Hey Folks!

So, a question came up recently about the Ticket Options in security events 4768 & 4769.  An example of one, below:

So just what are these "Ticket Options?

Well as it turns out, they are the options defined in the ticket by the KDC.  Seems pretty straightforward doesn't it?  Well.  While those options are defined in the RFC itself and in Microsoft’s own documentation of Kerberos, the translation of the RFC list and the Bit Mask that we use in Windows is missing.

For example, we see in the above example that the Ticket Options are 0x4081000.  But, what does this mean?  Which options do we have for this ticket?  Looking at RFC 1510 (Page 40-41) and our own article How the Kerberos Version 5 Authentication Protocol  Works (Key Distribution Center Option Flags Section) we have the Flag Bits for each of the options.  Unfortunately, most of us can't translate Flag Bits into Bit Masks in our heads.  And that translation is missing from our docs.

So, working with a couple of my colleagues, Wayne McIntyre and Seth Moore (who are a couple of wizards that actually CAN translate this stuff in their head), we came up with a nice easy to read table that hopefully will help if you are trying to figure out what 0x4081000 or, something like 0x608100 actually means. (Forwardable, Forwarded, Renewable and Name Canonicalize, just FYI.  For an explanation of each of these, see the aforementioned TechNet Article "How the Kerberos Version 5 Authentication Protocol Works")

One of the more often asked questions we get is regarding DNS Scavenging.  In Josh Jones' TechNet Article titled 'Don't be afraid of DNS Scavenging, just be patient' he perfectly outlines two of the most common scenarios:

"I'm hitting this 'scavenge now' button like a snare drum and nothing is happening.  Why?"

or

"I woke up this morning, my DNS zones are nearly empty and Active Directory is sitting in a corner rocking back and forth crying.  What happened?"

His article is, in my opinion, one of the best articles on how to set up scavenging successfully that I have ever seen.  Couple that with Sean Ivey's article on how DNS Scavenging and DHCP Leases relate and you have a one stop solution for a whole host of problems related to name resolution.

So, when the time comes to set up scavenging (guess what, it's already passed :) ) arm yourself with these two articles and make a tough job MUCH easier!

Don't be afraid of DNS Scavenging. Just be patient. -Josh Jones

&

How DNS Scavenging and the DHCP Lease Duration Relate -Sean Ivey

Sometimes, folks need to keep servers behind firewalls.  Between their corporate network & the Internet and, also inside their own Intranet, though this is more rare and MUCH more problematic.

Here is all the background information you could want on trusts and how they work:

How Domain and Forest Trusts Work

https://technet.microsoft.com/en-us/library/cc773178(v=WS.10).aspx

But, be aware that these ports are just the ports necessary for the trust to work.  It does not address any of the ports that will need to be opened on the firewalls in order to actually do anything over those trusts.  So, adding the ephemeral port ranges for Windows 2003 and Windows 2008 will also be required.  And in 2008 we changed the default 'ephemeral' or RPC port ranges in order to come into IANA standards..

The default dynamic port range for TCP/IP has changed in Windows Vista and in Windows Server 2008:

https://support.microsoft.com/kb/929851

Default RPC port range for Windows Server 2003:

1025-5000

Default RPC port range for Windows 2008 and beyond:

49152-65535

The best resource for what ports are needed by Windows and the various services is here:

How to configure a firewall for domains and trusts

https://support.microsoft.com/default.aspx?scid=kb;en-us;Q179442

And here:

Service overview and network port requirements for the Windows Server system:

https://support.microsoft.com/kb/832017

Hope that helps you keep some sanity!

-Chris Rutledge 

As part of our Active Directory Risk Assessment Program we perform an Operational Interview portion of the engagement.  During this we talk about things we can’t really ask the machines.  Such as, SLA’s, OLA’s, DR Plans and various other things that involve humans more than computers but, are a vital part to the health and risk associated with an enterprise environment.  One of the things that often come up are common scenarios in your Disaster Recovery plans.  This came up for one of my customers and they asked me to compile information on how to handle these common topics.  So I compiled a list of TechNet and KB articles that will hopefully help you guys plug these into your DR plans. (Even having the links to the online articles handy when a disaster comes up can save you time, money, frustration and sanity )  Hope this helps!

- How to recover an Active Directory forest

Planning for Active Directory Forest Recovery

https://technet.microsoft.com/en-us/library/planning-active-directory-forest-recovery(WS.10).aspx

Word Doc of the entire Forest Recovery Whitepaper:

https://go.microsoft.com/fwlink/?LinkId=152459

- How to recover domains

Recovering Active Directory Domain Services

https://technet.microsoft.com/en-us/library/cc816751(WS.10).aspx

- How to recover DNS

(Mostly covered in the Recovering Active Directory Domain Services article but additional info found here)

How to reinstall a dynamic DNS Active Directory-integrated zone

https://support.microsoft.com/kb/294328

- How to seize and transfer FSMO roles

Using Ntdsutil.exe to transfer or seize FSMO roles to a domain controller

https://support.microsoft.com/kb/255504

How to view and transfer FSMO roles in the graphical user interface

https://support.microsoft.com/kb/255690

- How to perform metadata cleanup

Clean Up Server Metadata (2008 & 2008R2)

https://technet.microsoft.com/en-us/library/cc816907%28WS.10%29.aspx

Clean up server metadata (2000, 2003 & 2003R2)

https://technet.microsoft.com/en-us/library/cc736378(WS.10).aspx

- How to recover an entire server

Windows Server Backup Step-by-Step Guide for Windows Server 2008

https://technet.microsoft.com/en-us/library/cc770266(WS.10).aspx

Performing a Full Server Recovery of a Domain Controller

https://technet.microsoft.com/en-us/library/cc772519(WS.10).aspx

- How to perform authoritative restores

- Active Directory database

Performing Authoritative Restore of Active Directory Objects

https://technet.microsoft.com/en-us/library/cc816878(WS.10).aspx

Performing Authoritative Restore of an Application Directory Partition

https://technet.microsoft.com/en-us/library/cc816934(WS.10).aspx

- SYSVOL (requires special recovery procedures)

For DFS Replicated SYSVOL

Restoring and Rebuilding SYSVOL

https://technet.microsoft.com/en-us/library/cc816596(WS.10).aspx

How to force an authoritative and non-authoritative synchronization for DFSR-replicated SYSVOL (like "D4/D2" for FRS)

https://support.microsoft.com/kb/2218556

For FRS Replicated SYSVOL

Using the BurFlags registry key to reinitialize File Replication Service replica sets

https://support.microsoft.com/kb/290762

How to rebuild the SYSVOL tree and its content in a domain

https://support.microsoft.com/kb/315457

- Successfully restoring users and their group memberships

How to restore deleted user accounts and their group memberships in Active Directory

https://support.microsoft.com/kb/840001

- How to perform non-authoritative restores

- Active Directory database

Performing Nonauthoritative Restore of Active Directory Domain Services

https://technet.microsoft.com/en-us/library/cc816627(WS.10).aspx

- SYSVOL (requires special recovery procedures) (Note: Same articles as Authoritative Restore since they include both procedures in the info.)

For DFS Replicated SYSVOL

Restoring and Rebuilding SYSVOL

https://technet.microsoft.com/en-us/library/cc816596(WS.10).aspx

How to force an authoritative and non-authoritative synchronization for DFSR-replicated SYSVOL (like "D4/D2" for FRS)

https://support.microsoft.com/kb/2218556

For FRS Replicated SYSVOL

Using the BurFlags registry key to reinitialize File Replication Service replica sets

https://support.microsoft.com/kb/290762

How to rebuild the SYSVOL tree and its content in a domain

https://support.microsoft.com/kb/315457

-Chris Rutledge

An issue arose today where a customers SQL machine ran out of disk space on the system drive (C:) and we needed to clean up a little bit.  Now, on a Win7 machine you just run Disk Cleanup and kill off those things that you don’t need.  (Debug Dumps, Temp Internet Files, Temp Files, Install Logs etc.)  But, for Windows 2008, Disk Cleanup is not installed by default so, how do you do it?

Well, the Disk Cleanup tool is available on 2008 and, all you have to do is add the Desktop Experience feature to the machine and you’ll have it..  Sweet, right?

“But I don’t want the Desktop Experience pack loaded on my Server, it’s not necessary!”

A VERY good point and, I agree.. So then how do we get the Disk Cleanup Tool?  Fortunately, there is TechNet!

Disk Cleanup option on drive’s general properties and cleanmgr.exe is not present in Windows Server 2008 or Windows Server 2008 R2 by default

Viola!  We can now use the tool intended to help us clean up all the ‘extra’…

“So what about this MASSIVE C:\Windows\winsxs folder that just keeps getting bigger over time?”

Actually, it doesn’t get a ‘big’ as you might think.  I learned something new about WinSxS over at the Engineering Windows 7 MSDN Blog, take a read on this..

Disk Space

Very interesting stuff huh? 

Hope That Helps!

-Chris Rutledge

So the question came up today.  ‘We know what the RID master does with his Pools of RID numbers etc., but what are the RIDs then used for?’

Relative Identifier Allocation

Short and Simple is this..  On a regular stand-alone machine, creating absolutely unique ID numbers for an object that gets created is easy, since it only matters to the one local machine.  However, in an environment like Active Directory where we usually have many machines that are all writing to the same database of objects and then replicating it gets a bit stickier.  The RID Master issues pools of RIDs, 500 at a time, and keeps track of who has which pool of numbers to prevent creating the same SID for two different objects.

Hello Everyone!

I wanted to take the opportunity to welcome you to what will be a veritable treasure trove of quick and easy access to information that you may need, tips and tricks to help, and generally useful things that we as Field Engineers see and use in our work that will help you in yours.

Field Engineers?!

That’s right!  For those of you who may not know, we work for Premier Services to provide our customers with onsite support, training, workshops, health checks, risk assessments, knowledge transfer, chalk talks and, generally anything they need to help them achieve a healthy, mature, stable enterprise computing environment and then keep it that way.  Our intention for this blog is to bring together, across all our different software offerings, links, tips, lists, tricks, scripts and, just about anything else we can think of that will be useful.

Hang On!! Here We Go!!

Chris Rutledge  |  Premier Field Engineer  |  Microsoft Premier