Wednesday, October 03, 2007

Exchange 2007 Autodiscover White Paper

Newly updated.

This white paper provides detailed information about the Microsoft Exchange Autodiscover service. It also includes information about how to configure this service in various deployment scenarios. Use the conceptual information and procedures in this white paper to help you deploy the Autodiscover service.

http://technet.microsoft.com/en-us/library/59adba4e-44e1-4aa2-b09d-06988cbeab2d.aspx

Tuesday, October 02, 2007

Windows Server 2008 Core: Read-Only DC

New in Windows Server 2008 is the option to create a read-only domain controller (RODC). To deploy an RODC, the domain controller that holds the PDC emulator operations master role (also known as flexible single master operations or FSMO) for the domain must be running Windows Server 2008. In addition, the functional level for the forest must be Windows Server 2003.

Because the administration of a Server Core is done from the command line only (at least initially), dcpromo must be run with a host of options to promote the Server Core installation to a domain controller (read-only or standard). From the Windows Server 2008 Technical Library, here are the command line options for dcpromo. The options can optionally be specified in an answer file.

So, to create a RODC on a Server Core installation without also installing DNS, the command line would be:

dcpromo /unattend /ReplicaDomainDNSName:<FQDN_of_Domain> /ReplicaOrNewDomain:ReadOnlyReplica /SiteName:<site_name> /InstallDNS:No /DatabasePath:"C:\NTDS" /LogPath:"C:\NTDS" /SysVolPath:"C:\SYSVOL"

Obviously, the paths for the database, logs, and sysvol would need to be changed to the appropriate location for your environment. The bulk of the parameters are pretty self-explanatory, but two need attention called out. First, the /ReplicaOrNewDomain:ReadOnlyReplica parameter is what defines the DC as a RODC. Using /ReplicaOrNewDomain:Replica creates a standard DC in an existing domain. Using /ReplicaOrNewDomain:NewDomain should be pretty obvious, but it does introduce a slew of different required parameters and options. Also, when creating a RODC you must specify the site name using the /SiteName parameter. I’m not sure, but I would assume this is for the enabling of universal group membership caching. So, if you haven’t figured it out, you’ll need to create the site for the RODC in AD DS before you promote the server to a RODC.

Other handy parameters:

  • /ConfirmGC:No – Do not configure the server as a GC (Default is Yes).
  • /CriticalReplicationOnly:Yes – This forces dcpromo to only replicate the critical directory information before rebooting, postpoting the full replication of the remaining AD DS information until after a reboot; can be useful for large directories to speed up the dcpromo process (Default is No).
  • /ReplicationSourceDC:<FQDN_of_DC> – This forces the replication operation to use a specific domain controller.

Windows Server 2008 Core: The Basics

The Server Core installation option of the Microsoft Windows Server 2008 operating system is a new option for installing Windows Server 2008. A Server Core installation provides a minimal environment for running specific server roles that reduces the maintenance and management requirements and the attack surface for those server roles. A Server Core installation supports the following server roles:

  • Active Directory Domain Services
  • Active Directory Lightweight Directory Services (AD LDS)
  • Dynamic Host Configuration Protocol (DHCP) Server
  • DNS Server
  • File Services
  • Print Server
  • Streaming Media Services
  • Web Server (IIS)

Local administration of a Server Core installation is done from the command prompt, but all roles can be administered from other computers running the appropriate MMC console. The Server Core Team Blog has a nice posting on the basics of getting a Server Core installation up and running. Here are the extreme basics to get a Server Core up and running on your network:

Change the Administrator Password

net user administrator *

Configure the IP Address and DNS Server

netsh interface ipv4 set address name <interface_name> static <ip_address> <default_gateway> <subnet_mask> 1

netsh interface ipv4 set dnsserver <interface_name> <pri_dns_server_ip> primary

netsh interface ipv4 add dnsserver <interface_name> <sec_dns_server_ip>

Join the Domain

netdom join %computername% /domain:<domain_name> /userd:<domain_user> /passwordd:*

shutdown –r

Rename the Server

netdom renamecomputer %computername% /newname <new_server_name>

shutdown -r

Activate the Server

slmgr.vbs -ato

Allow Remote Administration (should really be done via GPO)

netsh advfirewall firewall set rule group="Remote Administration" new enable=yes

Active Directory Topology Diagrammer

With the Active Directory Topology Diagrammer tool, you can read your Active Directory structure through Microsoft ActiveX Data Objects (ADO). The Active Directory Topology Diagrammer tool automates Microft Office Visio to draw a diagram of the Active Directory Domain topology, your Active Directory Site topology, your OU structure or your current Exchange 200X Server Organization. With the Active Directory Topology Diagrammer tool, you can also draw partial Information from your Active Directory, like only one Domain or one site. The objects are linked together, and arranged in a reasonable layout that you can later interactively work withthe objects in Microsoft Office Visio.

http://www.microsoft.com/downloads/details.aspx?familyid=cb42fc06-50c7-47ed-a65c-862661742764&displaylang=en&tm

Monday, October 01, 2007

Microsoft Certification Changes

So Microsoft is dropping the MCSE moniker in favor of “Microsoft Certified IT Professional” (MCITP) in flavors for specific Microsoft products or technologies. The MCP moniker is now “Microsoft Certified Technology Specialist” (MCTS). Basically, the MCTS is the entry level certification on a Microsoft product or technology, and MCITP is the advanced certification. At the top level there is the “Microsoft Certified Architect” (MCA) which is a whole other animal. That’s all fine, well, and good with me - I was one that never liked the “Engineer” designation anyway. Here are the currently available MCITP certifications:

The other big change, beyond the names, is that certifications will now expire after three years. For the most part, rather than tying MCITP certifications to specific products, Microsoft has chosen product agnostic names for these certifications (I’m not sure why they chose to specifically call out Project Server 2007, but that’s not one I’d likely be after, so it’s irrelevant to me anyway). To renew your certification, you will be required to take the current MCTS exams for your area of expertise. So the MCTS exams under the MCITP certifications will rotate out as products age, but the MCITP certificate name will remain constant. Many people won’t, but I like this approach. It reduces the number of certifications someone has, and if they have any of the new MCITP certifications, you know they are up to date. I like the idea of reducing the number of certifications because I personally have the following:

  • MCITP: Enterprise Messaging Administrator
  • MCTS: Microsoft Exchange Server 2007 Configuration
  • MCSA: Security on Windows Server 2003
  • MCSE: Security on Windows 2000
  • MCSE: Security on Windows Server 2003
  • MCSE: Messaging on Windows 2000
  • MCSE: Messaging on Windows Server 2003
  • MCSA: Messaging on Windows Server 2003
  • MCSA on Windows Server 2003
  • MCSE on Windows Server 2003
  • MCSE on Windows 2000
  • MCSE on Windows NT 4.0
  • MCP+I
  • MCP

I am not going to list these on a business card or email signature, and most people couldn’t care less about my experience with NT 4.0. So after getting the new MCSE equivalent certification, I would be simplified to:

  • MCITP: Enterprise Administrator
  • MCITP: Enterprise Messaging Administrator

Much better, and should carry more weight in time.

You’ll notice that “Enterprise Administrator” is not on the list of currently available MCITP certifications. Neither is “Server Administrator”. The “Enterprise Administrator” (MCSE equivalent) and “Server Administrator” (MCSA equivalent) certifications are based on Windows Server 2008, which is obviously not available yet, so neither are the certifications. Upgrade exams will be available for both the MCSE and MCSA path. Trika from Microsoft Learning notes on her blog that the MCSE/MCSA upgrade exams will be available October 29, 2007, but these exams only get you part of the way. Below is a summary of all the exams needed to get the new “MCITP: Enterprise Administrator” and “MCITP: Server Administrator” certifications.

Now get studying…


Starting Fresh (No Upgrades)

MCITP: Server Administrator (3 Exams)

  • 70-640 (MCTS: Windows Server 2008 Active Directory, Configuring)
  • 70-642 (MCTS: Windows Server 2008 Network Infrastructure, Configuring)
  • 70-646 (MCITP: Windows Server 2008 Administrator)

MCITP: Enterprise Administrator (5 Exams)

  • 70-640 (MCTS: Windows Server 2008 Active Directory, Configuring)
  • 70-642 (MCTS: Windows Server 2008 Network Infrastructure, Configuring)
  • 70-643 (MCTS: Windows Server 2008 Applications Infrastructure, Configuring)
  • 70-620 (MCTS: Microsoft Windows Vista, Configuring) OR 70-624 (MCTS: Deploying and Maintaining Windows Vista Client and 2007 Microsoft Office System Desktops)
  • 70-647 (MCITP: Windows Server 2008 Enterprise Administrator)

Upgrading from MCSE 2003

MCITP: Enterprise Administrator (3 Exams)

  • 70-649 (MCTS: Upgrading Your MCSE on Windows Server 2003 to Windows Server 2008, Technology Specialist)
  • 70-620 (MCTS: Microsoft Windows Vista, Configuring) OOR 70-624 (MCTS: Deploying and Maintaining Windows Vista Client and 2007 Microsoft Office System Desktops)
  • 70-647 (MCITP: Windows Server 2008 Enterprise Administrator)

MCITP: Server Administrator (2 Exams)

  • 70-649 (MCTS: Upgrading Your MCSE on Windows Server 2003 to Windows Server 2008, Technology Specialist)
  • 70-646 (MCITP: Windows Server 2008 Administrator)

Upgrading from MCSA 2003

MCITP: Enterprise Administrator (4 Exams)

  • 70-648 (MCTS: Upgrading Your MCSA on Windows Server 2003 to Windows Server 2008, Technology Specialist)
  • 70-643 (MCTS: Windows Server 2008 Applications Infrastructure, Configuring)
  • 70-620 (MCTS: Microsoft Windows Vista, Configuring) OR 70-624 (MCTS: Deploying and Maintaining Windows Vista Client and 2007 Microsoft Office System Desktops)
  • 70-647 (MCITP: Windows Server 2008 Enterprise Administrator)

MCITP: Server Administrator (2 Exams)

  • 70-648 (MCTS: Upgrading Your MCSA on Windows Server 2003 to Windows Server 2008, Technology Specialist)
  • 70-646 (MCITP: Windows Server 2008 Administrator)