Cluster feature.
It is not supported for a Failover Cluster running Microsoft Exchange Server or Microsoft SQL Server to be a Domain Controller.
It is recommended to leave at least 1 domain controller on bare metal when deploying domain controllers inside of virtual machines.

4 years ago, I kicked off this series with a blog post with the recommendation to not re-use Hyper-V Failover Cluster nodes as Domain Controllers from both an architectural and performance point of view. While this blogpost offers a workaround for the third recommendation above, my recommendations have been identical to Microsofts.

These recommendation still apply largely to the Windows Server Operating Systems of those days. However, with Windows Server 2012, Microsofts recommendations have changed and I feel it’s time to review my recommendations.

The updated guidance

Now, in KnowledgeBase article 281662, Microsoft updates the above guidance with information on Windows Server 2012. The Windows Server 2012-specific changes are listed below:

It is not supported to combine the Active Directory Domain Services role and the Failover Cluster feature on Windows Server 2012
It is no longer recommended to leave at least 1 domain controller on bare metal when deploying domain controllers inside of virtual machines in Windows Server 2012.

AD DS Role and Failover Cluster Feature no longer supported

While combining the Active Directory Domain Services Server Role and Failover Clustering Server Feature on one host have not been recommended in Windows Server 2003, Windows Server 2003 R2, Windows Server 2008 and Windows Server 2008 R2, it is now no longer supported.

Now, don’t misinterpret the above. You can still install the Failover Clustering Server Feature on an existing Windows Server 2012-based Domain Controller. The change in guidance is not reflected in Server Manager. However, if you want to add an existing Domain Controller to a Failover Cluster as a cluster node, the configuration will not pass the Cluster Validation:

Now, as you might be aware, if a configuration doesn’t pass the Configuration Validation, Microsoft will not offer support on it. In the help file for Failover Clustering, Microsoft states:

Microsoft support of Failover Cluster Solutions
Microsoft support a failover cluster solution only if it meets the following requirements:
All hardware components in the failover cluster solution are certified for Windows Server 2012. For more information, see Requirements and Steps for Creating a Failover Cluster or Adding a Node.

The complete cluster configuration (servers, network, and storage) can pass all tests in the Validate a Configuration Wizard. For more information, see Failover Cluster Validation Tests.

The hardware manufacturers’ recommendations for firmware updates and software updates have been followed. Usually, this means that the latest firmware and software updates have been applied.
Occasionally, a manufacturer might recommend specific updates other than the latest updates.

Note:
In Windows Server 2008 and Windows Server 2008 R2, the configuration would pass the Cluster Validation.

Bare metal Domain Controller recommendation

In previous versions of Windows Server, the Cluster Service (clussvc) communicated with Active Directory to gather information on the Cluster object when starting. The implication is, the Failover Clustering Service and all the highly available workloads on top if wouldn’t start when an Active Directory Domain Controller is not available: All VMs would not be started after a site-wide power failure when the Domain Controllers would run on top of the Hyper-V platform as highly-available VMs…

In Windows Server 2012, the Cluster Service (clussvc) still attempts to communicate with a Domain Controller when it starts, but when it doesn’t find one, it will start and try to communicate with Active Directory later. This way, the dependency on Active Directory Domain Controllers outside of the cluster is taken away. This feature is known as Active Directory-less Cluster Bootstrapping.

Concluding

Two of the guidance points for Active Directory in Hyper-V Failover Cluster environments have been changed with Windows Server 2012.

You can no longer re-use a Domain Controller as the parent partition of a Hyper-V Cluster node in a supported way. This configuration is no longer officially supported by Microsoft.

Active Directory-less Cluster Bootstrapping eliminates the need for communicating with a Domain Controller for a Failover Cluster node’s Cluster Service at startup, before it can bring its highly-available resources online.

Concluding

Today, in Windows Server 2012, Microsoft has changed rebooting into Directory Services Restore Mode and has made it far easier. Note, however, that easier in this case does not mean more straightforward.

The situation

In Windows Server 2012, you try to:

Configure a new Domain Controller by using Server Manager and the Active Directory Domain Services Configuration Wizard
Configure a new Domain Controller using the Install-ADDSForest, Install-ADDSDomain, or Install-ADDSDomainController PowerShell Cmdlets from the AddsDeployment Windows PowerShell module
Remove Active Directory Domain Services from an existing Domain Controller by using Server Manager and the Active Directory Domain Services Configuration Wizard
Remove Active Directory Domain Services from an existing Domain Controller by using the Uninstall-ADDSDomainController PowerShell Cmdlet from the AddsDeployment Windows PowerShell module
Clone a virtualized Domain Controller by using dccloneconfig.xml

The configuration change fails, and you receive an error, stating that the service cannot be started, either because it is disabled or because it has no enabled devices associated with it:

When you try and perform the actions above through PowerShell, you receive the following error:

The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

Additionally, you see that C:\Windows\Debug\dcpromoui.log contains the following line of text:

Enter GetErrorMessage 80070422

The cause

This error occurs because a policy or an administrator prevents the DS Role Server service (DsRoleSvc) from starting. A common configuration is to disable the service:

Note:
This does not occur because of the Security Configuration Wizard (scw.exe). Although the Security Configuration Wizard offers security configuration and is capable of service lockdown through Group Policies, based on current roles and services, installed on a reference server the DS Role Service is not affected by it.

The resolution

The KnowledgeBase article states to simply enable the service by setting its startup type to manual, either in the Services MMC Snap-in (services.msc) or by issuing the following command on an elevated command prompt:

sc.exe config dsrolesvc start= demand

Pre-Windows Server 2012

If you wanted to prevent Domain Controller promotions in Windows 2000 Server, Windows Server 2003 (R2) and Windows Server 2008 (R2) environments, you’d use on these methods:

Limiting membership of the Domain Admins group.
Use Delegation of Control to prevent people from creating computer objects in the Domain Controllers Organizational Unit (OU).

     Note:
     This is a quick fix, that I’ve seen applied a couple of times, but should really be
     part of a broader Delegation of Control and ACL’ing inside Active Directory, based
     on the information here.
Modify the NTFS Access Control List (ACL) on dcpromo.exe through your (virtual) server installation template and/or Group Policy Preferences.
Create IPSec rules for Replication traffic between known Domain Controllers, preventing new Domain Controllers from replicating.

Preventing Domain Controller demotions, however, is a different story. Even if you’re able to prevent it using the methods above, a rogue admin can still demote the server using dcpromo.exe /forceremoval…

Note:
Domain Controller cloning is not available in previous versions of Windows Server, prior to Windows Server 2012.

Windows Server 2012

Now, in Windows Server 2012, all of the methods above still work, although method 3 would not achieve much, since dcpromo.exe merely exists for legacy scripting.

Note:
Domain Controller promotions are now performed using the Install-ADDSDomainController, Install-ADDSDomain and Install-ADDSForest PowerShell Cmdlets, while demotions are now performed with Uninstall-ADDSDomainController.

Instead, a separate Service has been created to perform Domain Controller promotions, cloning and demotions. In Windows Server 2012, all these actions are performed by the DS Role Server Service (dsrolesvc).

Through Group Policy, this service can be set to disabled:

Additional security can be added by clicking the Edit Security… button and specifying who has Full, Write, Delete, Read and/or Start, stop and pause access. This way, the (group of) people able to promote, demote and clone Domain Controllers can be defined.

Note:
Since a Windows Server 2012-based Active Directory environment has NTLM authentication disabled by default, proposed Windows Server 2012-based Domain Controllers need to be joined to the domain, before they can be promoted to Domain Controllers.
Note:
When the Active Directory forest is operated on the Windows Server 2012 Forest Functional Level (FFL), the promotion of pre-Windows Server 2012 Domain Controllers will be unavailable.

Now, of course, since we’re using Group Policies, we’ll also need to look at the security of the Group Policy itself. The Group Policy Management Console (GPMC) should be your tool of choice here, too. Locate the Group Policy you’ve created earlier under the Group Policy Objects node in the left pane and click on the Delegation tab in the right pane. Next, click the Advanced… button in the bottom right corner.

When you apply the Group Policy, make sure the link between the Group Policy and the Organizational Unit (OU), Active Directory site or Active Directory domain is Enforced, when admins have the ability to create other (disagreeing) Group Policies on lower levels.

Note:
In the Group Policy Management Console, you can define who can create Group Policy Objects. By default, the Domain Admins and Group Policy Creator Owners will have these permissions. These permissions can be changed on the Delegation tab of the Group Policy Objects node.

With the Group Policy in place, we can utilize our 3rd party auditing solution to monitor changes to this Group Policy itself and new computer objects in the Domain Controllers Organizational Unit (OU).

Concluding

In Windows Server 2012, Active Directory admins gain an important new tool to restrict Domain Controller promotions, demotions and cloning: the DS Role Server Service (dsrolesvc).

When combining strict access to starting this service and the methods already available from before, a Security admin has full control over its servers operating as Domain Controllers.

What’s New

Service Pack 1 for System Center 2012 is not just a maintenance release, it also includes a lot of new features:

Concluding

With new functionality in new Operating Systems and Active Directory levels, don’t expect the old tooling you’ve learned to trust and love, to be updated.

Preventing OUs and Containers from Accidental Deletion

The situation

When you use the Detect Now button, you might continually see an error on the Status tab, stating that Domain Controllers report ‘replication in progress’ as in the screenshot below:

Additionally, when you examine the system volume (SYSVOL) shares on the domain controllers in the environment, you notice that administrative template (ADM) files are not present in the system volume (SYSVOL) shares on the domain controllers, except on the Domain Controller holding the Primary Domain Controller (PDC) emulator Flexible Single Master Operations (FSMO) role.

The cause

Additional examination shows that SYSVOL was previously configured by an administrator to filter out ADM files in order to minimize the size of system volumes on Domain Controllers and/or reduce the number of files and amount of data that must be replicated between Domain Controllers, as described in Microsoft KnowledgeBase article 813338.

The GPMC Infrastructure Status option does not examine files in SYSVOL by type or capability and does not follow customized File Replication Service (FRS) or Distributed File Service Replication (DFSR) filtering rules. Any file count, hash, or security differences in the SYSVOL Policies folder contents between domain controllers are flagged as "replication in progress."

This behavior is by design.

The workaround

There are several ways to work around this behavior:

If your environment no longer contains Windows XP client, Windows Server 2003 Member servers, Windows Server 2003 Domain Controllers or domain-joined earlier versions of Windows and Windows Server, and you haven’t created or imported non-Microsoft custom ADM files, you can delete the existing ADM files from the System volume (SYSVOL) on the Domain Controller holding the Primary Domain Controller (PDC) emulator Flexible Single Master Operations (FSMO) role.

Depending on your needs you can create a centralized ADMX store together with filters or use local copies of ADMX files (This is the default behavior.)

If the error on the Status tab bothers you in environments that still contain Windows XP and Windows Server 2003 member servers, you can switch to another tool to check for replication status (do not use gpotool.exe) or remove the previously applied filters, and let ADM files replicate to all Domain Controllers.

Do Not Display Last User Name

Microsoft offers a couple of Group Policy settings you can use to change the default Logon Screen. They are located in Computer Configuration, under Windows Settings, Security Settings, Local Policies, Security Options:

Some of these have been around for a long time, like the Interactive logon: Do not display last user name group policy setting.

The setting can be applied to Organizational Units, containing computer accounts. With the right Organizational Unit structure, it can be applied to presentation PCs, but not to normal desktops, to accommodate users in their personal computing experience, where appropriate.

Windows Vista and Windows 7

In Windows Vista and Windows 7, when you apply this Group Policy setting, the Logon Screen, by default, will display an empty avatar and the two common fields to enter credentials. (among other options) It looks like this on Windows 7:

Windows 8

In Windows 8, the Logon Screen has changed. Its fields are enlarged to accommodate selection by touch. You will still find the options to enable accessibility options, change the keyboard layout and turn off the PC and the two input fields:

But, one large difference between the logon screen in Windows 7 and Windows 8 is the label above the input fields: The Windows 7 Logon Screen does not display a label, where the Windows 8 Logon Screen suddenly describes your Logon attempts as attempts to log on as an Other user.

In Windows Server 2012, the same label is given to logon attempts when the Interactive logon: Do not display last user name Group Policy setting is applied.

This can be really confusing for users and admins, so Microsoft has decided to publish a KnowledgeBase article, describing the label as ‘by design’…

Related blogposts

Five must-have Group Policy settings to make people productive with Windows 8 on day 1
Five must-have Group Policy settings to create an uniform look for your Windows 8 clients
Five must-have Group Policy settings when your colleagues use 3G / 4G connections
Five must-have Group Policy settings to protect peoples privacy in Windows 8 and IE 10

SCOM Meets AD On October 6, 2011 I wrote about the updated Active Directory Domain Services Management Pack for System Center. Then, it was updated to version 6.0.7670.0. Today, I want to point you to another big update for the Active Directory Domain Services Management Pack for System Center: the 6.0.8070.0 update

About System Center Operations Manager

With Microsoft System Center Operations Manager (SCOM) you can leave the monitoring and alerting to software in a confident, fast and robust way. Now you can simply create an availability or replication bandwidth report by pressing a single button. No longer do you have to follow tedious routines to check up on your servers: The products in the System Center were created to do those things for you. Before Operations Manager became a part of the System Center family, it was known as Microsoft Operations Manager (MOM).

System Center Operations Manager (SCOM) comes with the basic set of monitoring tools to monitor Windows Servers. These basic monitoring capabilities can be extended using Monitoring Packs for specific Server Roles and Server Products. Even more, Operations Manager features an extensibility framework to allow any 3rd party developer to write Monitoring Packs. Packs have been written to manage UPS’s and even Linux hosts. Of course, monitoring is of little use in big environments with repeating errors, so System Center Operations Manager is designed to work together with the other members of the System Center family of products, like System Center Configuration Manager (formerly known as SMS Server) and System Center Orchestrator (formerly known as Opalis).

About the Active Directory Monitoring Pack

Active Directory Domain Services is a Server Role in Windows Server and Microsoft has deemed it fit to have its own Monitoring Pack. Even more, Microsoft has dedicated valuable time to actively maintain the Monitoring Pack for Active Directory.

Update

The version of the Active Directory Monitoring Pack, released on January 17th, 2013, is 6.0.8070.0 and is the seventh version of the Monitoring Pack since it’s original version (6.0.5000.0).

This update is conveniently referred to as the December 2012 revision.

What’s new in this release?

This release focuses fixing problems reported by customers. The accompanying guide mentions:

Added Windows Server 2012 Support
Product Knowledge improvements

Client Monitoring alerts identify problematic Domain Controllers in the description.
Inter-domain trust alert identifies which trust is broken in the alert description.
More specific action recommendations added to alert for “Could not determine FSMO role holder” and alert for “Domain Controller’s Ops Master is inconsistent.”
KnowledgeBase article information added to alert for “The Active Directory database is corrupt.”
KnowledgeBase article information added to alert for “Two replication partners have an inconsistent view of the FSMO role holders.”
Some rules with names that begin “Client Side script…“ but were not actually executed by client-side monitors were renamed.
More specific action recommendation added to description for Event ID 1000.

Excessive alert fixes

A duplicate alert that appears when a computer authentication fails was removed.
Repetitive alerts for UserEnv and Netlogon were replaced with a single alert that includes a count of the number of occurrences.
The alert for the number of allowable replication partners was increased from 100 to the maximum number of replication connections.
The alert of FSMO role holder availability was refined so that it is issued less frequently in cases where operations master role holder is temporarily unavailable.
Active Directory processor overload monitor was removed because it duplicates an existing monitor in the operating system management pack.
Duplicate alerts for KDC errors and trust verification failures were removed.
Informational alert was disabled for rule “The default security settings for the NTFS file systems have not been applied to Active Directory directory folders.”

Script error fixes

Multiple script errors were fixed to improve Active Directory site topology discovery, DNS verification, operation master role discovery, and other improvements.

Rule error fixes

Multiple rule errors were fixed to improve error handling, event logging, and server state reporting.

Download

You can download the update here.

About TechDays NL 2013

TechDays is an international series of Microsoft events, hosted by Microsoft subsidiaries around the world. Microsoft Netherlands, this year, has decided to make the event a 2-day event, filled with both IT Professionals and Developers content.

logo-techdays-2013 Together with the Belgian subsidiary, which is running the Belgian TechDays event on March 6 and March 7, 2013 at the Kinepolis filmtheatre in Antwerpen, Microsoft Netherlands has arranged for several highly rated international speakers, like John Craddock, Bryon Surace, Chris Jackson, Daniel Pearson,Johan Arwidmark, Vijay Tewari and Paula Januszkiewicz to present sessions, next to our own heroes Maarten Goet, Ronald Beekelaar, Ruben Spruijt, Steven van Houttum, Jeff Wouters, Kenneth van Surksum, Roel van Bueren and Alex De Jong.

About my session

My session, titled ‘Two of a kind: Virtualization-safe Active Directory & DC Cloning’ is a one-hour session on Active Directory Domain Services in Windows Server 2012. Specifically, I will be explaining and demoing the way Active Directory Domain Services leverage VMGeneration-ID to prevent problems commonly associated with reverting snapshots, like USN Rollbacks and Lingering Objects, and how organizations benefit when deploying Windows Server 2012-based Domain Controller virtually.

My session is planned in the first timeslot of the event, on March 7, 2013 between 9:15 AM and 10:30 AM.

Will I see you there?

Related blogposts

New features in AD DS in Windows Server 2012, Part 13: Domain Controller Cloning
New features in AD DS in Windows Server 2012, Part 12: Virtualization-safe Active Directory

Version History

Posted on blogs.dirteam.com on January 22, 2013

Related Blogposts

New features in AD DS in Windows Server 2012, Part 13: Domain Controller Cloning
New features in AD DS in Windows Server 2012, Part 12: Virtualization-safe Active Directory

The situation

What really happens

Related KnowledgeBase articles

Related Posts

Further reading

Related blogposts

Further reading

What’s new in Active Directory Domain Services in Windows Server 2012

Further reading

Why not use Active Directory-based Activation

Stick with Key Management Services (KMS)

Related KnowledgeBase article

Related Posts

Concluding

Related KnowledgeBase Articles

Related Downloads

Further reading

The situation

The cause

The resolution

Related KnowledgeBase articles

In this series

Related KnowledgeBase articles

Further reading

Further Reading

Related events

Active Directory Domain Services and Failover Clustering

The old guidance

The updated guidance

AD DS Role and Failover Cluster Feature no longer supported

Microsoft support of Failover Cluster Solutions

Bare metal Domain Controller recommendation

Concluding

Further reading

Related KnowledgeBase articles

Related posts

Concluding

Further reading

Related Posts

About the DS Role Server service

The situation

The cause

The resolution

Related KnowledgeBase articles

Pre-Windows Server 2012

Windows Server 2012

Concluding

Further reading

Related Posts

Further reading

Related Posts

What’s New

Further reading

Concluding

Related Posts

Further reading

The situation

The cause

The workaround

Related KnowledgeBase articles

Further reading

Do Not Display Last User Name

Windows Vista and Windows 7

Windows 8

Related KnowledgeBase articles

Related blogposts

About System Center Operations Manager

About the Active Directory Monitoring Pack

Update

What’s new in this release?

Download

Further reading

About TechDays NL 2013

About my session

Related blogposts

Further reading

Version History

Related Blogposts

Further reading