RE: [ActiveDir] DFS

2004-05-11 Thread Jennifer Fountain
I was only thinking about replication between two servers and the data
would be small. Maybe 20 mb here and there - as files are updated. 


Kind Regards,

Jennifer Fountain
RB Inc
3400 E Walnut Street
Colmar, PA  18915 

 -Original Message-
 From: [EMAIL PROTECTED] 
 [mailto:[EMAIL PROTECTED] On Behalf Of 
 Bruce Clingaman
 Sent: Tuesday, May 11, 2004 4:12 PM
 To: [EMAIL PROTECTED]
 Subject: RE: [ActiveDir] DFS
 
 
 1 TB is too much for DFS to replicate between two servers, 
 not to mention four. The replication (FRS) in DFS is flawed. 
 Have you looked into shadow copy or a utility like Robocopy? 
 
 -Original Message-
 From: [EMAIL PROTECTED]
 [mailto:[EMAIL PROTECTED] On Behalf Of 
 Jennifer Fountain
 Sent: Tuesday, May 11, 2004 1:45 PM
 To: [EMAIL PROTECTED]
 Subject: RE: [ActiveDir] DFS
 
 The main objective to to remove the single point of failure I 
 have now - one big file server.  If this goes down, we are 
 SOL.  From what I read/tested, DFS will allow you to point a 
 single folder to shares on different physical locations.  
 (basically, the user sees one server but in reality I have four)
 
 Replication is also something I could take advantage of; 
 However, can you schedule replication in DFS?
 
 Kind Regards,
 
 Jennifer Fountain
 RB Inc
 3400 E Walnut Street
 Colmar, PA  18915 
 
  -Original Message-
  From: [EMAIL PROTECTED]
  [mailto:[EMAIL PROTECTED] On Behalf Of 
 Depp, Dennis 
  M.
  Sent: Tuesday, May 11, 2004 1:59 PM
  To: Salandra, Justin A.; [EMAIL PROTECTED]
  Subject: RE: [ActiveDir] DFS
  
  Justin,
  
  I don't think this is correct.  With DFS, I can set up different 
  subfolders to point to different physical locations.  These 
 physical 
  locations can be setup a redundant pairs, but this is not required.
  
  Denny
  
  -Original Message-
  From: Salandra, Justin A. [EMAIL PROTECTED]
  Sent: 5/11/04 1:41:37 PM
  To: [EMAIL PROTECTED] 
 [EMAIL PROTECTED]
  Subject: RE: [ActiveDir] DFS
  
  Having a DFS structure would mean that you would have 4 servers 
  each with 1 TB of information on them because everything gets 
  replicated to all locations in the DFS.  DFS will NOT put 250 GB on 
  one server, 250 GB on another server and so on.
  
   
  
  -Original Message-
  From: [EMAIL PROTECTED]
  [mailto:[EMAIL PROTECTED] On Behalf Of 
 Rutherford, 
  Robert
  Sent: Tuesday, May 11, 2004 10:54 AM
  To: [EMAIL PROTECTED]
  Subject: RE: [ActiveDir] DFS
  Sensitivity: Private
  
   
  
   
  
  You can install a DFS root on a DC or member server.
  
   
  
  It should work fine, in terms of splitting down a server and 
  distributing the data over a number of other servers. I'm 
 assuming you 
  only want to use DFS to make a central share access hierarchy?
  
   
  
  I would not use the replication side of it though as it's 
  inherently flawed... well it was on 2000 and have read it hasn't 
  changed that significantly on 2k3. If you do want to use the 
  replication then I would only use it for read only data, i.e.
  Application distribution points.
  
   
  
  BR,
  
   
  
  Rob
  
   
  
  -Original Message-
  From: Jennifer Fountain [mailto:[EMAIL PROTECTED] 
  Sent: 11 May 2004 14:47
  To: [EMAIL PROTECTED]
  Subject: [ActiveDir] DFS
  Sensitivity: Private
  
  Does anyone here use DFS?  If so, do you use it 
 for load 
  balancing?  Did you install it on a DC? It's own server?
   We are looking into breaking our one huge file server (1 
 tb of space) 
  into 4 smaller servers (more manageable and wanted to look into DFS.
  We do have NT/95 clients but that should not stop me because I can 
  install the AD client on them.
  
  Thanks for any info! 
  
   
  
  Kind Regards,
  
  Jennifer Fountain 
  RB Inc 
  3400 E Walnut Street 
  Colmar, PA  18915
  
  
  The information transmitted is intended only for the person or 
  entity
  to which it is addressed and may contain confidential and/or
  privileged material. Any use (including retransmission 
 or copying)
  of this information by persons or entities other than 
 the intended
  recipient is prohibited. If you are not the intended 
 recipient of 
  this
  transmission, please contact the sender and delete the material
  from any computer. The sender is not responsible for the 
  completeness or accuracy of this communication as it has been
  transmitted over a public network. Any replies to this 
 email may 
  be
  monitored by the MCPS-PRS Alliance for quality control 
 and other 
  purposes.
  
  List info   : http://www.activedir.org/mail_list.htm
  List FAQ: 

RE: [ActiveDir] Replacing Shared Storage on a two node cluster

2004-05-11 Thread Nathan Danso
I have added additional drives and proceeded to move the data using clusterrecorvery 
tool. I have been successful in moving all my data except the quorum disk to the new 
drive. Attempt to move the data  generates an error  Failed to switch resource. Any 
ideas?
thanks

Nathan

TradeWeb LLC
Harborside Financial Center
2200 Plaza five
Jersey City, NJ 07311-4993
Tel: (201) 536-5846
Fax: (201) 915-3161
[EMAIL PROTECTED]



-Original Message-
From: Mulnick, Al [mailto:[EMAIL PROTECTED]
Sent: Tuesday, May 11, 2004 12:19 PM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] Replacing Shared Storage on a two node cluster


Essentially, your concern is about disk signatures.
http://support.microsoft.com/default.aspx?scid=kb;en-us;305793 should help
explain about that some.

What I'm curiuos about is why you don't just add disk and move the data over
to it?  Expand vs. replace?

Al 

-Original Message-
From: Nathan Danso [mailto:[EMAIL PROTECTED] 
Sent: Wednesday, May 05, 2004 9:19 AM
To: [EMAIL PROTECTED]
Subject: [ActiveDir] Replacing Shared Storage on a two node cluster

Greetings to all,
As always, many thanks for  your quick responses to problems and questions
posted on this forum.  I am currently  running an Active/ Passive  Cluster
service on  2 dell power edge  2650  connected to another Dell 220s Power
vault   subsystem. I have  3 X 18G (RAID 5) drives in my subsystem
configured as 3  separate virtual logical array disk.
I am about to embark on a mission to  move the data   from the  virtual
disk to its own disk  by adding additional  drives and configuring them as
RAID 5 for my data and RAID 1 for my log files. Knowing how sensitive
cluster service is  to disk changes, I will like to approach this  task very
carefully without  destroying my cluster installation and having to rebuild
the whole cluster. I was hoping someone may have already gone through this
process and will kindly enlightened me to any obstacles that I should be
aware of. My numerous searches have produced  different  confusing
approaches. Any help will be greatly appreciated. Thanks in advance.

Nathan




This e-mail may contain confidential and/or privileged information. If you
are not the intended recipient (or have received this e-mail in error)
please notify the sender immediately and destroy this e-mail. Any
unauthorized copying, disclosure or distribution of the material in this
e-mail is strictly forbidden. TradeWeb reserves the right to monitor all
e-mail communications through its networks.

List info   : http://www.activedir.org/mail_list.htm
List FAQ: http://www.activedir.org/list_faq.htm
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
List info   : http://www.activedir.org/mail_list.htm
List FAQ: http://www.activedir.org/list_faq.htm
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
List info   : http://www.activedir.org/mail_list.htm
List FAQ: http://www.activedir.org/list_faq.htm
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/


[ActiveDir] Desktop security solutions

2004-05-11 Thread Rimmerman, Russ



What's
everyone's opinion of desktop security software solutions like Cisco's ACS,
which every time some application tries to change the registry or a file or
something and it's not part of your pre-configured security template, it pops up
an alert asking you if it's OK? Mgmt is asking for this and I personally
think it will be too much of a bear to make servers with their applications play
well with it (or user desktops).

~~This e-mail is confidential, may contain proprietary informationof the Cooper Cameron Corporation and its operating Divisionsand may be confidential or privileged.This e-mail should be read, copied, disseminated and/or used onlyby the addressee. If you have received this message in error pleasedelete it, together with any attachments, from your system.~~

RE: [ActiveDir] Desktop security solutions

2004-05-11 Thread Michael B. Smith








Weve deployed CSA (Cisco Secure ACS)
on several of our Internet-facing servers and for a few clients. It works
surprisingly well.











From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rimmerman, Russ
Sent: Tuesday, May 11, 2004 7:58
PM
To: '[EMAIL PROTECTED]'
Subject: [ActiveDir] Desktop
security solutions







What's everyone's opinion of desktop
security software solutions like Cisco's ACS, which every time some application
tries to change the registry or a file or something and it's not part of your
pre-configured security template, it pops up an alert asking you if it's
OK? Mgmt is asking for this and I personally think it will be too much of
a bear to make servers with their applications play well with it (or user
desktops).








~~This e-mail is confidential, may contain proprietary informationof the Cooper Cameron Corporation and its operating Divisionsand may be confidential or privileged.This e-mail should be read, copied, disseminated and/or used onlyby the addressee. If you have received this message in error pleasedelete it, together with any attachments, from your system.~~

RE: [ActiveDir] Desktop security solutions

2004-05-11 Thread Caple, Andrew
Title: Message



With 
applications like this (also CheckPoint VPN) we've created a batch file that we 
run on the local computer which changes the permissions registery and in program 
files to allow the user to have read/write to that spacific 
folder.

As you 
said below becasue it's a adhoc type request it's a pain to have to go around to 
the specific computers and run the file - but it's better than the 
alternative.

Regards, Andrew


-Original Message-From: 
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] 
On Behalf Of Rimmerman, RussSent: Wednesday, May 12, 2004 9:58 
AMTo: '[EMAIL PROTECTED]'Subject: [ActiveDir] 
Desktop security solutions
What's 
everyone's opinion of desktop security software solutions like Cisco's ACS, 
which every time some application tries to change the registry or a file or 
something and it's not part of your pre-configured security template, it pops up 
an alert asking you if it's OK? Mgmt is asking for this and I personally 
think it will be too much of a bear to make servers with their applications play 
well with it (or user desktops).

  
  
~~This 
  e-mail is confidential, may contain proprietary informationof the 
  Cooper Cameron Corporation and its operating Divisionsand may be 
  confidential or privileged.This e-mail should be read, copied, 
  disseminated and/or used onlyby the addressee. If you have received 
  this message in error pleasedelete it, together with any attachments, 
  from your 
  system.~~


[ActiveDir] Senior Microsoft Solution Architect

2004-05-11 Thread Joshua Lopez
Hello members of ActiveDir,

I'd like to inform you all of an opportunity for a Senior Microsoft Solution
Architect.  Below you'll find the details of the position as well as my
contact information.

 

 Immediate Opening for a Senior Microsoft Solution Architect 

Our client is a Fortune 10 company, and provides customers the ability to
out-task or completely out-source IT infrastructure programs and projects.
Sales and Service delivery capabilities in major North American markets
across the United States and Canada are augmented through strategic partners
to provide global coverage. 

Seeking a Senior Level Solutions Architect with detailed experience with
Windows, Exchange and Active Directory.  Willing to travel in the New York
City area.

Job Description:

The Solution Architect's role is to ensure that solutions delivered are
technically sound and conform to leading-edge standards in the IT industry.
He plays a leadership role in supporting the company's partners and clients,
acting as a lead technical representative towards customers, gathering
information and proposing solutions.  The Solution Architect is a leader who
has the judgment, determination, people and technical skills to ensure
smooth and successful implementation and completion of all consulting
assignments.  

The successful candidate will play a key role in both the pre-sales process
and implementation of Microsoft solutions.

Requirements:

Detailed  knowledge of Microsoft Windows, Exchange and Active Directory
Experience in large-scale IT projects
Strong analytical, technical and communication skills
Must have broad business and technical expertise
7+ Years experience
Willing to Travel in North America

Qualified candidates should send their resume to [EMAIL PROTECTED] or call
650-627-9919.

---



Josh Lopez
Kain Management Group, LLC
1650 Borel Place, Suite 125
San Mateo, CA 94402
[EMAIL PROTECTED]
(650) 627-9919
www.kainmg.com

List info   : http://www.activedir.org/mail_list.htm
List FAQ: http://www.activedir.org/list_faq.htm
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/


RE: [ActiveDir] Desktop security solutions

2004-05-11 Thread Rimmerman, Russ



But 
would you recommend it on an all server and all desktop deployment 
solution? Or just internet facing servers and a few select clients? 
And why?

  -Original Message-From: 
  [EMAIL PROTECTED] 
  [mailto:[EMAIL PROTECTED]On Behalf Of Michael B. 
  SmithSent: Tuesday, May 11, 2004 7:07 PMTo: 
  [EMAIL PROTECTED]Subject: RE: [ActiveDir] Desktop 
  security solutions
  
  We've deployed CSA 
  (Cisco Secure ACS) on several of our Internet-facing servers and for a few 
  clients. It works surprisingly well.
  
  
  
  
  
  From: 
  [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] 
  On Behalf Of Rimmerman, 
  RussSent: Tuesday, May 11, 
  2004 7:58 PMTo: 
  '[EMAIL PROTECTED]'Subject: [ActiveDir] Desktop security 
  solutions
  
  
  What's everyone's 
  opinion of desktop security software solutions like Cisco's ACS, which every 
  time some application tries to change the registry or a file or something and 
  it's not part of your pre-configured security template, it pops up an alert 
  asking you if it's OK? Mgmt is asking for this and I personally think it 
  will be too much of a bear to make servers with their applications play well 
  with it (or user desktops).
  


  ~~This 
e-mail is confidential, may contain proprietary informationof the 
Cooper Cameron Corporation and its operating Divisionsand may be 
confidential or privileged.This e-mail should be read, copied, 
disseminated and/or used onlyby the addressee. If you have received 
this message in error pleasedelete it, together with any 
attachments, from your 
system.~~

~~This e-mail is confidential, may contain proprietary informationof the Cooper Cameron Corporation and its operating Divisionsand may be confidential or privileged.This e-mail should be read, copied, disseminated and/or used onlyby the addressee. If you have received this message in error pleasedelete it, together with any attachments, from your system.~~

[ActiveDir] Reccomendations Please

2004-05-11 Thread John Harvey
Title: Reccomendations Please






Hello All


This may be off topic so please forgive me if it is but I thought I might get some usefull suggestions from the other list members. 

Due to a serious shortfall in staffing and increasingly complexity and growth my challenge is to find something we can use in a Windows 2000 AD domain to do some remote monitoring of servers for the basics like disk space, memory and the like (basic system checks and monitoring, nothing too deep just the facts and thats it really) and if it did event traps it would also be usefull but not neccesary, we are dealing with 140 sites and some 300 servers but would be looking at something that handled a core of 50 servers to start. We really do not know where to start and being completely honest we just dont have the time and staff to dig into this, patch management is eating us alive as it is so ANY suggestions anyone can give us or reccomendations would be great.

Oh and if anyone knows anything which is freeware or low cost that would be even better, as usual the need is now and the budget is nil as usual. So suggestions please all would be much appreciated.

Thanks in Advance all.



John Harvey

Network Administrator

Brisbane Catholic Education

Phone +61 7 3840 0588

Mobile +61 0418 189 689

email: [EMAIL PROTECTED]




**
This e-mail (including all attachments) is intended solely for the
named addressee/s and may contain confidential information. If you
have received this e-mail in error please inform the sender and delete
it from your computer system and destroy any copies.

This e-mail is subject to copyright. Any unauthorised disclosure,
modification or distribution is expressly prohibited.

Unless explicitly attributed, the opinions expressed in this e-mail do
not necessarily represent the official position or opinions of
Brisbane Catholic Education.

Brisbane Catholic Education gives no warranties that this e-mail is
free from computer viruses or other defects. Except for
responsibilities implied by law that cannot be excluded, Brisbane
Catholic Education, its employees and agents will not be responsible
for any loss, damage or consequence arising from this e-mail.


RE: [ActiveDir] Reccomendations Please

2004-05-11 Thread Caple, Andrew
Title: Message



John,

Good 
afternoon, a colleague of mine has used the following software before: http://www.bb4.com and highly recommends it. 
Apparently it takes a little bit to set it up but is very stable and works very 
well.

Personally I haven't had a look at it yet, but I've seen it work in a 
production environment and it seems to work quite well. I hope this is what you 
were after.

Regards, Andrew





Andrew 
Caple



Infrastructure 
Engineer


Phone:+61 3 9861 
5425


Facsimile:+61 3 9861 
5510

[EMAIL PROTECTED]



  
  

  

  105 Camberwell Road,Hawthorn 
  East, Vic 
3123








 






-Original Message-From: 
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] 
On Behalf Of John HarveySent: Wednesday, May 12, 2004 3:07 
PMTo: [EMAIL PROTECTED]Subject: [ActiveDir] 
Reccomendations Please
Hello All 
This may be off topic so please forgive me if it is 
but I thought I might get some usefull suggestions from the other list 
members. 
Due to a serious shortfall in staffing and 
increasingly complexity and growth my challenge is to find something we can use 
in a Windows 2000 AD domain to do some remote monitoring of servers for the 
basics like disk space, memory and the like (basic system checks and monitoring, 
nothing too deep just the facts and thats it really) and if it did event traps 
it would also be usefull but not neccesary, we are dealing with 140 sites and 
some 300 servers but would be looking at something that handled a core of 50 
servers to start. We really do not know where to start and being 
completely honest we just dont have the time and staff to dig into this, patch 
management is eating us alive as it is so ANY suggestions anyone can give us or 
reccomendations would be great.
Oh and if anyone knows anything which is freeware or 
low cost that would be even better, as usual the need is now and the budget is 
nil as usual. So suggestions please all would be much 
appreciated.
Thanks in Advance all. 
John 
Harvey Network Administrator Brisbane Catholic 
Education Phone +61 7 3840 0588 Mobile +61 0418 189 
689 email: [EMAIL PROTECTED] 


  
  
**
This e-mail (including all attachments) is intended solely for the
named addressee/s and may contain confidential information. If you
have received this e-mail in error please inform the sender and delete
it from your computer system and destroy any copies.


This e-mail is subject to copyright. Any unauthorised disclosure,
modification or distribution is expressly prohibited.

Unless explicitly attributed, the opinions expressed in this e-mail do
not necessarily represent the official position or opinions of
Brisbane Catholic Education.

Brisbane Catholic Education gives no warranties that this e-mail is
free from computer viruses or other defects. Except for
responsibilities implied by law that cannot be excluded, Brisbane
Catholic Education, its employees and agents will not be responsible
for any loss, damage or consequence arising from this e-mail.



RE: [ActiveDir] DNS settings

2004-05-11 Thread Rick Reynolds
I have always pushed lmhosts and hosts files to the machines...
 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Carlos Magalhaes
Sent: Monday, May 10, 2004 11:38 AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS settings 



Nope that's what gets me, and its happening to ALL the laptops, (they are
the only machines using third party dialers)

 

AGRRR - there must be an answer :P

 

CM

 


  _  


From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Charlie Kaiser
Sent: Monday, May 10, 2004 8:30 PM
To: '[EMAIL PROTECTED]'
Subject: RE: [ActiveDir] DNS settings 

 

Is there any hard coding of DNS settings on the laptop's network connection
properties? This will override any server-assigned DNS settings...

 

 

**
Charlie Kaiser
MCSE, CCNA
Systems Engineer
Essex Credit / Brickwalk
510 595 5083
**

-Original Message-
From: Carlos Magalhaes [mailto:[EMAIL PROTECTED] 
Sent: Monday, May 10, 2004 11:15 AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS settings 

Hey Al,

 

Yeah all the settings are suppose to be set via the ISP , most ISP's run
DHCP so yes the settings should be set. The weird thing is that only the DNS
settings are being forced to our network, the user gets a valid third party
IP address and default gateway, just not a DNS setting, that's what made me
think it might be something on our network.

 

We done run WINS just DNS.

 

Thank you and Keep well!

 

CM

 


  _  


From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Mulnick, Al
Sent: Monday, May 10, 2004 4:31 PM
To: '[EMAIL PROTECTED]'
Subject: RE: [ActiveDir] DNS settings 

 

Trying to remember exactly, but wouldn't they get their DNS settings from
the ISP upon connection either through their software locally or from their
RRAS server?

 

Al

 


  _  


From: Carlos Magalhaes [mailto:[EMAIL PROTECTED] 
Sent: Monday, May 10, 2004 9:41 AM
To: [EMAIL PROTECTED]
Subject: [ActiveDir] DNS settings 

Hey all,

 

I have a weird issue; all our laptop users have their own third part dial
up's (RRAS and RAS) for their convenience. When the users dial up to their
third party ISP's (all users) they obtain an IP address from the ISP but
their DNS settings are being forced to the networks internal DNS servers,
remembering that this is a PPP connection.  This causes havoc on their dial
ups. I have had a look at the DNS settings the GPO and even the DHCP server.
I don't see anything that would force a PPP connection to use the internal
DNS servers. The settings are not hard coded into the PPP connections IP
settings.

 

Anyone have an idea of what this is or maybe I over looked something.


Thanks!

 

Carlos 

attachment: winmail.dat

RE: [ActiveDir] DNS settings

2004-05-11 Thread Rutherford, Robert
Title: Message



It's 
either got to be WINS or Hosts files while using the standard W2K VPN dial-up. I 
don't think WINS is a bad solution to be honest unless you want to dig into 
your pocket.

If you use a 3rd party, i.e. Checkpoint, then their technology 
allows for overlay of your DNS setting post connection. I mentioned IPass
earlier and they can do a similar thing with their client, i.e. push on your 
internal DNS server post connection to an IPass ISP.



  
  -Original Message-From: 
  [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] 
  On Behalf Of Rick ReynoldsSent: 11 May 2004 
  08:14To: [EMAIL PROTECTED]Subject: RE:
  [ActiveDir] DNS settings 
  I 
  have always pushed lmhosts and hosts files to the 
  machines...
  
  
-Original Message-From: 
[EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED]On Behalf Of Carlos
MagalhaesSent: Monday, May 10, 2004 11:38 AMTo:
[EMAIL PROTECTED]Subject: RE: [ActiveDir] DNS settings 


Nope thats what 
gets me, and its happening to ALL the laptops, (they are the only machines 
using third party dialers)

AGRRR  there must 
be an answer :P

CM





From: 
[EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of Charlie KaiserSent: Monday, May 10, 2004 8:30
PMTo: '[EMAIL PROTECTED]'Subject: RE: [ActiveDir] DNS settings 



Is there 
any hard coding of DNS settings on the laptop's network connection 
properties? This will override any server-assigned DNS 
settings...




**Charlie 
KaiserMCSE, 
CCNASystems 
EngineerEssex Credit / 
Brickwalk510 595 
5083**

  -Original 
  Message-From: Carlos 
  Magalhaes [mailto:[EMAIL PROTECTED] Sent: Monday, May 10, 2004 11:15 
  AMTo: [EMAIL PROTECTED]Subject: RE: [ActiveDir] DNS settings 
  
  Hey 
  Al,
  
  Yeah all the 
  settings are suppose to be set via the ISP , most ISP's run DHCP so yes 
  the settings should be set. The weird thing is that only the DNS settings 
  are being forced to our network, the user gets a valid third party IP 
  address and default gateway, just not a DNS setting, that's what made me 
  think it might be something on our network.
  
  We done run WINS 
  just DNS.
  
  Thank you and 
  Keep well!
  
  CM
  
  
  
  
  
  From: 
  [EMAIL PROTECTED] 
  [mailto:[EMAIL PROTECTED] On Behalf Of Mulnick, AlSent: Monday, May 10, 2004 4:31 
  PMTo: '[EMAIL PROTECTED]'Subject: RE: [ActiveDir] DNS settings 
  
  
  Trying to
  remember exactly, but wouldn't they get their DNS settings from the ISP 
  upon connection either through their software locally or from their RRAS 
  server?
  
  Al
  
  
  
  
  From: 
  Carlos Magalhaes [mailto:[EMAIL PROTECTED] Sent: Monday, May 10, 2004 9:41 
  AMTo: [EMAIL PROTECTED]Subject: [ActiveDir] DNS settings 
  
  Hey 
  all,
  
  I have a weird issue; all our 
  laptop users have their own third part dial up's (RRAS and RAS) for their 
  convenience. When the users dial up to their third party ISP's (all users) 
  they obtain an IP address from the ISP but their DNS settings are being 
  forced to the networks internal DNS servers, remembering that this is a 
  PPP connection. This causes havoc on their dial ups. I have had a 
  look at the DNS settings the GPO and even the DHCP server. I don't see 
  anything that would force a PPP connection to use the internal DNS
  servers. The settings are not hard coded into the PPP connections IP
  settings.
  
  Anyone have an idea of what 
  this is or maybe I over looked something.
  Thanks!
  
  Carlos 
  The information transmitted is intended only for the person or entityto which it is addressed and may contain confidential and/orprivileged material. Any use (including retransmission or copying)of this information by persons or entities other than the intendedrecipient is prohibited.  If you are not the intended recipient of thistransmission, please contact the sender and delete the materialfrom any computer. The sender is not responsible for the completeness or accuracy of this communication as it has beentransmitted over a public network. Any replies to this email may bemonitored by the MCPS-PRS Alliance for quality control and other purposes.


RE: [ActiveDir] DNS settings

2004-05-11 Thread Carlos Magalhaes
Title: Message








We havent and still dont use
WINS , this network only uses DNS. 



The problem I am having is that the user
logged onto our network can work fine DNS is working etc. The user dialed up to
their own ISPs are being forced to our internal DNS servers, they still
get a valid IP addy from the ISP they just are forced to use ours















From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rutherford, Robert
Sent: Tuesday, May 11, 2004 9:56
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 







It's either got to be WINS or Hosts files
while using the standard W2K VPN dial-up. I don't think WINS is a bad solution
to be honest unless you want to dig into your pocket.











If you use a 3rd party, i.e.
Checkpoint, then their technology allows for overlay of your DNS setting post
connection. I mentioned IPass earlier and they can do a similar thing with
their client, i.e. push on your internal DNS server post connection to an IPass
ISP.

















-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Rick Reynolds
Sent: 11 May 2004 08:14
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 



I have always pushed lmhosts and hosts
files to the machines...











-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Carlos Magalhaes
Sent: Monday, May 10, 2004 11:38
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 

Nope thats what gets me, and its
happening to ALL the laptops, (they are the only machines using third party
dialers)



AGRRR  there must be an answer :P



CM











From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Charlie Kaiser
Sent: Monday, May 10, 2004 8:30 PM
To: '[EMAIL PROTECTED]'
Subject: RE: [ActiveDir] DNS
settings 







Is there any
hard coding of DNS settings on the laptop's network connection properties? This
will override any server-assigned DNS settings...















**
Charlie
Kaiser
MCSE,
CCNA
Systems
Engineer
Essex Credit /
Brickwalk
510
595 5083
**



-Original Message-
From: Carlos Magalhaes
[mailto:[EMAIL PROTECTED] 
Sent: Monday, May 10, 2004 11:15
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 

Hey Al,



Yeah all the settings are suppose to be
set via the ISP , most ISP's run DHCP so yes the settings should be set. The
weird thing is that only the DNS settings are being forced to our network, the
user gets a valid third party IP address and default gateway, just not a DNS
setting, that's what made me think it might be something on our network.



We done run WINS just DNS.



Thank you and Keep well!



CM











From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Mulnick, Al
Sent: Monday, May 10, 2004 4:31 PM
To: '[EMAIL PROTECTED]'
Subject: RE: [ActiveDir] DNS
settings 





Trying to remember exactly, but wouldn't they
get their DNS settings from the ISP upon connection either through their
software locally or from their RRAS server?



Al









From: Carlos
Magalhaes [mailto:[EMAIL PROTECTED] 
Sent: Monday, May 10, 2004 9:41 AM
To: [EMAIL PROTECTED]
Subject: [ActiveDir] DNS settings 

Hey all,



I have a weird issue; all our laptop users have their own
third part dial up's (RRAS and RAS) for their convenience. When the users dial
up to their third party ISP's (all users) they obtain an IP address from the
ISP but their DNS settings are being forced to the networks internal DNS
servers, remembering that this is a PPP connection. This causes havoc on
their dial ups. I have had a look at the DNS settings the GPO and even the DHCP
server. I don't see anything that would force a PPP connection to use the
internal DNS servers. The settings are not hard coded into the PPP connections
IP settings.



Anyone have an idea of what this is or maybe I over looked
something.


Thanks!



Carlos 








The information transmitted is intended only for the person or entity
to which it is addressed and may contain confidential and/or
privileged material. Any use (including retransmission or copying)
of this information by persons or entities other than the intended
recipient is prohibited. If you are not the intended recipient of this
transmission, please contact the sender and delete the material
from any computer. The sender is not responsible for the 
completeness or accuracy of this communication as it has been
transmitted over a public network. Any replies to this email may be
monitored by the MCPS-PRS Alliance for quality control and other 
purposes.








RE: [ActiveDir] DNS settings

2004-05-11 Thread Rutherford, Robert
Title: Message



Sorry 
I think I have lost track here somewhere... I probably didn't read your problem 
correctly.

I 
would actually think that it is better for them to resolve to your internal DNS 
servers. I have seen loads of issues with people trying to get it to work the 
other way round. The only thing is that do your internal DNS servers forward 
out? If they did then you would probably be in an ok 
situation?

I'd 
still like to find out how your machines are getting their DNS entries though?? 
Strange.



-Original Message-From: Carlos 
Magalhaes [mailto:[EMAIL PROTECTED] Sent: 11 May 2004 
09:14To: [EMAIL PROTECTED]Subject: RE: 
[ActiveDir] DNS settings 

  
  We havent and still 
  dont use WINS , this network only uses DNS. 
  
  The problem I am 
  having is that the user logged onto our network can work fine DNS is working 
  etc. The user dialed up to their own ISPs are being forced to our internal 
  DNS servers, they still get a valid IP addy from the ISP they just are
  forced to use ours
  
  
  
  
  
  
  
  From: 
  [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] 
  On Behalf Of Rutherford,
  RobertSent: Tuesday, May 11, 
  2004 9:56 AMTo: 
  [EMAIL PROTECTED]Subject: RE: [ActiveDir] DNS settings 
  
  
  
  It's either got to be 
  WINS or Hosts files while using the standard W2K VPN dial-up. I don't think 
  WINS is a bad solution to be honest unless you want to dig into your
  pocket.
  
  
  
  If you use a 
  3rd party, i.e. Checkpoint, then their technology allows for overlay of your 
  DNS setting post connection. I mentioned IPass earlier and they can do a
  similar thing with their client, i.e. push on your internal DNS server post 
  connection to an IPass ISP.
  
  
  
  
  
-Original 
Message-From:
[EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of Rick ReynoldsSent: 11 May 2004 08:14To: [EMAIL PROTECTED]Subject: RE: [ActiveDir] DNS settings 


I have always 
pushed lmhosts and hosts files to the 
machines...


-Original 
  Message-From: 
  [EMAIL PROTECTED] 
  [mailto:[EMAIL PROTECTED]On Behalf Of Carlos 
  MagalhaesSent: Monday, 
  May 10, 2004 11:38 AMTo: 
  [EMAIL PROTECTED]Subject: RE: [ActiveDir] DNS settings 
  
  Nope thats what 
  gets me, and its happening to ALL the laptops, (they are the only machines 
  using third party dialers)
  
  AGRRR  there 
  must be an answer :P
  
  CM
  
  
  
  
  
  From: 
  [EMAIL PROTECTED] 
  [mailto:[EMAIL PROTECTED] On Behalf Of Charlie 
  KaiserSent: Monday, May 
  10, 2004 8:30 PMTo: 
  '[EMAIL PROTECTED]'Subject: RE: [ActiveDir] DNS settings 
  
  
  
  Is 
  there any hard coding of DNS settings on the laptop's network connection 
  properties? This will override any server-assigned DNS 
  settings...
  
  
  
  
  **Charlie 
  KaiserMCSE, 
  CCNASystems 
  EngineerEssex Credit / 
  Brickwalk510 595 
  5083**
  
-Original 
Message-From: 
Carlos Magalhaes [mailto:[EMAIL PROTECTED] Sent: Monday, May 10, 2004 11:15 
AMTo: [EMAIL PROTECTED]Subject: RE: [ActiveDir] DNS 
settings 
Hey 
Al,

Yeah all the 
settings are suppose to be set via the ISP , most ISP's run DHCP so yes 
the settings should be set. The weird thing is that only the DNS
settings are being forced to our network, the user gets a valid third 
party IP address and default gateway, just not a DNS setting, that's 
what made me think it might be something on our 
network.

We done run 
WINS just DNS.

Thank you and 
Keep well!

CM





From: 
[EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of Mulnick, 
AlSent: Monday, May 
10, 2004 4:31 PMTo: 
'[EMAIL PROTECTED]'Subject: RE: [ActiveDir] DNS 
settings 

Trying to 
remember exactly, but wouldn't they get their DNS settings from the ISP 
upon connection either through their software locally or from their RRAS 
server?

Al




From: 
Carlos Magalhaes [mailto:[EMAIL PROTECTED] Sent: Monday, May 10, 2004 9:41 
AMTo: [EMAIL PROTECTED]Subject: [ActiveDir] DNS settings 

Hey 
all,

I have a weird issue; all 
our laptop users have their own third part dial up's (RRAS and RAS) for 
their convenience. When the users dial up to their third party ISP's 
(all users) they obtain an IP address from the ISP but their DNS
settings are being forced to the networks 

RE: [ActiveDir] DNS settings

2004-05-11 Thread Carlos Magalhaes
Title: Message








Hey Robert,



Ok there is nothing wrong with the internal
DNS at all, they can resolve everything they want when logged onto the network.



Their problem is when they go home and are
off the network they use their own third party ISP accounts with the default
windows dialer to create a 56k Dial up PPP connection to a third party ISP.
This is for their own email and internet usage. At this stage (when they dial
up) they are not connected to us in any way what so ever.



What I am finding strange is that the ISP
usually assigns them a valid IP, DNS and gateway from the ISPs DHCP
server. The weird thing here is that they are assigned a valid IP and gateway
but the DNS servers for that PPP connection is using our internal DNS server address.
Which causes a nightmare when they try to resolve names while connected to the
ISP. 



As you can see the ISP can not resolve
names cause its trying to use the DNS settings of our internal network.



Thats what I dont get and I dont
get why its doing this either L



Thanks for your time.











From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rutherford, Robert
Sent: Tuesday, May 11, 2004 10:53
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 







Sorry I think I have lost track here
somewhere... I probably didn't read your problem correctly.











I would actually think that it is better
for them to resolve to your internal DNS servers. I have seen loads of issues
with people trying to get it to work the other way round. The only thing is
that do your internal DNS servers forward out? If they did then you would
probably be in an ok situation?











I'd still like to find out how your
machines are getting their DNS entries though?? Strange.

















-Original Message-
From: Carlos Magalhaes
[mailto:[EMAIL PROTECTED] 
Sent: 11 May 2004 09:14
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 





We havent and still dont use
WINS , this network only uses DNS. 



The problem I am having is that the user
logged onto our network can work fine DNS is working etc. The user dialed up to
their own ISPs are being forced to our internal DNS servers, they still
get a valid IP addy from the ISP they just are forced to use
ours















From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Rutherford, Robert
Sent: Tuesday, May 11, 2004 9:56
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 







It's either got to be WINS or Hosts files
while using the standard W2K VPN dial-up. I don't think WINS is a bad solution
to be honest unless you want to dig into your pocket.











If you use a 3rd party, i.e.
Checkpoint, then their technology allows for overlay of your DNS setting post
connection. I mentioned IPass earlier and they can do a similar thing with
their client, i.e. push on your internal DNS server post connection to an IPass
ISP.

















-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rick Reynolds
Sent: 11 May 2004 08:14
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 



I have always pushed lmhosts and hosts
files to the machines...











-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]On
Behalf Of Carlos Magalhaes
Sent: Monday, May 10, 2004 11:38
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 

Nope thats what gets me, and its
happening to ALL the laptops, (they are the only machines using third party
dialers)



AGRRR  there must be an answer :P



CM











From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Charlie Kaiser
Sent: Monday, May 10, 2004 8:30 PM
To: '[EMAIL PROTECTED]'
Subject: RE: [ActiveDir] DNS
settings 







Is there any
hard coding of DNS settings on the laptop's network connection properties? This
will override any server-assigned DNS settings...















**
Charlie
Kaiser
MCSE,
CCNA
Systems
Engineer
Essex Credit /
Brickwalk
510
595 5083
**



-Original Message-
From: Carlos Magalhaes
[mailto:[EMAIL PROTECTED] 
Sent: Monday, May 10, 2004 11:15
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 

Hey Al,



Yeah all the settings are suppose to be
set via the ISP , most ISP's run DHCP so yes the settings should be set. The
weird thing is that only the DNS settings are being forced to our network, the
user gets a valid third party IP address and default gateway, just not a DNS
setting, that's what made me think it might be something on our network.



We done run WINS just DNS.



Thank you and Keep well!



CM











From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mulnick, Al
Sent: Monday, May 10, 2004 4:31 PM
To: '[EMAIL PROTECTED]'
Subject: RE: [ActiveDir] DNS
settings 





Trying to remember exactly, but wouldn't
they get their DNS settings from the ISP upon connection either through their
software locally 

RE: [ActiveDir] Setting \winlogon\welcome by ADM

2004-05-11 Thread Yakir, Ronen
Title: Message



Hi

I have 
tried it on the default domain policy.

Ronen

  
  -Original Message-From: Darren Mar-Elia 
  [mailto:[EMAIL PROTECTED] On Behalf Of Darren 
  Mar-EliaSent: Sunday, May 09, 2004 7:05 PMTo: 
  [EMAIL PROTECTED]Subject: RE: [ActiveDir] Setting 
  \winlogon\welcome by ADM
  Ronen-
  What I've seen is that the key you've listed below is populated when I 
  set local policy on a machine that is part of a domain, but I'm not connected 
  to the domain. My guess is that this is Windows' way of preventing a 
  disconnected user from overriding domain policy by simply setting it locally 
  when they're offline. Are you setting this policy in a local GPO and if so, 
  are you connected to the domain when you set it? 
  
-Original Message- From: 
[EMAIL PROTECTED]on behalf ofYakir, Ronen 
Sent: Sun 5/9/2004 5:24 AM To: 
[EMAIL PROTECTED] Cc: Subject: RE: 
[ActiveDir] Setting \winlogon\welcome by ADM 
HiWhat I see is the the following key is generated 
when I set the policyin the gpo 
mmc[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\GroupPolicyObjects\{15087322-E2C5-4C7A-902A-E813FA21EB66}Machine\SOFTWARE\Microsoft\Windows 
NT\CurrentVersion\Winlogon]"Welcome"=hex(2):25,00,63,00,6f,00,6d,00,70,00,75,00,74,00,65,00,72,00,6e,00,\ 
61,00,6d,00,65,00,25,00,00,00But after that, the actual registry key 
(Software\Microsoft\WindowsNT\currentversion\Winlogon\welcome) is not 
created and the value is notset.Does this key needs to be setup 
by the policies 
regkey(hklm\software\microsoft\windows\currentversion\policies\system) 
ordirectly?Ronen-Original Message-From: 
[EMAIL PROTECTED][mailto:[EMAIL PROTECTED]] 
On Behalf Of Darren Mar-EliaSent: Thursday, May 06, 2004 8:30 PMTo: 
[EMAIL PROTECTED]Subject: RE: [ActiveDir] Setting 
\winlogon\welcome by ADMOk. I'm not sure I understand what 
you're seeing. You say that the"group policy objects reg key is being 
updated". Does that mean you seeit appearing in the GPO Editor UI as 
being enabled but when you processthe GPO, it does not get stamped on 
the workstation's registry?If so, this might be a separate problem. 
Can you run Gpresult on theworkstation and see what it 
returns?-Original Message-From: 
[EMAIL PROTECTED][mailto:[EMAIL PROTECTED]] 
On Behalf Of Yakir, RonenSent: Thursday, May 06, 2004 12:24 AMTo: 
[EMAIL PROTECTED]Subject: RE: [ActiveDir] Setting 
\winlogon\welcome by ADMHiOnly tested it today.Well 
- it does not work.The ADM template is loading, the group policy 
objects reg key is beingupdated.But, the actual desired registry 
key is not affected (after secedit.Logoff and 
logon)Ronen-Original Message-From: 
[EMAIL PROTECTED][mailto:[EMAIL PROTECTED]] 
On Behalf Of Darren Mar-EliaSent: Wednesday, May 05, 2004 8:20 AMTo: 
[EMAIL PROTECTED]Subject: RE: [ActiveDir] Setting 
\winlogon\welcome by ADMHi-I think this might work. Give it 
a go. I made the assumption that youwanted %computername% to be resolved 
to the actual machinename. If not,then go ahead and remove the 
EXPANDABLETEXT keyword.CLASS MACHINECATEGORY "set 
welcome"POLICY "Display Computer 
Name" KEYNAME 
"Software\Microsoft\Windows 
NT\currentversion\Winlogon" 
PART "Enter Message:" EDITTEXT 
EXPANDABLETEXT 
 DEFAULT 
"%computername%" 
 VALUENAME 
"Welcome" END PARTEND 
POLICYEND CATEGORYDarren-Original 
Message-From: [EMAIL PROTECTED][mailto:[EMAIL PROTECTED]] 
On Behalf Of Yakir, RonenSent: Tuesday, May 04, 2004 2:17 AMTo: 
[EMAIL PROTECTED]Subject: [ActiveDir] Setting 
\winlogon\welcome by ADMHiI am trying to set the 
\software\microsoft\windowsnt\currentversion\winlogon\welcome key so 
that the text will appear inthe alt-ctrl-del screen.Doing so 
directly works, but not by gpo.This is the adm I have 
tried:CLASS MACHINECATEGORY 
"set welcome"POLICY "Display Computer Name"KEYNAME 
"Software\Microsoft\Windows 
NT\currentversion\Winlogon" 
PART "Computer 
name"VALUENAME "Welcome"Value text "%computername%"END 
PARTEND POLICYEND 
CATEGORY==But no 
successAny help?ThanksRonenList 
info : http://www.activedir.org/mail_list.htmList 
FAQ : http://www.activedir.org/list_faq.htmList 
archive:http://www.mail-archive.com/activedir%40mail.activedir.org/List 
info : http://www.activedir.org/mail_list.htmList 
FAQ : http://www.activedir.org/list_faq.htmList 
archive:http://www.mail-archive.com/activedir%40mail.activedir.org/List 
info : http://www.activedir.org/mail_list.htmList 
FAQ : http://www.activedir.org/list_faq.htmList 
archive:http://www.mail-archive.com/activedir%40mail.activedir.org/List 
info : http://www.activedir.org/mail_list.htmList 

RE: [ActiveDir] LDAP stress tool for AD 2003

2004-05-11 Thread silenty
Hello, all
Eric, can you point to the location of such a cool tool like ADPerf?
I've google'd but have got no results...


--
Best regards,
Alex.



- Original Message - 
From: Eric Fleischman
To: [EMAIL PROTECTED]
Sent: Sunday, May 09, 2004 5:22 PM
Subject: RE: [ActiveDir] LDAP stress tool for AD 2003


I'll weigh in here a bit...

I would argue there are lots of types of stress one can put on a DC and no single 
metric measures everything. In my brain, I typically first go through the following 
checklist of sorts to figure out what I'm looking at when testing a given DC:
0) Will the entire DIT on this DC be cached in memory - how much physical memory do we 
have? If dit=2gb and ram2gb, probably yes; if dit=2.6gb and
ram3gb, are we using /3gb?; if 64bit, how much physical memory do we
have
(as that is the only limit really)?
1) What is functionality level of this domain (2k mixed or 2k native or 2k03
functional) and is the DC also a GC?
2) How many other domains in forest?
3) How many trusts to domains in other forests and downlevel domains?
4) What does the disk subsystem look like on this box? Where are dit and logs stored?

After that is in mind, I ask myself this question: what is the most important thing 
this DC will be doing that need be finished quickly? For many DCs, the answer 
authentication probably comes to mind. For some others (say GCs servicing Exchange) 
queries (such as ANR) may be your answer. Still others might be some other application 
which it need satisfy. It just depends upon the box.

Then, I look at the box and say logically is this thing optimized for this scenario. 
That's hard for me to quantify really. ;)

Now you indicated ldap calls specifically...within ldap calls we typically think of a 
few common things:
0)   can the query be satisfied from info already in cache
1)   is the query hitting solid indexes
2)   within a slow query, there are fundamentally two reasons a
query
can be slow:
a.   cpu-bound (such as a large index intersection)
b.   i/o-bound (badly-designed search filter that need walk a lot of
objects as it isn't hitting good indexes)

With the info in those three items, there should be something painstakingly obvious to 
you: no single test can adequately measure each of these items. Further, any item from 
that list or my earlier list of general things this DC does can bog down the DC. We 
have some thresholds in place with default values that are typically good (for 
example, only 4 LDAP op's processed per physical CPU at a time by default, or perhaps 
for you MaxConcurrentAPI will be your bottleneck..I have no idea) to prevent swamping 
other subsystems, like I/O or secure channel. These things can be tweaked, but it's 
hard to give huge advice that is general enough to be of any use..that's what the 
defaults try to do. ;)

I have seen boxes tuned to ANR before that got abused by a bad authentication setup 
and consequently, despite the amazing disk i/o subsystem and other things done, came 
to its knees due to some bad client requests and bad authentication configuration 
server-side. It's worth watching everything the box does. ADPerf is a great tool for 
this.

If you give us some further insight in to the types of queries this box will be 
servicing we might be of more help. At least I think I might be. ;)

~Eric





From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Darren Mar-Elia
Sent: Sunday, May 09, 2004 10:59 AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] LDAP stress tool for AD 2003

There is a load test tool for AD, called ADTest. Check it out at: 
http://www.microsoft.com/downloads/details.aspx?FamilyID=4814fe3f-92ce-4
871-b8a4-99f98b3f4338DisplayLang=en
-Original Message- 
From: [EMAIL PROTECTED] on behalf of Tony Murray
Sent: Sun 5/9/2004 8:40 AM
To: [EMAIL PROTECTED]
Cc:
Subject: RE: [ActiveDir] LDAP stress tool for AD 2003
Hi Steve

I'm not aware of anything specific.  The ldclt tool (comes with iPlanet) might also 
work for AD, but I haven't tried it.

Being an ASP.NET guru you should be able to script something quite easily
:-)   You can track expensive and inefficient queries (good for a stress
test) by using the method described in the link below.

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnactdi
r/html/efficientadapps.asp

Also be aware that the LDAP policies in place on the DCs will protect the DC to a 
certain extent.  For example, the maximum number of records returned for a single 
query is 1000, although you can change these by modifying the MaxPageSize policy or by 
paging the results using the pagedResultsControl LDAP control.

Tony




From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Steve Schofield
Sent: Sonntag, 9. Mai 2004 16:07
To: [EMAIL PROTECTED]
Subject: [ActiveDir] LDAP stress tool for AD 2003
i have a need to find a tool that will help stress test LDAP calls to AD. Anyone aware 
of a tool such as this?  I know in the web world 

RE: [ActiveDir] LDAP stress tool for AD 2003

2004-05-11 Thread Eric Fleischman
I also should have probably pointed you to adtest. Adtest can do some
load testing as well but be sure you keep in mind the caveats below.
http://www.microsoft.com/downloads/details.aspx?FamilyID=4814fe3f-92ce-4
871-b8a4-99f98b3f4338DisplayLang=en

Bottom line: nothing is as good as actually perf monitoring when you
deploy and proactively looking for issues.

~Eric


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Steve Schofield
Sent: Monday, May 10, 2004 3:52 PM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] LDAP stress tool for AD 2003

Thanks for the replies,  Didn't realize i was getting someone in trouble
but I won't get in the middle of that.  I'll sit on the sidelines and
enjoy someone else getting the hard-time!  

Steve Schofield - MCP, CCA
[EMAIL PROTECTED]
Windows Server Architecture 
Ext - (616)-791-3773 Int - 13773




 [EMAIL PROTECTED] 05/09/04 09:55PM 
I've dissected a bit and put some info inline.
I'm a bit tired so sorry if it is a bit incoherent. ;)

Eric
(would have been ~Eric but Joe's been making fun of that as of late
;))


Eric Fleischman
Escalation Engineer
Platforms Critical Problem Resolution (CPR) - Directory Services


-Original Message-
From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of Steve
Schofield
Sent: Sunday, May 09, 2004 6:33 PM
To: [EMAIL PROTECTED] 
Subject: Re: [ActiveDir] LDAP stress tool for AD 2003

Good questions Eric,  there will be five DC's in this site that will
be
doing authentication.  Exchange server and DC's that are dedicated to
exchange are in another site.  The main type of authentication will be
two
types, regular logins via a logon on a client, others will be LDAP
enabled
web/client applications making a connection checking
credentials(mostly
web-based).   In our test environment we have the domain controllers
already
behind a hardware load-balancer doing this and app's calling a VIP.
Applications and clients haven't seen any difference nor has this
affected
the directory.  My background is from the web world of ASP.NET/ ASP.
Things like scalability, well designed applications is something I can
influence to insure the directory.  I suppose I could write my own
stress
tools but would rather use a proven tool.

0) Will the entire DIT on this DC be cached in memory - how much
physical
memory do we have? If dit=2gb and ram2gb, probably yes; if
dit=2.6gb
and
ram3gb, are we using /3gb?; if 64bit, how much physical memory do we
have
(as that is the only limit really)?
Servers each have 2.5 gig of ram, some are DL380's g2/g3 models
running
5
drives (OS/Logs on one mirrored set, database on another RAID 5 set of
disks) There are a couple of 4 proc ML570's, 2.5 gig ram 7 HD set
(mirror
OS, mirror - Logs, RAID 5 - database)

[EFLEIS] - Getting the DIT and logs on different physical gives you an
umph in perf, I'd go down that road if it is an option.
How big is the DIT?

1) What is functionality level of this domain (2k mixed or 2k native
or
2k03
functional) and is the DC also a GC?
2003 functionality

[EFLEIS] - Reason I asked: users in a domain which is 2k native or
greater needs to talk to a GC during auth. Therefore, you want GCs to
be
plentiful. I really like making all of my DCs in to GCs in high-load
sites.

2) How many other domains in forest?
This only has two domains in production Forest, one root domain, one
child
domain.

3) How many trusts to domains in other forests and downlevel domains?
Three one way trusts to lab domains, the lab domains trust the
production
domain but production doesn't trust the lab.

4) What does the disk subsystem look like on this box?  Where are dit
and
logs stored?
Most DC's have a 5 drive set.  Mirrored OS, Logs together and one
drive
set
RAID 5 that holds the database, as I stated we have a couple DC's that
have
a 7 drive set, Mirrored OS, Mirrored Logs, RAID 5 Set for database.
Note:
these servers that have the 7 drive setup hold the FSMO roles (RID,
PDC
emulator)

Now you indicated ldap calls specifically...within ldap calls we
typically
think of a few common things:
0)   can the query be satisfied from info already in cache
Not sure how to answer, I'm going to have to research how to utilize
the
cache in AD.  Is this similiar to using the TEMPDB in SQL to store
stuff
in
memory?
[EFLEIS] - We do it for you, it's not something you utilize per se. We
cache stuff for you and have algorithms to decide what to cache. In
2k03, we'll cache up to 2gb of stuff (or less if there is memory
pressure of coursewe back off if we see memory being used heavily)
without /3gb, up to about 2.6gb if you have /3gb enabled. Oh, that's
on
32bit. On 64bit the sky's the limit.
If your dit is 2gb (2.6 if you have more physical ram and /3gb)
you'll
want to think a bit about this and what sorts of inefficient searches
you have. If the whole thing fits in cache, sure we want efficient
searches, but it isn't nearly as bad as we don't take a huge i/o hit
typically.

1)   

RE: [ActiveDir] DNS settings

2004-05-11 Thread Carlos Magalhaes
Title: Message








DHCP Enabled. . . . . . . . . . . : Yes

Autoconfiguration Enabled . . . . : Yes

IP Address. . . . . . . . . . . . : 196.2.45.82

Subnet Mask . . . . . . . . . . . : ispSubnetMask

Default Gateway . . . . . . . . . : ispGateWay

DHCP Server . . . . . . . . . . . : ispDHCPServer

DNS Servers . . . . . . . . . . . : internal/localDNS











From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rutherford, Robert
Sent: Tuesday, May 11, 2004 12:05
PM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 







For some reason I thought you were using a
VPN to connect I'm an idiot and should have read the detail.











Can you humour me and justpost an
IPCONFIG /ALL dump from a troubled client.. just type local DNS in place of
your internal IP range if required.











Thanks,











Rob





-Original Message-
From: Carlos Magalhaes
[mailto:[EMAIL PROTECTED] 
Sent: 11 May 2004 10:03
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 

Hey Robert,



Ok there is nothing wrong with the
internal DNS at all, they can resolve everything they want when logged onto the
network.



Their problem is when they go home and are
off the network they use their own third party ISP accounts with the default
windows dialer to create a 56k Dial up PPP connection to a third party ISP.
This is for their own email and internet usage. At this stage (when they dial
up) they are not connected to us in any way what so ever.



What I am finding strange is that the ISP
usually assigns them a valid IP, DNS and gateway from the ISPs DHCP
server. The weird thing here is that they are assigned a valid IP and gateway
but the DNS servers for that PPP connection is using our internal DNS server
address. Which causes a nightmare when they try to resolve names while
connected to the ISP. 



As you can see the ISP can not resolve
names cause its trying to use the DNS settings of our internal network.



Thats what I dont get and I
dont get why its doing this either L



Thanks for your time.











From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Rutherford, Robert
Sent: Tuesday, May 11, 2004 10:53
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 







Sorry I think I have lost track here
somewhere... I probably didn't read your problem correctly.











I would actually think that it is better
for them to resolve to your internal DNS servers. I have seen loads of issues
with people trying to get it to work the other way round. The only thing is
that do your internal DNS servers forward out? If they did then you would
probably be in an ok situation?











I'd still like to find out how your
machines are getting their DNS entries though?? Strange.

















-Original Message-
From: Carlos Magalhaes
[mailto:[EMAIL PROTECTED] 
Sent: 11 May 2004 09:14
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 





We havent and still dont use
WINS , this network only uses DNS. 



The problem I am having is that the user
logged onto our network can work fine DNS is working etc. The user dialed up to
their own ISPs are being forced to our internal DNS servers, they still
get a valid IP addy from the ISP they just are forced to use
ours















From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Rutherford, Robert
Sent: Tuesday, May 11, 2004 9:56
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 







It's either got to be WINS or Hosts files
while using the standard W2K VPN dial-up. I don't think WINS is a bad solution
to be honest unless you want to dig into your pocket.











If you use a 3rd party, i.e.
Checkpoint, then their technology allows for overlay of your DNS setting post
connection. I mentioned IPass earlier and they can do a similar thing with
their client, i.e. push on your internal DNS server post connection to an IPass
ISP.

















-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rick Reynolds
Sent: 11 May 2004 08:14
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 



I have always pushed lmhosts and hosts
files to the machines...











-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]On
Behalf Of Carlos Magalhaes
Sent: Monday, May 10, 2004 11:38
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 

Nope thats what gets me, and its
happening to ALL the laptops, (they are the only machines using third party
dialers)



AGRRR  there must be an answer :P



CM











From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Charlie Kaiser
Sent: Monday, May 10, 2004 8:30 PM
To: '[EMAIL PROTECTED]'
Subject: RE: [ActiveDir] DNS
settings 







Is there any
hard coding of DNS settings on the laptop's network connection properties? This
will override any server-assigned DNS settings...















**
Charlie
Kaiser
MCSE,
CCNA

RE: [ActiveDir] (OT) DNS settings

2004-05-11 Thread Rutherford, Robert
Title: Message



I take 
it that you also use DHCP in your internal networks, i.e. you don't assign
static IP'sto your internal NIC's? As a test could you just disable the 
internal NIC and try the dialup again?

Are 
all the machine exactly the same, i.e. same model with same 
NIC's?

Sorry 
if I seem to be shooting all over the place but we will home in 
eventually.

  
  -Original Message-From: Carlos Magalhaes 
  [mailto:[EMAIL PROTECTED] Sent: 11 May 2004 13:11To: 
  [EMAIL PROTECTED]Subject: RE: [ActiveDir] DNS settings 
  
  
  DHCP Enabled. . . . . 
  . . . . . . : Yes
  Autoconfiguration 
  Enabled . . . . : Yes
  IP Address. . . . . . 
  . . . . . . : 196.2.45.82
  Subnet Mask . . . . . 
  . . . . . . : ispSubnetMask
  Default Gateway . . . 
  . . . . . . : ispGateWay
  DHCP Server . . . . . 
  . . . . . . : ispDHCPServer
  DNS Servers . . . . . 
  . . . . . . : internal/localDNS
  
  
  
  
  
  From: 
  [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] 
  On Behalf Of Rutherford,
  RobertSent: Tuesday, May 11, 
  2004 12:05 PMTo: 
  [EMAIL PROTECTED]Subject: RE: [ActiveDir] DNS settings 
  
  
  
  For some reason I 
  thought you were using a VPN to connect I'm an idiot and should have read 
  the detail.
  
  
  
  Can you humour me and 
  justpost an IPCONFIG /ALL dump from a troubled client.. just type local 
  DNS in place of your internal IP range if 
  required.
  
  
  
  Thanks,
  
  
  
  Rob
  
-Original 
Message-From: Carlos 
Magalhaes [mailto:[EMAIL PROTECTED] Sent: 11 May 2004 10:03To: [EMAIL PROTECTED]Subject: RE: [ActiveDir] DNS settings 

Hey 
Robert,

Ok there is nothing 
wrong with the internal DNS at all, they can resolve everything they want 
when logged onto the network.

Their problem is 
when they go home and are off the network they use their own third party ISP 
accounts with the default windows dialer to create a 56k Dial up PPP
connection to a third party ISP. This is for their own email and internet 
usage. At this stage (when they dial up) they are not connected to us in any 
way what so ever.

What I am finding 
strange is that the ISP usually assigns them a valid IP, DNS and gateway 
from the ISPs DHCP server. The weird thing here is that they are assigned a 
valid IP and gateway but the DNS servers for that PPP connection is using 
our internal DNS server address. Which causes a nightmare when they try to 
resolve names while connected to the ISP. 

As you can see the 
ISP can not resolve names cause its trying to use the DNS settings of our 
internal network.

Thats what I dont 
get and I dont get why its doing this either L

Thanks for your 
time.





From: 
[EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of Rutherford, 
RobertSent: Tuesday, May 
11, 2004 10:53 AMTo: 
[EMAIL PROTECTED]Subject: RE: [ActiveDir] DNS settings 



Sorry I think I 
have lost track here somewhere... I probably didn't read your problem
correctly.



I would actually 
think that it is better for them to resolve to your internal DNS servers. I 
have seen loads of issues with people trying to get it to work the other way 
round. The only thing is that do your internal DNS servers forward out? If 
they did then you would probably be in an ok 
situation?



I'd still like to 
find out how your machines are getting their DNS entries though?? 
Strange.





-Original 
Message-From: Carlos 
Magalhaes [mailto:[EMAIL PROTECTED] Sent: 11 May 2004 09:14To: [EMAIL PROTECTED]Subject: RE: [ActiveDir] DNS settings 

We havent and 
  still dont use WINS , this network only uses DNS. 
  
  
  The problem I am 
  having is that the user logged onto our network can work fine DNS is
  working etc. The user dialed up to their own ISPs are being forced to our 
  internal DNS servers, they still get a valid IP addy from the ISP they 
  just are forced to use ours
  
  
  
  
  
  
  
  From: 
  [EMAIL PROTECTED] 
  [mailto:[EMAIL PROTECTED] On Behalf Of Rutherford, 
  RobertSent: Tuesday, May 
  11, 2004 9:56 AMTo: 
  [EMAIL PROTECTED]Subject: RE: [ActiveDir] DNS settings 
  
  
  
  It's either got 
  to be WINS or Hosts files while using the standard W2K VPN dial-up. I 
  don't think WINS is a bad solution to be honest unless you want to dig 
  into your pocket.
  
  
  
  If you use 
  a 3rd party, i.e. Checkpoint, then their technology allows for overlay of 
  your DNS setting post connection. I mentioned IPass earlier and they can 
  do a similar thing with their client, i.e. push on your internal DNS
  server post connection to 

RE: [ActiveDir] DNS settings

2004-05-11 Thread Carlos Magalhaes
Title: Message








Well, thats what the intention is
with ISP DHCP, but for some reason its not change JUST the DNS settings for
that connection.











From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Patrick - IT Department
Sent: Tuesday, May 11, 2004 2:20
PM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 





I would try pointing your DNS
settings to your ISP DNS server.



-Original
Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Carlos Magalhaes
Sent: Tuesday, May 11, 2004 8:11
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 



DHCP Enabled. . . . . . .
. . . . : Yes

Autoconfiguration Enabled
. . . . : Yes

IP Address. . . . . . . .
. . . . : 196.2.45.82

Subnet Mask . . . . . . .
. . . . : ispSubnetMask

Default Gateway . . . . .
. . . . : ispGateWay

DHCP Server . . . . . . .
. . . . : ispDHCPServer

DNS Servers . . . . . . .
. . . . : internal/localDNS













From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rutherford, Robert
Sent: Tuesday, May 11, 2004 12:05
PM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 



For some reason I thought
you were using a VPN to connect I'm an idiot and should have read the
detail.



Can you humour me and
justpost an IPCONFIG /ALL dump from a troubled client.. just type local
DNS in place of your internal IP range if required.



Thanks,



Rob

-Original
Message-
From: Carlos Magalhaes
[mailto:[EMAIL PROTECTED] 
Sent: 11 May 2004 10:03
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 

Hey
Robert,



Ok there
is nothing wrong with the internal DNS at all, they can resolve everything they
want when logged onto the network.



Their
problem is when they go home and are off the network they use their own third
party ISP accounts with the default windows dialer to create a 56k Dial up PPP
connection to a third party ISP. This is for their own email and internet
usage. At this stage (when they dial up) they are not connected to us in any
way what so ever.



What I
am finding strange is that the ISP usually assigns them a valid IP, DNS and
gateway from the ISPs DHCP server. The weird thing here is that they are
assigned a valid IP and gateway but the DNS servers for that PPP connection is
using our internal DNS server address. Which causes a nightmare when they try
to resolve names while connected to the ISP. 



As you
can see the ISP can not resolve names cause its trying to use the DNS settings
of our internal network.



Thats
what I dont get and I dont get why its doing this either L



Thanks
for your time.













From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rutherford, Robert
Sent: Tuesday, May 11, 2004 10:53
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 



Sorry I
think I have lost track here somewhere... I probably didn't read your problem
correctly.



I would
actually think that it is better for them to resolve to your internal DNS servers.
I have seen loads of issues with people trying to get it to work the other way
round. The only thing is that do your internal DNS servers forward out? If they
did then you would probably be in an ok situation?



I'd
still like to find out how your machines are getting their DNS entries though??
Strange.





-Original
Message-
From: Carlos Magalhaes
[mailto:[EMAIL PROTECTED] 
Sent: 11 May 2004 09:14
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 

We
havent and still dont use WINS , this network only uses DNS. 



The
problem I am having is that the user logged onto our network can work fine DNS
is working etc. The user dialed up to their own ISPs are being forced to
our internal DNS servers, they still get a valid IP addy from the ISP they just
are forced to use ours

















From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rutherford, Robert
Sent: Tuesday, May 11, 2004 9:56
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 



It's
either got to be WINS or Hosts files while using the standard W2K VPN dial-up.
I don't think WINS is a bad solution to be honest unless you want to dig
into your pocket.



If
you use a 3rd party, i.e. Checkpoint, then their technology allows for overlay
of your DNS setting post connection. I mentioned IPass earlier and they can do
a similar thing with their client, i.e. push on your internal DNS server post
connection to an IPass ISP.





-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rick Reynolds
Sent: 11 May 2004 08:14
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 

I have always
pushed lmhosts and hosts files to the machines...



-Original
Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Carlos Magalhaes
Sent: Monday, May 10, 2004 11:38
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 

Nope
thats what gets me, and its happening to ALL the 

RE: [ActiveDir] (OT) DNS settings

2004-05-11 Thread Carlos Magalhaes
Title: Message








Not a problem I might have overlooked something
and thank you for taking the time to help.




 Ok 
 Yes we use DHCP.
 No
 Static IP addies.
 Machines
 are all different models and NICs
 I
 could disable the internal NIC  why would that make a diff (just
 trying to understand the logic?)












From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rutherford, Robert
Sent: Tuesday, May 11, 2004 2:21
PM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] (OT) DNS
settings 







I take it that you also use DHCP in your
internal networks, i.e. you don't assign static IP'sto your internal
NIC's? As a test could you just disable the internal NIC and try the dialup
again?











Are all the machine exactly the same, i.e.
same model with same NIC's?











Sorry if I seem to be shooting all over
the place but we will home in eventually.





-Original Message-
From: Carlos Magalhaes
[mailto:[EMAIL PROTECTED] 
Sent: 11 May 2004 13:11
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 

DHCP Enabled. . . . . . . . . . . : Yes

Autoconfiguration Enabled . . . . : Yes

IP Address. . . . . . . . . . . . :
196.2.45.82

Subnet Mask . . . . . . . . . . . :
ispSubnetMask

Default Gateway . . . . . . . . . :
ispGateWay

DHCP Server . . . . . . . . . . . :
ispDHCPServer

DNS Servers . . . . . . . . . . . : internal/localDNS











From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rutherford, Robert
Sent: Tuesday, May 11, 2004 12:05
PM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 







For some reason I thought you were using a
VPN to connect I'm an idiot and should have read the detail.











Can you humour me and justpost an
IPCONFIG /ALL dump from a troubled client.. just type local DNS in place of
your internal IP range if required.











Thanks,











Rob





-Original Message-
From: Carlos Magalhaes
[mailto:[EMAIL PROTECTED] 
Sent: 11 May 2004 10:03
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 

Hey Robert,



Ok there is nothing wrong with the
internal DNS at all, they can resolve everything they want when logged onto the
network.



Their problem is when they go home and are
off the network they use their own third party ISP accounts with the default
windows dialer to create a 56k Dial up PPP connection to a third party ISP.
This is for their own email and internet usage. At this stage (when they dial
up) they are not connected to us in any way what so ever.



What I am finding strange is that the ISP
usually assigns them a valid IP, DNS and gateway from the ISPs DHCP
server. The weird thing here is that they are assigned a valid IP and gateway
but the DNS servers for that PPP connection is using our internal DNS server
address. Which causes a nightmare when they try to resolve names while
connected to the ISP. 



As you can see the ISP can not resolve
names cause its trying to use the DNS settings of our internal network.



Thats what I dont get and I
dont get why its doing this either L



Thanks for your time.











From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rutherford, Robert
Sent: Tuesday, May 11, 2004 10:53
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 







Sorry I think I have lost track here
somewhere... I probably didn't read your problem correctly.











I would actually think that it is better
for them to resolve to your internal DNS servers. I have seen loads of issues
with people trying to get it to work the other way round. The only thing is
that do your internal DNS servers forward out? If they did then you would probably
be in an ok situation?











I'd still like to find out how your
machines are getting their DNS entries though?? Strange.

















-Original Message-
From: Carlos Magalhaes
[mailto:[EMAIL PROTECTED] 
Sent: 11 May 2004 09:14
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 





We havent and still dont use
WINS , this network only uses DNS. 



The problem I am having is that the user
logged onto our network can work fine DNS is working etc. The user dialed up to
their own ISPs are being forced to our internal DNS servers, they still
get a valid IP addy from the ISP they just are forced to use
ours















From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rutherford, Robert
Sent: Tuesday, May 11, 2004 9:56
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 







It's either got to be WINS or Hosts files
while using the standard W2K VPN dial-up. I don't think WINS is a bad solution
to be honest unless you want to dig into your pocket.











If you use a 3rd party, i.e.
Checkpoint, then their technology allows for overlay of your DNS setting post
connection. I mentioned IPass earlier and they can do a similar thing with
their client, i.e. push on your internal DNS server post connection to an IPass
ISP.






RE: [ActiveDir] DNS settings

2004-05-11 Thread Roger Seielstad
Title: Message



The problem is that the mobile users are dialed up to the 
Internet, say just to surf, and they are holding onto their internal DNS 
settings.

Since 
its systemic, I'm wondering if its not either a driver issue or a policy issue, 
but I can't think of a single good reason for either of those to cause this 
issue.
-- 
Roger D. Seielstad - 
MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. 


  
  
  From: Rutherford, Robert 
  [mailto:[EMAIL PROTECTED] Sent: Tuesday, 
  May 11, 2004 4:53 AMTo: 
  [EMAIL PROTECTED]Subject: RE: [ActiveDir] DNS settings 
  
  
  Sorry I think I have lost track here somewhere... I probably didn't 
  read your problem correctly.
  
  I 
  would actually think that it is better for them to resolve to your internal 
  DNS servers. I have seen loads of issues with people trying to get it to work 
  the other way round. The only thing is that do your internal DNS servers 
  forward out? If they did then you would probably be in an ok 
  situation?
  
  I'd 
  still like to find out how your machines are getting their DNS entries 
  though?? Strange.
  
  
  
  -Original Message-From: 
  Carlos Magalhaes [mailto:[EMAIL PROTECTED] Sent: 11 May 2004 
  09:14To: [EMAIL PROTECTED]Subject: RE: 
  [ActiveDir] DNS settings 
  

We havent and 
still dont use WINS , this network only uses DNS. 


The problem I am 
having is that the user logged onto our network can work fine DNS is working 
etc. The user dialed up to their own ISPs are being forced to our internal 
DNS servers, they still get a valid IP addy from the ISP they just are 
forced to use ours







From: 
[EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of Rutherford, 
RobertSent: Tuesday, May 
11, 2004 9:56 AMTo: 
[EMAIL PROTECTED]Subject: RE: [ActiveDir] DNS settings 



It's either got to 
be WINS or Hosts files while using the standard W2K VPN dial-up. I don't 
think WINS is a bad solution to be honest unless you want to dig into 
your pocket.



If you use a 
3rd party, i.e. Checkpoint, then their technology allows for overlay of your 
DNS setting post connection. I mentioned IPass earlier and they can do a 
similar thing with their client, i.e. push on your internal DNS server post 
connection to an IPass ISP.




-Original 
  Message-From: 
  [EMAIL PROTECTED] 
  [mailto:[EMAIL PROTECTED] On Behalf Of Rick 
  ReynoldsSent: 11 May 
  2004 08:14To: 
  [EMAIL PROTECTED]Subject: RE: [ActiveDir] DNS settings 
  
  
  I have always 
  pushed lmhosts and hosts files to the 
  machines...
  
  
  
-Original 
Message-From: 
[EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED]On Behalf Of Carlos 
MagalhaesSent: Monday, 
May 10, 2004 11:38 AMTo: [EMAIL PROTECTED]Subject: RE: [ActiveDir] DNS 
settings 
Nope thats 
what gets me, and its happening to ALL the laptops, (they are the only 
machines using third party dialers)

AGRRR  there 
must be an answer :P

CM





From: 
[EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of Charlie 
KaiserSent: Monday, 
May 10, 2004 8:30 PMTo: '[EMAIL PROTECTED]'Subject: RE: [ActiveDir] DNS 
settings 


Is 
there any hard coding of DNS settings on the laptop's network connection 
properties? This will override any server-assigned DNS 
settings...




**Charlie 
KaiserMCSE, 
CCNASystems 
EngineerEssex Credit 
/ Brickwalk510 595 
5083**

  -Original 
  Message-From: 
  Carlos Magalhaes [mailto:[EMAIL PROTECTED] Sent: Monday, May 10, 2004 11:15 
  AMTo: 
  [EMAIL PROTECTED]Subject: RE: [ActiveDir] DNS 
  settings 
  Hey 
  Al,
  
  Yeah all the 
  settings are suppose to be set via the ISP , most ISP's run DHCP so 
  yes the settings should be set. The weird thing is that only the DNS 
  settings are being forced to our network, the user gets a valid third 
  party IP address and default gateway, just not a DNS setting, that's 
  what made me think it might be something on our 
  network.
  
  We done run 
  WINS just DNS.
  
  Thank you and 
  Keep well!
  
  CM
  
  
  
  
  
  From: 
  [EMAIL PROTECTED] 
  [mailto:[EMAIL 

RE: [ActiveDir] DNS settings

2004-05-11 Thread Roger Seielstad
Title: Message



Have you run a network trace on the PPP adapter while its 
logging in?

-- 
Roger D. Seielstad - 
MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. 


  
  
  From: Carlos Magalhaes 
  [mailto:[EMAIL PROTECTED] Sent: Tuesday, May 11, 2004 5:03 
  AMTo: [EMAIL PROTECTED]Subject: RE: 
  [ActiveDir] DNS settings 
  
  
  Hey 
  Robert,
  
  Ok there is nothing 
  wrong with the internal DNS at all, they can resolve everything they want when 
  logged onto the network.
  
  Their problem is when 
  they go home and are off the network they use their own third party ISP 
  accounts with the default windows dialer to create a 56k Dial up PPP 
  connection to a third party ISP. This is for their own email and internet 
  usage. At this stage (when they dial up) they are not connected to us in any 
  way what so ever.
  
  What I am finding 
  strange is that the ISP usually assigns them a valid IP, DNS and gateway from 
  the ISPs DHCP server. The weird thing here is that they are assigned a valid 
  IP and gateway but the DNS servers for that PPP connection is using our 
  internal DNS server address. Which causes a nightmare when they try to resolve 
  names while connected to the ISP. 
  
  As you can see the 
  ISP can not resolve names cause its trying to use the DNS settings of our 
  internal network.
  
  Thats what I dont 
  get and I dont get why its doing this either L
  
  Thanks for your 
  time.
  
  
  
  
  
  From: 
  [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] 
  On Behalf Of Rutherford, 
  RobertSent: Tuesday, May 11, 
  2004 10:53 AMTo: 
  [EMAIL PROTECTED]Subject: RE: [ActiveDir] DNS settings 
  
  
  
  Sorry I think I have 
  lost track here somewhere... I probably didn't read your problem 
  correctly.
  
  
  
  I would actually 
  think that it is better for them to resolve to your internal DNS servers. I 
  have seen loads of issues with people trying to get it to work the other way 
  round. The only thing is that do your internal DNS servers forward out? If 
  they did then you would probably be in an ok 
  situation?
  
  
  
  I'd still like to 
  find out how your machines are getting their DNS entries though?? 
  Strange.
  
  
  
  
  
  -Original 
  Message-From: Carlos 
  Magalhaes [mailto:[EMAIL PROTECTED] Sent: 11 May 2004 09:14To: [EMAIL PROTECTED]Subject: RE: [ActiveDir] DNS settings 
  
  
We havent and 
still dont use WINS , this network only uses DNS. 


The problem I am 
having is that the user logged onto our network can work fine DNS is working 
etc. The user dialed up to their own ISPs are being forced to our internal 
DNS servers, they still get a valid IP addy from the ISP they just are 
forced to use ours







From: 
[EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of Rutherford, 
RobertSent: Tuesday, May 
11, 2004 9:56 AMTo: 
[EMAIL PROTECTED]Subject: RE: [ActiveDir] DNS settings 



It's either got to 
be WINS or Hosts files while using the standard W2K VPN dial-up. I don't 
think WINS is a bad solution to be honest unless you want to dig into 
your pocket.



If you use a 
3rd party, i.e. Checkpoint, then their technology allows for overlay of your 
DNS setting post connection. I mentioned IPass earlier and they can do a 
similar thing with their client, i.e. push on your internal DNS server post 
connection to an IPass ISP.




-Original 
  Message-From: 
  [EMAIL PROTECTED] 
  [mailto:[EMAIL PROTECTED] On Behalf Of Rick 
  ReynoldsSent: 11 May 
  2004 08:14To: 
  [EMAIL PROTECTED]Subject: RE: [ActiveDir] DNS settings 
  
  
  I have always 
  pushed lmhosts and hosts files to the 
  machines...
  
  
  
-Original 
Message-From: 
[EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED]On Behalf Of Carlos 
MagalhaesSent: Monday, 
May 10, 2004 11:38 AMTo: [EMAIL PROTECTED]Subject: RE: [ActiveDir] DNS 
settings 
Nope thats 
what gets me, and its happening to ALL the laptops, (they are the only 
machines using third party dialers)

AGRRR  there 
must be an answer :P

CM





From: 
[EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of Charlie 
KaiserSent: Monday, 
May 10, 2004 8:30 PMTo: '[EMAIL PROTECTED]'Subject: RE: [ActiveDir] DNS 
settings 


Is 
there any hard coding of DNS settings on the laptop's network connection 
properties? This will override any server-assigned DNS 
settings...




**Charlie 
KaiserMCSE, 

RE: [ActiveDir] DNS settings

2004-05-11 Thread Patrick - IT Department
Title: Message









Maybe trying some actions from the cmd line would help such as:



IPCONFIG /release [adapter] Release the IP address for the specified adapter. IPCONFIG /renew [adapter] Renew the IP address for the specified adapter. IPCONFIG /flushdns Purge the DNS Resolver cache. IPCONFIG /registerdns Refresh all DHCP leases and re-register DNS names.


IPCONFIG /displaydns
Display the contents of the DNS Resolver Cache





-Original
Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Roger Seielstad
Sent: Tuesday, May 11, 2004 8:36
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 



The
problem is that the mobile users are dialed up to the Internet, say just to
surf, and they are holding onto their internal DNS settings.



Since
its systemic, I'm wondering if its not either a driver issue or a policy issue,
but I can't think of a single good reason for either of those to cause this
issue.

-- 
Roger D. Seielstad - MTS MCSE MS-MVP 
Sr. Systems Administrator 
Inovis Inc. 















From: Rutherford, Robert [mailto:[EMAIL PROTECTED]

Sent: Tuesday, May 11, 2004 4:53
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 

Sorry I
think I have lost track here somewhere... I probably didn't read your problem
correctly.



I would
actually think that it is better for them to resolve to your internal DNS
servers. I have seen loads of issues with people trying to get it to work the
other way round. The only thing is that do your internal DNS servers forward
out? If they did then you would probably be in an ok situation?



I'd
still like to find out how your machines are getting their DNS entries though??
Strange.





-Original
Message-
From: Carlos Magalhaes
[mailto:[EMAIL PROTECTED] 
Sent: 11 May 2004 09:14
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 





We havent and still dont use WINS , this network only uses DNS. 



The problem I am having is that the user logged onto our network
can work fine DNS is working etc. The user dialed up to their own ISPs are
being forced to our internal DNS servers, they still get a valid IP addy from
the ISP they just are forced to use ours















From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rutherford, Robert
Sent: Tuesday, May 11, 2004 9:56
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 



It's either got to be WINS or Hosts files while using the standard
W2K VPN dial-up. I don't think WINS is a bad solution to be honest unless
you want to dig into your pocket.



If you use a 3rd party, i.e. Checkpoint, then their
technology allows for overlay of your DNS setting post connection. I mentioned
IPass earlier and they can do a similar thing with their client, i.e. push on
your internal DNS server post connection to an IPass ISP.









-Original
Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rick Reynolds
Sent: 11 May 2004 08:14
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 

I have always pushed lmhosts and hosts files to the machines...







-Original
Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Carlos Magalhaes
Sent: Monday, May 10, 2004 11:38
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 

Nope thats what gets me, and its happening to ALL the laptops,
(they are the only machines using third party dialers)



AGRRR  there must be an answer :P



CM











From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Charlie Kaiser
Sent: Monday, May 10, 2004 8:30 PM
To: '[EMAIL PROTECTED]'
Subject: RE: [ActiveDir] DNS
settings 



Is there any hard coding of DNS settings on the laptop's network
connection properties? This will override any server-assigned DNS settings...





**
Charlie Kaiser
MCSE, CCNA
Systems Engineer
Essex Credit / Brickwalk
510 595 5083
**





-Original
Message-
From: Carlos Magalhaes
[mailto:[EMAIL PROTECTED] 
Sent: Monday, May 10, 2004 11:15
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 

Hey Al,



Yeah all the settings are suppose to be set via the ISP , most
ISP's run DHCP so yes the settings should be set. The weird thing is that only
the DNS settings are being forced to our network, the user gets a valid third
party IP address and default gateway, just not a DNS setting, that's what made me
think it might be something on our network.



We done run WINS just DNS.



Thank you and Keep well!



CM











From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mulnick, Al
Sent: Monday, May 10, 2004 4:31 PM
To: '[EMAIL PROTECTED]'
Subject: RE: [ActiveDir] DNS
settings 



Trying to remember exactly, but wouldn't they get their DNS
settings from the ISP upon connection either through their software locally or
from their RRAS server?



Al











From: Carlos Magalhaes

RE: [ActiveDir] DNS settings

2004-05-11 Thread Carlos Magalhaes
Title: Message








I tried that and it seems to work. The
problem though is I cant expect the users to do this every time they want to
use their connections, there must be something that is going wacky here. 



Dont you agree?



CM











From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Patrick - IT Department
Sent: Tuesday, May 11, 2004 3:23
PM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 





Maybe trying some actions from the
cmd line would help such as:



IPCONFIG /release [adapter] Release the IP address for the specified adapter. IPCONFIG /renew [adapter] Renew the IP address for the specified adapter. IPCONFIG /flushdns Purge the DNS Resolver cache. IPCONFIG /registerdns Refresh all DHCP leases and re-register DNS names.

 IPCONFIG /displaydns Display the
contents of the DNS Resolver Cache





-Original
Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Roger Seielstad
Sent: Tuesday, May 11, 2004 8:36
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 



The
problem is that the mobile users are dialed up to the Internet, say just to
surf, and they are holding onto their internal DNS settings.



Since
its systemic, I'm wondering if its not either a driver issue or a policy issue,
but I can't think of a single good reason for either of those to cause this
issue.

-- 
Roger D. Seielstad - MTS MCSE MS-MVP 
Sr. Systems Administrator 
Inovis Inc. 

















From: Rutherford, Robert
[mailto:[EMAIL PROTECTED] 
Sent: Tuesday, May 11, 2004 4:53
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 

Sorry I think I have lost
track here somewhere... I probably didn't read your problem correctly.



I would actually think
that it is better for them to resolve to your internal DNS servers. I have seen
loads of issues with people trying to get it to work the other way round. The
only thing is that do your internal DNS servers forward out? If they did then
you would probably be in an ok situation?



I'd still like to find
out how your machines are getting their DNS entries though?? Strange.





-Original Message-
From: Carlos Magalhaes
[mailto:[EMAIL PROTECTED] 
Sent: 11 May 2004 09:14
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 





We
havent and still dont use WINS , this network only uses DNS. 



The
problem I am having is that the user logged onto our network can work fine DNS
is working etc. The user dialed up to their own ISPs are being forced to
our internal DNS servers, they still get a valid IP addy from the ISP they just
are forced to use ours





















From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rutherford, Robert
Sent: Tuesday, May 11, 2004 9:56
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 



It's
either got to be WINS or Hosts files while using the standard W2K VPN dial-up.
I don't think WINS is a bad solution to be honest unless you want to dig
into your pocket.



If
you use a 3rd party, i.e. Checkpoint, then their technology allows for overlay
of your DNS setting post connection. I mentioned IPass earlier and they can do
a similar thing with their client, i.e. push on your internal DNS server post
connection to an IPass ISP.









-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rick Reynolds
Sent: 11 May 2004 08:14
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 

I have
always pushed lmhosts and hosts files to the machines...







-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Carlos Magalhaes
Sent: Monday, May 10, 2004 11:38
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 

Nope
thats what gets me, and its happening to ALL the laptops, (they are the
only machines using third party dialers)



AGRRR
 there must be an answer :P



CM

















From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Charlie Kaiser
Sent: Monday, May 10, 2004 8:30 PM
To: '[EMAIL PROTECTED]'
Subject: RE: [ActiveDir] DNS
settings 



Is there any hard coding of DNS settings on the laptop's network
connection properties? This will override any server-assigned DNS settings...





**
Charlie
Kaiser
MCSE,
CCNA
Systems
Engineer
Essex Credit /
Brickwalk
510
595 5083
**





-Original Message-
From: Carlos Magalhaes
[mailto:[EMAIL PROTECTED] 
Sent: Monday, May 10, 2004 11:15
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 

Hey Al,



Yeah all
the settings are suppose to be set via the ISP , most ISP's run DHCP so yes the
settings should be set. The weird thing is that only the DNS settings are being
forced to our network, the user gets a valid third party IP address and default
gateway, just not a DNS setting, that's what made me think it might be
something on our network.



We done
run WINS just 

RE: [ActiveDir] DMZ to Internal LAN one-way trust via firewall

2004-05-11 Thread Creamer, Mark









Nope, wasnt
me  maybe my counterpart did though. He knows I subscribe to this list,
so he asked me to post the initial query to this group. He probably wanted to
see what other kinds of rants he could raise J



Thanks for
the advice, as always!





mc



-Original Message-
From: Mulnick, Al
[mailto:[EMAIL PROTECTED] 
Sent: Monday, May 10, 2004 9:22 AM
To: '[EMAIL PROTECTED]'
Subject: RE: [ActiveDir] DMZ to
Internal LAN one-way trust via firewall



It get's better. I saw
the EXACT same post in the newsgroups over the weekend. PWI, but figured
that I sent the same message. Be interesting to hear Mark's Experience
this week (unless Mark posts as his alternate self on occasion of course :)



ajm









From: Roger Seielstad
[mailto:[EMAIL PROTECTED] 
Sent: Monday, May 10, 2004 8:56 AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DMZ to
Internal LAN one-way trust via firewall

Least
wrong way to do it is indeed continue with an upgrade to have asecond
forest in the DMZ, without any trusts. 



I'd
also suggest a different operations model, one in which the developers have no
elevated permissions to the production environment. Take it from much personal
experience that no good can come from that situation. They need to develop and
test against a staging environment, and then let the operations staff promote
the changes into the production systems.



I
completely understand that its unrealistic to expect that culture change to
happen over night, however. So, I'd insist on them having different accounts
(i.e. no trust), to help drive home the point that this is a special set of
systems.



Roger

--

Roger D. Seielstad - MTS MCSE MS-MVP 
Sr. Systems Administrator 
Inovis Inc. 

















From: Creamer, Mark
[mailto:[EMAIL PROTECTED] 
Sent: Friday, May 07, 2004 4:33 PM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DMZ to
Internal LAN one-way trust via firewall

Hi Al, good rant J



I think I can elaborate a bit...We can't use the separate forest
idea that you mention as a best practice, because it's not a 2000 or above
domain (the one in the DMZ). In fact, my first question was why don't we
upgrade it first (as its own forest, of course).



The goal is that we have developers who manage the content and apps
on these web servers, and we're trying to eliminate the accounts in the domain
in the DMZ. So we're trying to see if there is a good way to allow the
developers to use their internal AD accounts to authenticate to the DMZ domain
via a one-way trust.



Anything more specific on what risks we'd face? (e.g. would it be
possible with a one-way trust for a person who breaks in to an account in a DMZ
domain to then cross over into the other domain on the other side of the
firewall?)



Is there a least wrong way to do this?





mc



-Original Message-
From: Mulnick, Al
[mailto:[EMAIL PROTECTED] 
Sent: Friday, May 07, 2004 3:55 PM
To: '[EMAIL PROTECTED]'
Subject: RE: [ActiveDir] DMZ to
Internal LAN one-way trust via firewall



shudder



So, if I
read this correctly, somebody wants to put lipstick on a pig? My first
question is why? My second question is also why? Why would you ever
want to have authentication handled inside your firewall for web servers?
Why would you want to put in a single point of failure only relying on the
PDCe? Why would you want to fly in the face of best practices (use
separate forests internal and external?) 



IPSec is
something that would be nice to have if they had a 2000 forest out there, but
then again, see above. 



Overall,
I'd say that this is a bad idea for many reasons including the single point of
failure (what if your PDCe goes down?), the lowered security possibilities of
NT4 etc. Hacking NT 4 is not going to provide much of a challenge to most
script kiddies these days,IMHO. Opening ports from a DMZ to your
internal network doesn't buy anything but convenience in this situation and
since it flies in the face of good practices, I hate to see it running.



Fix your
BAS DMZ domain permissions and upgrade it to 2003 AD for control
purposes. 



The PPTP
that he's asking about is available in Win2K and above, but for Win2K it
doesn't work at start up. That would only be shared secret vs. kerberos
negotiation. 



/rant













From: Creamer, Mark
[mailto:[EMAIL PROTECTED] 
Sent: Friday, May 07, 2004 2:43 PM
To: [EMAIL PROTECTED]
Subject: [ActiveDir] DMZ to
Internal LAN one-way trust via firewall

L  G, I'm sending this on behalf of one of our project
engineers. Thanks for any assistance or advice. 



1. We have a 12-server (mostly 2000 web servers) NT 4.0
domain in
our Checkpoint firewall-protected DMZ subnet. All support is
currently a mess of local and domain users, no security policy, etc. 
Making it a Workgroup isn't a popular choice given the number of servers and
differences between.

2. Therefore, we are looking to setup a one-way trust to our internal
2000 AD 

RE: [ActiveDir] DNS settings

2004-05-11 Thread Rutherford, Robert
Title: Message



Good 
call

If 
that doesn't work then why don't u add some external DNS entries statically to 
the PPP adapt and see if they stick.

  
  -Original Message-From: Charlie Kaiser 
  [mailto:[EMAIL PROTECTED] Sent: 11 May 2004 
  14:26To: '[EMAIL PROTECTED]'Subject: RE: 
  [ActiveDir] DNS settings 
  How about this...
  Perhaps your ISP's DHCP is not providing DNS, and the laptop is using 
  it's last known good DNS entries. Try doing an ipconfig /release, then
  ipconfig /all to verify the release, maybe even do a registry search for the 
  internal DNS address, then, dial up and see what settings you get from the 
  ISP...
  
  
  **Charlie KaiserMCSE, 
  CCNASystems EngineerEssex Credit / Brickwalk510 595 
  5083**
  

-Original Message-From: Carlos 
Magalhaes [mailto:[EMAIL PROTECTED] Sent: Tuesday, May 11, 
2004 5:11 AMTo: [EMAIL PROTECTED]Subject: 
RE: [ActiveDir] DNS settings 

DHCP Enabled. . . . 
. . . . . . . : Yes
Autoconfiguration 
Enabled . . . . : Yes
IP Address. . . . . 
. . . . . . . : 196.2.45.82
Subnet Mask . . . . 
. . . . . . . : ispSubnetMask
Default Gateway . . 
. . . . . . . : ispGateWay
DHCP Server . . . . 
. . . . . . . : ispDHCPServer
DNS Servers . . . . 
. . . . . . . : internal/localDNS





From: 
[EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of Rutherford, 
RobertSent: Tuesday, May 
11, 2004 12:05 PMTo: 
[EMAIL PROTECTED]Subject: RE: [ActiveDir] DNS settings 



For some reason I 
thought you were using a VPN to connect I'm an idiot and should have 
read the detail.



Can you humour me 
and justpost an IPCONFIG /ALL dump from a troubled client.. just type 
local DNS in place of your internal IP range if 
required.



Thanks,



Rob
-Original 
  Message-From: Carlos 
  Magalhaes [mailto:[EMAIL PROTECTED] Sent: 11 May 2004 10:03To: [EMAIL PROTECTED]Subject: RE: [ActiveDir] DNS settings 
  
  Hey 
  Robert,
  
  Ok there is 
  nothing wrong with the internal DNS at all, they can resolve everything 
  they want when logged onto the network.
  
  Their problem is 
  when they go home and are off the network they use their own third party 
  ISP accounts with the default windows dialer to create a 56k Dial up PPP 
  connection to a third party ISP. This is for their own email and internet 
  usage. At this stage (when they dial up) they are not connected to us in 
  any way what so ever.
  
  What I am finding 
  strange is that the ISP usually assigns them a valid IP, DNS and gateway 
  from the ISP's DHCP server. The weird thing here is that they are assigned 
  a valid IP and gateway but the DNS servers for that PPP connection is 
  using our internal DNS server address. Which causes a nightmare when they 
  try to resolve names while connected to the ISP. 
  
  
  As you can see 
  the ISP can not resolve names cause its trying to use the DNS settings of 
  our internal network
  
  That's what I 
  don't get and I don't get why its doing this either L
  
  Thanks for your 
  time.
  
  
  
  
  
  From: 
  [EMAIL PROTECTED] 
  [mailto:[EMAIL PROTECTED] On Behalf Of Rutherford, 
  RobertSent: Tuesday, May 
  11, 2004 10:53 AMTo: 
  [EMAIL PROTECTED]Subject: RE: [ActiveDir] DNS settings 
  
  
  
  Sorry I think I 
  have lost track here somewhere... I probably didn't read your problem 
  correctly.
  
  
  
  I would actually 
  think that it is better for them to resolve to your internal DNS servers. 
  I have seen loads of issues with people trying to get it to work the other 
  way round. The only thing is that do your internal DNS servers forward 
  out? If they did then you would probably be in an ok 
  situation?
  
  
  
  I'd still like to 
  find out how your machines are getting their DNS entries though?? 
  Strange.
  
  
  
  
  
  -Original 
  Message-From: Carlos 
  Magalhaes [mailto:[EMAIL PROTECTED] Sent: 11 May 2004 09:14To: [EMAIL PROTECTED]Subject: RE: [ActiveDir] DNS settings 
  
  
We haven't and 
still don't use WINS , this network only uses DNS. 


The problem I 
am having is that the user logged onto our network can work fine DNS is 
working etc. The user dialed up to their own ISP's are being forced to 
our internal DNS servers, they still get a valid IP addy from the ISP 
they just are "forced" to use ours...






  

RE: [ActiveDir] DNS settings

2004-05-11 Thread Patrick - IT Department
Title: Message








Definitely!

I have a similar setup as
you. We use ISP for DNS but our router handles the DHCP. Mixing ISP with
network services has to be the culprit I would think. 



-Original
Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Carlos Magalhaes
Sent: Tuesday, May 11, 2004 9:31
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 



I tried that and it seems
to work. The problem though is I cant expect the users to do this every time
they want to use their connections, there must be something that is going wacky
here. 



Dont you agree?



CM











From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Patrick - IT Department
Sent: Tuesday, May 11, 2004 3:23
PM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 



Maybe trying some actions from the cmd line would help such as:



IPCONFIG /release [adapter] Release the IP address for the specified adapter. IPCONFIG /renew [adapter] Renew the IP address for the specified adapter. IPCONFIG /flushdns Purge the DNS Resolver cache. IPCONFIG /registerdns Refresh all DHCP leases and re-register DNS names.


IPCONFIG /displaydns Display the contents of the DNS Resolver Cache





-Original
Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Roger Seielstad
Sent: Tuesday, May 11, 2004 8:36
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 



The
problem is that the mobile users are dialed up to the Internet, say just to
surf, and they are holding onto their internal DNS settings.



Since
its systemic, I'm wondering if its not either a driver issue or a policy issue,
but I can't think of a single good reason for either of those to cause this
issue.

-- 
Roger D. Seielstad - MTS MCSE MS-MVP 
Sr. Systems Administrator 
Inovis Inc. 


















From: Rutherford, Robert
[mailto:[EMAIL PROTECTED] 
Sent: Tuesday, May 11, 2004 4:53
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 

Sorry I think I have lost track here
somewhere... I probably didn't read your problem correctly.



I would actually think that it is better
for them to resolve to your internal DNS servers. I have seen loads of issues
with people trying to get it to work the other way round. The only thing is
that do your internal DNS servers forward out? If they did then you would
probably be in an ok situation?



I'd still like to find out how your
machines are getting their DNS entries though?? Strange.





-Original
Message-
From: Carlos Magalhaes
[mailto:[EMAIL PROTECTED] 
Sent: 11 May 2004 09:14
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 





We havent and still dont use WINS ,
this network only uses DNS. 



The
problem I am having is that the user logged onto our network can work fine DNS
is working etc. The user dialed up to their own ISPs are being forced to our
internal DNS servers, they still get a valid IP addy from the ISP they just are
forced to use ours






















From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rutherford, Robert
Sent: Tuesday, May 11, 2004 9:56
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 



It's
either got to be WINS or Hosts files while using the standard W2K VPN dial-up.
I don't think WINS is a bad solution to be honest unless you want to dig
into your pocket.



If
you use a 3rd party, i.e. Checkpoint, then their technology allows for overlay
of your DNS setting post connection. I mentioned IPass earlier and they can do
a similar thing with their client, i.e. push on your internal DNS server post
connection to an IPass ISP.









-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rick Reynolds
Sent: 11 May 2004 08:14
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 

I have
always pushed lmhosts and hosts files to the machines...







-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Carlos Magalhaes
Sent: Monday, May 10, 2004 11:38
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 

Nope
thats what gets me, and its happening to ALL the laptops, (they are the only
machines using third party dialers)



AGRRR 
there must be an answer :P



CM


















From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Charlie Kaiser
Sent: Monday, May 10, 2004 8:30 PM
To: '[EMAIL PROTECTED]'
Subject: RE: [ActiveDir] DNS
settings 



Is there any hard coding of DNS settings on the laptop's network
connection properties? This will override any server-assigned DNS settings...





**
Charlie Kaiser
MCSE, CCNA
Systems Engineer
Essex Credit / Brickwalk
510 595 5083
**





-Original Message-
From: Carlos Magalhaes
[mailto:[EMAIL PROTECTED] 
Sent: Monday, May 10, 2004 11:15
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 

Hey 

RE: [ActiveDir] DNS settings

2004-05-11 Thread Carlos Magalhaes
Title: Message








Hey Charlie,



They have multiple ISPs and all of
the ISPs dial ups have the same symptoms  



DHCP Enabled. . . . . . . . . . . : Yes

Autoconfiguration Enabled . . . . : Yes

IP Address. . . . . . . . . . . . :
196.2.45.82

Subnet Mask . . . . . . . . . . . :
ispSubnetMask

Default Gateway . . . . . . . . . :
ispGateWay

DHCP Server . . . . . . . . . . . :
ispDHCPServer

DNS Servers . . . . . . . . . . . : internal/localDNS



I will try reg searches on all the machines.
Its the weirdest thing I have ever seen (so far :P)



CM











From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Charlie Kaiser
Sent: Tuesday, May 11, 2004 3:26
PM
To: '[EMAIL PROTECTED]'
Subject: RE: [ActiveDir] DNS
settings 







How about
this...





Perhaps your
ISP's DHCP is not providing DNS, and the laptop is using it's last known good
DNS entries. Try doing an ipconfig /release, then ipconfig /all to verify the
release, maybe even do a registry search for the internal DNS address, then,
dial up and see what settings you get from the ISP...















**
Charlie
Kaiser
MCSE,
CCNA
Systems
Engineer
Essex Credit /
Brickwalk
510
595 5083
**



-Original Message-
From: Carlos Magalhaes [mailto:[EMAIL PROTECTED]

Sent: Tuesday, May 11, 2004 5:11
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 

DHCP Enabled. . . . . . . . . . . : Yes

Autoconfiguration Enabled . . . . : Yes

IP Address. . . . . . . . . . . . :
196.2.45.82

Subnet Mask . . . . . . . . . . . :
ispSubnetMask

Default Gateway . . . . . . . . . :
ispGateWay

DHCP Server . . . . . . . . . . . :
ispDHCPServer

DNS Servers . . . . . . . . . . . : internal/localDNS











From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rutherford, Robert
Sent: Tuesday, May 11, 2004 12:05
PM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 







For some reason I thought you were using a
VPN to connect I'm an idiot and should have read the detail.











Can you humour me and justpost an
IPCONFIG /ALL dump from a troubled client.. just type local DNS in place of
your internal IP range if required.











Thanks,











Rob





-Original Message-
From: Carlos Magalhaes
[mailto:[EMAIL PROTECTED] 
Sent: 11 May 2004 10:03
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 

Hey Robert,



Ok there is nothing wrong with the
internal DNS at all, they can resolve everything they want when logged onto the
network.



Their problem is when they go home and are
off the network they use their own third party ISP accounts with the default
windows dialer to create a 56k Dial up PPP connection to a third party ISP.
This is for their own email and internet usage. At this stage (when they dial
up) they are not connected to us in any way what so ever.



What I am finding strange is that the ISP
usually assigns them a valid IP, DNS and gateway from the ISP's DHCP server.
The weird thing here is that they are assigned a valid IP and gateway but the
DNS servers for that PPP connection is using our internal DNS server address.
Which causes a nightmare when they try to resolve names while connected to the
ISP. 



As you can see the ISP can not resolve
names cause its trying to use the DNS settings of our internal network



That's what I don't get and I don't get
why its doing this either L



Thanks for your time.











From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rutherford, Robert
Sent: Tuesday, May 11, 2004 10:53
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 







Sorry I think I have lost track here
somewhere... I probably didn't read your problem correctly.











I would actually think that it is better
for them to resolve to your internal DNS servers. I have seen loads of issues
with people trying to get it to work the other way round. The only thing is
that do your internal DNS servers forward out? If they did then you would
probably be in an ok situation?











I'd still like to find out how your
machines are getting their DNS entries though?? Strange.

















-Original Message-
From: Carlos Magalhaes
[mailto:[EMAIL PROTECTED] 
Sent: 11 May 2004 09:14
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 





We haven't and still don't use WINS , this
network only uses DNS. 



The problem I am having is that the user
logged onto our network can work fine DNS is working etc. The user dialed up to
their own ISP's are being forced to our internal DNS servers, they still get a
valid IP addy from the ISP they just are forced to use ours...















From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rutherford, Robert
Sent: Tuesday, May 11, 2004 9:56
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 







It's either got to be WINS or Hosts files
while using the standard W2K VPN dial-up. I don't think WINS is a bad solution

RE: [ActiveDir] DNS settings

2004-05-11 Thread Carlos Magalhaes
Title: Message








The only VPN clients they have is the
default windows VPN client you create with Add New Connection
there is no third party VPN clients at all.



There are some third party dialers but not
VPN clients. The symptoms are true whether they use a third party dialer or a
windows dialer to any ISP (accept RRAS to our network)





L











From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Rutherford, Robert
Sent: Tuesday, May 11, 2004 3:40
PM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 







Carlos, have you got any VPN client
software running on these machines at all or was there?











-Original Message-
From: Patrick - IT Department
[mailto:[EMAIL PROTECTED] 
Sent: 11 May 2004 14:23
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 





Maybe trying some actions from the
cmd line would help such as:



IPCONFIG /release [adapter] Release the IP address for the specified adapter. IPCONFIG /renew [adapter] Renew the IP address for the specified adapter. IPCONFIG /flushdns Purge the DNS Resolver cache. IPCONFIG /registerdns Refresh all DHCP leases and re-register DNS names.

 IPCONFIG /displaydns Display the
contents of the DNS Resolver Cache





-Original
Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Roger Seielstad
Sent: Tuesday, May 11, 2004 8:36
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 



The
problem is that the mobile users are dialed up to the Internet, say just to
surf, and they are holding onto their internal DNS settings.



Since
its systemic, I'm wondering if its not either a driver issue or a policy issue,
but I can't think of a single good reason for either of those to cause this
issue.

-- 
Roger D. Seielstad - MTS MCSE MS-MVP 
Sr. Systems Administrator 
Inovis Inc. 



















From: Rutherford, Robert
[mailto:[EMAIL PROTECTED] 
Sent: Tuesday, May 11, 2004 4:53
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 

Sorry I think I have lost
track here somewhere... I probably didn't read your problem correctly.



I would actually think
that it is better for them to resolve to your internal DNS servers. I have seen
loads of issues with people trying to get it to work the other way round. The
only thing is that do your internal DNS servers forward out? If they did then
you would probably be in an ok situation?



I'd still like to find
out how your machines are getting their DNS entries though?? Strange.





-Original
Message-
From: Carlos Magalhaes
[mailto:[EMAIL PROTECTED] 
Sent: 11 May 2004 09:14
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 









We
havent and still dont use WINS , this network only uses DNS. 



The
problem I am having is that the user logged onto our network can work fine DNS
is working etc. The user dialed up to their own ISPs are being forced to
our internal DNS servers, they still get a valid IP addy from the ISP they just
are forced to use ours





















From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Rutherford, Robert
Sent: Tuesday, May 11, 2004 9:56
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 



It's
either got to be WINS or Hosts files while using the standard W2K VPN dial-up.
I don't think WINS is a bad solution to be honest unless you want to dig
into your pocket.



If
you use a 3rd party, i.e. Checkpoint, then their technology allows for overlay
of your DNS setting post connection. I mentioned IPass earlier and they can do
a similar thing with their client, i.e. push on your internal DNS server post
connection to an IPass ISP.













-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rick Reynolds
Sent: 11 May 2004 08:14
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 

I have
always pushed lmhosts and hosts files to the machines...











-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]On
Behalf Of Carlos Magalhaes
Sent: Monday, May 10, 2004 11:38
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 

Nope
thats what gets me, and its happening to ALL the laptops, (they are the
only machines using third party dialers)



AGRRR
 there must be an answer :P



CM

















From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Charlie Kaiser
Sent: Monday, May 10, 2004 8:30 PM
To: '[EMAIL PROTECTED]'
Subject: RE: [ActiveDir] DNS
settings 



Is there any hard coding of DNS settings on the laptop's network
connection properties? This will override any server-assigned DNS settings...





**
Charlie
Kaiser
MCSE,
CCNA
Systems
Engineer
Essex Credit /
Brickwalk
510
595 5083
**









-Original Message-
From: Carlos Magalhaes
[mailto:[EMAIL PROTECTED] 
Sent: Monday, May 10, 2004 11:15
AM
To: [EMAIL PROTECTED]
Subject: RE: 

RE: [ActiveDir] DNS settings

2004-05-11 Thread Rich Milburn
Title: Message








So XP is holding onto the old IP
address now that youre on W2k3 AD, but didnt do it before 
is that accurate?

Does right-clicking on the dial connection
systray icon and choosing repair fix the problem as well? Thats at
least friendlier than ipconfig but obviously not the end solution



h





Rich Milburn

MCSE, Microsoft MVP -
Directory Services

Sr Network Analyst, Field
Platform Development

Applebee's International,
Inc.

4551 W. 107th St

Overland Park, KS 66207

913-967-2819











From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Carlos Magalhaes
Sent: Tuesday, May 11, 2004 8:31
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 





I tried that and it seems to work. The problem
though is I cant expect the users to do this every time they want to use their
connections, there must be something that is going wacky here. 



Dont you agree?



CM











From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Patrick - IT Department
Sent: Tuesday, May 11, 2004 3:23
PM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 





Maybe trying some actions from the
cmd line would help such as:



IPCONFIG /release [adapter] Release the IP address for the specified adapter. IPCONFIG /renew [adapter] Renew the IP address for the specified adapter. IPCONFIG /flushdns Purge the DNS Resolver cache. IPCONFIG /registerdns Refresh all DHCP leases and re-register DNS names.

 IPCONFIG /displaydns Display
the contents of the DNS Resolver Cache





-Original
Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Roger Seielstad
Sent: Tuesday, May 11, 2004 8:36
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 



The
problem is that the mobile users are dialed up to the Internet, say just to
surf, and they are holding onto their internal DNS settings.



Since
its systemic, I'm wondering if its not either a driver issue or a policy issue,
but I can't think of a single good reason for either of those to cause this
issue.

-- 
Roger D. Seielstad - MTS MCSE MS-MVP 
Sr. Systems Administrator 
Inovis Inc. 

















From:
Rutherford, Robert [mailto:[EMAIL PROTECTED] 
Sent: Tuesday, May 11, 2004 4:53 AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 

Sorry I
think I have lost track here somewhere... I probably didn't read your problem
correctly.



I would
actually think that it is better for them to resolve to your internal DNS servers.
I have seen loads of issues with people trying to get it to work the other way
round. The only thing is that do your internal DNS servers forward out? If they
did then you would probably be in an ok situation?



I'd
still like to find out how your machines are getting their DNS entries though??
Strange.





-Original Message-
From: Carlos Magalhaes
[mailto:[EMAIL PROTECTED] 
Sent: 11 May 2004 09:14
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 





We
havent and still dont use WINS , this network only uses DNS. 



The
problem I am having is that the user logged onto our network can work fine DNS
is working etc. The user dialed up to their own ISPs are being forced to
our internal DNS servers, they still get a valid IP addy from the ISP they just
are forced to use ours





















From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rutherford, Robert
Sent: Tuesday, May 11, 2004 9:56
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 



It's
either got to be WINS or Hosts files while using the standard W2K VPN dial-up.
I don't think WINS is a bad solution to be honest unless you want to dig
into your pocket.



If
you use a 3rd party, i.e. Checkpoint, then their technology allows for overlay
of your DNS setting post connection. I mentioned IPass earlier and they can do
a similar thing with their client, i.e. push on your internal DNS server post
connection to an IPass ISP.









-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rick Reynolds
Sent: 11 May 2004 08:14
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 

I have
always pushed lmhosts and hosts files to the machines...







-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Carlos Magalhaes
Sent: Monday, May 10, 2004 11:38
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 

Nope
thats what gets me, and its happening to ALL the laptops, (they are the
only machines using third party dialers)



AGRRR
 there must be an answer :P



CM

















From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Charlie Kaiser
Sent: Monday, May 10, 2004 8:30 PM
To: '[EMAIL PROTECTED]'
Subject: RE: [ActiveDir] DNS
settings 



Is there any hard coding of DNS settings on the laptop's network
connection properties? This will override any server-assigned DNS settings...






RE: [ActiveDir] DNS settings

2004-05-11 Thread Rich Milburn
Title: Message








Carlos did you check RSOP on a client to
see if its getting the 

Computer Configuration 
Administrative Templates  Network  DNS Client  DNS Servers 

setting from somewhere?

Warning: The list of the DNS servers defined in
this setting supersedes DNS servers configured locally and those configured
using DHCP. The list of DNS servers is applied to all network connections of
multihomed computers to which this setting is applied.

With a new AD could someone have set
this? Everything would work as expected internally, and only fail in the
situation you are seeing. And this setting requires Windows XP.



Rich





Rich Milburn

MCSE, Microsoft MVP -
Directory Services

Sr Network Analyst, Field
Platform Development

Applebee's International,
Inc.

4551 W. 107th St

Overland Park, KS 66207

913-967-2819











From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Carlos Magalhaes
Sent: Tuesday, May 11, 2004 8:31
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 





I tried that and it seems to work. The
problem though is I cant expect the users to do this every time they want to
use their connections, there must be something that is going wacky here. 



Dont you agree?



CM











From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Patrick - IT Department
Sent: Tuesday, May 11, 2004 3:23
PM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 





Maybe trying some actions from the
cmd line would help such as:



IPCONFIG /release [adapter] Release the IP address for the specified adapter. IPCONFIG /renew [adapter] Renew the IP address for the specified adapter. IPCONFIG /flushdns Purge the DNS Resolver cache. IPCONFIG /registerdns Refresh all DHCP leases and re-register DNS names.

 IPCONFIG /displaydns Display
the contents of the DNS Resolver Cache





-Original
Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Roger Seielstad
Sent: Tuesday, May 11, 2004 8:36
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 



The problem
is that the mobile users are dialed up to the Internet, say just to surf, and
they are holding onto their internal DNS settings.



Since
its systemic, I'm wondering if its not either a driver issue or a policy issue,
but I can't think of a single good reason for either of those to cause this
issue.

-- 
Roger D. Seielstad - MTS MCSE MS-MVP 
Sr. Systems Administrator 
Inovis Inc. 

















From:
Rutherford, Robert [mailto:[EMAIL PROTECTED] 
Sent: Tuesday, May 11, 2004 4:53
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 

Sorry I
think I have lost track here somewhere... I probably didn't read your problem
correctly.



I would
actually think that it is better for them to resolve to your internal DNS
servers. I have seen loads of issues with people trying to get it to work the
other way round. The only thing is that do your internal DNS servers forward
out? If they did then you would probably be in an ok situation?



I'd
still like to find out how your machines are getting their DNS entries though??
Strange.





-Original Message-
From: Carlos Magalhaes
[mailto:[EMAIL PROTECTED] 
Sent: 11 May 2004 09:14
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 





We
havent and still dont use WINS , this network only uses DNS. 



The
problem I am having is that the user logged onto our network can work fine DNS
is working etc. The user dialed up to their own ISPs are being forced to
our internal DNS servers, they still get a valid IP addy from the ISP they just
are forced to use ours





















From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rutherford, Robert
Sent: Tuesday, May 11, 2004 9:56
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 



It's
either got to be WINS or Hosts files while using the standard W2K VPN dial-up.
I don't think WINS is a bad solution to be honest unless you want to dig
into your pocket.



If
you use a 3rd party, i.e. Checkpoint, then their technology allows for overlay
of your DNS setting post connection. I mentioned IPass earlier and they can do a
similar thing with their client, i.e. push on your internal DNS server post
connection to an IPass ISP.









-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rick Reynolds
Sent: 11 May 2004 08:14
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 

I have
always pushed lmhosts and hosts files to the machines...







-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Carlos Magalhaes
Sent: Monday, May 10, 2004 11:38
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 

Nope
thats what gets me, and its happening to ALL the laptops, (they are the
only machines using third party dialers)



AGRRR
 there must be an answer :P



CM

















From:

RE: [ActiveDir] DFS

2004-05-11 Thread Rutherford, Robert
Title: Message




You 
can install a DFS root on a DC or member server.

It 
should work fine, in terms of splitting down a server and distributing the data 
over a number of other servers. I'm assuming you only want to use DFS to make a 
central share access hierarchy?

I 
would not use the replication side of it though as it's inherently flawed... 
well it was on 2000 and have read it hasn't changed that significantly on 2k3. 
If you do want to use the replication then I would only use it for read only 
data, i.e. Application distribution points.

BR,

Rob


  
  -Original Message-From: Jennifer 
  Fountain [mailto:[EMAIL PROTECTED] Sent: 11 May 2004 
  14:47To: [EMAIL PROTECTED]Subject: 
  [ActiveDir] DFSSensitivity: Private
  Does anyone here use DFS? If so, do you use 
  it for load balancing? Did you install it on a DC? It's own 
  server? We are looking into breaking our one huge file server (1 tb of 
  space) into 4 smaller servers (more manageable and wanted to look into
  DFS. We do have NT/95 clients but that should not stop me because I can 
  install the AD client on them.
  Thanks for any info! 
  Kind Regards, 
  Jennifer Fountain RB Inc 3400 E Walnut 
  Street Colmar, PA 18915 
The information transmitted is intended only for the person or entityto which it is addressed and may contain confidential and/orprivileged material. Any use (including retransmission or copying)of this information by persons or entities other than the intendedrecipient is prohibited.  If you are not the intended recipient of thistransmission, please contact the sender and delete the materialfrom any computer. The sender is not responsible for the completeness or accuracy of this communication as it has beentransmitted over a public network. Any replies to this email may bemonitored by the MCPS-PRS Alliance for quality control and other purposes.


RE: [ActiveDir] DFS

2004-05-11 Thread Bruce Clingaman
Title: DFS



DFS can be used for load balancing and redundancy 
redundancy. Do not install it on a DC, especially with 1 tb of data. A DFS share 
will have at least 2 servers. I would recommend looking into 3rd party software 
for this. I have heard the limit for DFS is about 250 to 500 gb depending on the 
traffic.Read thru the documentation in the resource kit 
thoroughly.


From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of Jennifer 
FountainSent: Tuesday, May 11, 2004 8:47 AMTo: 
[EMAIL PROTECTED]Subject: [ActiveDir] 
DFSSensitivity: Private

Does anyone here use DFS? If so, do you use it 
for load balancing? Did you install it on a DC? It's own server? We 
are looking into breaking our one huge file server (1 tb of space) into 4 
smaller servers (more manageable and wanted to look into DFS. We do have 
NT/95 clients but that should not stop me because I can install the AD client on 
them.
Thanks for any info! 
Kind Regards, 
Jennifer Fountain RB Inc 3400 E Walnut 
Street Colmar, PA 18915 



RE: [ActiveDir][OT] LDAP stress tool for AD 2003

2004-05-11 Thread Rich Milburn
And to think I _was_ a bit sad about missing the Summit ;)

Rich 
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Mulnick, Al
Sent: Monday, May 10, 2004 8:15 AM
To: '[EMAIL PROTECTED]'
Subject: RE: [ActiveDir][OT] LDAP stress tool for AD 2003

Um.  Rick, given Joe's last post about Dean and playing with butter knives,
it would be my humble opinion that you a[1]) shouldn't post as Rick-sey
and b) really should keep the sharp shiny objects locked up next time Joe's
in the area.  Not that I'm paranoid, but...


Al 


[1] shoot.  If Joe's correct, Rick only saw that as garble)shgarbleldn't
pgarble

-Original Message-
From: Rick Kingslan [mailto:[EMAIL PROTECTED] 
Sent: Monday, May 10, 2004 2:09 AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir][OT] LDAP stress tool for AD 2003

OK, OK, I GIVE.  ROTLMAO!!! YUO RAELLY AER TOO FUNY JOE. 

RIKC

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of joe
Sent: Monday, May 10, 2004 1:05 AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir][OT] LDAP stress tool for AD 2003

I agree with most of that. Though I think it was Jimmy that smelled funny
and that was simply because he never made it back to his room to change. 

Of course you still read [1]... That is why I knew I could sucker you into
posting. :o)


Anyway, when I was at the summit, I had no chance with the females with Dean
always standing next to me. That handsome english bastard... He had all
three traits for picking up the ladies... Foreign Accent, Sparkling Eyes /
Nicely dressed look, Don Johnson Shaving Methodology. Heck, *I* could barely
keep my eyes off of him. Was ready to scoop him up and take him home to meet
mum. 

Oh btw, the Dr's say I can officially use butter knives again so I am slowly
working back up to the world of normal. 



   joe





[1] Rick doesn't really read, he pays his kid to read the posts to him. Rick
is challenged by the vowels a,e,i,o,u (and occasionally y) and all of the
consonants b-z inclusive. He is however able to handle the uppercase
versions... So an email like the above would read something like I garble
garble T garble garble J garble garble O garble garble T... Then 
garble he
spends an hour trying to find ITJOT in the various language dictionaries. So
that is why the kid comes into the picture and why, interestingly enough, I
always spell my name joe.

:o) 


 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Rick Kingslan
Sent: Monday, May 10, 2004 1:47 AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] LDAP stress tool for AD 2003

 Rick has given me a very bad reputation of being mean or something.

Oh, for crying out loud.  I haven't been POSTING much.  I still READ!

Eric, joe is a pretty nice guy.  Just socially unacceptable.  At Summit, we
had to keep him away from females, sharp objects, and alcohol.  Plus, he
farts a lot.

Otherwise, joe's great.

Rick Kingslan  MCSE, MCSA, MCT, CISSP
Microsoft MVP:
Windows Server / Directory Services
Windows Server / Rights Management
Associate Expert
Expert Zone - www.microsoft.com/windowsxp/expertzone
WebLog - www.msmvps.com/willhack4food
  

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of joe
Sent: Monday, May 10, 2004 12:45 AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] LDAP stress tool for AD 2003

I'm not making fun of ~Eric. That is your call sign, when I say ~Eric, there
isn't a single person who confuses that with any other Eric's that are
running around.

BTW, I am guessing you mean me when you say this, I would know for sure if
you had written: 

(would have been ~Eric but joe's been making fun of that as of late ;))


Rick has given me a very bad reputation of being mean or something. I am
very nice, I am just outspoken when something is stupid or wrong which is
unusual in this overly politicaly correct world. Also people think I hate
Exchange and the Exchange Dev guys, this is simply untrue, I just don't
think the code flows as well as it probably should (not elegant) and was
based on many bad security assumptions and uses Active Directory like a red
headed step child instead of as a respectable directory. I like to question
things, not sit back and say, hmm ok, they want me to do it that way, I
guess I better change everything I had planned for how this was going to go
so it fits how they want me to be configured. 

To think I was going to say your initial response to the LDAP Stress Tool
topic was an outstanding response and that I had bookmarked it for later
regurgitation to anyone else who asked a question like that... 


  joe



-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Eric Fleischman
Sent: Sunday, May 09, 2004 9:55 PM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] LDAP stress tool for AD 2003

I've dissected a bit and put some info inline.
I'm a bit tired so sorry if it is a bit 

[ActiveDir] Enumerating User Rights

2004-05-11 Thread Passo, Larry
Does anyone know how to connect to a remote machine and enumerate the
User Rights that are assigned on it?  I'd prefer a VBscript technique
but I could use a command line utility. I already know about
ntrights.exe in the Resource Kit but it only modifies selected rights it
doesn't list what is there.

Thanks in Advance

List info   : http://www.activedir.org/mail_list.htm
List FAQ: http://www.activedir.org/list_faq.htm
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/


RE: [ActiveDir] how to identify the servers (Domain Controllers) us ing File Replication service - - - And how to enable/disable FRS servi ce on these servers

2004-05-11 Thread Rich Milburn








 I received a development request =
time to check your backups and update your resume J



Sounds like the developers want to fix something they probably dont
understand at all. If so, thats almost like disabling the netlogon
service on all your workstations because theres an LSASS exploit out
there  not really the best way to do it..





Rich Milburn

MCSE, Microsoft MVP -
Directory Services

Sr Network Analyst, Field
Platform Development

Applebee's International,
Inc.

4551 W. 107th St

Overland Park, KS 66207

913-967-2819











From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Carlos Magalhaes
Sent: Monday, May 10, 2004 5:46 AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] how to
identify the servers (Domain Controllers) us ing File Replication service - - -
And how to enable/disable FRS service on these servers





Its doable with code, I can find you the
DC or GCs, and if you REALLLY want disable the FRS services but you
would really be screwing up some important services that your DC needs.



Do you really want to do this?


Carlos Magalhaes  AD programming?  http://groups.yahoo.com/group/adsianddirectoryservices












From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Durairaj K. Avasi
Sent: Monday, May 10, 2004 12:31
PM
To: [EMAIL PROTECTED]
Cc: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] how to
identify the servers (Domain Controllers) using File Replication service - - -
And how to enable/disable FRS service on these servers





Honestly I am not sure why my sys. Admin
needs it I received a development request with the following spec. 



-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Grillenmeier, Guido
Sent: Monday, May 10, 2004 2:41 AM
To: [EMAIL PROTECTED]
Cc: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] how to
identify the servers (Domain Controllers) using File Replication service - - -
And how to enable/disable FRS service on these servers



can you add, roughly WHY
you want to do this?



FRS is enabled on ALL DCs
in an AD forest, and that's the way it should be as SYSVOL replication uses
FRS.FRS is one of those special services, that you don't want to screw
around with (such as turning off, make a lot of file-system changes, turning
back on), unless you really know what you're doing or you really want to have
more trouble. 



/Guido













From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Durairaj K. Avasi
Sent: Sonntag, 9. Mai 2004 23:59
To: [EMAIL PROTECTED]
Cc: [EMAIL PROTECTED]
Subject: [ActiveDir] how to
identify the servers (Domain Controllers) using File Replication service - - -
And how to enable/disable FRS service on these servers

AD Gurus::



I hope all had very good
weekend.. Here is my requirement where I stuck and I need your hand on this



In short: This is what I
want:



Script 1: identify the
servers (Domain Controllers) using File Replication service (FRS).



Script 2: Disable these
found in Script 1. (When I say disable, I just meant to say FRS service on
these servers)



Script 3: Enable these found
in Script 1. (When I say enable, I just meant to say FRS service on these
servers)





The following is the detail
of what I found

=



How to identify the servers
(Domain Controllers) using File Replication service (FRS)?



I found the repadmin
/replsum in Active Directory cookbook. However I need the same output in
a txt file just servernames (Note  not the status)



and how to disable and
enable the FRS service on the above identified servers? 



I thought of using
cscript service.vbs /X /N ntfrs /S __SERVERNAME /U avasi /W password /O
c:\temp.txt  I dont know how this is going to workout.





Thanks in advance.



Durairaj K. Avasi















---APPLEBEE'S INTERNATIONAL, INC. CONFIDENTIALITY NOTICE---  PRIVILEGED / CONFIDENTIAL INFORMATION may be contained in this message or any attachments. This information is strictly confidential and may be subject to attorney-client privilege. This message is intended only for the use of the named addressee. If you are not the intended recipient of this message, unauthorized forwarding, printing, copying, distribution, or using such information is strictly prohibited and may be unlawful. If you have received this in error, you should kindly notify the sender by reply e-mail and immediately destroy this message. Unauthorized interception of this e-mail is a violation of federal criminal law. Applebee's International, Inc. reserves the right to monitor and review the content of all messages sent to and from this e-mail address. Messages sent to or from this e-mail address may be stored on the Applebee's International, Inc. e-mail system.


[ActiveDir] Managing accounts for 'outsiders'

2004-05-11 Thread Fugleberg, David A
I'm curious what y'all do with those situations where you have to manage credentials 
for 'outsiders' - in other words, users from some business partner, vendor, etc. who 
must have access to some resource in your company.  For example, say you have some 
intranet web app that you make available on the Internet via ISA Server/reverse proxy. 
 This works for employees, but soon some 'outsiders' (contractors, outsourced service 
providers) need to use it.

Do you put them someplace in your existing AD so they can use the same proxy ?  Do you 
set up an alternate way for them to get to the resource ?  What steps do you take to 
ensure that those credentials are restricted to the resource you intend ?

I'm a tad uncomfortable with people outside the organization running around with valid 
credentials to the internal NOS directory, but maybe that's just me.  I realize it's a 
business decision, and that there's hopefully some level of trust in these individuals 
since they've been contracted to perform some service, but the more I can control it 
the better.

Rants, flames, war stories are welcome (I can take it:).  Even more welcome is some 
discussion of how you deal with external users in general, and specific steps you take 
to protect your AD from misuse by them.

Dave
List info   : http://www.activedir.org/mail_list.htm
List FAQ: http://www.activedir.org/list_faq.htm
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/


[ActiveDir] disk configuration

2004-05-11 Thread Nathan Casey



I have a question about the best way to separate the 
AD DB and AD log files.My standard server build is a Compaq DL380 with six 
36GB drives and one Compaq Smart Array 5i Controller.Normally I mirror 
the first two HD's for OS and apps use the other fourdisks for RAID5 with 
hot spare.For Active Directory would it be best to use my standard 
configuration and putthe AD DB on the mirror with the OS and put the AD log 
files on the RAID5 orshould I take the six disks and make three 
mirrors:Mirror1 = OS and appsMirror2 = AD DBMirror3 = AD 
logs

Any advice would be 
appreciated.


RE: [ActiveDir] Replacing Shared Storage on a two node cluster

2004-05-11 Thread Mulnick, Al
Essentially, your concern is about disk signatures.
http://support.microsoft.com/default.aspx?scid=kb;en-us;305793 should help
explain about that some.

What I'm curiuos about is why you don't just add disk and move the data over
to it?  Expand vs. replace?

Al 

-Original Message-
From: Nathan Danso [mailto:[EMAIL PROTECTED] 
Sent: Wednesday, May 05, 2004 9:19 AM
To: [EMAIL PROTECTED]
Subject: [ActiveDir] Replacing Shared Storage on a two node cluster

Greetings to all,
As always, many thanks for  your quick responses to problems and questions
posted on this forum.  I am currently  running an Active/ Passive  Cluster
service on  2 dell power edge  2650  connected to another Dell 220s Power
vault   subsystem. I have  3 X 18G (RAID 5) drives in my subsystem
configured as 3  separate virtual logical array disk.
I am about to embark on a mission to  move the data   from the  virtual
disk to its own disk  by adding additional  drives and configuring them as
RAID 5 for my data and RAID 1 for my log files. Knowing how sensitive
cluster service is  to disk changes, I will like to approach this  task very
carefully without  destroying my cluster installation and having to rebuild
the whole cluster. I was hoping someone may have already gone through this
process and will kindly enlightened me to any obstacles that I should be
aware of. My numerous searches have produced  different  confusing
approaches. Any help will be greatly appreciated. Thanks in advance.

Nathan




This e-mail may contain confidential and/or privileged information. If you
are not the intended recipient (or have received this e-mail in error)
please notify the sender immediately and destroy this e-mail. Any
unauthorized copying, disclosure or distribution of the material in this
e-mail is strictly forbidden. TradeWeb reserves the right to monitor all
e-mail communications through its networks.

List info   : http://www.activedir.org/mail_list.htm
List FAQ: http://www.activedir.org/list_faq.htm
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
List info   : http://www.activedir.org/mail_list.htm
List FAQ: http://www.activedir.org/list_faq.htm
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/


RE: [ActiveDir] DNS settings

2004-05-11 Thread Rutherford, Robert
Title: Message



Id be 
tempted to setup a reservation in DHCP internally and set different DNS settings 
(whatever u like) to a test machine ipconfig/release and renew... see if it 
obtains the new settings or still holds the old settings.

  
  -Original Message-From: Rich Milburn 
  [mailto:[EMAIL PROTECTED] Sent: 11 May 2004 
  15:30To: [EMAIL PROTECTED]Subject: RE:
  [ActiveDir] DNS settings 
  
  So XP is holding 
  onto the old IP address now that youre on W2k3 AD, but didnt do it before  
  is that accurate?
  Does right-clicking 
  on the dial connection systray icon and choosing repair fix the problem as 
  well? Thats at least friendlier than ipconfig but obviously not the end 
  solution
  
  h
  
  
  Rich 
  Milburn
  MCSE, Microsoft MVP 
  - Directory Services
  Sr Network Analyst, 
  Field Platform Development
  Applebee's
  International, Inc.
  4551 W. 107th 
  St
  Overland Park, KS 
  66207
  913-967-2819
  
  
  
  
  From: 
  [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] 
  On Behalf Of Carlos 
  MagalhaesSent: Tuesday, May 
  11, 2004 8:31 AMTo:
  [EMAIL PROTECTED]Subject: RE: [ActiveDir] DNS settings 
  
  
  I tried that and it 
  seems to work. The problem though is I cant expect the users to do this every 
  time they want to use their connections, there must be something that is going 
  wacky here. 
  
  Dont you 
  agree?
  
  CM
  
  
  
  
  
  From: 
  [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] 
  On Behalf Of Patrick - IT 
  DepartmentSent: Tuesday, May 
  11, 2004 3:23 PMTo:
  [EMAIL PROTECTED]Subject: RE: [ActiveDir] DNS settings 
  
  
  Maybe trying some actions from the cmd 
  line would help such as:
  IPCONFIG /release [adapter] Release the IP address for the specified adapter. IPCONFIG /renew [adapter] Renew the IP address for the specified adapter. IPCONFIG /flushdns Purge the DNS Resolver cache. IPCONFIG /registerdns Refresh all DHCP leases and re-register DNS names.
   IPCONFIG /displaydns 
  Display the contents of the DNS Resolver Cache
  
  
  -Original 
  Message-From: 
  [EMAIL PROTECTED] 
  [mailto:[EMAIL PROTECTED]On Behalf Of Roger SeielstadSent: Tuesday, May 11, 2004 8:36
  AMTo: 
  [EMAIL PROTECTED]Subject: RE: [ActiveDir] DNS settings 
  
  
  The 
  problem is that the mobile users are dialed up to the Internet, say just to 
  surf, and they are holding onto their internal DNS settings.
  
  Since 
  its systemic, I'm wondering if its not either a driver issue or a policy
  issue, but I can't think of a single good reason for either of those to cause 
  this issue.
  -- Roger D. Seielstad - 
  MTS MCSE MS-MVP 
  Sr. Systems
  Administrator 
  Inovis 
  Inc. 
  
  
  
  
  
  
  
  
  From: Rutherford, Robert 
  [mailto:[EMAIL PROTECTED] Sent: Tuesday, May 11, 2004 4:53
  AMTo: 
  [EMAIL PROTECTED]Subject: RE: [ActiveDir] DNS settings 
  
  Sorry I 
  think I have lost track here somewhere... I probably didn't read your problem 
  correctly.
  
  I would 
  actually think that it is better for them to resolve to your internal DNS 
  servers. I have seen loads of issues with people trying to get it to work the 
  other way round. The only thing is that do your internal DNS servers forward 
  out? If they did then you would probably be in an ok 
  situation?
  
  I'd 
  still like to find out how your machines are getting their DNS entries
  though?? Strange.
  
  
  -Original 
  Message-From: Carlos 
  Magalhaes [mailto:[EMAIL PROTECTED] Sent: 11 May 2004 09:14To: 
  [EMAIL PROTECTED]Subject: RE: [ActiveDir] DNS settings 
  
  
  We 
  havent and still dont use WINS , this network only uses DNS. 
  
  
  The 
  problem I am having is that the user logged onto our network can work fine DNS 
  is working etc. The user dialed up to their own ISPs are being forced to our 
  internal DNS servers, they still get a valid IP addy from the ISP they just 
  are forced to use ours
  
  
  
  
  
  
  
  
  From: 
  [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] 
  On Behalf Of Rutherford,
  RobertSent: Tuesday, May 11, 
  2004 9:56 AMTo: 
  [EMAIL PROTECTED]Subject: RE: [ActiveDir] DNS settings 
  
  
  It's 
  either got to be WINS or Hosts files while using the standard W2K VPN dial-up. 
  I don't think WINS is a bad solution to be honest unless you want to dig 
  into your pocket.
  
  If 
  you use a 3rd party, i.e. Checkpoint, then their technology allows for overlay 
  of your DNS setting post connection. I mentioned IPass earlier and they can do 
  a similar thing with their client, i.e. push on your internal DNS server post 
  connection to an IPass ISP.
  
  
  
  -Original 
  Message-From: 
  [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] 
  On Behalf Of Rick 
  ReynoldsSent: 11 May 2004 
  08:14To: 
  [EMAIL PROTECTED]Subject: RE: [ActiveDir] DNS settings 
  
  I have 
  always pushed lmhosts and hosts files to the machines...
  
  
  -Original 
  

RE: [ActiveDir] DFS

2004-05-11 Thread Salandra, Justin A.
Title: Message









Having a DFS structure would mean that you
would have 4 servers each with 1 TB of information on them because everything
gets replicated to all locations in the DFS. DFS will NOT put 250 GB on one server, 250 GB on
another server and so on.



-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rutherford, Robert
Sent: Tuesday, May 11, 2004 10:54
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DFS
Sensitivity: Private











You can install a DFS
root on a DC or member server.











It should work fine, in
terms of splitting down a server and distributing the data over a number of
other servers. I'm assuming you only want to use DFS to make a central share
access hierarchy?











I would not use the
replication side of it though as it's inherently flawed... well it was on 2000
and have read it hasn't changed that significantly on 2k3. If you do want to
use the replication then I would only use it for read only data, i.e.
Application distribution points.











BR,











Rob











-Original
Message-
From: Jennifer Fountain
[mailto:[EMAIL PROTECTED] 
Sent: 11 May 2004 14:47
To: [EMAIL PROTECTED]
Subject: [ActiveDir] DFS
Sensitivity: Private

Does anyone
here use DFS? If so, do you use it for load balancing? Did you
install it on a DC? It's own server? We are looking into breaking our one
huge file server (1 tb of space) into 4 smaller servers (more manageable and
wanted to look into DFS. We do have NT/95 clients but that should not
stop me because I can install the AD client on them.

Thanks for any info! 



Kind Regards, 

Jennifer Fountain 
RB
Inc 
3400 E
Walnut Street 
Colmar,
PA 18915 




The information transmitted is intended only for the person or entity
to which it is addressed and may contain confidential and/or
privileged material. Any use (including retransmission or copying)
of this information by persons or entities other than the intended
recipient is prohibited. If you are not the intended recipient of this
transmission, please contact the sender and delete the material
from any computer. The sender is not responsible for the 
completeness or accuracy of this communication as it has been
transmitted over a public network. Any replies to this email may be
monitored by the MCPS-PRS Alliance for quality control and other 
purposes.








[ActiveDir] disk configuration

2004-05-11 Thread Nathan Casey



I have a question about the best way to separate the 
AD DB and AD log files.My standard server build is a Compaq DL380 with six 
36GB drives and one Compaq Smart Array 5i Controller.Normally I mirror 
the first two HD's for OS and apps use the other fourdisks for RAID5 with 
hot spare.For Active Directory would it be best to use my standard 
configuration and putthe AD DB on the mirror with the OS and put the AD log 
files on the RAID5 orshould I take the six disks and make three 
mirrors:Mirror1 = OS and appsMirror2 = AD DBMirror3 = AD 
logs

Any advice would be 
appreciated.


RE: [ActiveDir] Managing accounts for 'outsiders'

2004-05-11 Thread Roger Seielstad
We don't mix authentication schemes. Internal is internal, and external is
external.

We require VPN access to internal resources- nothing is published
externally. I'd be really leery of doing it any other way.

--
Roger D. Seielstad - MTS MCSE MS-MVP
Sr. Systems Administrator
Inovis Inc.
 

 -Original Message-
 From: Fugleberg, David A [mailto:[EMAIL PROTECTED] 
 Sent: Tuesday, May 11, 2004 11:14 AM
 To: [EMAIL PROTECTED]
 Subject: [ActiveDir] Managing accounts for 'outsiders'
 
 I'm curious what y'all do with those situations where you 
 have to manage credentials for 'outsiders' - in other words, 
 users from some business partner, vendor, etc. who must have 
 access to some resource in your company.  For example, say 
 you have some intranet web app that you make available on the 
 Internet via ISA Server/reverse proxy.  This works for 
 employees, but soon some 'outsiders' (contractors, outsourced 
 service providers) need to use it.
 
 Do you put them someplace in your existing AD so they can use 
 the same proxy ?  Do you set up an alternate way for them to 
 get to the resource ?  What steps do you take to ensure that 
 those credentials are restricted to the resource you intend ?
 
 I'm a tad uncomfortable with people outside the organization 
 running around with valid credentials to the internal NOS 
 directory, but maybe that's just me.  I realize it's a 
 business decision, and that there's hopefully some level of 
 trust in these individuals since they've been contracted to 
 perform some service, but the more I can control it the better.
 
 Rants, flames, war stories are welcome (I can take it:).  
 Even more welcome is some discussion of how you deal with 
 external users in general, and specific steps you take to 
 protect your AD from misuse by them.
 
 Dave
 List info   : http://www.activedir.org/mail_list.htm
 List FAQ: http://www.activedir.org/list_faq.htm
 List archive: 
 http://www.mail-archive.com/activedir%40mail.activedir.org/
 
List info   : http://www.activedir.org/mail_list.htm
List FAQ: http://www.activedir.org/list_faq.htm
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/


[ActiveDir] Cookbook sample scripts

2004-05-11 Thread James Payne




I just bought the Active Directory Cookbook and started looking at some of
the sample scripts posted on the author's website.  When I attempt to use
this one it tells me the server is not operational, line 14 character 1.
Can anyone take a look at this and let me know if you see something I have
done wrong?  Thanks a bunch.

' This VBScript code prints the FSMO role owners for the specified domain.

' ---
' From the book Active Directory Cookbook by Robbie Allen
' Publisher: O'Reilly and Associates
' ISBN: 0-596-00466-4
' Book web site: http://rallenhome.com/books/adcookbook/code.html
' ---

' -- SCRIPT CONFIGURATION --
strDomain = mydomain.com  ' e.g. emea.rallencorp.com
' -- END CONFIGURATION -

set objRootDSE = GetObject(LDAP://;  strDomain  /RootDSE)
strDomainDN  = objRootDSE.Get(defaultNamingContext)
strSchemaDN = objRootDSE.Get(schemaNamingContext)
strConfigDN = objRootDSE.Get(configurationNamingContext)

' PDC Emulator
set objPDCFsmo = GetObject(LDAP://;  strDomainDN)
Wscript.Echo PDC Emulator:   objPDCFsmo.fsmoroleowner

' RID Master
set objRIDFsmo = GetObject(LDAP://cn=RID Manager$,cn=system, 
strDomainDN)
Wscript.Echo RID Master:   objRIDFsmo.fsmoroleowner

' Schema Master
set objSchemaFsmo = GetObject(LDAP://;  strSchemaDN)
Wscript.Echo Schema Master:   objSchemaFsmo.fsmoroleowner

' Infrastructure Master
set objInfraFsmo = GetObject(LDAP://cn=Infrastructure,;  strDomainDN)
Wscript.Echo Infrastructure Master:   objInfraFsmo.fsmoroleowner

' Domain Naming Master
set objDNFsmo = GetObject(LDAP://cn=Partitions,;  strConfigDN)
Wscript.Echo Domain Naming Master:   objDNFsmo.fsmoroleowner

List info   : http://www.activedir.org/mail_list.htm
List FAQ: http://www.activedir.org/list_faq.htm
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/


RE: [ActiveDir] disk configuration

2004-05-11 Thread Mulnick, Al



Either of those 
configurations would work depending on what performance you would need. 
For optimal configuration, you first want to separate the I/O stream for Log 
files. That's because they tend to be very write expensive and they are 
typically sequential I/O. Separating that to a separate I/O stream to a 
high-speed write set of spindles, provides the first greatest performance 
benefit. In other words, RAID 5 won't provide the same level of 
performance since you typically get a 4x increase in write latency with RAID 5 
vs. 0. Putting the db on either RAID 5 or 1 is going to give similar 
results in the low-end, but likely would get faster response in the high-end due 
to splitting the data across spindles. RAID5 is read optimized up to a 
certain number of disks. 

I think in your case, 
given the parameters and limitations without knowing how large you need to scale 
a single DC, the three mirror set would be my choice. With Active 
Directory it's often better to scale out than scale up for DC's. If you 
need that extra bit of performance, you may want to consider using a separate 
enclosure and a RAID 5 or 0+1 configuration for your DB's.

My 0.02 (USD) 
anyway.

Al


From: Nathan Casey [mailto:[EMAIL PROTECTED] 
Sent: Tuesday, May 11, 2004 11:38 AMTo: 
[EMAIL PROTECTED]Subject: [ActiveDir] disk 
configuration

I have a question about the best way to separate the 
AD DB and AD log files.My standard server build is a Compaq DL380 with six 
36GB drives and one Compaq Smart Array 5i Controller.Normally I mirror 
the first two HD's for OS and apps use the other fourdisks for RAID5 with 
hot spare.For Active Directory would it be best to use my standard 
configuration and putthe AD DB on the mirror with the OS and put the AD log 
files on the RAID5 orshould I take the six disks and make three 
mirrors:Mirror1 = OS and appsMirror2 = AD DBMirror3 = AD 
logs

Any advice would be 
appreciated.


RE: [ActiveDir] disk configuration

2004-05-11 Thread Depp, Dennis M.
Nathan,

My recomendation would be to use 3 mirrors.  This would avoid mixing log files with 
the OS, or placing log files on a raid5

Denny

-Original Message-
From: Nathan Casey [EMAIL PROTECTED]
Sent: 5/11/04 1:45:33 PM
To: [EMAIL PROTECTED] [EMAIL PROTECTED]
Subject: [ActiveDir] disk configuration

I have a question about the best way to separate the AD DB and AD log files.
My standard server build is a Compaq DL380 with six 36GB drives and one Compaq 
Smart Array 5i Controller.

Normally I mirror the first two HD's for OS and apps use the other four
disks for RAID5 with hot spare.

For Active Directory would it be best to use my standard configuration and put
the AD DB on the mirror with the OS and put the AD log files on the RAID5 or
should I take the six disks and make three mirrors:

Mirror1 = OS and apps

Mirror2 = AD DB

Mirror3 = AD logs

 

Any advice would be appreciated.

List info   : http://www.activedir.org/mail_list.htm
List FAQ: http://www.activedir.org/list_faq.htm
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/


RE: [ActiveDir] DFS

2004-05-11 Thread Roger Seielstad
Title: Message



Replication of data is optional in DFS, but a domain root 
will replicate the configuration to all domain controllers.

-- 
Roger D. Seielstad - 
MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. 


  
  
  From: Salandra, Justin A. 
  [mailto:[EMAIL PROTECTED] Sent: Tuesday, May 11, 2004 12:37 
  PMTo: [EMAIL PROTECTED]Subject: RE: 
  [ActiveDir] DFSSensitivity: Private
  
  
  Having a DFS 
  structure would mean that you would have 4 servers each with 1 TB of 
  information on them because everything gets replicated to all locations in the 
  DFS. DFS will NOT put 250 
  GB on one server, 250 GB on another server and so on.
  
  -Original 
  Message-From: 
  [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] 
  On Behalf Of Rutherford, 
  RobertSent: Tuesday, May 11, 
  2004 10:54 AMTo: 
  [EMAIL PROTECTED]Subject: RE: [ActiveDir] DFSSensitivity: Private
  
  
  
  
  You can 
  install a DFS root on a DC or member server.
  
  
  
  It 
  should work fine, in terms of splitting down a server and distributing the 
  data over a number of other servers. I'm assuming you only want to use DFS to 
  make a central share access hierarchy?
  
  
  
  I would 
  not use the replication side of it though as it's inherently flawed... well it 
  was on 2000 and have read it hasn't changed that significantly on 2k3. If you 
  do want to use the replication then I would only use it for read only data, 
  i.e. Application distribution points.
  
  
  
  BR,
  
  
  
  Rob
  
  
  
-Original 
Message-From: Jennifer 
Fountain [mailto:[EMAIL PROTECTED] Sent: 11 May 2004 14:47To: 
[EMAIL PROTECTED]Subject: [ActiveDir] DFSSensitivity: Private
Does 
anyone here use DFS? If so, do you use it for load balancing? 
Did you install it on a DC? It's own server? We are looking into 
breaking our one huge file server (1 tb of space) into 4 smaller servers 
(more manageable and wanted to look into DFS. We do have NT/95 clients 
but that should not stop me because I can install the AD client on 
them.
Thanks for any 
info! 

Kind Regards, 
Jennifer Fountain 
RB Inc 
3400 E Walnut 
Street Colmar, PA 
18915 
  The information transmitted is 
  intended only for the person or entityto which it is addressed and may 
  contain confidential and/orprivileged material. Any use (including 
  retransmission or copying)of this information by persons or entities other 
  than the intendedrecipient is prohibited. If you are not the intended 
  recipient of thistransmission, please contact the sender and delete the 
  materialfrom any computer. The sender is not responsible for the 
  completeness or accuracy of this communication as it has 
  beentransmitted over a public network. Any replies to this email may 
  bemonitored by the MCPS-PRS Alliance for quality control and other 
  purposes.


RE: [ActiveDir] Managing accounts for 'outsiders'

2004-05-11 Thread Mulnick, Al
That's a pretty common scenario in many types of business.  We all do
business with partners and have to face this at some point.  Most businesses
have since they started with EDI, but they security wasn't as high-profile
as it is these days for many of them. 

To paraphrase the question, how do you securely grant access to internal
resources for non-employees (FTE's)? Do you use AD or some other way?

Unfortunately for this conversation I think the only accurate answer could
be that it depends.  If you work in a place where there is a risk that your
administrative process could allow improper access to a resource, I would
say you should firewall non-FTE access away from sensitive systems.  If
your process and policy can withstand the risk, then why not make it easier
to manage for you and your staff?  Active Directory is handling your
Identification, Authentication, and Authorization for your internal
employees and you are extending some level of trust to these others.  Many
shops don't use Active Directory for their Authorization, especially when it
comes to web/intranet.  Tends to be better products for that.  Not a lot of
better products for Identification and Authorization (many as good using the
same technology for the most part; they don't tend to be as reliable from a
topology standpoint)

That said, if you don't use Active Directory for this access, what would you
use instead?  Would you store the identity in the AD and use something else
for authentication and authorization?  Would you create a totally separate
IAA scheme to handle this?  Is it worth it?  

My own personal belief is that contractors are under the exact same
obligations as my FTE's and are no more trustworthy (nor less). I believe I
have an obligation to provide them with the service and to make it as secure
as I can, while keeping everything as simple and cost-effective as I can.  I
have no problems giving that kind of access via Active Directory as long as
my account lifecycle management processes and systems are where they should
be.  I think it is critical to have these policies and enforcement
mechanisms in place to ensure that access is only given where it belongs
regardless of mistakes etc.  

Al   

-Original Message-
From: Fugleberg, David A [mailto:[EMAIL PROTECTED] 
Sent: Tuesday, May 11, 2004 11:14 AM
To: [EMAIL PROTECTED]
Subject: [ActiveDir] Managing accounts for 'outsiders'

I'm curious what y'all do with those situations where you have to manage
credentials for 'outsiders' - in other words, users from some business
partner, vendor, etc. who must have access to some resource in your company.
For example, say you have some intranet web app that you make available on
the Internet via ISA Server/reverse proxy.  This works for employees, but
soon some 'outsiders' (contractors, outsourced service providers) need to
use it.

Do you put them someplace in your existing AD so they can use the same proxy
?  Do you set up an alternate way for them to get to the resource ?  What
steps do you take to ensure that those credentials are restricted to the
resource you intend ?

I'm a tad uncomfortable with people outside the organization running around
with valid credentials to the internal NOS directory, but maybe that's just
me.  I realize it's a business decision, and that there's hopefully some
level of trust in these individuals since they've been contracted to perform
some service, but the more I can control it the better.

Rants, flames, war stories are welcome (I can take it:).  Even more welcome
is some discussion of how you deal with external users in general, and
specific steps you take to protect your AD from misuse by them.

Dave
List info   : http://www.activedir.org/mail_list.htm
List FAQ: http://www.activedir.org/list_faq.htm
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
List info   : http://www.activedir.org/mail_list.htm
List FAQ: http://www.activedir.org/list_faq.htm
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/


RE: [ActiveDir] DFS

2004-05-11 Thread Depp, Dennis M.
Justin,

I don't think this is correct.  With DFS, I can set up different subfolders to point 
to different physical locations.  These physical locations can be setup a redundant 
pairs, but this is not required.

Denny

-Original Message-
From: Salandra, Justin A. [EMAIL PROTECTED]
Sent: 5/11/04 1:41:37 PM
To: [EMAIL PROTECTED] [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DFS

Having a DFS structure would mean that you would have 4 servers each with 1 TB of 
information on them because everything gets replicated to all locations in the DFS.  
DFS will NOT put 250 GB on one server, 250 GB on another server and so on.

 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rutherford, Robert
Sent: Tuesday, May 11, 2004 10:54 AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DFS
Sensitivity: Private

 

 

You can install a DFS root on a DC or member server.

 

It should work fine, in terms of splitting down a server and distributing the data 
over a number of other servers. I'm assuming you only want to use DFS to make a 
central share access hierarchy?

 

I would not use the replication side of it though as it's inherently flawed... 
well it was on 2000 and have read it hasn't changed that significantly on 2k3. If you 
do want to use the replication then I would only use it for read only data, i.e. 
Application distribution points.

 

BR,

 

Rob

 

-Original Message-
From: Jennifer Fountain [mailto:[EMAIL PROTECTED] 
Sent: 11 May 2004 14:47
To: [EMAIL PROTECTED]
Subject: [ActiveDir] DFS
Sensitivity: Private

Does anyone here use DFS?  If so, do you use it for load balancing?  Did you 
install it on a DC? It's own server?  We are looking into breaking our one huge file 
server (1 tb of space) into 4 smaller servers (more manageable and wanted to look into 
DFS.  We do have NT/95 clients but that should not stop me because I can install the 
AD client on them.

Thanks for any info! 

 

Kind Regards, 

Jennifer Fountain 
RB Inc 
3400 E Walnut Street 
Colmar, PA  18915 


The information transmitted is intended only for the person or entity
to which it is addressed and may contain confidential and/or
privileged material. Any use (including retransmission or copying)
of this information by persons or entities other than the intended
recipient is prohibited. If you are not the intended recipient of this
transmission, please contact the sender and delete the material
from any computer. The sender is not responsible for the 
completeness or accuracy of this communication as it has been
transmitted over a public network. Any replies to this email may be
monitored by the MCPS-PRS Alliance for quality control and other 
purposes.

List info   : http://www.activedir.org/mail_list.htm
List FAQ: http://www.activedir.org/list_faq.htm
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/


RE: [ActiveDir] Cookbook sample scripts

2004-05-11 Thread Creamer, Mark
Did you change the strDomain value to match your environment?

mc

-Original Message-
From: James Payne [mailto:[EMAIL PROTECTED] 
Sent: Tuesday, May 11, 2004 1:41 PM
To: [EMAIL PROTECTED]
Subject: [ActiveDir] Cookbook sample scripts





I just bought the Active Directory Cookbook and started looking at some of
the sample scripts posted on the author's website.  When I attempt to use
this one it tells me the server is not operational, line 14 character 1.
Can anyone take a look at this and let me know if you see something I have
done wrong?  Thanks a bunch.

' This VBScript code prints the FSMO role owners for the specified domain.

' ---
' From the book Active Directory Cookbook by Robbie Allen
' Publisher: O'Reilly and Associates
' ISBN: 0-596-00466-4
' Book web site: http://rallenhome.com/books/adcookbook/code.html
' ---

' -- SCRIPT CONFIGURATION --
strDomain = mydomain.com  ' e.g. emea.rallencorp.com
' -- END CONFIGURATION -

set objRootDSE = GetObject(LDAP://;  strDomain  /RootDSE)
strDomainDN  = objRootDSE.Get(defaultNamingContext)
strSchemaDN = objRootDSE.Get(schemaNamingContext)
strConfigDN = objRootDSE.Get(configurationNamingContext)

' PDC Emulator
set objPDCFsmo = GetObject(LDAP://;  strDomainDN)
Wscript.Echo PDC Emulator:   objPDCFsmo.fsmoroleowner

' RID Master
set objRIDFsmo = GetObject(LDAP://cn=RID Manager$,cn=system, 
strDomainDN)
Wscript.Echo RID Master:   objRIDFsmo.fsmoroleowner

' Schema Master
set objSchemaFsmo = GetObject(LDAP://;  strSchemaDN)
Wscript.Echo Schema Master:   objSchemaFsmo.fsmoroleowner

' Infrastructure Master
set objInfraFsmo = GetObject(LDAP://cn=Infrastructure,;  strDomainDN)
Wscript.Echo Infrastructure Master:   objInfraFsmo.fsmoroleowner

' Domain Naming Master
set objDNFsmo = GetObject(LDAP://cn=Partitions,;  strConfigDN)
Wscript.Echo Domain Naming Master:   objDNFsmo.fsmoroleowner

List info   : http://www.activedir.org/mail_list.htm
List FAQ: http://www.activedir.org/list_faq.htm
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
List info   : http://www.activedir.org/mail_list.htm
List FAQ: http://www.activedir.org/list_faq.htm
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/


RE: [ActiveDir] Managing accounts for 'outsiders'

2004-05-11 Thread simon.geary
I don't treat a 3rd party account in AD any differently from normal user accounts. 
They should be given the least privelege required to do their job, which will 
typically mean logon access is restricted to whatever server they are supporting. 
One personal annoyance is when admins set up generic AD accounts for 3rd party 
companies rather than following the best practice of setting up several specific 
accounts for the named support staff who need access to your network.

-Original Message- 
From: [EMAIL PROTECTED] on behalf of Fugleberg, David A 
Sent: Tue 11/05/2004 16:14 
To: [EMAIL PROTECTED] 
Cc: 
Subject: [ActiveDir] Managing accounts for 'outsiders'



I'm curious what y'all do with those situations where you have to manage 
credentials for 'outsiders' - in other words, users from some business partner, 
vendor, etc. who must have access to some resource in your company.  For example, say 
you have some intranet web app that you make available on the Internet via ISA 
Server/reverse proxy.  This works for employees, but soon some 'outsiders' 
(contractors, outsourced service providers) need to use it.

Do you put them someplace in your existing AD so they can use the same proxy ? 
 Do you set up an alternate way for them to get to the resource ?  What steps do you 
take to ensure that those credentials are restricted to the resource you intend ?

I'm a tad uncomfortable with people outside the organization running around 
with valid credentials to the internal NOS directory, but maybe that's just me.  I 
realize it's a business decision, and that there's hopefully some level of trust in 
these individuals since they've been contracted to perform some service, but the more 
I can control it the better.

Rants, flames, war stories are welcome (I can take it:).  Even more welcome is 
some discussion of how you deal with external users in general, and specific steps you 
take to protect your AD from misuse by them.

Dave
List info   : http://www.activedir.org/mail_list.htm
List FAQ: http://www.activedir.org/list_faq.htm
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/


winmail.dat

RE: [ActiveDir] Cookbook sample scripts

2004-05-11 Thread Mulnick, Al
??  Did you modify it?  Strdomain looks the same as the default.

Al 

-Original Message-
From: James Payne [mailto:[EMAIL PROTECTED] 
Sent: Tuesday, May 11, 2004 1:41 PM
To: [EMAIL PROTECTED]
Subject: [ActiveDir] Cookbook sample scripts





I just bought the Active Directory Cookbook and started looking at some of
the sample scripts posted on the author's website.  When I attempt to use
this one it tells me the server is not operational, line 14 character 1.
Can anyone take a look at this and let me know if you see something I have
done wrong?  Thanks a bunch.

' This VBScript code prints the FSMO role owners for the specified domain.

' ---
' From the book Active Directory Cookbook by Robbie Allen ' Publisher:
O'Reilly and Associates ' ISBN: 0-596-00466-4 ' Book web site:
http://rallenhome.com/books/adcookbook/code.html
' ---

' -- SCRIPT CONFIGURATION --
strDomain = mydomain.com  ' e.g. emea.rallencorp.com ' -- END
CONFIGURATION -

set objRootDSE = GetObject(LDAP://;  strDomain  /RootDSE) strDomainDN
= objRootDSE.Get(defaultNamingContext)
strSchemaDN = objRootDSE.Get(schemaNamingContext)
strConfigDN = objRootDSE.Get(configurationNamingContext)

' PDC Emulator
set objPDCFsmo = GetObject(LDAP://;  strDomainDN) Wscript.Echo PDC
Emulator:   objPDCFsmo.fsmoroleowner

' RID Master
set objRIDFsmo = GetObject(LDAP://cn=RID Manager$,cn=system, 
strDomainDN)
Wscript.Echo RID Master:   objRIDFsmo.fsmoroleowner

' Schema Master
set objSchemaFsmo = GetObject(LDAP://;  strSchemaDN) Wscript.Echo Schema
Master:   objSchemaFsmo.fsmoroleowner

' Infrastructure Master
set objInfraFsmo = GetObject(LDAP://cn=Infrastructure,;  strDomainDN)
Wscript.Echo Infrastructure Master:   objInfraFsmo.fsmoroleowner

' Domain Naming Master
set objDNFsmo = GetObject(LDAP://cn=Partitions,;  strConfigDN)
Wscript.Echo Domain Naming Master:   objDNFsmo.fsmoroleowner

List info   : http://www.activedir.org/mail_list.htm
List FAQ: http://www.activedir.org/list_faq.htm
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
List info   : http://www.activedir.org/mail_list.htm
List FAQ: http://www.activedir.org/list_faq.htm
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/


RE: [ActiveDir] Cookbook sample scripts

2004-05-11 Thread Lou Vega
strDomain = mydomain.com  ' e.g. emea.rallencorp.com

needs to be mydomain.com (minus the  )



-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of James Payne
Sent: Tuesday, May 11, 2004 1:41 PM
To: [EMAIL PROTECTED]
Subject: [ActiveDir] Cookbook sample scripts





I just bought the Active Directory Cookbook and started looking at some of
the sample scripts posted on the author's website.  When I attempt to use
this one it tells me the server is not operational, line 14 character 1.
Can anyone take a look at this and let me know if you see something I have
done wrong?  Thanks a bunch.

' This VBScript code prints the FSMO role owners for the specified domain.

' ---
' From the book Active Directory Cookbook by Robbie Allen
' Publisher: O'Reilly and Associates
' ISBN: 0-596-00466-4
' Book web site: http://rallenhome.com/books/adcookbook/code.html
' ---

' -- SCRIPT CONFIGURATION --
strDomain = mydomain.com  ' e.g. emea.rallencorp.com
' -- END CONFIGURATION -

set objRootDSE = GetObject(LDAP://;  strDomain  /RootDSE)
strDomainDN  = objRootDSE.Get(defaultNamingContext)
strSchemaDN = objRootDSE.Get(schemaNamingContext)
strConfigDN = objRootDSE.Get(configurationNamingContext)

' PDC Emulator
set objPDCFsmo = GetObject(LDAP://;  strDomainDN)
Wscript.Echo PDC Emulator:   objPDCFsmo.fsmoroleowner

' RID Master
set objRIDFsmo = GetObject(LDAP://cn=RID Manager$,cn=system, 
strDomainDN)
Wscript.Echo RID Master:   objRIDFsmo.fsmoroleowner

' Schema Master
set objSchemaFsmo = GetObject(LDAP://;  strSchemaDN)
Wscript.Echo Schema Master:   objSchemaFsmo.fsmoroleowner

' Infrastructure Master
set objInfraFsmo = GetObject(LDAP://cn=Infrastructure,;  strDomainDN)
Wscript.Echo Infrastructure Master:   objInfraFsmo.fsmoroleowner

' Domain Naming Master
set objDNFsmo = GetObject(LDAP://cn=Partitions,;  strConfigDN)
Wscript.Echo Domain Naming Master:   objDNFsmo.fsmoroleowner

List info   : http://www.activedir.org/mail_list.htm
List FAQ: http://www.activedir.org/list_faq.htm
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/

List info   : http://www.activedir.org/mail_list.htm
List FAQ: http://www.activedir.org/list_faq.htm
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/


RE: [ActiveDir] Cookbook sample scripts

2004-05-11 Thread Lou Vega
You can try the slightly modified one I use - it writes the roles out to a
text file versus displaying them on the screen


' This VBScript code prints the FSMO role owners for the specified domain.

' ---
' From the book Active Directory Cookbook by Robbie Allen
' Publisher: O'Reilly and Associates
' ISBN: 0-596-00466-4
' Book web site: http://rallenhome.com/books/adcookbook/code.html
' ---
' MODIFIED by Lou Vega - added output to file versus screen
' -- SCRIPT CONFIGURATION --
strDomain = mydomain.com  ' e.g. emea.rallencorp.com
OutfileName = AD FSMO Roles -  Replace(date,/,)  .txt
' -- File Constants --
Const ForReading = 1
Const ForWriting = 2
Const ForAppending = 8
' -- Open the extract file --
Set Filesys = CreateObject(Scripting.FileSystemObject)
Set Outfile = Filesys.OpenTextFile(OutfileName, ForWriting, True)
' -- END CONFIGURATION -

set objRootDSE = GetObject(LDAP://;  strDomain  /RootDSE)
strDomainDN  = objRootDSE.Get(defaultNamingContext)
strSchemaDN = objRootDSE.Get(schemaNamingContext)
strConfigDN = objRootDSE.Get(configurationNamingContext)

' PDC Emulator
set objPDCFsmo = GetObject(LDAP://;  strDomainDN)
outfile.writeline PDC Emulator:   objPDCFsmo.fsmoroleowner

' RID Master
set objRIDFsmo = GetObject(LDAP://cn=RID Manager$,cn=system, 
strDomainDN)
outfile.writeline RID Master:   objRIDFsmo.fsmoroleowner

' Schema Master
set objSchemaFsmo = GetObject(LDAP://;  strSchemaDN)
outfile.writeline Schema Master:   objSchemaFsmo.fsmoroleowner

' Infrastructure Master
set objInfraFsmo = GetObject(LDAP://cn=Infrastructure,;  strDomainDN)
outfile.writeline Infrastructure Master:   objInfraFsmo.fsmoroleowner

' Domain Naming Master
set objDNFsmo = GetObject(LDAP://cn=Partitions,;  strConfigDN)
outfile.writeline Domain Naming Master:   objDNFsmo.fsmoroleowner 
msgbox(All done Chief!  vbcrlf  Errors:   err.number)

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of James Payne
Sent: Tuesday, May 11, 2004 1:41 PM
To: [EMAIL PROTECTED]
Subject: [ActiveDir] Cookbook sample scripts





I just bought the Active Directory Cookbook and started looking at some of
the sample scripts posted on the author's website.  When I attempt to use
this one it tells me the server is not operational, line 14 character 1.
Can anyone take a look at this and let me know if you see something I have
done wrong?  Thanks a bunch.

' This VBScript code prints the FSMO role owners for the specified domain.

' ---
' From the book Active Directory Cookbook by Robbie Allen
' Publisher: O'Reilly and Associates
' ISBN: 0-596-00466-4
' Book web site: http://rallenhome.com/books/adcookbook/code.html
' ---

' -- SCRIPT CONFIGURATION --
strDomain = mydomain.com  ' e.g. emea.rallencorp.com
' -- END CONFIGURATION -

set objRootDSE = GetObject(LDAP://;  strDomain  /RootDSE)
strDomainDN  = objRootDSE.Get(defaultNamingContext)
strSchemaDN = objRootDSE.Get(schemaNamingContext)
strConfigDN = objRootDSE.Get(configurationNamingContext)

' PDC Emulator
set objPDCFsmo = GetObject(LDAP://;  strDomainDN)
Wscript.Echo PDC Emulator:   objPDCFsmo.fsmoroleowner

' RID Master
set objRIDFsmo = GetObject(LDAP://cn=RID Manager$,cn=system, 
strDomainDN)
Wscript.Echo RID Master:   objRIDFsmo.fsmoroleowner

' Schema Master
set objSchemaFsmo = GetObject(LDAP://;  strSchemaDN)
Wscript.Echo Schema Master:   objSchemaFsmo.fsmoroleowner

' Infrastructure Master
set objInfraFsmo = GetObject(LDAP://cn=Infrastructure,;  strDomainDN)
Wscript.Echo Infrastructure Master:   objInfraFsmo.fsmoroleowner

' Domain Naming Master
set objDNFsmo = GetObject(LDAP://cn=Partitions,;  strConfigDN)
Wscript.Echo Domain Naming Master:   objDNFsmo.fsmoroleowner

List info   : http://www.activedir.org/mail_list.htm
List FAQ: http://www.activedir.org/list_faq.htm
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/

List info   : http://www.activedir.org/mail_list.htm
List FAQ: http://www.activedir.org/list_faq.htm
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/


RE: [ActiveDir] Cookbook sample scripts

2004-05-11 Thread Passo, Larry
Unless your domain is named mydomain.com, you need to change line 11

-Original Message-
From: James Payne [mailto:[EMAIL PROTECTED] 
Sent: Tuesday, May 11, 2004 10:41 AM
To: [EMAIL PROTECTED]
Subject: [ActiveDir] Cookbook sample scripts





I just bought the Active Directory Cookbook and started looking at some
of
the sample scripts posted on the author's website.  When I attempt to
use
this one it tells me the server is not operational, line 14 character 1.
Can anyone take a look at this and let me know if you see something I
have
done wrong?  Thanks a bunch.

' This VBScript code prints the FSMO role owners for the specified
domain.

' ---
' From the book Active Directory Cookbook by Robbie Allen
' Publisher: O'Reilly and Associates
' ISBN: 0-596-00466-4
' Book web site: http://rallenhome.com/books/adcookbook/code.html
' ---

' -- SCRIPT CONFIGURATION --
strDomain = mydomain.com  ' e.g. emea.rallencorp.com
' -- END CONFIGURATION -

set objRootDSE = GetObject(LDAP://;  strDomain  /RootDSE)
strDomainDN  = objRootDSE.Get(defaultNamingContext)
strSchemaDN = objRootDSE.Get(schemaNamingContext)
strConfigDN = objRootDSE.Get(configurationNamingContext)

' PDC Emulator
set objPDCFsmo = GetObject(LDAP://;  strDomainDN)
Wscript.Echo PDC Emulator:   objPDCFsmo.fsmoroleowner

' RID Master
set objRIDFsmo = GetObject(LDAP://cn=RID Manager$,cn=system, 
strDomainDN)
Wscript.Echo RID Master:   objRIDFsmo.fsmoroleowner

' Schema Master
set objSchemaFsmo = GetObject(LDAP://;  strSchemaDN)
Wscript.Echo Schema Master:   objSchemaFsmo.fsmoroleowner

' Infrastructure Master
set objInfraFsmo = GetObject(LDAP://cn=Infrastructure,;  strDomainDN)
Wscript.Echo Infrastructure Master:   objInfraFsmo.fsmoroleowner

' Domain Naming Master
set objDNFsmo = GetObject(LDAP://cn=Partitions,;  strConfigDN)
Wscript.Echo Domain Naming Master:   objDNFsmo.fsmoroleowner

List info   : http://www.activedir.org/mail_list.htm
List FAQ: http://www.activedir.org/list_faq.htm
List archive:
http://www.mail-archive.com/activedir%40mail.activedir.org/

List info   : http://www.activedir.org/mail_list.htm
List FAQ: http://www.activedir.org/list_faq.htm
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/


[ActiveDir] Got a good one for everybody

2004-05-11 Thread Mike Hogenauer








Im
looking for a way to have a 3rd party app call a mapped drive on a
remote server at anytime without any user account being logged on at the Application
server with a persistence drive mapping. The remote server has the file shared
out as well. 



The
Application needs to have a drive letter mapped and not a UNC path. (For example
E: instead of \\servername\share)



Thanks in
advance



Mike 



Mike Hogenauer

[EMAIL PROTECTED]

Rendition
Networks, Inc.

10735 Willows Rd
  NE, Suite 150

Redmond, WA
 98052

425.636.2115
| Fax: 425.497.1149










RE: [ActiveDir] DFS

2004-05-11 Thread Brian Desmond
Title: DFS








Yes. I use
it for load balancing the file servers which serve MSIs assigned via GP. I have
it running on DCs as well. Works like a charm once you get all your ducks in a
row.





--Brian Desmond

[EMAIL PROTECTED]

Payton on the
Web! Http://www.wpcp.org



v: 773.534.0034
x135

f: 773.534.0035















From: Jennifer
Fountain [mailto:[EMAIL PROTECTED] 
Sent: Tuesday, May 11, 2004 8:47
AM
To: [EMAIL PROTECTED]
Subject: [ActiveDir] DFS
Sensitivity: Private





Does
anyone here use DFS? If so, do you use it for load balancing? Did
you install it on a DC? It's own server? We are looking into breaking our
one huge file server (1 tb of space) into 4 smaller servers (more manageable
and wanted to look into DFS. We do have NT/95 clients but that should not
stop me because I can install the AD client on them.

Thanks
for any info! 



Kind
Regards, 

Jennifer
Fountain 
RB
Inc 
  3400
  E Walnut Street 
  Colmar, PA 18915 








smime.p7s
Description: S/MIME cryptographic signature


RE: [ActiveDir] disk configuration

2004-05-11 Thread Brian Desmond








For a
truly high perf situation, youre probably going be best with an OS
Mirror, a RAID5 for the DB, and a mirror for the logs.

How big
is your database and how busy will the DC be? This isnt really relevant/an
issue in smaller/medium size configs





--Brian Desmond

[EMAIL PROTECTED]

Payton on the
Web! Http://www.wpcp.org



v: 773.534.0034
x135

f: 773.534.0035















From: Nathan
Casey [mailto:[EMAIL PROTECTED] 
Sent: Tuesday, May 11, 2004 10:38
AM
To: [EMAIL PROTECTED]
Subject: [ActiveDir] disk
configuration





I have a question
about the best way to separate the AD DB and AD log files.
My standard server build is a Compaq DL380 with six 36GB drives and one Compaq
Smart Array 5i Controller.

Normally I mirror the first two HD's for OS and apps use the other four
disks for RAID5 with hot spare.

For Active Directory would it be best to use my standard configuration and put
the AD DB on the mirror with the OS and put the AD log files on the RAID5 or
should I take the six disks and make three mirrors:

Mirror1 = OS and apps

Mirror2 = AD DB

Mirror3 = AD logs



Any advice would
be appreciated.








smime.p7s
Description: S/MIME cryptographic signature


RE: [ActiveDir] DFS

2004-05-11 Thread Jennifer Fountain
The main objective to to remove the single point of failure I have now -
one big file server.  If this goes down, we are SOL.  From what I
read/tested, DFS will allow you to point a single folder to shares on
different physical locations.  (basically, the user sees one server but
in reality I have four)

Replication is also something I could take advantage of; However, can
you schedule replication in DFS?

Kind Regards,

Jennifer Fountain
RB Inc
3400 E Walnut Street
Colmar, PA  18915 

 -Original Message-
 From: [EMAIL PROTECTED] 
 [mailto:[EMAIL PROTECTED] On Behalf Of 
 Depp, Dennis M.
 Sent: Tuesday, May 11, 2004 1:59 PM
 To: Salandra, Justin A.; [EMAIL PROTECTED]
 Subject: RE: [ActiveDir] DFS
 
 Justin,
 
 I don't think this is correct.  With DFS, I can set up 
 different subfolders to point to different physical 
 locations.  These physical locations can be setup a redundant 
 pairs, but this is not required.
 
 Denny
 
 -Original Message-
 From: Salandra, Justin A. [EMAIL PROTECTED]
 Sent: 5/11/04 1:41:37 PM
 To: [EMAIL PROTECTED] [EMAIL PROTECTED]
 Subject: RE: [ActiveDir] DFS
 
 Having a DFS structure would mean that you would have 4 
 servers each with 1 TB of information on them because 
 everything gets replicated to all locations in the DFS.  DFS 
 will NOT put 250 GB on one server, 250 GB on another server and so on.
 
  
 
 -Original Message-
 From: [EMAIL PROTECTED] 
 [mailto:[EMAIL PROTECTED] On Behalf Of 
 Rutherford, Robert
 Sent: Tuesday, May 11, 2004 10:54 AM
 To: [EMAIL PROTECTED]
 Subject: RE: [ActiveDir] DFS
 Sensitivity: Private
 
  
 
  
 
 You can install a DFS root on a DC or member server.
 
  
 
 It should work fine, in terms of splitting down a server 
 and distributing the data over a number of other servers. I'm 
 assuming you only want to use DFS to make a central share 
 access hierarchy?
 
  
 
 I would not use the replication side of it though as it's 
 inherently flawed... well it was on 2000 and have read it 
 hasn't changed that significantly on 2k3. If you do want to 
 use the replication then I would only use it for read only 
 data, i.e. Application distribution points.
 
  
 
 BR,
 
  
 
 Rob
 
  
 
   -Original Message-
   From: Jennifer Fountain [mailto:[EMAIL PROTECTED] 
   Sent: 11 May 2004 14:47
   To: [EMAIL PROTECTED]
   Subject: [ActiveDir] DFS
   Sensitivity: Private
 
   Does anyone here use DFS?  If so, do you use it for 
 load balancing?  Did you install it on a DC? It's own server? 
  We are looking into breaking our one huge file server (1 tb 
 of space) into 4 smaller servers (more manageable and wanted 
 to look into DFS.  We do have NT/95 clients but that should 
 not stop me because I can install the AD client on them.
 
   Thanks for any info! 
 

 
   Kind Regards, 
 
   Jennifer Fountain 
   RB Inc 
   3400 E Walnut Street 
   Colmar, PA  18915 
 
 
 The information transmitted is intended only for the 
 person or entity
 to which it is addressed and may contain confidential and/or
 privileged material. Any use (including retransmission or copying)
 of this information by persons or entities other than the intended
 recipient is prohibited. If you are not the intended 
 recipient of this
 transmission, please contact the sender and delete the material
 from any computer. The sender is not responsible for the 
 completeness or accuracy of this communication as it has been
 transmitted over a public network. Any replies to this 
 email may be
 monitored by the MCPS-PRS Alliance for quality control and other 
 purposes.
 
 List info   : http://www.activedir.org/mail_list.htm
 List FAQ: http://www.activedir.org/list_faq.htm
 List archive: 
 http://www.mail-archive.com/activedir%40mail.activedir.org/
 
List info   : http://www.activedir.org/mail_list.htm
List FAQ: http://www.activedir.org/list_faq.htm
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/


RE: [ActiveDir] DNS settings

2004-05-11 Thread Carlos Magalhaes
Title: Message








Ok (all the
clients are XP ) - In Computer Configuration|Admin Templates|Network|DNS
Client 



There is a setting for DNS Servers to our internal
DNS server.



And this would apply to PPP connections???











From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Rutherford, Robert
Sent: Tuesday, May 11, 2004 6:26
PM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 







Id be tempted to setup a reservation in
DHCP internally and set different DNS settings (whatever u like) to a test
machine ipconfig/release and renew... see if it obtains the new settings or
still holds the old settings.





-Original Message-
From: Rich Milburn
[mailto:[EMAIL PROTECTED] 
Sent: 11 May 2004 15:30
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 

So XP is holding onto the old IP
address now that youre on W2k3 AD, but didnt do it before 
is that accurate?

Does right-clicking on the dial
connection systray icon and choosing repair fix the problem as well?
Thats at least friendlier than ipconfig but obviously not the end
solution



h





Rich Milburn

MCSE, Microsoft MVP -
Directory Services

Sr Network Analyst, Field
Platform Development

Applebee's International,
Inc.

4551 W. 107th St

Overland Park, KS 66207

913-967-2819











From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Carlos Magalhaes
Sent: Tuesday, May 11, 2004 8:31
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 





I tried that and it seems to work. The
problem though is I cant expect the users to do this every time they want to
use their connections, there must be something that is going wacky here. 



Dont you agree?



CM











From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Patrick - IT Department
Sent: Tuesday, May 11, 2004 3:23
PM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 





Maybe trying some actions from the
cmd line would help such as:



IPCONFIG /release [adapter] Release the IP address for the specified adapter. IPCONFIG /renew [adapter] Renew the IP address for the specified adapter. IPCONFIG /flushdns Purge the DNS Resolver cache. IPCONFIG /registerdns Refresh all DHCP leases and re-register DNS names.

 IPCONFIG /displaydns Display
the contents of the DNS Resolver Cache





-Original
Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Roger Seielstad
Sent: Tuesday, May 11, 2004 8:36
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 



The
problem is that the mobile users are dialed up to the Internet, say just to
surf, and they are holding onto their internal DNS settings.



Since
its systemic, I'm wondering if its not either a driver issue or a policy issue,
but I can't think of a single good reason for either of those to cause this
issue.

-- 
Roger D. Seielstad - MTS MCSE MS-MVP 
Sr. Systems Administrator 
Inovis Inc. 

















From: Rutherford, Robert [mailto:[EMAIL PROTECTED]

Sent: Tuesday, May 11, 2004 4:53
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 

Sorry I
think I have lost track here somewhere... I probably didn't read your problem
correctly.



I would
actually think that it is better for them to resolve to your internal DNS
servers. I have seen loads of issues with people trying to get it to work the
other way round. The only thing is that do your internal DNS servers forward
out? If they did then you would probably be in an ok situation?



I'd
still like to find out how your machines are getting their DNS entries though??
Strange.





-Original
Message-
From: Carlos Magalhaes
[mailto:[EMAIL PROTECTED] 
Sent: 11 May 2004 09:14
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 





We
havent and still dont use WINS , this network only uses DNS. 



The
problem I am having is that the user logged onto our network can work fine DNS
is working etc. The user dialed up to their own ISPs are being forced to
our internal DNS servers, they still get a valid IP addy from the ISP they just
are forced to use ours





















From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rutherford, Robert
Sent: Tuesday, May 11, 2004 9:56
AM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS
settings 



It's
either got to be WINS or Hosts files while using the standard W2K VPN dial-up.
I don't think WINS is a bad solution to be honest unless you want to dig into
your pocket.



If
you use a 3rd party, i.e. Checkpoint, then their technology allows for overlay
of your DNS setting post connection. I mentioned IPass earlier and they can do
a similar thing with their client, i.e. push on your internal DNS server post
connection to an IPass ISP.









-Original
Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rick Reynolds
Sent: 11 May 2004 08:14
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DNS

RE: [ActiveDir] Got a good one for everybody

2004-05-11 Thread England, Christopher M



Well, you could have itcall ascript that 
does:

"net use E: \\server\share 
/persistent:no"

The next time the user logs in, it will not be there (it is 
the same as -not- checking the "Reconnect at login" box in Map Network Drive). 
However, until they logout, they will see the E: drive. But an idea 
anyways.

Chris
- 
Christopher England 
Systems Administrator 
MCSA, Server+, Network+, 
A+ College 
Information Technology Office Indiana University - Bloomington 



From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of Mike 
HogenauerSent: Tuesday, May 11, 2004 1:44 PMTo: 
[EMAIL PROTECTED]Subject: [ActiveDir] Got a good one for 
everybody


Im looking 
for a way to have a 3rd party app call a mapped drive on a remote 
server at anytime without any user account being logged on at the Application 
server with a persistence drive mapping. The remote server has the file shared 
out as well. 

The 
Application needs to have a drive letter mapped and not a UNC path. (For example 
E: instead of \\servername\share)

Thanks in 
advance

Mike 


Mike 
Hogenauer
[EMAIL PROTECTED]
Rendition 
Networks, Inc.
10735 
Willows Rd NE, Suite 
150
Redmond, 
WA 98052
425.636.2115 
| Fax: 425.497.1149



RE: [ActiveDir] Got a good one for everybody

2004-05-11 Thread joe



If I understand your question correctly, my thoughts on 
this are good luck. 

With NT4 you could pull this off, 2K and K3 are tightening 
down perms and making cross process/security context access of shared resources 
very difficult if not impossible. Using drive letters was never a recommended 
practive from anyone I know (including MS) for services. 

If I had to guess I would guess that this is a service that 
is being made into a service with like srvany or firedaemon or 
something?If that is the case, back it up a bit and have the process try 
to fire a batch file that sets up the connection and then fires the app. That 
*might* work. 

Mostly this would be a great one to go kick the vendor on 
and ask them if they are serious about playing in the Windows 
space.

 joe


From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of Mike 
HogenauerSent: Tuesday, May 11, 2004 2:44 PMTo: 
[EMAIL PROTECTED]Subject: [ActiveDir] Got a good one for 
everybody


Im looking 
for a way to have a 3rd party app call a mapped drive on a remote 
server at anytime without any user account being logged on at the Application 
server with a persistence drive mapping. The remote server has the file shared 
out as well. 

The 
Application needs to have a drive letter mapped and not a UNC path. (For example 
E: instead of \\servername\share)

Thanks in 
advance

Mike 


Mike 
Hogenauer
[EMAIL PROTECTED]
Rendition 
Networks, Inc.
10735 
Willows Rd NE, Suite 
150
Redmond, 
WA 98052
425.636.2115 
| Fax: 425.497.1149



RE: [ActiveDir] Got a good one for everybody

2004-05-11 Thread Wilson, Julie
Create an AD account for the application to run under and give it full
permission to that share.  Then right a script for the app to run every
time it needs to access that share.  Seems logical and it is something
we do quite often here.

Julie

Julie A. Wilson
University Network Coordinator
Microsoft Network Administrator 
Information Technology Services 
Eastern Illinois University
217-581-7808


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of England,
Christopher M
Sent: Tuesday, May 11, 2004 2:03 PM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] Got a good one for everybody


Well, you could have it call a script that does:
 
net use E: \\server\share /persistent:no
 
The next time the user logs in, it will not be there (it is the same as
-not- checking the Reconnect at login box in Map Network Drive).
However, until they logout, they will see the E: drive. But an idea
anyways.
 
Chris

- 
Christopher England 
Systems Administrator 
MCSA, Server+, Network+, A+ 
College Information Technology Office 
Indiana University - Bloomington 

 

  _  

From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Mike Hogenauer
Sent: Tuesday, May 11, 2004 1:44 PM
To: [EMAIL PROTECTED]
Subject: [ActiveDir] Got a good one for everybody



I'm looking for a way to have a 3rd party app call a mapped drive on a
remote server at anytime without any user account being logged on at the
Application server with a persistence drive mapping. The remote server
has the file shared out as well. 

 

The Application needs to have a drive letter mapped and not a UNC path.
(For example E: instead of \\servername\share
file:///\\servername\share )

 

Thanks in advance

 

Mike 

 

Mike Hogenauer

[EMAIL PROTECTED] blocked::mailto:[EMAIL PROTECTED] 

Rendition Networks, Inc.

10735 Willows Rd NE, Suite 150

Redmond, WA 98052

425.636.2115 | Fax: 425.497.1149

 

List info   : http://www.activedir.org/mail_list.htm
List FAQ: http://www.activedir.org/list_faq.htm
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/


RE: [ActiveDir] DFS

2004-05-11 Thread Bruce Clingaman

1 TB is too much for DFS to replicate between two servers, not to mention
four. The replication (FRS) in DFS is flawed. Have you looked into shadow
copy or a utility like Robocopy? 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Jennifer Fountain
Sent: Tuesday, May 11, 2004 1:45 PM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] DFS

The main objective to to remove the single point of failure I have now - one
big file server.  If this goes down, we are SOL.  From what I read/tested,
DFS will allow you to point a single folder to shares on different physical
locations.  (basically, the user sees one server but in reality I have four)

Replication is also something I could take advantage of; However, can you
schedule replication in DFS?

Kind Regards,

Jennifer Fountain
RB Inc
3400 E Walnut Street
Colmar, PA  18915 

 -Original Message-
 From: [EMAIL PROTECTED]
 [mailto:[EMAIL PROTECTED] On Behalf Of Depp, Dennis 
 M.
 Sent: Tuesday, May 11, 2004 1:59 PM
 To: Salandra, Justin A.; [EMAIL PROTECTED]
 Subject: RE: [ActiveDir] DFS
 
 Justin,
 
 I don't think this is correct.  With DFS, I can set up different 
 subfolders to point to different physical locations.  These physical 
 locations can be setup a redundant pairs, but this is not required.
 
 Denny
 
 -Original Message-
 From: Salandra, Justin A. [EMAIL PROTECTED]
 Sent: 5/11/04 1:41:37 PM
 To: [EMAIL PROTECTED] [EMAIL PROTECTED]
 Subject: RE: [ActiveDir] DFS
 
 Having a DFS structure would mean that you would have 4 servers 
 each with 1 TB of information on them because everything gets 
 replicated to all locations in the DFS.  DFS will NOT put 250 GB on 
 one server, 250 GB on another server and so on.
 
  
 
 -Original Message-
 From: [EMAIL PROTECTED]
 [mailto:[EMAIL PROTECTED] On Behalf Of Rutherford, 
 Robert
 Sent: Tuesday, May 11, 2004 10:54 AM
 To: [EMAIL PROTECTED]
 Subject: RE: [ActiveDir] DFS
 Sensitivity: Private
 
  
 
  
 
 You can install a DFS root on a DC or member server.
 
  
 
 It should work fine, in terms of splitting down a server and 
 distributing the data over a number of other servers. I'm assuming you 
 only want to use DFS to make a central share access hierarchy?
 
  
 
 I would not use the replication side of it though as it's 
 inherently flawed... well it was on 2000 and have read it hasn't 
 changed that significantly on 2k3. If you do want to use the 
 replication then I would only use it for read only data, i.e. 
 Application distribution points.
 
  
 
 BR,
 
  
 
 Rob
 
  
 
   -Original Message-
   From: Jennifer Fountain [mailto:[EMAIL PROTECTED] 
   Sent: 11 May 2004 14:47
   To: [EMAIL PROTECTED]
   Subject: [ActiveDir] DFS
   Sensitivity: Private
 
   Does anyone here use DFS?  If so, do you use it for load 
 balancing?  Did you install it on a DC? It's own server?
  We are looking into breaking our one huge file server (1 tb of space) 
 into 4 smaller servers (more manageable and wanted to look into DFS.  
 We do have NT/95 clients but that should not stop me because I can 
 install the AD client on them.
 
   Thanks for any info! 
 

 
   Kind Regards,
 
   Jennifer Fountain 
   RB Inc 
   3400 E Walnut Street 
   Colmar, PA  18915
 
 
 The information transmitted is intended only for the person or 
 entity
 to which it is addressed and may contain confidential and/or
 privileged material. Any use (including retransmission or copying)
 of this information by persons or entities other than the intended
 recipient is prohibited. If you are not the intended recipient of 
 this
 transmission, please contact the sender and delete the material
 from any computer. The sender is not responsible for the 
 completeness or accuracy of this communication as it has been
 transmitted over a public network. Any replies to this email may 
 be
 monitored by the MCPS-PRS Alliance for quality control and other 
 purposes.
 
 List info   : http://www.activedir.org/mail_list.htm
 List FAQ: http://www.activedir.org/list_faq.htm
 List archive: 
 http://www.mail-archive.com/activedir%40mail.activedir.org/
 
List info   : http://www.activedir.org/mail_list.htm
List FAQ: http://www.activedir.org/list_faq.htm
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/

List info   : http://www.activedir.org/mail_list.htm
List FAQ: http://www.activedir.org/list_faq.htm
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/