MDMarra's questions

I have a Storage Spaces pool containing 2x 3TB disks. A single mirrored volume is created from this pool with a fixed size (not thin provisioned) and is set to use all space in the pool at the time of creation.

Now, I want to add 2x 4TB disks to the same pool and extend the same volume. I can't seem to dig up documentation that covers this scenario.

What will my total usable space for the volume be? Do I lose any space by using drives of mixed sizes in the same pool if I add them in pairs?

My understanding is that since this is a one-column, two copy setup, I shouldn't "leave any space on the table" as long as disks of the same size are added in pairs, even if that new pair is different in size from the current disks, but I can't seem to find any docs that confirm this.

In volume licensed editions of Office (ones with an MSI deployment), you can use OCT to create a package that will remove previous versions of Office when the new version is deployed.

Office 365 Pro Plus is Click-to-Run only, which means that OCT will not work with it. ODT allows for some customization of Office 365 Pro Plus, but appears to lack the ability to remove previous versions of Office.

Is there a way to do this native to the Office 365 Pro Plus deployment, or does this really involve creating a script to check for every possible version of Office along with uninstall logic?

When provisioning a PKI for internal use, is there a private OID space that can be used without having to pay and/or register your own OID range? Think RFC1918 addresses for OID ranges.

How can I use PowerShell to find AD site options like +IS_INTER_SITE_AUTO_TOPOLOGY_DISABLED in PowerShell? I've been playing around with the following command, but can't get it to spit out anything useful.

Get-ADObject -Filter 'objectClass -eq "site"' -Searchbase (Get-ADRootDSE).ConfigurationNamingContext` -Properties options

There are two schools of thought for the decommissioning process of Active Directory Domain Controllers that are heavily used as DNS servers.

1. Add the IP address of the outgoing DC to a new DC and ensure that DNS is listening on that address.

2. Demote the old DC, leave the DNS role on it, and configure a global DNS forwarder to your new server.

Obviously, both are stopgaps until all servers and devices have been configured to use the primary IP address of a new server, but sometimes that transition period can be relatively long depending on the size of the environment.

Is there a clear cut best practice here?

In System Center Service Manager 2012 SP1, is it possible to granularly control what comes over the SCOM CI connector into the CMDB?

For example, to get an AIX computer across the connector, you have to whitelist the following classes using Add-SCSMAllowListClass:

Microsoft.Unix.LogicalDevice
Microsoft.Linux.Computer
Microsoft.Unix.AIX.6.1.Computer
etc

This also brings in all of the peripheral information from those computers as CIs, such as network adapters, logical disks, etc.

Is there a way to just bring the computer CI over the connector and leave the related items behind, or does it have to come over all at once?

I was recently in an environment where there were 120 domain controllers in over 100 sites around the world. This domain began in the Windows 2000 era and was upgraded over time, so strict replication consistency was never set as the default for new DCs and has never been enabled on any DCs. There are lingering objects in the directory and you regularly see a decent number of conflicted objects because of this.

Using repadmin /removelingeringobjects requires knowing two things:

1. Which DC(s) have lingering objects in the database

2. A DC that has no lingering objects on it to use as a reference DC.

Obviously, in the future, this environment should be set so that all new DCs have strict replication consistency enforced and repadmin /options * +strict should be run to make all current DCs use strict replication consistency, but that will break replication now without cleaning the objects.

So, my question is this: In such a massive environment where I would have no idea which DCs have lingering objects and which ones do not, how can I identify a good reference DC for repadmin /removelingeringobjects to use, and how can I ensure that all 120+ DCs are clean of lingering objects before enforcing strict replication consistency and breaking replication? Or, is it just easier to turn on strict mode and watch repadmin /replsum to see what breaks and deal with it?

Inside-to-inside NAT aka NAT loopback solves hairpin NAT issues when accessing a web server on the external interface of an ASA or similar device from computers on the internal interface. This prevents DNS admins from having to maintain a duplicate internal DNS zone that has the corresponding RFC1918 addresses for their servers that are NATted to public addresses. I'm not a network engineer, so I might be missing something, but this seems like a no-brainer to configure and implement. Asymmetric routing can be an issue but is easily mitigated.

In my experience, network admins/engineers prefer that systems folks just run split-dns rather than configuring their firewalls to properly handle NAT hairpins. Why is this?

I've always assumed that using Y cables from the PDU to redundant PSUs in the same server was totally acceptable practice, however I was recently speaking to someone that said that their colo wouldn't allow it.

I'm no electrician, but it would seem to me that since the PSUs are redundant, they aren't both drawing at the same time. If this is the case, it would seem that using a Y cable on two PSUs doesn't risk overdrawing the rated ampacity of the cable or individual outlet.

Have I missed something here? Why would a colo choose to ban Y-power cables in server racks?

There are plenty of TechNet articles, like this one that say that phantom object don't get updated if an Infrastructure Master is also a Global Catalog, but other than that there isn't a lot of in depth information on what actually happens in this configuration.

Imagine a configuration like this:

|--------------|
| example.com  |
|              |
| dedicated IM |
|--------------|
    |
    |
    |
|-------------------|
| child.example.com |
|                   |
|  IM on a GC       |
|-------------------|

Where child has two DCs that are both global catalogs, meaning that the Infrastructure Master role is on a GC. And, example has three DCs with the Infrastructure Master role on a DC that is not a GC.

I understand that it's usually best to just make everything a GC and not have to worry about this sort of thing, but assuming that's not the case - what is the exact error behavior that can be expected from a setup like this, and which domain(s) would this behavior manifest in? The child or the parent?

How are cached Active Directory domain credentials stored on a Windows client? Are they stored in the local SAM database, thus making them susceptible to the same rainbow table attacks that local user accounts are susceptible to, or are they stored differently? Note, that I do realize that they are salted and hashed, so as not to be stored in plain-text, but are they hashed in the same way as local accounts and are they stored in the same location?

I realize that at a minimum they're be susceptible to a brute force attack, but that's a much better situation than being vulnerable to rainbow tables in the event of a stolen machine.

Please note that I do know the answer to this and have provided one below. I see a lot of newer systems administrators that don't understand the contents of my answer, so I hope that all of the beginner AD DNS questions will be closed as a duplicate of this. If you have a minor improvement, feel free to edit my answer. If you can provide a more comprehensive complete answer, feel free to leave one.

How is DNS related to Active Directory and what are some common configurations that I should be aware of?

How can I find all computer accounts in my Active Directory domain that have been inactive for x days using PowerShell?

Note that I do actually know how to do this. This is a self-answered question just to get the knowledge out there. If anyone else has a better way, feel free to post it!

This is a Canonical Question about Active Directory Group Policy Basics

What is Group Policy? How does it work and why should I use it?

_{Note: This is a Question & Answer to new administrator that might not be familiar with how it functions and how powerful it is.}

This is a Canonical Question about Active Directory Domain Services (AD DS).

What is Active Directory? What does it do and how does it work?

How is Active Directory organized: Forest, Child Domain, Tree, Site, or OU

I find myself explaining some of what I assume is common knowledge about it almost daily. This question will, hopefully, serve as a canonical question and answer for most basic Active Directory questions. If you feel that you can improve the answer to this question, please edit away.

This is a Canonical Question about Active Directory DNS Settings.

Related:

• What is Active Directory Domain Services and how does it work?

Assuming an environment with multiple domain controllers (assume that they all run DNS as well):

• in what order should the DNS servers be listed in the network adapters for each domain controller?
• Should 127.0.0.1 be used as the primary DNS server for each domain controller?
• Does it make any difference, if so what versions are affected and how?

I'm designing a little vSphere 5 cluster for one of our remote sites. We have some IBM x3650s that have 6x 300GB 10K RPM drives in them, along with dual quad core CPUs and 24GB RAM. Because we use HP P4500 G2s at our primary site, we have licenses available for HP P4000 VSAs. I thought that this would be the perfect opportunity to use them.

Below is a basic drawing of what I want to accomplish:

I want to run a P4000 VSA on each server and run them in a Network RAID-10 (Lefthand speak for network mirroring, think of it as RAID 1 across nodes or as an active/active storage cluster). I will then present this storage to guests that will run on this mini-cluster. It will be managed by a vCenter Server on our main site.

All connections will be GbE with two dedicated to storage. Management and Data will share a pair of connections, since I don't expect there to be high load. These servers are just there to provide directory services, dhcp, printing, etc.

Does anyone see anything potentially wrong with this approach? Is this the best way to do this without adding additional dedicated storage heads? Are there any pitfalls in this design, besides the lack of dedicated Data/Mgmt interfaces?

This is a Canonical Question about RAID levels.

What are:

• the RAID levels typically used (including the RAID-Z family)?
• deployments are they commonly found in?
• benefits and pitfalls of each?

I have Nagios set up on three disjoint networks that are all behind firewalls. The monitoring is working great and I'm getting the hang of the somewhat complex configuration. I have a server that is outside of these networks that could be made available to them. What I would like to do, ideally, is have these Nagios servers inside of the firewalls continue to do their normal monitoring and send out their notifications as they have been, but I would like them all to send their data to the server that I have outside of the firewalls.

Essentially, this server would be a place where I could see everything going on inside of each disjoint network at once, and the only things contacting it would be other other Nagios servers. Firewall configs are not an issue, I just have no idea how to configure this in Nagios.

I have Nagios 3.2.1 running on all monitoring servers, compiled from source on CentOS 5.5 monitoring Windows Servers with NSClient++

I've created an unattended install of Office 2010 using the OCT. We are using a MAK rather than KMS (not my decision). Is there a way to activate Office 2010 after the install? Even though the key is set during the install, it does not activate.

I don't want the users to be prompted to activate since this is going to be in a lab environment.