HPlum78

Surly this will be the start of the end of owning your own car...?

calsync - CalSync - S2 Unified

PowerShell, I have been an advocate of it for a long time.... In the fist instance you can export your users from your MIS system to a CSV file and then using PowerShell import the users into AD, but to be honest the best way to do this is use PowerShell to conect to your MIS solution and have all of your user life cycle driven from what should be your golden source of data for your users (creation, modifications and deletion). This is something I have done from both CMIS and iSAMS and is one thing I would encourage all IT departments to do is automate these processes as soon as you are able (as mentioned baby steps). Get on the PowerShell journey it's an investment in your own career and if you are a Windows admin it's a skill you will need to continue being a Windows admin! PowerShell.org Don Jones https://donjones.com/powershell/ Jeff Snover The godfather of PowerShell watch his vids on channel 9. https://channel9.msdn.com/Events/Speakers/Jeffrey-Snover Lee Holmes Precision Computing His PowerShell cookbook is well worth a read and comes with some goodies that will help you on your ps learning.

oh and this is useful:- A way of just holding back a new DC from becoming a fully functional DC in a domain, gives you some options around testing your apps/ clients and the like before letting it go wild in your Domains :- $DataValue = "Dc","Pdc","Gc","GcAtSite","GenericGc","GenericGcAtSite","GcIpAddress","Kdc","KdcAtSite","Ldap","LdapAtSite","LdapIpAddress","Rfc1510Kdc","Rfc1510KdcAtSite","Rfc1510UdpKdc","Rfc1510Kpwd","Rfc1510UdpKpwd" New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" -Name DnsAvoidRegisterRecords -Value $DataValue -PropertyType Multistring Restart-Service -Name Netlogon Hope some of this will help.

Just some helpful bits... Unless you absolutely know what connects to your DC's and where from then the following is worth a look before you dive in. (sometimes it hard to sell break fix on something as important as your DC's and AD) https://blogs.technet.microsoft.com/askpfeplat/2013/12/15/domain-and-dc-migrations-how-to-monitor-ldap-kerberos-and-ntlm-traffic-to-your-domain-controllers/ This maybe helpful around the question of what is supported for in place OS upgrades https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/upgrade-domain-controllers-to-windows-server-2016 I know this is a topic that people don't like but it is supported and is a perfectly valid approach if you take out opinion and experience (just recently I talked about this very approach with a premier field engineer) the following is a screen from a pester test that I wrote for testing the state of DC's and AD and is what it returned in my dev environment The code for the pester is here:- [CmdletBinding()] Param( [string]$ADFile = (Read-Host "Please enter the path to your ADreport-*.xml file"), [string]$ADGoldFile = $(Get-ChildItem ('ADGoldConfig-*.xml') | Select-Object name -last 1).name ) $ADSnapshot = Import-Clixml $ADFile Write-Verbose "Loading the AD Gold Config from: $ADGoldFile" $ADGoldConfig = Import-Clixml $ADGoldFile #Begin testing Describe 'Active Directory Forest Operational Readiness checks' -Tags 'Forest' { Context 'Verifying Forest Configuration'{ it "Forest FQDN $($ADGoldConfig.ForestInformation.RootDomain)" { $ADGoldConfig.ForestInformation.RootDomain | Should be $ADSnapshot.ForestInformation.RootDomain } it "ForestMode $($ADGoldConfig.ForestInformation.ForestMode.ToString())"{ $ADGoldConfig.ForestInformation.ForestMode.ToString() | Should be $ADSnapshot.ForestInformation.ForestMode.ToString() } it "Schema Version $($ADGoldConfig.SchemaVersion.objectVersion)"{ $ADGoldConfig.SchemaVersion.objectVersion | Should be $ADSnapshot.SchemaVersion.objectVersion } it "Server $($ADGoldConfig.ForestInformation.DomainNamingMaster) is Domain Naming Master" { $ADGoldConfig.ForestInformation.DomainNamingMaster | Should be $ADSnapshot.ForestInformation.DomainNamingMaster } it "Server $($ADGoldConfig.ForestInformation.SchemaMaster) is Schema Master" { $ADGoldConfig.ForestInformation.SchemaMaster | Should be $ADSnapshot.ForestInformation.SchemaMaster } } Context 'Verifying GlobalCatalogs'{ $ADGoldConfig.ForestInformation.GlobalCatalogs | ForEach-Object{ it "Server $($_) is a GlobalCatalog"{ $ADSnapshot.ForestInformation.GlobalCatalogs.Contains($_) | Should be $true } } } } Describe 'Active Directory Domain Operational Readiness checks' -Tags 'Domain' { Context 'Verifying Domain Configuration'{ it "Total Domain Controllers $($ADGoldConfig.DomainControllers.Count)" { $ADGoldConfig.DomainControllers.Count | Should be $ADSnapshot.DomainControllers.Count } $ADGoldConfig.DomainControllers.Name | ForEach-Object{ it "DomainController $($_) exists"{ $ADSnapshot.DomainControllers.Name.Contains($_) | Should be $true } } it "DNSRoot $($ADGoldConfig.DomainInformation.DNSRoot)"{ $ADGoldConfig.DomainInformation.DNSRoot | Should be $ADSnapshot.DomainInformation.DNSRoot } it "NetBIOSName $($ADGoldConfig.DomainInformation.NetBIOSName)"{ $ADGoldConfig.DomainInformation.NetBIOSName | Should be $ADSnapshot.DomainInformation.NetBIOSName } it "DomainMode $($ADGoldConfig.DomainInformation.DomainMode.ToString())"{ $ADGoldConfig.DomainInformation.DomainMode.ToString() | Should be $ADSnapshot.DomainInformation.DomainMode.ToString() } it "DistinguishedName $($ADGoldConfig.DomainInformation.DistinguishedName)"{ $ADGoldConfig.DomainInformation.DistinguishedName | Should be $ADSnapshot.DomainInformation.DistinguishedName } it "Server $($ADGoldConfig.DomainInformation.RIDMaster) is RIDMaster"{ $ADGoldConfig.DomainInformation.RIDMaster | Should be $ADSnapshot.DomainInformation.RIDMaster } it "Server $($ADGoldConfig.DomainInformation.PDCEmulator) is PDCEmulator"{ $ADGoldConfig.DomainInformation.PDCEmulator | Should be $ADSnapshot.DomainInformation.PDCEmulator } it "Server $($ADGoldConfig.DomainInformation.InfrastructureMaster) is InfrastructureMaster"{ $ADGoldConfig.DomainInformation.InfrastructureMaster | Should be $ADSnapshot.DomainInformation.InfrastructureMaster } } } Describe 'Active Directory Default Password Policy Operational Readiness checks' -Tags 'Password' { Context 'Verifying Default Password Policy'{ it 'ComplexityEnabled'{ $ADGoldConfig.DefaultPassWordPoLicy.ComplexityEnabled | Should be $ADSnapshot.DefaultPassWordPoLicy.ComplexityEnabled } it 'Password History count'{ $ADGoldConfig.DefaultPassWordPoLicy.PasswordHistoryCount | Should be $ADSnapshot.DefaultPassWordPoLicy.PasswordHistoryCount } it "Lockout Threshold equals $($ADGoldConfig.DefaultPassWordPoLicy.LockoutThreshold)"{ $ADGoldConfig.DefaultPassWordPoLicy.LockoutThreshold | Should be $ADSnapshot.DefaultPassWordPoLicy.LockoutThreshold } it "Lockout duration equals $($ADGoldConfig.DefaultPassWordPoLicy.LockoutDuration)"{ $ADGoldConfig.DefaultPassWordPoLicy.LockoutDuration | Should be $ADSnapshot.DefaultPassWordPoLicy.LockoutDuration.ToString() } it "Lockout observation window equals $($ADGoldConfig.DefaultPassWordPoLicy.LockoutObservationWindow)"{ $ADGoldConfig.DefaultPassWordPoLicy.LockoutObservationWindow | Should be $ADSnapshot.DefaultPassWordPoLicy.LockoutObservationWindow.ToString() } it "Min password age equals $($ADGoldConfig.DefaultPassWordPoLicy.MinPasswordAge)"{ $ADGoldConfig.DefaultPassWordPoLicy.MinPasswordAge | Should be $ADSnapshot.DefaultPassWordPoLicy.MinPasswordAge.ToString() } it "Max password age equals $($ADGoldConfig.DefaultPassWordPoLicy.MaxPasswordAge)"{ $ADGoldConfig.DefaultPassWordPoLicy.MaxPasswordAge | Should be $ADSnapshot.DefaultPassWordPoLicy.MaxPasswordAge.ToString() } } } Describe 'Active Directory Sites,subnets & sublinks Operational Readiness' -Tags 'Sites','Subnets','Sitelinks' { Context 'Verifying Active Directory Sites'{ $ADGoldConfig.Sites.Name | ForEach-Object{ it "Site $($_)" { $ADSnapshot.Sites.Name.Contains($_) | Should be $true } } } Context 'Verifying Active Directory Sitelinks'{ $lookupSiteLinks = $ADSnapshot.Sitelinks | Group-Object -AsHashTable -Property Name $ADGoldConfig.Sitelinks | ForEach-Object{ it "Sitelink $($_.Name)" { $_.Name | Should be $($lookupSiteLinks.$($_.Name).Name) } it "Sitelink $($_.Name) costs $($_.Cost)" { $_.Cost | Should be $lookupSiteLinks.$($_.Name).Cost } it "Sitelink $($_.Name) replication interval $($_.ReplicationFrequencyInMinutes)" { $_.ReplicationFrequencyInMinutes | Should be $lookupSiteLinks.$($_.Name).ReplicationFrequencyInMinutes } } } Context 'Verifying Active Directory Subnets'{ $lookupSubnets = $ADSnapshot.SubNets | Group-Object -AsHashTable -Property Name $ADGoldConfig.Subnets | ForEach-Object{ it "Subnet $($_.Name)" { $_.Name | Should be $lookupSubnets.$($_.Name).Name } it "Site $($_.Site)" { $_.Site | Should be $lookupSubnets.$($_.Name).Site } } } } Describe 'Active Directory health checks' -Tags 'ADHC' { Context 'Checking the output of NLTest /Query'{ $NLTest = NLTest.exe /Query it 'NLTest.exe /Query Result' { ($NLTest | out-string).contains('Success') | Should be $true } } } Describe 'Checking the output of DCDiag for issues on all DCs'{ $ADGoldConfig.DomainControllers.Name | ForEach-Object { $DCToTest = $_ $DCDiag = dcdiag.exe /a /s:$DCToTest Context "DCDiag tests on $DCToTest"{ it 'DCDiag.exe -a Result' { ($DCDiag | out-string).contains('failed') | Should be $false } } $DCToTest = $null } } Describe 'Checking the output of RepAdmin /showrepl for replication issues'{ (Repadmin.exe /showrepl * /csv | convertfrom-csv) | Sort-Object 'Source DSA' | Where-Object{$_.'Number of Failures' -ge 0} | ForEach-Object{ it "Replication from $($_.'Source DSA') to $($_.'Destination DSA') has $($_.'Number of Failures') failures" { $_.'Number of Failures' | Should Not BeGreaterThan 0 } } } Describe 'Pinging each Domain Controller'{ $ADGoldConfig.DomainControllers.Name | Sort-Object | ForEach-Object{ it "Ping result for Domain Controller $($_)"{ Test-Connection $_ -Quiet | Should be $true } } } Describe 'Testing local Active Directory TCP ports respond' -Tag 'TCP Tests' { # AD Ports: https://technet.microsoft.com/en-us/library/dd772723(v=ws.10).aspx $Ports = @(53,88,135,139,389,445,464,636,3268,3269,9389) $ADGoldConfig.DomainControllers.Name | ForEach-Object{ $DCToTest = $_ Context "Testing TCP Ports on $DCToTest"{ $Ports | foreach-object{ it "Port test for TCP $_" { (Test-netconnection -ComputerName $DCToTest -Port $_).TcpTestSucceeded | Should be $true } } } $DCToTest = "$null" } } Describe 'Checking local Active Directory Windows services are running'-Tag 'Service Tests'{ $Services = @('ADWS','CertPropSvc','CryptSvc','Dfs','DFSR','DNS','Dnscache','eventlog','gpsvc','kdc',` 'LanmanServer','LanmanWorkstation','Netlogon','NTDS','RpcEptMapper','RpcSs','SamSs',` 'W32Time') $ADGoldConfig.DomainControllers.Name | ForEach-Object{ $DCToTest = $_ Context "Testing TCP Ports on $DCToTest"{ $Services | foreach-object{ $Svc = get-service -ComputerName $DCToTest $_ it "Service: $($Svc.DisplayName)" { $Svc.status | Should be 'Running' } } } $DCToTest = $null } } The pester relies on a script that I found on GIT and is as follows:- [cmdletbinding()] Param($ExportToXML = $True) Import-Module ActiveDirectory #HashTable to save ADReport $ADSnapshot = @{} $ADSnapshot.RootDSE = $(Get-ADRootDSE) $ADSnapshot.ForestInformation = $(Get-ADForest) $ADSnapshot.DomainInformation = $(Get-ADDomain) $ADSnapshot.SchemaVersion = (Get-ADObject (Get-ADRootDSE).schemaNamingContext -Property objectVersion) $ADSnapshot.DomainControllers = $(Get-ADDomainController -Filter *) $ADSnapshot.DomainTrusts = (Get-ADTrust -Filter *) $ADSnapshot.DefaultPassWordPoLicy = $(Get-ADDefaultDomainPasswordPolicy) $ADSnapshot.AuthenticationPolicies = $(Get-ADAuthenticationPolicy -LDAPFilter '(name=AuthenticationPolicy*)') $ADSnapshot.AuthenticationPolicySilos = $(Get-ADAuthenticationPolicySilo -Filter 'Name -like "*AuthenticationPolicySilo*"') $ADSnapshot.CentralAccessPolicies = $(Get-ADCentralAccessPolicy -Filter *) $ADSnapshot.CentralAccessRules = $(Get-ADCentralAccessRule -Filter *) $ADSnapshot.ClaimTransformPolicies = $(Get-ADClaimTransformPolicy -Filter *) $ADSnapshot.ClaimTypes = $(Get-ADClaimType -Filter *) $ADSnapshot.DomainAdministrators =$( Get-ADGroup -Identity $('{0}-512' -f (Get-ADDomain).domainSID) | Get-ADGroupMember -Recursive) $ADSnapshot.OrganizationalUnits = $(Get-ADOrganizationalUnit -Filter *) $ADSnapshot.OptionalFeatures = $(Get-ADOptionalFeature -Filter *) $ADSnapshot.Sites = $(Get-ADReplicationSite -Filter *) $ADSnapshot.Subnets = $(Get-ADReplicationSubnet -Filter *) $ADSnapshot.SiteLinks = $(Get-ADReplicationSiteLink -Filter *) #Export to XML If ($ExportToXML -eq $True) { $ADSnapshot | Export-Clixml "E:\Local\AD_Pester\ADReport-$(get-date -format yyyy-MM-dd).xml" -Encoding UTF8 Return $True }Else{ Return $ADSnapshot } To run the tests and I used the following invoke-OperationValidation available from here:- https://github.com/PowerShell/Operation-Validation-Framework (Invoke-OperationValidation -testFilePath E:\Local\AD_Pester\ -IncludePesterOutput | export-csv .\ADTestResultsPreSchemaUpd.csv) Using the ADreport that the second script creates the tests are run against you DC/ AD configuration, the idea behind this is that I was able to test a lot of individual settings and check a lot of log files and the like after each step of the upgrade process. If you do not update the ADReport you can the see what has changed after each step as these will be marked as failed tests.

Forget about the whole PDC/ BDC thing, FSMO roles replaced the absolute concept of PDC/ BDC design and now all DC's are equal for the purpose of any thing past NT4, this is the simplistic view of the architecture of FSMO roles and the holders of them. To answer your question by the Binaries that you have noted above they are referring to the files that are required to make a Windows Server a DC, nothing more and they are correct that a demotion of a DC will not remove the files a server will use to become a DC the sxs folder essentially. As for the actual AD DB and everything that makes up AD along with DNS (as long as its AD integrated DNS) this will be replicated as part of the DC promotion to a new DC (and will continue to be replicated to all DC's in a domain) and will stop being replicated as soon as a DC has been demoted. FSMO roles have no dependencies on the replication of AD/ AD integrated DNS as this data is replicated to all DC's in the Domain, again a simplistic view of how this works. If I where in your shoes and I had the hardware to support me I would add the new 2016 DC before I started to demote the older DC's in the domain, a topic I am about to pick up on a different thread in a few mins (one that you have commented on DAN).

in fact here https://blogs.technet.microsoft.com/teamdhcp/2012/09/10/migrating-existing-dhcp-server-deployment-to-windows-server-2012-dhcp-failover/ will help you migrate the DHCP Failover config.

I have just done this (a few weeks ago) on a network that has 40K + users and a mass of end users devices and no one even knew, so to answer your first question yeah it can be done during the day. As for DHCP moving the FSMO roles around will not alter the operation of DHCP in my understanding of how that failover works within DHCP, I think that you would have to backup the DB on the Server you are going to bin off and change the mode to hot spare and then setup the fail over again when the new server is built (This is from distant memory as I aint used DHCP in failover mode on a windows server for a long while now!)

Yeah you could just move the FSMO roles with the first command like you say (the -identity can be the FQDN although it will just accept the computer name). I would be tempted to run the second part first just so you have no surprises and you know where everything was living before you move it with the first command. I would then run it again after the move to check that they have all gone to the places you expect (if that makes sense).

Powershell command to do the same thing is like this Move-ADDirectoryServerOperationMasterRole -Identity "DC TO MOVE TO" -OperationMasterRole SchemaMaster,RIDMaster,InfrastructureMaster,DomainNamingMaster,PDCEmulator Powershell to get FSMO role holders:- Get-ADDomain | Select-Object InfrastructureMaster, RIDMaster, PDCEmulator Get-ADForest | Select-Object DomainNamingMaster, SchemaMaster Get-ADDomainController -Filter * | Select-Object Name, Domain, Forest, OperationMasterRoles | Where-Object {$_.OperationMasterRoles} | Format-Table -AutoSize

I cannot see an issue with that approach, see how you get on. Good luck H.

Is the issue a schema thing? I cannot see it, unless its some kind of token issue that the Forest/ Domain Level would case an issue to an application like Facility (not impossible, just not probable) schema changes may do. Rolling back the Forest/ Domain Functional levels will not roll the Schema back... that is a whole different world of hurt right there.

Thinking on mind I don't know that there was a massive change to the Forest Functional stuff between the two versions..... and for that matter from 2008r2. May have been some Domain Functional changes between the 2 (TGT) springs to mind I cannot think of others without digging into it. Was there even much change to the Forest Functional stuff between 2003? would need to look....

Not impossible, see here:- https://blogs.technet.microsoft.com/aman/2012/12/28/step-by-step-guide-to-lower-active-directory-functional-level/

https://technet.microsoft.com/en-us/library/dn440734(v=exchg.150).aspx

FIM/ MIM gives users the ability to change passwords based on answering questions to verify account ownership.

If you have already done the piece of work around getting the computer name to OU mapping in to a csv file then the following would do it:- [array]$WksToOu = Import-Csv .\WksToOUs.csv $WksToOu | %{ Get-ADComputer $_.ComputerName | Move-ADObject -TargetPath $_.TargetOU } The CSV would look like this:- ComputerName,TargetOU IT-2276,"OU=W10,OU=StaffPC,OU=Workstations,DC=YOURDOM,DC=XX,DC=XX,DC=XX" TestPC2,"OU=Room2,OU=StudentPC,OU=Workstations,DC=YOURDOM,DC=XX,DC=XX,DC=XX" TestPC3,"OU=W10,OU=StudentPC,OU=Workstations,DC=YOURDOM,DC=XX,DC=XX,DC=XX" TestPC4,"OU=W10,OU=StudentPC,OU=Workstations,DC=YOURDOM,DC=XX,DC=XX,DC=XX" I will add as always some notes around this sort of script, although the above code will do the job (as will the code further up) if I was approaching this I would have it in a try/ catch and have some error trapping and the like. Also any code that has write-host in it needs these instantly changing to write-output as you can do something with the output, no one really runs scripts in the console....

Like @bald_pig suggests, fruity devices are good at locking accounts out when passwords are changed and they sit there just sending requests to exchange.....

That document is absolutely correct and outlines the possible ways to get your users synced with Azure AD, and outlines the very idiosyncrasies that I was taking about that need to be decided on before you start. So any of the Multiple forests approaches, and the one you chose will be dependent on a number of factors complexity, manageability, the speed you need to deliver a solution, if you have an appetite to support multiple Exchange/ Skype environments so and forth.

I am going to correct something that I said yesterday around Azure AD not being able to accept disparate domains, after talking to a college last night and doing some digging I see that it is now possible to achieve this using AD connect. There are a number of idiosyncrasies around accomplishing this mainly around how you treat these forests/ domains outside of the connection to Azure AD.

If any of you want to contact me directly feel free, give me some background about what you are trying to achieve and some detail around your current setups and I will try point you in the right direction.

I will add this IaaS solutions are more expensive than SaaS solutions, so if you are setting up a VM to run a service that exists as a SaaS offering you will pay for it, and in the case of AD unless you have an absolute need to have your entire AD structure replicated to an offsite VM then I would in the first instance steer away from it. That said there are circumstances where this configuration is desirable but you should make sure that the business need really requires it, and that you make sure you get you AD structure setup accordingly. As for express route its still a little expensive and that's about as much as I can say on that.

I guess you have right now 2 disparate AD forests? and you want to combine these in to one? so the first place I will point you is here https://technet.microsoft.com/en-us/library/cc974335(v=ws.10).aspx you could do this with an azure DC but you would probably be best to just do this with onsite hardware, when you have a continuous forest you can then just use the tools available to sync up to azure AD. There is no way with azure AD to sync dissipate forests.

I like @localzuk think that you are in the right position to think about a cloudy solution to this, if you plan this solution correctly then you can get a lot for your money and take out some of your onsite hardware dependencies for servers and file storage. I know that this will divide the room and I am not saying that an all out lift and shift is the way to use the cloud but there are now a lot of compelling arguments to moving services to the (a) cloud. Mail/ file storage and the likes are prime suspects for this in my view.

Has one of the Server 2008R2 DC had a bad shutdown? this will stop DFS-R, the following may help https://blogs.technet.microsoft.com/filecab/2012/07/23/understanding-dfsr-dirty-unexpected-shutdown-recovery/