{"id":1771,"date":"2014-11-25T08:40:59","date_gmt":"2014-11-25T04:40:59","guid":{"rendered":"https:\/\/rakhesh.com\/?p=1771"},"modified":"2014-12-28T13:19:07","modified_gmt":"2014-12-28T09:19:07","slug":"active-directory-critical-services","status":"publish","type":"post","link":"https:\/\/rakhesh.com\/windows\/active-directory-critical-services\/","title":{"rendered":"Active Directory: Domain Controller critical services"},"content":{"rendered":"<p>The first of my (hopefully!) many posts on Active Directory, based on the <a title=\"Coming soon \u2026 fingers crossed!\" href=\"https:\/\/rakhesh.com\/windows\/coming-soon-fingers-crossed\/\">WorkshopPLUS sessions I attended last month<\/a>. Progress is slow as I don&#8217;t have much time, plus I am going through the slides and my notes and adding more information from the Internet and such.\u00a0<\/p>\n<p>This one&#8217;s on the services that are critical for Domain Controllers to function properly.\u00a0<\/p>\n<h2>DHCP Client<\/h2>\n<ul>\n<li>In Server 2003 and before the DHCP Client service registers A, AAAA, and PTR records for the DC with DNS<\/li>\n<li>In Server 2008 and above this is done by the DNS Client<\/li>\n<li>Note that <em>only the A and PTR records<\/em> are registered. Other records are by the Netlogon service.<\/li>\n<\/ul>\n<h2>File Replication Services (FRS)<\/h2>\n<ul>\n<li>Replicates SVSVOL amongst DCs.<\/li>\n<li>Starting with Server 2008 it is now in maintenance mode. DFSR replaces it.\n<ul>\n<li>To check whether your domain is still using FRS for SYSVOL replication, open the DFS Management console and see whether the &#8220;Domain System Volume&#8221; entry is present under &#8220;Replication&#8221; (if it is not, see whether it is available for adding to the display). If it is present then your domain is using DFSR for SYSVOL replication.<\/li>\n<li>Alternatively, type the following command on your DC. If the output says &#8220;Eliminated&#8221; as below, your domain is using DFSR for SYSVOL. (Note this only works with domain functional level 2008 and above).\n<pre class=\"lang:batch decode:true\">C:\\&gt;dfsrmig \/getglobalstate\r\n\r\nCurrent DFSR global state: 'Eliminated'\r\nSucceeded.\r\n<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<li>Stopping FRS for long periods can result in Group Policy distribution errors as SYSVOL isn\u2019t replicated. Event ID 13568 in FRS log.<\/li>\n<\/ul>\n<h2>Distributed File System Replication (DFSR)<\/h2>\n<ul>\n<li>Replicates SYSVOL amongst DCs. Replaced functionality previously provided by FRS.\u00a0<\/li>\n<li>DFSR was introduced with Server 2003 R2.<\/li>\n<li>If the domain was born\u00a0functional level 2008 &#8211; meaning all DCs are Server 2008 or higher &#8211; <a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/cc507518%28v=vs.85%29.aspx\" target=\"_blank\">DFSR is used for SYSVOL replication<\/a>.\n<ul>\n<li>\u00a0Once all pre-Server 2008 DCs are removed FRS can be migrated to DFSR.\u00a0<\/li>\n<li>Apart from the <code>dfsrmig<\/code> command mentioned in the FRS section, the\u00a0<code>HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\DFSR\\Parameters\\SysVols\\Migrating Sysvols\\LocalState<\/code> <a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/cc507518%28v=vs.85%29.aspx\" target=\"_blank\">registry key<\/a> can also be checked to see if DFSR is in use (a value of 3 means it is in use).\u00a0<\/li>\n<\/ul>\n<\/li>\n<li>If\u00a0a DC is offline\/ disconnected from its peers for a long time\u00a0<span style=\"text-decoration: underline;\">and<\/span> Content Freshness Protection is turned on, when the DC is online\/ reconnected DFSR might block SYSVOL replications to &amp; from this DC &#8211; resuling in Group Policy distribution errors.\n<ul>\n<li>Content Freshness Protection is off by default. It needs to be <em>manually<\/em> turned on for <em>each server<\/em>.<\/li>\n<li>Run the following command on each server to turn it on:\n<pre class=\"lang:batch decode:true nums:false\">wmic.exe \/namespace:\\\\root\\microsoftdfs path DfsrMachineConfig set MaxOfflineTimeInDays=60<\/pre>\n<p>Replace 60 with the maximum number of days it is acceptable for a DC or DFSR member to be offline. The recommended value is 60 days. And to turn off:<\/p>\n<pre class=\"lang:batch decode:true nums:false\">wmic.exe \/namespace:\\\\root\\microsoftdfs path DfsrMachineConfig set MaxOfflineTimeInDays=0<\/pre>\n<p>To view the current setting:<\/p>\n<pre class=\"lang:batch decode:true nums:false\">wmic.exe \/namespace:\\\\root\\microsoftdfs path DfsrMachineConfig get MaxOfflineTimeInDays<\/pre>\n<\/li>\n<li>Content Freshness Protection exists because of the way deletions work.\n<ul>\n<li>DFSR is multi-master, like AD, which means changes can be made on any server.<\/li>\n<li>When you delete an item on one server, it can&#8217;t simply be deleted because then the item won&#8217;t exist any more and there&#8217;s no way for other servers to know if that&#8217;s the case because the item was deleted or because it wasn&#8217;t replicated to that server in the first place.<\/li>\n<li>So what happens is that a deleted item is &#8220;<a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/cc232143.aspx#tombstone\" target=\"_blank\">tombstoned<\/a>&#8220;. The item is removed from disk but a record for it remains the in DFSR database for 60 days (this period is called the &#8220;tombstone lifetime&#8221;) indicating this item as being deleted.<\/li>\n<li>During these 60 days other DFSR servers can learn that the item is marked as deleted and thus act upon their copy of the item. After 60 days the record is removed from the database too.<\/li>\n<li>In such a context, say we have DC that is offline for more than 60 days and say we have other DCs where files were removed from SYSVOL (replicated via DFSR). All the other DCs no longer have a copy of the file nor a record that it is deleted as 60 days has past and the file is removed for good.<\/li>\n<li>When the previously offline DC replicates, it still has a copy of the file and it will pass this on to the other DCs. The other DCs don&#8217;t remember that this file was deleted (because they don&#8217;t have a record of its deletion any more as as 60 days has past) and so will happily replicate this file to their folders &#8211; resulting in a deleted file now appearing and causing corruption.<\/li>\n<li>It is to avoid such situations\u00a0that Content Freshness Protection was invented and is recommended to be turned on.<\/li>\n<\/ul>\n<\/li>\n<li>Here&#8217;s <a href=\"http:\/\/blogs.technet.com\/b\/askds\/archive\/2009\/11\/18\/implementing-content-freshness-protection-in-dfsr.aspx\" target=\"_blank\">a good blog post<\/a> from the Directory Services team explaining Content Freshness Protection.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h2>DNS Client<\/h2>\n<ul>\n<li>For Server 2008 and above registers the A, AAAA, and PTR records for the DC with DNS (notice that when you change the DC IP address you do not have to update DNS manually \u2013 it is updated automatically. This is because of the DNS Client service).<\/li>\n<li>Note that <em>only the A, AAAA, and PTR records<\/em> are registered. Other records are by the Netlogon service. \u00a0<\/li>\n<\/ul>\n<h2>DNS Server<\/h2>\n<ul>\n<li>\u00a0The <span style=\"text-decoration: underline;\">glue<\/span> for Active Directory. DNS is what domain controllers use to locate each other. DNS is what client computers use to find domain controllers. If this service is down both these functions fail.\u00a0\u00a0<\/li>\n<\/ul>\n<h2>Kerberos Distribution Center (KDC)<\/h2>\n<ul>\n<li>Required for Kerberos 5.0 authentication. AD domains use Kerberos for authentication. If the KDC service is stopped Kerberos authentication fails.\u00a0<\/li>\n<li>NTLM is not affected by this service.\u00a0<\/li>\n<\/ul>\n<h2>Netlogon<\/h2>\n<ul>\n<li>Maintains the secure channel between DCs and domain members (including other DCs). This secure channel is used for authentication (NTLS and Kerberos) and DC replication.<\/li>\n<li>Writes the SRV and other records to DNS. These records are what domain members use to find DCs.\n<ul>\n<li>The records are also written to a file\u00a0<code>%systemroot%\\system32\\config\\Netlogon.DNS<\/code>. If the DNS server doesn&#8217;t support dynamic updates then the records in this text file must be <em>manually<\/em> created on the DNS server.\u00a0<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h2>Windows Time<\/h2>\n<ul>\n<li>Acts as an NTP client and server to keep time in sync across the domain. If this service is down and time is not in sync then <a href=\"http:\/\/technet.microsoft.com\/en-us\/library\/cc780011(v=WS.10).aspx\" target=\"_blank\">Kerberos authentication<\/a>\u00a0and <a href=\"http:\/\/technet.microsoft.com\/en-us\/library\/replication-error-5-access-is-denied(v=ws.10).aspx#BKMK_MoreInfo\" target=\"_blank\">AD replication will fail<\/a> (see <a href=\"http:\/\/technet.microsoft.com\/en-us\/library\/replication-error-5-access-is-denied(v=ws.10).aspx#BKMK_Resolutions\" target=\"_blank\">resolution #5 in this link)<\/a>.\n<ul>\n<li>Kerberos authentication <a href=\"http:\/\/blogs.technet.com\/b\/askds\/archive\/2012\/08\/24\/friday-i-mean-saturday-mail-sack-very-wordy-edition.aspx#kerbtime\" target=\"_blank\">may not necessarily break<\/a>\u00a0for newer versions of Windows. But AD replication is still sensitive to time. \u00a0<\/li>\n<\/ul>\n<\/li>\n<li>The PDC of the forest root domain is the <a href=\"https:\/\/support.microsoft.com\/kb\/816042?wa=wsignin1.0\" target=\"_blank\">master time keeper of the forest<\/a>. All other DCs in the forest will sync time from it.\n<ul>\n<li>The Windows Time service on every domain member looks to <em>the DC that authenticates<\/em> them for time time updates.<\/li>\n<li>DCs in the domain look to <em>the domain PDC<\/em> for time updates.\u00a0<\/li>\n<li>Domain PDCs look to the domain PDC of the domain above\/ sibling to them. Except the forest root domain PDC who gets time from an external source (hardware source, Internet, etc).<\/li>\n<\/ul>\n<\/li>\n<li>From <a href=\"http:\/\/technet.microsoft.com\/en-us\/library\/dd723684(v=WS.10).aspx\" target=\"_blank\">this link<\/a>: there are two registry keys\u00a0<code>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\W32Time\\Config\\MaxPosPhaseCorrection<\/code> and\u00a0<code>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\W32Time\\Config\\MaxNegPhaseCorrection<\/code> that restrict the time updates accepted by the Windows Time service\u00a0to the number of seconds defined by these values (the maximum and minimum range). This can be set directly in the registry or via a GPO. The <a href=\"http:\/\/technet.microsoft.com\/en-us\/library\/dd723684(v=WS.10).aspx\" target=\"_blank\">recommended value is 172800 (i.e. 48 hours)<\/a>.<\/li>\n<\/ul>\n<h3>w32tm<\/h3>\n<p>The <code>w32tm<\/code> command can be used to manage time. For instance:<\/p>\n<ul>\n<li>To get an idea of the time situation in the domain (who is the master time keeper, what is the offset of each of the DCs from this time keeper):\n<pre class=\"nums:false lang:ps decode:true \">w32tm \/monitor<\/pre>\n<\/li>\n<li>To ask the Windows Time service to resync as soon as possible (the command can target a remote computer too via the <code>\/computer:<\/code> switch)\n<pre class=\"nums:false lang:ps decode:true\">w32tm \/resync<\/pre>\n<ul>\n<li>Same as above but before resyncing redetect any network configuration changes and rediscover the sources:\n<pre class=\"nums:false lang:ps decode:true \">w32tm \/resync \/rediscover<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<li>To get the status of the local computer (use the <code>\/computer:<\/code> switch to target a different computer)\n<pre class=\"nums:false lang:ps decode:true \">w32tm \/query \/status<\/pre>\n<\/li>\n<li>To show what time sources are being used:\n<pre class=\"nums:false lang:ps decode:true \">w32tm \/query \/source<\/pre>\n<\/li>\n<li>To show who the peers are:\n<pre class=\"nums:false lang:ps decode:true \">w32tm \/query \/peers<\/pre>\n<\/li>\n<li>To show the current time zone:\n<pre class=\"nums:false lang:ps decode:true \">w32tm \/tz<\/pre>\n<ul>\n<li>You can&#8217;t change the time zone using this command; you have to do:\n<pre class=\"nums:false lang:ps decode:true \">tzutil \/s \"Time Zone Name\"<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>On the PDC in the forest root domain you would typically run a command like this if you want it to get time from an NTP pool on the Internet:<\/p>\n<pre class=\"nums:false lang:ps decode:true \">w32tm \/config \/update \/manualpeerlist:\"0.pool.ntp.org,1.pool.ntp.org,2.pool.ntp.org\" \/syncfromflags:MANUAL \/reliable:YES<\/pre>\n<p>Here&#8217;s what the command does:<\/p>\n<ul>\n<li>specify a list of peers to sync time from (in this example the NTP Pool servers on the Internet);<\/li>\n<li>the <code>\/update<\/code> switch tells w32tm to update the Windows Time service with this configuration change;<\/li>\n<li>the <code>\/syncfromflags:MANUAL<\/code> tells the Windows Time service that it must only sync from these sources (other options such as &#8220;DOMHIER&#8221; tells it to sync from the domain peers only, &#8220;NO&#8221; tells it sync from none, &#8220;ALL&#8221; tells it to sync from both the domain peers and this manual list);<\/li>\n<li>the <code>\/reliable:YES<\/code> switch <a href=\"http:\/\/blogs.msdn.com\/b\/w32time\/archive\/2008\/05\/29\/to-be-reliable-or-not-to-be-reliable.aspx\" target=\"_blank\">marks<\/a> <em>this machine<\/em> as special in that it is a reliable source of time for the domain (read <a href=\"http:\/\/blogs.msdn.com\/b\/w32time\/archive\/2008\/05\/29\/to-be-reliable-or-not-to-be-reliable.aspx\" target=\"_blank\">this link<\/a> on what gets set when you set a machine as RELIABLE).<\/li>\n<\/ul>\n<p><strong>Note<\/strong>: You must manually configure the time source on the PDC in the forest root domain and mark it as reliable. If that server were to fail and you transfer the role to another DC, be sure to repeat the step.\u00a0<\/p>\n<p>On other machines in the domain you would run a command like this:<\/p>\n<pre class=\"nums:false lang:ps decode:true \">w32tm \/config \/update \/syncfromflags:DOMHIER \/reliable:NO<\/pre>\n<p>This tells those DCs to follow the domain hierarchy (and\u00a0<em>only<\/em> the domain hierarchy) and that they are not reliable time sources (this switch is\u00a0not really needed if these other DCs are not PDCs).<\/p>\n<h2>Active Directory Domain Services (AD DS)<\/h2>\n<ul>\n<li>Provides the DC services. If this service is stopped the DC stops acting as a DC.\u00a0<\/li>\n<li>Pre-Server 2008 this service could not be stopped while the OS was online. But since Server 2008 it can be stopped and started.\u00a0<\/li>\n<\/ul>\n<h2>Active Directory Web Services (AD WS)<\/h2>\n<ul>\n<li>Introduced in Windows Server 2008 R2 to provide\u00a0a web service interface to Active Directory Domain Services (AD DS), Active Directory Lightweight Domain Services (AD LDS), and Active Directory Database Mounting Tool instances running on the DC.\n<ul>\n<li>The Active Directory Database Mounting Tool was new to me so here&#8217;s a <a href=\"http:\/\/technet.microsoft.com\/en-us\/library\/cc753246(v=WS.10).aspx\" target=\"_blank\">link<\/a> to\u00a0what it does. It&#8217;s a pretty cool tool. Starting from Server 2008 you can take AD DS and AD LDS snapshots via the Volume Snapshots Service (VSS)\u00a0(I am writing a post on VSS side by side so expect to see one soon). This makes use of the NTDS VSS writer which ensures that consistent snapshots of the AD databases can be taken. The AD snapshots can be taken manually via the <code>ntdsutil snapshot<\/code> command or via backup software \u00a0or even via images of the whole system. Either ways, once you have such snapshots you can mount the one(s) you want via <code>ntdsutil<\/code> and point Active Directory Database Mounting Tool to it. As the tool name says it &#8220;mounts&#8221; the AD database in the snapshot and exposes it as an LDAP server. You can then use tools such as <code>ldp.exe<\/code> of the AD Users and Computers to go through this instance of the AD database. More info on this tool can be found at <a href=\"http:\/\/technet.microsoft.com\/en-us\/library\/cc753609(v=WS.10).aspx\" target=\"_blank\">this<\/a> and <a href=\"http:\/\/windowsitpro.com\/windows-server-2008\/using-active-directory-snapshots-and-dsamain-tool\" target=\"_blank\">this<\/a> link.<\/li>\n<\/ul>\n<\/li>\n<li>AD WS is what the PowerShell Active Directory module connects to.\u00a0<\/li>\n<li>It is also what the new Active Directory Administrative Center (which in turn uses PowerShell) too connects to.<\/li>\n<li>AD WS is installed automatically when the AD DS or AD LDS roles are installed. It is only activated once the server is promoted to a DC or if and AD LDS instance is created on it.\u00a0<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>The first of my (hopefully!) many posts on Active Directory, based on the WorkshopPLUS sessions I attended last month. Progress is slow as I don&#8217;t have much time, plus I am going through the slides and my notes and adding more information from the Internet and such.\u00a0 This one&#8217;s on the services that are critical &hellip; <a href=\"https:\/\/rakhesh.com\/windows\/active-directory-critical-services\/\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">Active Directory: Domain Controller critical services<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[333,85],"tags":[4,194,355,365,349,47,346,353,354,351,350,352,357],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/1771"}],"collection":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/comments?post=1771"}],"version-history":[{"count":0,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/1771\/revisions"}],"wp:attachment":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/media?parent=1771"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/categories?post=1771"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/tags?post=1771"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}