Patrick Pellegrino's questions

A DFS-R is in place with 2 servers. ServerA in one location, ServerB on an another

Since yesterday morning we're in a situation where we don't know how to get rid of this.

The situation :

We receive a call where peoples don't have access anymore on a specific DFS namespace. Checking around, we found, on ServerA, that someone have first remove the share on this folder and 2 no more ACL are there.

First step, on the DFS namespace we disabled the Folder target on ServerA. To permit users accessing their files.

The replication looks to be very vey slow. drfsdiag backlog give 101000+ and 78000+ files on both side of the replication. Probably due to ACL mismatch I guess.

What is the best way to put back on track this situation ?

• Stopping Replication of ServerA to ServerB ?
• Delete the folder on ServerA ?
• Recreate the replication with ServerB as primary source ?
• Recreate ACL and share on ServerA ?
• All of those steps in a specific order ?
• Wait the backlogs is over and move after ?

Really new on DFS-R and we don't know how to proceed for that and all possible effect.

Any clue will be appreciate.

I have a deployment share that allows me to deploy a single image across several sites. Each site has its own default applications and other specific parameters ( WSUS , etc).

For a more automated deployment possible, I created a custom panel that lets you select the site in question so that applications and other parameters are pre- selected.

Since customsettings.ini file is evaluated before displaying the wizard I can not use the variable created in my custom panel.

Based on this website I raised the ZTIGather.wsf script to validate my custom panel. The script runs but the variable used in the custom panel still not applied to customsettings.ini.

Have you do something similar? Is it only possible to do this ? I 'm open to suggestions.

I have SQL Agent running under a local user account. Jobs runs well if I used Local account credentials for the cmdExec step. If I try to use a domain user account (created previously in proxies account) the job start and "hang" (still running but nothing is done) and I got an event id 10016 in the System section of Event Viewer.

Is it a normal behavior ? Does I have to start the SQL Agent services with a Domain user account ? Does the local user account will continue to work ?

I'll try to explain my problem as clearly as possible. We just migrated from Novell eDir and files/print server to Microsoft AD and files/print server. Our domain is integrated into a regional forest. We're a NAT network, LAN it's a 172.16.0.0 and on WAN it's a 10.140.0.0 network.

Actually, we got rogue Windows DNS and DHCP services. I'm to configure DNS and DHCP services into the domain.

Some users have to work on other sites with different domain (in the same forest) so they bring their laptop and authenticated themselve on our DC (domain).

My first tests went well (tests done locally), everything works as expected. The problems starting to occurs when users have to switch sites. While our DNS was empty, adresses resolution were done by sites DNS. Per example, Lotus Notes server is already known as 10.140.x.x outside and users on other sites was able to access those services.

Now, since I put entry in the domain's DNS, those were resolve as 172.16.x.x. (and unreachable outside LAN).

In attempt to resolve this I multihome some servers with 172.16.x.x and 10.140.x.x IP, unchecked the round robin option on DNS to force the subnet ordering. But on LAN, if I do a nslookup multihomed_name I receive IP in this order : 10.140.x.x, 172.16.x.x.

Maybe there's something I don't understand. I expected to receive first the 172.x.x.x Ip since I'm on a 172.x.x.x network. Does can be an issue of how the DHCP's scope are designed (4 vlan's with /23 mask) ?

Anybody can point me where I'm wrong.

We're in the process of migrating from Novell Netware to Windows 2K8 R2 infrastructure (AD, File server, print server... etc)

My question is about ACL. While Netware and Windows are totally different, I want to be sure my thnking is good before screwing everything up!

There's a scenario :

F:
|
+-- DATA <= Shared as DATA with Access based enumeration
     |
     +-- Folder 1
     +-- Team 1's Folder
     +-- Team 2's Folder
     ...

In that case, by default, rights are herited from the F: to the deepest folders.

What we want :

• Administrators group have full control top - down.
• From DATA, ABE list only folders that users have access. (ex. : I'm in group Team 2, I see Team 2's Folder).

From what I understand, at DATA I remove all NTFS ACL to be herited (ex. Users Group), be sure to keep Administrators Group and SYSTEM user.

After that, grant Full control (or any right needed) on each folder to Groups or Users that have to have access.

Does I'm wrong ? Anything I should take care of ?

Any help to my understanding will be very appreciated.

Regards.

I want to know, before going forward, what I can expected in lost of performance (or not) of creating Windows spanned volumes from LUN delivered by a SAN ?

I don't know which kind of SAN is (we don't administer it), but they give us 10 300 Gb LUN to our Windows 2k8 R2 (Vmware) and we need larger volume so we think to spanned some disk but we are aware of the performance issue.

Any input ?

Regards.

I'm trying to run a script that modify password for multiple AD user accounts, enable the accounts and force a password change at next logon.

I use this code but that's not work :

Get-ADUSER -Filter * -SearchScope Subtree -SearchBase "OU=myou,OU=otherou,DC=mydc,DC=local" | Set-ADAccountPassword -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "NewPassord" -Force) | Enable-ADAccount | Set-ADUSER -ChangePasswordAtLogon $true

If I run the Get-ADuser line with ONLY one of the other line that's run fine ex :

Get-ADUSER -Filter * -SearchScope Subtree -SearchBase "OU=myou,OU=otherou,DC=mydc,DC=local" | Enable-ADAccount

Where I'm wrong ? I'm new to PowerShell probably I'm misunderstanding something.

I have to replace all disks of a Raid 5 volume for more space on a Windows 2003.

I want to see what is the more reliable method to backup or move data of this volume (about 800 Gb).

In first I was planning to robocopy all files on a external USB Drive. But I really not sure that's the best method for that kind of job.

I'm thinking to make a full backup of that Server/volume and then make the restore. But what about a remote VSS backup on the External drive ? A good method, feasible ?

There's the situation :

Intranet hosted here with intranet_name.domain.com with a private network address 172.x.x.x.

I have to give access to this intranet to an another site. They add a DNS entry corresponding to remote_intranet.other_site_domain.com 10.x.x.x.

In my firewall I do a NAT of 10.x.x.xto 172.x.x.x.

Because of the NATing I presume that my configuration will continue to listen to the 172.x.x.x address.

Does I have to put a new ServerName remote_intranet.other_site_domain.com on my intranet VirtualHost ?

I read about Proxy too.

I don't know Apache very much. Any help will be appreciated.