DFSR Setup and considerations

DFSR is actually relatively easy to setup.

There’s no need for me to re-invent the wheel or explain in tiny detail, as most of it has all been done before.

So, to start

MS blog about how it can work for you.

DFS Replication in Windows Server 2012 R2

How to set it up

DFSR Setup with screenshots

Another MS blog about how if you have a huge estate, you better use DFSRADMIN command line! (Yeah you’d better!)

DFS Replication and command line

 

AD Certificate Services

I hate certificates. Well, a nice wildcard cert deployed internally is fine, but when there’s a faff to replace certificates and it’s been so long, that you really cannot remember what you did in the first place…I just hate it. So imagine my childish delight when I had to build AD CS!

It’s not that bad in all fairness and it boils down to make server, add role, next next next and let AD do it’s magic for all machines you need sending the certificate to within the domain. That’s just reminded me about the VDM certificate for connection servers, which will come later on.

I followed the MS lab guides and also backed this up with a very nice blog post with pretty screenshots and all worked fine. Just remember to add in any subject alternative names if you have a mixture of FQDN and abbreviated server names within your domain.

AD CS and PKI

Deploying Standalone Root CA (Server 2012)

AD Sites, Subnets and Links

Ok, so you may have set up AD, done your Domain and it all works and the world is a happy place. But Alas! You now have to deal with the Branch Office. Dead easy. You got your connection to it? Check. You know the name you want to use? Check. You got the subnet? Check.

Read these and be done with it!

Understanding it!

Step by Step Set up

More details

There considerations such as the Cost (really for multiple sites) and the Replication schedule. I’ve always found the traffic/bandwidth use, to be minimal, but your mileage may vary depending on those underground wires you’re connected to. Or satellite. Or point to point laser link (Pew pew! Aw it’s foggy it doesn’t work anymore!)

Documenting Active Directory

Over the years I’ve amassed a huge amount of AD related information. Most of it at the moment I’m working through is about creating a Forest/Domains, OU structure, logical/Geographical models and I think if you need to do that… You probably know how to or where to get the information to do it! All the MS stuff is easily accessible so it’s a bit pointless me posting everything I’ve ever read on it.

One thing that is of use and that bypasses the need to actually…Pay for things is a very old school way of making pretty pictures from AD. It doesn’t work on server 2012, so it will need playing with, but it saves a ton of time working through text documents, AD users and computers, then Visio:

AD Visio Tool

Disable IE Enhanced Security

New server built. Need access to vSphere or any other web based, server or appliance web front.

Are you sure?

Do you trust this site?

Do you really trust this site?

Are you sure you trust this site?

Are you really sure you really trust this site?

Just turn it off via GPO

Disable IE Enhanced mode

In all fairness, some people have security concerns about using any browser on a server. I get that. If you’re using server 2012 R2, relatively recently updated and well… You aren’t an idiot, you’re probably OK using it to get media from a trusted site, or use your web based admin pages. Final decision lies with you!

There are situations and environments, where you may have apprentices, or non IT literate staff who are the IT staff; I’ve been involved with a lot of places where they don’t have anyone in an official IT capacity and the highest qualified person is the one who can change the lockscreen on their phone –  where you shouldn’t do this and in fact, should lock it all down as much as you can.

Get Default Gateway…Change Default Gateway

Sometimes, people change things. Sometimes people change subnets and default gateways and you aren’t allowed to inflict serious physical or emotional pain on them like a vengeful senior team member. You have to fix it. Actually that reminds of the time someone took ownership of all the GPO’s in an environment and gave himself the only permissions and everyone wondered why it all broke. And he screamed ‘Blamefest!’ at everyone when he got told off. Ah well, that’s what happens when you give full domain admin rights to an apprentice. But I digress!

Actually, changing default GW 2, The Search For A Script, came about because I was working on an environment where there was originally no internet, then some machines had a working GW, then other machines were given a different one and like many infrastructure related tasks I feel I may have to do again as part of process, I try and find a solution to automate or expedite for next time. So, with no further ado, I used these great links to Find the GW and Change the GW.

PSEXEC to Find:

Get Default GW

Powershell to Change:

Change GW

Fix home drive permissions with powershell

Honestly, there’s some times when…Ok, ALOT of times when you feel like cold water has been thrown over the burden on your shoulders and within a few minutes of googling, someone you’ve never met will save your life. This is one of those 😉

Hundreds of home drives under DFS…And everyone has access to everyone’s drives (thankfully said drives are empty). Then as you create more, you realise that even new ones are doing the same thing. Thankfully, this wonderful person already wrote a powershell script to fix it!

You can see from the comments a slight change needs to be made and if I remember rightly, I think you need to use powershell 2 (or a less modern version anyway)

Fix NTFS home drive permissions script

If you’re using DFS or folder redirection with home drives the following MS KB also helps!

How to dynamically create security-enhanced redirected folders or home folders