Windows Server 2008 Core: Read-Only DC

New in Windows Server 2008 is the option to create a read-only domain controller (RODC). To deploy an RODC, the domain controller that holds the PDC emulator operations master role (also known as flexible single master operations or FSMO) for the domain must be running Windows Server 2008. In addition, the functional level for the forest must be Windows Server 2003.

Because the administration of a Server Core is done from the command line only (at least initially), dcpromo must be run with a host of options to promote the Server Core installation to a domain controller (read-only or standard). From the Windows Server 2008 Technical Library, here are the command line options for dcpromo. The options can optionally be specified in an answer file.

So, to create a RODC on a Server Core installation without also installing DNS, the command line would be:

dcpromo /unattend /ReplicaDomainDNSName:<FQDN_of_Domain> /ReplicaOrNewDomain:ReadOnlyReplica /SiteName:<site_name> /InstallDNS:No /DatabasePath:"C:\NTDS" /LogPath:"C:\NTDS" /SysVolPath:"C:\SYSVOL"

Obviously, the paths for the database, logs, and sysvol would need to be changed to the appropriate location for your environment. The bulk of the parameters are pretty self-explanatory, but two need attention called out. First, the /ReplicaOrNewDomain:ReadOnlyReplica parameter is what defines the DC as a RODC. Using /ReplicaOrNewDomain:Replica creates a standard DC in an existing domain. Using /ReplicaOrNewDomain:NewDomain should be pretty obvious, but it does introduce a slew of different required parameters and options. Also, when creating a RODC you must specify the site name using the /SiteName parameter. I’m not sure, but I would assume this is for the enabling of universal group membership caching. So, if you haven’t figured it out, you’ll need to create the site for the RODC in AD DS before you promote the server to a RODC.

Other handy parameters:

• /ConfirmGC:No – Do not configure the server as a GC (Default is Yes).
• /CriticalReplicationOnly:Yes – This forces dcpromo to only replicate the critical directory information before rebooting, postpoting the full replication of the remaining AD DS information until after a reboot; can be useful for large directories to speed up the dcpromo process (Default is No).
• /ReplicationSourceDC:<FQDN_of_DC> – This forces the replication operation to use a specific domain controller.

Windows Server 2008 Core: The Basics

The Server Core installation option of the Microsoft Windows Server 2008 operating system is a new option for installing Windows Server 2008. A Server Core installation provides a minimal environment for running specific server roles that reduces the maintenance and management requirements and the attack surface for those server roles. A Server Core installation supports the following server roles:

• Active Directory Domain Services
• Active Directory Lightweight Directory Services (AD LDS)
• Dynamic Host Configuration Protocol (DHCP) Server
• DNS Server
• File Services
• Print Server
• Streaming Media Services
• Web Server (IIS)

Local administration of a Server Core installation is done from the command prompt, but all roles can be administered from other computers running the appropriate MMC console. The Server Core Team Blog has a nice posting on the basics of getting a Server Core installation up and running. Here are the extreme basics to get a Server Core up and running on your network:

Change the Administrator Password

net user administrator *

Configure the IP Address and DNS Server

netsh interface ipv4 set address name <interface_name> static <ip_address> <default_gateway> <subnet_mask> 1

netsh interface ipv4 set dnsserver <interface_name> <pri_dns_server_ip> primary

netsh interface ipv4 add dnsserver <interface_name> <sec_dns_server_ip>

Join the Domain

netdom join %computername% /domain:<domain_name> /userd:<domain_user> /passwordd:*

shutdown –r

Rename the Server

netdom renamecomputer %computername% /newname <new_server_name>

shutdown -r

Activate the Server

slmgr.vbs -ato

Allow Remote Administration (should really be done via GPO)

netsh advfirewall firewall set rule group="Remote Administration" new enable=yes

AD Explorer v1.0

A nice Microsoft/Sysinternals provided AD utility to have handy. From Microsoft:

Active Directory Explorer (AD Explorer) is an advanced Active Directory (AD) viewer and editor. You can use AD Explorer to easily navigate an AD database, define favorite locations, view object properties and attributes without having to open dialog boxes, edit permissions, view an object's schema, and execute sophisticated searches that you can save and re-execute.

AD Explorer also includes the ability to save snapshots of an AD database for off-line viewing and comparisons. When you load a saved snapshot, you can navigate and explorer it as you would a live database. If you have two snapshots of an AD database you can use AD Explorer's comparison functionality to see what objects, attributes and security permissions changed between them.

AD Explorer works on Windows 2000 and higher.

http://www.microsoft.com/technet/sysinternals/utilities/adexplorer.mspx

Configuring TCP/IP from the Command Line

In order to configure TCP/IP settings such as the IP address, Subnet Mask, Default Gateway, DNS and WINS addresses and many other options you can use Netsh.exe.

Netsh.exe is a command-line scripting utility that allows you to, either locally or remotely, display or modify the network configuration of a computer that is currently running. Netsh.exe also provides a scripting feature that allows you to run a group of commands in batch mode against a specified computer. Netsh.exe can also save a configuration script in a text file for archival purposes or to help you configure other servers.

Netsh.exe is available on Windows 2000, Windows XP, Windows Vista, Windows Server 2003, and Windows Server 2008

http://www.petri.co.il/configure_tcp_ip_from_cmd.htm