Tag Archives: Active Directory

DFS NameSpace Issues – MIGRATING FROM FSR TO DFSR FOLLOWING AD Upgrade

I recently assisted a friend who had an issue with DFS Namespaces following an Active Directory Upgrade from 2008R2 to 2012R2.  They were faced with not being able to access the NameSpace following the demotion of the last 2008R2 controller and promotion of the final 2012R2 controller.

Upon opening the DFS NameSpace management console, the following error was displayed when selecting the required NameSpace – “The namespace cannot be queried. Element not found.”

After looking in the FRS (File Replication Service) and DFSR (Distributed File System Replication) event logs, I came to realise that the forest was using FRS for replication! This isn’t supported after 2008R2.  Ideally, you would have completed the migration from FRS to DFSR before upgrading the domain controllers.

Note: Always make sure you have a backup, snapshot or other reliable rollback method in place before doing anything in your live environment. This worked for me, it doesn’t guarantee it will work for you!

With FRS being the likely cause, I needed to confirm this.  I ran the following command to confirm the status –

Dfsrmig /getglobalstate

It returned the following result confirming that FRS was still in fact being used.

Current DFSR global state: 'Start'
Succeeded.

Before being able to look at the DFS NameSpace issue, this needed addressing.  Luckily you can still remediate this after upgrading the domain controllers. I would still advise confirming all the prerequisites are in place BEFORE upgrading!

Now onto the migration from FRS to DFSR.

Firstly, run the following command to move the state to the second of the four states.  The four states being; Start, Prepared, Redirected and Eliminated.

Dfsrmig /setglobalstate 1

You will then want to run a directory sync to speed things up, especially if you have a large replication interval!

Run the following RepAdmin command to get things moving.

Repadmin /syncall /AdeP

You can then monitor the progress by running –

Dfsrmig /getmigrationstate

You will then see any remaining domain controllers that are yet to have synchronized the new state.  Eventually you will see that all domain controllers have migrated to the second state; Prepared.

undefined

Now time to move to the Redirected state.  Same process as the previous set but this time specifying ‘setglobalstate 2’

Dfsrmig /setglobalstate 2
Repadmin /syncall /AdeP
Dfsrmig /getmigrationstate

Again run the RepAdmin to get replication moving and monitor using the ‘getmigrationstate’ command.  As in the previous step, you will eventually see that all domain controllers have migrated to the third state; Redirected.

undefined

Last one! Same as before, but this time you want to use ‘setglobalstate 3 –

Dfsrmig /setglobalstate 3
Repadmin /syncall /AdeP
Dfsrmig /getmigrationstate

Once complete you will get confirmation that you have reached the final state; Eliminated.

undefined

You will now be able to run the ‘net share’ command to see that the SYSVOL share has been moved to ‘C:\Windows\SYSVOL_DFSR\sysvol’ and that the FRS Windows service is stopped and set to disabled.

Output of the ‘net share’ command
File Replication Service Properties (Local Computer) 
General Ing On Recovery Dependencies 
Service name 
Display name 
File Replication Service 
chronizas folders wth fila servers that use Fila 
Cation Service (FRS) instead of the newer OFS 
Path to executable 
C exe 
Startup type 
Service status 
Start 
Stopped 
Stop 
Pause 
Resume 
You can specify the start parameters that apply when you start the service 
Start parameters: 
*ppb'
File Replication Service (FRS) service

This should now give you a correctly functioning directory again! You will want to now check the Directory Services, File Replication and DFSR Logs in Windows Event Viewer to ensure you have no further errors.

Now onto repairing the NameSpace.  I read a few different blogs and guides for this, some included deleting the NameSpace via ADSI Edit others didn’t.

I found I didn’t need to delete anything, bonus.

The get the NameSpace accessible again I found that right clicking the NameSpace and removing it, followed by recreating it using the  ‘New NameSpace Wizard’ did the trick. 

OFS Management 
File Action View Window Help 
z[öl 
OFS Management 
v Namespaces 
Folder I 
Folder 2 
Folder 3 
(Domain-based in Windows Server 2008 mode) 
Namespace Namespace Servers Delegation Search 
New Folder... 
Add Namespace Server... 
Delegate Management Permissions... 
\smt- lab.IocaI\D 
New Folder... 
Replication 
Remove Namespace from Displaym 
New Window from Here 
Delete 
Refresh 
Properties 
Help 
a 
Add Namespace Server... 
Delegate Management 
Remove Namespace fr... 
New Window from Here 
Delete 
Refresh 
Properties 
Help
New Namespace Wizard 
Con 
Namespace Server 
Namespace Name and Settings 
amespace ype 
Review Settings and Create 
Namespace 
You have successfully completed the New Namespace Wizard 
Tasks Enum 
Task 
Creat 
Status 
e namespace
OFS Management 
File Action View Window Help 
zbll O d 
OFS Management 
v Namespaces 
Folder I 
Folder 2 
Folder 3 
Replication 
(Domain-based in Windows Server 2008 mode) 
Namespace Namespace Servers Delegation Search 
FSRoot 
Type 
Name 
Folder I 
Folder 2 
Folder 3 
New Folder... 
Add Namespace Server... 
Delegate Management 
Remove Namespace fr... 
New Window from Here 
Delete 
Refresh 
Properties 
Help

Upon recreating it, all of the folders reappeared and were accessible again with no additional configuration required. (these screenshots are of my lab, not the live environment as it was not appropriate)

Thanks for reading!

Exporting and Importing Active Directory OU Structures

Recently I needed to build out some test Active Directory Forests that resemble production in order to complete some testing. One of the forests contained a significant amount of OU’s that I had no intention of manually recreating.

To run the New-ADOrganizationalUnit cmdlet, you need to provide the OU name and the Path where you want to create it. However, Get-ADOrganizationalUnit doesn’t provide the path, so you need to determine it from the DistinguishedName.

After a number of google searches, I couldn’t find exactly what I needed, so I began piecing together various bits of Powershell that I found. I ended up learning a bit of Regex in the process! Powerful tool if you know how to use it.

I came up with two versions in the end, you can see both below with the differences highlighted.

$OUs=Get-ADOrganizationalUnit -Filter * | select name,DistinguishedName,@{n=’OUPath’;e={$_.distinguishedName -replace '^.+?,',''}},@{n=’OUNum’;e={([regex]::Matches($_.distinguishedName, “OU=” )).count}} | Sort OUNum | export-csv C:\<Path_to_CSV>\OUTree.csv -NoTypeInformation
$OUs=Get-ADOrganizationalUnit -Filter * | select name,DistinguishedName,@{n=’OUPath’;e={$_.distinguishedName -replace '^.+?,(CN|OU|DC.+)','$1'}},@{n=’OUNum’;e={([regex]::Matches($_.distinguishedName, “OU=” )).count}} | Sort OUNum | export-csv C:\<Path_to_CSV>\OUTree.csv -NoTypeInformation

The first one effectively takes everything up to the first ‘,’ and replaces it with nothing, effectively removing the OU Name. The second one captures everything after the first ‘,’ and replaces the whole string with what was captured. Both have produced the same result in my scenario, but it was useful to understand both methods for future use of Regex.

Both also have a property called ‘OUNum’, this property counts how many time ‘OU=’ appears in the original DistigushedName string. OU’s need to be created in order, so that the parent OU exists before the child. This orders the OU’s in ‘tiers’ before exporting them to CSV. All OU’s in the root of the directory will get a value of 1, OU’s within these will get a value of 2 and so on. Credit to ‘David Z’ for this bit!

Once you have your data, you may or may not need to modify the domain. If you are importing it into a different domain, you’ll need to. In my case it was simple enough to do a find and replace in a text editor (eg. DC=lab,DC=local to DC=lab2,DC=local). You could look at using concepts from above to achieve this before exporting the data if you so wish.

Now you have your data, you need to import it. You can run the following in the target domain.

$OUs = import-csv C:\<Path_to_CSV>\OUTree.csv
ForEach ($OU in $OUs) 
          {New-ADOrganizationalUnit -Name $OU.Name -Path $OU.OUPath}

Hope this has been useful. Thanks for reading!

Home Lab – Equipment and Software: Part 1

Thanks for coming back! If you missed the first post in my Home Lab series you can find it here.

In this post I will begin drilling into the equipment and software that makes up my Home Lab and my reasoning for these choices.

I’m going to skip the original Raspberry Pi, there are enough blogs covering the use cases for them and begin at the first significant device; my MacBook Pro (late 2013). I wanted something mobile to start with so I could take it to work, use it on commutes to other offices etc. The MacBook came with an Intel i7 2.3Ghz Quad core chip, 16GB of memory and a 512GB SSD. This wasn’t going to be able to run everything, but its enough to run what I need when I’m away from home.

Before I dive into the VM’s and nested hosts, lets look at the networking configuration I used in VMware Fusion. I created four custom networks in total. One being a Management network for my ESXi Hosts and my VCSA. The second for vMotion and the other two as guest VM networks. None of these networks are NAT’d or have DHCP enabled, however I have selected the ‘Connect the host Mac to this network option in the VMware Fusion Preferences for the management network.

There are two ways to set these custom networks up. The first being the UBER Network Fuser and the second, editing the VMWare Fusion network file. In ‘/Library/Preferences/VMWare Fusion’, you will find the file called ‘networking’.

There are guides already available if you search google for either option so I won’t go into this further. This is the one I used – https://tinyurl.com/y7cjkhky.

Now onto the virtual machines. Running directly on VMware Fusion, I have a Windows Domain Controller / DNS Server, a PFSense firewall and two 6.7 ESXi hosts. They all use local storage, including the ESXi Datastores. My PFSense virtual firewall provides my layer 3 routing and eventually interfaces with my physical firewall. The Domain Controller/DNS Server is a ‘standard’ deployment, nothing special. The two ESXi hosts are the standard 6.7 image available from the VMUG Advantage subscription. Check out the last post for more on VMUG.

Then within ESXi, there’s my vCenter Appliance and the DR node of my vSphere Replication Appliances. At this point you might be wondering how I have fit this into 16GB of memory…

To start with, I built the first ESXi host with 12GB of memory and deployed my vCenter appliance on this (the tiny appliance requires 10GB). Once I had successfully deployed the appliance, I reduced the vCenter memory to 6GB and then followed this by reducing the ESXi host to 7GB.

I then created the second ESXi host, which also has has 7GB allocated. Its a tight squeeze but it allows me the basics I need when I’m not at home and there’s still enough room for some small VM’s with the nested ESXi hosts if needed.

One final thing… To ease the starting and suspension of this lab, I use the following script that I run from PowerShell on the Mac.

Lab_Start_Up

Write-Host "Starting PFSense Firewall"
vmrun start "/Users/<Path_to_VM>/PFSense.vmwarevm" nogui
Write-Host "Starting DC01"
vmrun start "/Users/<Path_to_VM>/DC01/DC01.vmwarevm" nogui
Write-Host "Starting ESX01"
vmrun start "/Users/<Path_to_VM>/ESX01/ESX01.vmwarevm" nogui
Write-Host "Starting ESX02"
vmrun start "/Users/<Path_to_VM>/ESX02/ESX02.vmwarevm" nogui

Write-Host "Start Up Complete!"

Lab_Supend

vmrun suspend "/Users/<Path_to_VM>/ESX02/ESX02.vmwarevm"
vmrun suspend "/Users/<Path_to_VM>/ESX01/ESX01.vmwarevm"
vmrun suspend "/Users/<Path_to_VM>/DC01/DC01.vmwarevm"
vmrun suspend "/Users/<Path_to_VM>/PFSense.vmwarevm"

Write-Host "Suspension Complete!"

That wraps up the high level MacBook Pro setup. Thanks for reading!