Cross-forest Certificate Enrollment

When deploying Cross-forest Certificate Enrollment with Windows Server 2008 R2, one of the steps is to add the issuing CA to the "Cert Publishers" group in the domains which will be auto-enrolling with the new CA.  Ran into a small issue at a client in which that wasn't possible because the "Cert Publishers" group was a domain global group, which can only contain members from the domain in which the group exists.

To get around this, you have to modify the "Cert Publishers" group to be a domain local group.  This is the default for all domains created as Windows Server 2003 or new, but for Windows 2000 domains, it was created as a domain global group.  This design change is detailed in this KB article.

The UI does not allow you change the group scope for this group; changing the scope can still be done with dsmod.  Use the following syntax:

dsmod group <DN of Cert Publishers Group> -scope l

For example:

dsmod group "CN=Cert Publishers,CN=Users,DC=domain,DC=com" -scope l

Full details on using dsmod to change the scope can be found here.

Re-installing Network Clients/Servers from the Command Line

On Monday, I was helping a client work through their planning and testing of a Novell to Microsoft migration. One of the issues in their environment is that "Client for Microsoft Networks" and "File and Print Sharing for Microsoft Networks" had both been uninstalled from all of their workstations. Not disabled, uninstalled. Without them, joining the domain and other migration processes weren't going to happen. I spent some time looking for a method of remotely installing those pieces to avoid the client having to go around to each workstation and install them. I ended up finding a great solution that did exactly what we needed (and worked) and was feeling like a genius. My genius was fleeting as moments later I learned a co-worker not more than 15 feet away on the other side of a cubicle wall knew all about my "solution" and had been using it for years at other clients and projects.

In any event, I thought it was worthwhile enough to capture and post. The solution conisists of two Microsoft provided utilities that are well hidden and documented even less, snetcfg.exe and snetcfg_wxp.exe. One is for XP and the other for 2000. I'll let you figure out which is which...

JSI FAQ has the details on the utility and the various command line switches for the Windows 2000 version here. As far as I can tell, the switches are the same for the XP version. Also note that the link to the XP version on the JSI FAQ page is incorrect, it links to the Windows 2000 version. Use the link in the paragraph above to get it.

Changing the Windows GINA

Ran into a Novell to Microsoft migration case where the client wants to leave the Novell client on the Windows XP workstations to allow access to non-migrated volumes, but wants the user to have the Microsoft GINA for login. When all the volumes are migrated, then the client will be removed or the workstation will be reimaged. The change itself is simple is relatively simple. To replace the Novell GINA with the Microsoft GINA, edit the registry under the following key:

HKEY LOCAL MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

Change the data value GinaDLL from "NWGINA.DLL" to "MSGINA.DLL" (without the quotation marks). This changes the GINA, but the Novell client still prompts for authentication to Novell after you log in to the Windows GINA. To stop that, you need to make a change to this registry key:

HKEY LOCAL MACHINE\SOFTWARE\Novell\Network Provider\Initial Login

Add a string value called Login when NWGina Not Loaded (unless it already exists of course) and set the value to "no". You'll find that you still get a nice Novell splash screen and we don't want that! To turn it off, you'll need to make a change to this registry key:

HKEY LOCAL MACHINE\SYSTEM\CurrentControlSet\Services\NetWareWorkstation\Parameters

Add a dword value called NoLogoDisplay (unless it already exists) and set the value to 1. Finally, if you don't want the big red N in the tray, you'll need to remove the NWTRAY value from the following registry key:

HKEY LOCAL MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

And now the Novell client is fully "disabled". You can still log on to Novell by going to the Programs - Novell and logging in from there.

AD Explorer v1.0

A nice Microsoft/Sysinternals provided AD utility to have handy. From Microsoft:

Active Directory Explorer (AD Explorer) is an advanced Active Directory (AD) viewer and editor. You can use AD Explorer to easily navigate an AD database, define favorite locations, view object properties and attributes without having to open dialog boxes, edit permissions, view an object's schema, and execute sophisticated searches that you can save and re-execute.

AD Explorer also includes the ability to save snapshots of an AD database for off-line viewing and comparisons. When you load a saved snapshot, you can navigate and explorer it as you would a live database. If you have two snapshots of an AD database you can use AD Explorer's comparison functionality to see what objects, attributes and security permissions changed between them.

AD Explorer works on Windows 2000 and higher.

http://www.microsoft.com/technet/sysinternals/utilities/adexplorer.mspx

Configuring TCP/IP from the Command Line

In order to configure TCP/IP settings such as the IP address, Subnet Mask, Default Gateway, DNS and WINS addresses and many other options you can use Netsh.exe.

Netsh.exe is a command-line scripting utility that allows you to, either locally or remotely, display or modify the network configuration of a computer that is currently running. Netsh.exe also provides a scripting feature that allows you to run a group of commands in batch mode against a specified computer. Netsh.exe can also save a configuration script in a text file for archival purposes or to help you configure other servers.

Netsh.exe is available on Windows 2000, Windows XP, Windows Vista, Windows Server 2003, and Windows Server 2008

http://www.petri.co.il/configure_tcp_ip_from_cmd.htm