Archive for category domain controller

Forcibly Remove Dfs Nameserver

The following steps can be used to remove a Dfs nameserver that no longer exists in your environment.

  1. Log on to a Dfs server
  2. Open an elevated command line
  3. We’re going to use dfsutil with the following parameters: dfsutil diag unmapdomroot \<domainname><DFSname> \<DFSrootserver><DFSshare>
    1. As a sample: dfsutil diag unmapdomroot \\DfsRootName\DfsFolderName \\Server_to_remove\DfsFolderName
  4. No need to reboot just wait for replication

Leave a comment

Renaming Windows Domain Controllers

The following are the steps needed to rename a domain controller; the steps have been tested up to Windows Server 2016.

Note: If your DC is also acting as a Dfs nameroot server, make sure you remove the nameserver from Dfs first!

From an elevated command line, type the following commands:

  1. Add the new domain controller name NEW_DC; we’re replacing OLD_DC
    NETDOM COMPUTERNAME OLD_DC.companydomain.com /ADD:NEW_DC.companydomain.com
  2. Designate the new name as the primary computer name; OLD_DC gets removed and NEW_DC is new primary name
    NETDOM COMPUTERNAME OLD_DC.companydomain.com /MAKEPRIMARY:NEW_DC.companydomain.com
  3. Reboot domain controller
  4. Now, let’s remove the old domain controller name from Active Directory
    NETDOM COMPUTERNAME NEW_DC.companydomain.com /REMOVE:OLD_DC.companydomain.com
  5. Sync all DCs

In the event that you didn’t notice the warning on top and you went ahead and renamed the domain controller and you had Dfs services running on it, here are some instructions on how to manually remove Dfs nameserver and fix the issue.

  1. Log on to the recently renamed domain controller
  2. Open Regedit.exe
  3. Go to HKLM\Software\Microsoft\DFS\Roots\domainV2
  4. Delete the key found under domainV2 and reboot your server
  5. Next, remove the Dfs share from the server
  6. Now you can delete the Dfs folder
  7. Done

2017-06-10_1708

Leave a comment

Vmware Port Mirror and MS Advanced Thread Analytics

The project was to install MS Advanced Thread Analytic Gateway in a virtual machine, in Vmware, to monitor a physical domain controller.

Hardware involved

  1. Domain controller (physical) – DCServer1
  2. DELL switch – switch1
  3. ESXi host – host1
  4. MS ATA Gateway – atagw1

Setup Port Mirroring at Physical Switch Level

DC server DCserver1 and ESXi host1 are physically connected to switch1. DCserver1 connects on port 40 and host1 connects on port 44 of the switch.

We’re going to configure port mirroring on switch1 as source being port 40 and destination port 44 and we’re going to use use both directions in our config. You can use the following link to configure port mirroring on DELL switches.

Configure Vmware for Port Mirroring

As mentioned before, host1 connects to switch1, and we’re going to use this connection (vmnic2) and create a new standard switch (that was my setup). So, at point, vmnic2 connects to port 44 on switch1.

Once your new standard switch is created (vSwitch2), then we’ll create a new port group (ATA-Capture). While creating port group ATA-Capture, make sure to enable Promiscuous Mode and set VLAN ID to All (4095) – this part crucial!

port-group

 

Configure Microsoft ATA Gateway VM

Your MS ATA Gateway will need to have two NICs. One NIC will be used for day to day work and the second NIC for capture. To make thing easier, rename the NIC to something like ‘Capture‘. Next, make sure that your Capture NIC belongs to the ATA-Capture port group.

At this point you should be able to install MS ATA Gateway software.

Leave a comment