KAPes's questions

I have an AD integrated forward DNS zone say domain.com. when I try to query a specific record in the zone like ie.domain.com it gives me answer that it's CNAME pointing to www.domain.com.

When I open the DNS Management console, I don't see this record at all.

I cleared the server cache. I created A record with same name and it let me create, but it still continued to resolve to earlier CNAME. I created CNAME record with same name and it let me create, but it still continued to resolve to earlier CNAME.

I also looked at querying the record using dnscmd.exe /enumrecords command I also looked at backend AD location (ForestDNSZone) and there also there is no such record. I also verified there are no conditional forwarder for this domain on the server.

I am stumped right now, from where DNS server is getting that CNAME record?

Setup:

Forest Functional Level: Windows 2003
All DCs - Windows 2003 64 bit SP2

Requirements:

Citrix server wants to use Kerberos delegation for SSO purpose. They want to create Kerberos constrained delegation from Citrix presentation server to local DCs for CIFS and LDAP services.

I fear that it would allow administrators on the presentation server to impersonate domain admins against LDAP service on the DCs and make unauthorized changes in AD.

Questions:

1. Is my assumption correct?
2. If yes, how easy it would be to do that?
3. What are the operational repercussion of allowing such delegation on maintaining local DCs in that site? (We have 200+ DCs globally and 10 DCs in site where delegation is asked for)

I am looking for programatically removing user accounts from OCS 2007 R2.

I would prefer vbscript solution as this will become part of larger deprovisioning script used for removing various user related stuff across applications.

We are evaluating system center operations manager 2007 R2 product, and would like to know what all roles can be combined onto single server.

Like root management server and reporting servers can be on one box or not?

my environment is like 450 servers mostly Exchange and Domain Controllers plus few OCS servers.

All DCs : Windows 2003 SP2

DFL& FFL at Windows 2003

In our environment we have 500+ GPOs, I want to know which groups/users have been given rights to edit GPOs. and we need this list for each GPO.

Secondary question would be how do we change those rights through script.

Can it be done through script?

I have inherited a MOM 2005 environment and its unmanageable. The Onepoint DB is 50 GB and Systemcenterreporting DB is around 700 GB (yes 700 !!) I am going through all the normal cleanup process like changing the period for which SCDW stores data in DB. It was configured 900 days and by changing it 5 days at a time and running grooming I have reached to 370 days. my goal is to keep 100 days worth of data eventually. Right now I am tired of decreasing it 5 days at a time and running grooming. I would like to just drop whole of data and start from scratch, how do I do it.

I do not want to uninstall and reinstall reporting services.

What are my options ?

Does anyone know how to change the color of selection done in command prompt window on the fly? I forgot the key sequence which used to allow that.

I am not talking about changing the color permanently like with color command which changes color of all the text.

For example visit this page: Check Command Prompt Window screenshots