about administration

проблема с Normal.dot на терминальном сервере

Sharm — Tue, 03 Nov 2009 12:16:09 +0000

MS Word 2003, установленный на терминальном сервере Windows 2003 Server, начал через раз выдавать предложение создать новый файл шаблонов Normal.dot в связи с его повреждением.

Выглядело это так:

Word has detected a problem with the existing Normal.dot. Would you like to create a new Normal.dot?

Полное удаление существующих шаблонов и временныз файлов никак не влияло – Word стабильно выдавал свое предупреждение, есть шаблон или его нет.

Помогло выполнение действий, описанных в статьях базы знаний Microsoft:

Every other time that you open a document in Word, the document opens in recovery mode or you receive an error message

You are prompted to save the changes to the Normal.dot or Normal.dotm or Normal.dotm global template every time that you quit Word

Every other time that you open a document in Word, the document opens in recovery mode or you receive an error message

To work around this issue, delete the DisabledItems subkey and the Startup subkey. To do this, follow these steps:

Log on as an administrator to the console of the computer that is a terminal server.
Click Start, click Run, type regedit in the Open box, and then click OK.
Locate and then click the following registry subkey, as appropriate for your version of Word.

Word 2002

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\MICROSOFT\Office\10.0\Word\Resiliency

Word 2003

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\MICROSOFT\Office\11.0\Word\Resiliency

Word 2007

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Office\12.0\Word\Resiliency

With the registry subkey that is specified in step 3 selected, follow these steps:
1. Right-click DisabledItems, and then click Delete.
2. Click Yes to confirm that you want to delete the DisabledItems subkey.
3. Right-click Startup, and then click Delete.
4. Click Yes to confirm that you want to delete the Startup subkey.
Locate and then select the following registry subkey, as appropriate for your version of Word.

Word 2002

HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Word\Resiliency

Word 2003

HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Word\Resiliency

Word 2007

HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency

With the registry subkey that is specified in step 5 selected, follow these steps:

. Right-click DisabledItems, and then click Delete.

Click Yes to confirm that you want to delete the DisabledItems subkey.
Right-click Startup, and then click Delete.
Click Yes to confirm that you want to delete the Startup subkey.
On the File menu, click Exit to exit Registry Editor.

You are prompted to save the changes to the Normal.dot or Normal.dotm or Normal.dotm global template every time that you quit Word

Cause 1: The «Prompt to save Normal template» check box is selected

You receive this message if the Prompt to save Normal template check box is selected.

Workaround

To turn off this message, follow these steps.

Important If you turn off this message in Word, you may still have a problem. Word will automatically save the changes to your global template, Normal.dot or Normal.dotm, but you will not be prompted. You may still have to perform the other steps listed in this article.

If you use Microsoft Office Word 2003 or an earlier version of Word:

On the Tools menu, click Options.
On the Save tab, click to clear the Prompt to save Normal template check box.

If you use Microsoft Office Word 2007:

In the upper-left corner of the screen, click the Office button.
In the lower-right area of the drop-down box, click Word Options.
In the Word Options page, click Advanced in the left menu.
Use the scroll bar to scroll down to the Save section.
In the Save section, click to clear the Prompt before saving Normal template check box.

Cause 2: An installed add-in or an installed macro is changing the global template Normal.dot or Normal.dotm

You may receive the message that is listed in the «Symptoms» section if an add-in or a macro on your computer modified the Normal.dot or Normal.dotm template. Add-ins that are known to cause this behavior include the following:

Stamps.com Internet postage
Works Suite add-in for Microsoft Word

An add-in installed in Word may add one or more of the following items to your computer:

WLL file
Templates
COM add-in
Auto macros

Workaround

How to remove WLL add-ins and templates in the Word and Office Startup folders

When you start Word, Word automatically loads templates and add-ins that are located in the Startup folders. Problems in Word may be the result of conflicts or of problems with an add-in. To determine whether an item in a Startup folder is causing the problem, temporarily empty the folder.

Word loads items from the Office Startup folder and the Word Startup folder. To remove items from the Startup folders, follow these steps:

Quit all instances of Word. If you use Word as your e-mail editor, make sure that you quit Outlook also.
On your Windows desktop, double-click My Computer, and then locate your Office Startup folder. The default location is:

C:\Program Files\Microsoft Office\Office\Startup

Note For Office versions 2000 and earlier, the Office folder is Office. For Office XP, the Officefolder is Office10. For Office 2003, the Office folder is Office11.

Drag each item from the Startup folder to the desktop. (Or create a folder on your desktop and drag each item to this new folder.)
Note To create a new folder on the desktop, right-click a blank area on the desktop, point toNew, and then click Folder.
Find the Word Startup folder, and then drag each item from the Startup folder to the desktop. (Or create a folder on your desktop and drag each item to this new folder.) The default location for the Word Startup folder depends on the operating system.
On Microsoft Windows 98 and Windows Millennium Edition without profiles enabled, the location is:

C:\Windows\Application Data\Microsoft\Word\Startup

On Windows 98 and Windows Millennium with profiles enabled or on Windows NT 4.0, the location is:

C:\Windows\user name\Application Data\Microsoft\Word\Startup

On Windows 2000, Windows XP, and Windows Server 2003, the location is:

C:\Documents and Settings\user name\Application Data\Microsoft\Word\Startup

Start Word.
If you can no longer reproduce the problem, and you removed multiple items from the Startup folder or folders, you can try to isolate the problem by adding the files back to the appropriate Startup folder, one by one. Try to reproduce the problem after each addition to determine which file causes the problem.

How to remove COM Add-ins

COM add-ins can be installed in any location. COM add-ins are installed by programs that interact with Word. To view the list of installed COM add-ins, follow these steps:

If you use Word 2003 or an earlier version of Word:

On the Tools menu, click Customize.
Click the Commands tab.
On the Commands tab, click Tools in the Categories list.
Use the mouse to drag the COM Add-Ins command to a toolbar.
Click Close to close the Customize dialog box.
Click the new COM Add-Ins button to view the COM add-ins that are loaded with Word.

If add-ins are listed in the COM Add-Ins dialog box, temporarily turn off each of the add-ins. To do this, click to clear the check box for each COM add-in that is listed, and then click OK. When you restart Word, Word starts without loading the COM add-ins that you turned off.

If the problem is resolved after you turn off the COM add-ins, one of the listed COM add-ins is the cause of the problem. If you have multiple COM add-ins listed, you may want to determine which one is causing the specific problem. To determine this, turn the COM add-ins back on one at a time, and then restart Word.

If you use Word 2007:

In the upper-left corner of the screen, click the Office button.
In the lower-right area of the drop-down box, click Word Options.
In the Word Options page, click Add-ins in the left menu.
At the bottom of the page, select COM Add-ins in the Manage: drop-down list, and then clickGo.
Note If add-ins are listed in the COM Add-Ins dialog box, temporarily turn off each add-in. To do this, click to clear the check box for each COM add-in that is listed. Then, click OK. When you restart Word, Word starts without loading the COM add-ins that you turned off.

If the problem is resolved after you turn off the COM add-ins, one of the COM add-ins is the cause of the problem. If you have multiple COM add-ins listed, you may want to determine which one is causing the specific problem. To determine this, turn the COM add-ins back on one at a time, and then restart Word.

How to remove Word auto macros

Some macros are named «auto» macros. These auto macros run automatically when Word is started. The following table lists these auto macros. To start Microsoft Word without running the auto macros, hold the SHIFT key while you start Word. To do this, click Start, point to Programs, and then hold the SHIFT key and click Microsoft Word.

Macro	Storage location	Automatically runs
AutoExec	In the Normal template or in a global add-in	When you start Word
AutoNew	In a template	When a new document that is based on the template is created
AutoOpen	In document or template	When a document that is based on the template or that contains the macro is opened
AutoClose	In document or template	When a document that is based on the template or that contains the macro is closed
AutoExit	In the Normal template or a global add-in	When you quit Word

Word recognizes a macro with a name that begins with «Auto» as a macro that automatically runs when the situation to which it applies occurs. You can temporarily prevent an auto macro from running by holding SHIFT while performing the action that causes the macro to run. For example, to prevent an AutoOpen macro from running, hold SHIFT while you open a document or a template.

If the problem is resolved by holding the SHIFT key when you start Word or when you perform an action in Word such as opening a document, an auto macro is the problem. To work around this problem, follow these steps:

If you use Word 2003 or an earlier version of Word:

Click Start, and then click Run.
In the Open box, type winword, and then click OK.
On the Tools menu, point to Macro, and then click Macros.
In the Macros dialog box, a list of macros may appear. If any macro listed begins with «Auto,» you may want to remove this macro. To remove an auto macro, click the macro, and then clickDelete.

Note An auto macro may have been added by a Word add-in. To determine what template contains the auto macro, change the Macros in box to a listed template. After you determine which template contains the auto macro, you may want to remove that template from your computer. Removing a template that was added by a Word add-in may reduce or stop the add-in’s functionality.

Click Cancel or click Close to close the Macros dialog box.
On the File menu, click Exit to quit Microsoft Word.

Expand this image

If the problem is resolved after you restart Word, the auto macro was the problem.

If you use Word 2007:

In the upper-left corner of the screen, click the Office button.
In the lower-right area of the drop-down box, click Word Options.
In the Word Options page, click Popular in the left menu.
In the Top options for working with Word section, click to select the Show Developer tab in the Ribbon check box, and then click OK.
At the top of the Word window, click the Developer tab.
On the Developer tab, click Macros in the Code group.
In the Macros dialog box, a list of macros may appear. If any macro that is listed begins with «Auto,» you may want to remove this macro. To remove an auto macro, click the macro, and then click Delete.

Note An auto macro may have been added by a Word add-in. To determine what template contains the auto macro, change the Macros in box to a listed template. After you determine which template contains the auto macro, you may want to remove that template from your computer. Removing a template that was added by a Word add-in may reduce or stop the add-in’s functionality.

Cause 3: Word is infected with a macro virus

This problem may occur if your computer is infected with a virus that changes the global template (Normal.dot or Normal.dotm). To help avoid virus infection, keep your antivirus software and your virus definitions updated with the latest versions. Ask your antivirus software vendor for the latest information.

For information about how to contact your antivirus software vendor, click the appropriate article number in the following list to view the article in the Microsoft Knowledge Base:

65416 Hardware and software vendor contact information, A-K

60781 Hardware and software vendor contact information, L-P

60782 Hardware and software vendor contact information, Q-Z

For additional information, click the following article numbers to view the articles in the Microsoft Knowledge Base:

211800 How to deal with a macro virus in Word 2000 or Word 2002

233396 How to reduce the chances of macro virus infection

211607 Frequently asked questions about Word macro viruses

Как обновить Windows 7 Ultimate RC до Windows 7 Enterprise RTM

Sharm — Sat, 31 Oct 2009 03:40:54 +0000

Использование на рабочем ноутбуке Windows 7 RC показало, что эта операционная система гораздо быстрее и удобнее в работе, чем Windows XP и Windows Vista.

Однако вышел официальный релиз, компаниям-партнерам давно доступны RTM версии – подходит время обновления.

Причем доступна партнерам именно Enterprise редакция. По информации с сайта Майкрософт, Ultimate и Enterprise полностью идентичны – просто последняя доступна для лицензирования только организациям.

Некоторое неудобство вызывало уведомление Майкрософт о том, что такое обновление будет недоступно.

И правда, запустив установку мы получим сообщение ошибке.

Но не переставлять же хорошо работающую систему, в самом деле!

Приступим.

Что делать с Windows 7 Ultimate RC

Запустить Registry Editor (Start > Run > regedit)

Открыть раздел HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\Current Version

Заменить слово “Ultimate” на “Enterprise” в ключах ProductName и EditionID.

На этом изменение Windows 7 RC завершено.

Модификация установки WIndows 7 Enterprise

Я рекомендую использовать для установки USB (Flash) диск. Устанавливается система быстрее, чем с DVD. Носить удобнее. Да и модификации можно делать сразу, не записывая ничего на диски. Как это сделать, написано здесь: http://blogs.technet.com/iwalker/archive/2009/01/21/windows-7-windows-server-2008-r2-c-usb.aspx

Нам остается открыть для редактирования файл \sources\cversion.ini, заменить значение MinClient на 7100 и сохранить его.

Это все. Можно запускать установку. Для обновления существующей системы это обязательно нужно сделать внутри нее.

Оригинал взят отсюда: http://www.gmtaz.com/index.php/how-to-upgrade-windows-7-rc-ultimate-to-rtm-enterprise/

How to Run Programs as a Domain User from a Non-domain Computer

Sharm — Tue, 13 Oct 2009 13:56:34 +0000

In most cases, not being joined to a client’s domain doesn’t make one iota of difference. You need to access a network share or printer, browser to it and you will be prompted for domain credentials. The fact that you’re using different domain credentials to access the resource from those that you logged in with doesn’t matter one bit. If you want to expedite the process and not wait for an authentication time-out, you can utilize NET USE from the command line to tell Windows which credentials you want to use when accessing certain computers. You can even make them persistent or roll the whole thing into a batch script that you can execute whenever at a particular client.

net use \\server /user:domain\username /persistent:yes

Unfortunately this doesn’t work in all cases. One of my longstanding development pet peeves has been certain tools – I’m looking at you SQL Server Management Studio and SQL Query Analyzer – that don’t allow you to specify alternate domain credentials for authentication. For example, SQL Server Management Studio allows you to log into a SQL Server instance using Windows Authentication or SQL Server Authentication. If the SQL instance requires Windows Authentication – the recommended configuration – SQL Server Management Studio uses your logged in credentials. This works well if your computer is part of the domain, but fails horribly if not. It doesn’t let you specify alternate credentials or even prompt you for alternate credentials if the log-in fails.

I’ve tried seemingly everything. NET USE doesn’t help here because NET USE is specifically for network shares.

net use \\sql-server-name /user:domain\username # DOES NOT WORK – Only provides the domain credentials when accessing shares

RUNAS also fails – either the SHIFT right-click variety or command line – as it tries to run the command locally as the domain user, who is unknown by your computer because you’re not part of the domain.

runas /user:domain\username “C:\Program Files (x86)\Microsoft SQL Server\100\Tools\Binn\VSShell\Common7\IDE\Ssms.exe”

For years (yes, years) I have resorted to using Remote Desktop to log into a domain computer so that I could run SQL Server Management Studio, used a domain-joined virtual machine, or begged co-workers to run commands for me. Now I feel foolish because I stumbled upon a solution that has been built into Windows for years. It is a simple command line switch for the RUNAS command that I never noticed: /netonly. (Note that the /netonly flag is not accessible via the SHIFT right-click menu, only via the command line.)

runas /netonly /user:domain\username “C:\Program Files (x86)\Microsoft SQL Server\100\Tools\Binn\VSShell\Common7\IDE\Ssms.exe”

Success! And SQL Server Management Studio running using /netonly domain credentials. The command is run as my local user, but uses the supplied domain credentials only when accessing the network.

I can access remote SQL Servers using Windows Authentication without problem now! (You’ll have to take my word for it or try it yourself as it would be impolite for me to show screenshots of me accessing a client’s SQL Server.) Hopefully this makes some other consultant’s life a little bit easier.

Original: http://codebetter.com/blogs/james.kovacs/archive/2009/10/11/tip-how-to-run-programs-as-a-domain-user-from-a-non-domain-computer.aspx

Как восстановить отсутствующие разделы в Group Policy Editor

Sharm — Fri, 02 Oct 2009 14:10:44 +0000

Однажды я столкнулся с ситуацией, когда оказалось невозможным включить Windows Firewall. Опции включения и отключения не могли быть изменены. Такое бывает, если эта опция установлена групповой политикой. Причем для этого не обязательно, чтобы компьютер находился в домене. В моем случае с большой вероятностью файервол был отключен вирусом.

Запустив gpedit.msc для редактирования групповой политики, я с удивлением обнаружил, что там отсутствует раздел, содержащий настройки Windows Firewall. Эта статья описывает методы, позволящие восстановить доступ к настройке отсутствующих политик.

When you open the Group Policy Editor in Windows XP Professional, some of the categories under Administrative Templates may be missing. For example when you expand Administrative Templates, the System category may be missing. This article provides information on how to restore the missing folders to the Group Policy Editor.

Add the Missing ADM File

Method 1

1. Open the Group Policy Editor (gpedit.msc)

2. Expand Computer Configuration

3. Right-click Administrative Templates, and click Add/Remove Templates…

4. Click Add…

5. Select the file system.adm and click Open

6. Click Close.

Method 2

Using Windows Explorer, copy the file system.adm from the C:\Windows\INF folder to C:\Windows\system32\GroupPolicy folder. In a standard Windows XP installation, the target folder has the following ADM files by default:

conf.adm
inetres.adm
wmplayer.adm
wuau.adm
system.adm

Copying the missing file from the ADM folder should restore the missing folder in the Group Policy Editor. If that does not work, make sure that filtering is turned off.

Turn Off Filtering

1. Expand Computer Configuration, and select Administrative Templates

2. From the View menu, click Filtering…

3. Uncheck the following checkboxes:

Filter by Requirements information
Only show configured Policy settings

4. Click OK.

Взято здесь: http://www.winhelponline.com/blog/restore-missing-folders-group-policy-editor-xp/

Как добавить доменного пользователя в локальную группу

Sharm — Thu, 24 Sep 2009 11:44:47 +0000

Иногда нужно добавить пользователя в локальнуюю группу – например, дать ему административные права на компьютер.

Это можно сделать следующей командой:

net localgroup Administrators "DOMAIN\username" /ADD

С помощью команды net можно также добавить пользователя и в доменную группу:

net group LocalAdmins "DOMAIN\username" /ADD

The syntax of this command is:

NET GROUP
[groupname [/COMMENT:"text"]] [/DOMAIN]
             groupname {/ADD [/COMMENT:"text"] | /DELETE}  [/DOMAIN]
             groupname username [...] {/ADD | /DELETE} [/DOMAIN]

NET GROUP adds, displays, or modifies global groups on servers. Used
without parameters, it displays the groupnames on the server.

groupname        Is the name of the group to add, expand, or delete.
                 Supply only a groupname to view a list of users
                 in a group.
/COMMENT:"text"  Adds a comment for a new or existing group.
                 Enclose the text in quotation marks.
/DOMAIN          Performs the operation on a domain controller
                 of the current domain. Otherwise, the operation is
                 performed on the local computer.
username[ ...]   Lists one or more usernames to add to or remove from
                 a group. Separate multiple username entries with a space.
/ADD             Adds a group, or adds a username to a group.
/DELETE          Removes a group, or removes a username from a group.

The syntax of this command is:

NET GROUP

[groupname [/COMMENT:"text"]] [/DOMAIN]

groupname {/ADD [/COMMENT:"text"] | /DELETE} [/DOMAIN]

groupname username [...] {/ADD | /DELETE} [/DOMAIN]

NET GROUP adds, displays, or modifies global groups on servers. Used

without parameters, it displays the groupnames on the server.

groupname Is the name of the group to add, expand, or delete.

Supply only a groupname to view a list of users

in a group.

/COMMENT:»text» Adds a comment for a new or existing group.

Enclose the text in quotation marks.

/DOMAIN Performs the operation on a domain controller

of the current domain. Otherwise, the operation is

performed on the local computer.

username[ ...] Lists one or more usernames to add to or remove from

a group. Separate multiple username entries with a space.

/ADD Adds a group, or adds a username to a group.

/DELETE Removes a group, or removes a username from a group.

NET HELP command | MORE displays Help one screen at a time.

Как узнать имя выполняемого командного файла

Sharm — Fri, 18 Sep 2009 11:58:53 +0000

И другие фишки, которые могут пригодится при batch-programming

%* in a batch script refers to all the arguments (e.g. %1 %2 %3

%4 %5 …)

Substitution of batch parameters (%n) has been enhanced. You can

now use the following optional syntax:

%~1 – expands %1 removing any surrounding quotes («)

%~f1 - expands %1 to a fully qualified path name

%~d1 - expands %1 to a drive letter only

%~p1 - expands %1 to a path only

%~n1 - expands %1 to a file name only

%~x1 - expands %1 to a file extension only

%~s1 - expanded path contains short names only

%~a1 - expands %1 to file attributes

%~t1 - expands %1 to date/time of file

%~z1 - expands %1 to size of file

%~$PATH:1 – searches the directories listed in the PATH

environment variable and expands %1 to the fully

qualified name of the first one found. If the

environment variable name is not defined or the

file is not found by the search, then this

modifier expands to the empty string

The modifiers can be combined to get compound results:

%~dp1 – expands %1 to a drive letter and path only

%~nx1 – expands %1 to a file name and extension only

%~dp$PATH:1 – searches the directories listed in the PATH

environment variable for %1 and expands to the

drive letter and path of the first one found.

%~ftza1 – expands %1 to a DIR like output line

In the above examples %1 and PATH can be replaced by other

valid values. The %~ syntax is terminated by a valid argument

number. The %~ modifiers may not be used with %*

Using batch parameters

You can use batch parameters anywhere within a batch file to extract information about your environment settings.

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/percent.mspx?mfr=true

Shift

Changes the position of batch parameters in a batch file.

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/shift.mspx?mfr=true

Using command redirection operators

You can use redirection operators to redirect command input and output streams from the default locations to different locations. The input or output stream location is referred to as a handle

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/redirection.mspx?mfr=true

Using filters

Used in conjunction with the command redirection pipe character (|), a command filter is a command within a command that reads the command’s input, transforms the input, and then writes the output. Filter commands help you sort, view, and select parts of a command output.

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/filters.mspx?mfr=true

Cmd.exe provides the batch parameter expansion variables %0 through %9. When you use batch parameters in a batch file, %0 is replaced by the batch file name, and %1 through %9 are replaced by the corresponding arguments that you type at the command line. To access arguments beyond %9, you need to use the shift command. For more information about the shift command, see Shift The %* batch parameter is a wildcard reference to all the arguments, not including %0, that are passed to the batch file.

For example, to copy the contents from Folder1 to Folder2, where %1 is replaced by the value Folder1 and %2 is replaced by the value Folder2, type the following in a batch file called Mybatch.bat:

xcopy %1\*.* %2

To run the file, type:

mybatch.bat C:\folder1 D:\folder2

This has the same effect as typing the following in the batch file:

xcopy C:\folder1 \*.* D:\folder2

You can also use modifiers with batch parameters. Modifiers use current drive and directory information to expand the batch parameter as a partial or complete file or directory name. To use a modifier, type the percent (%) character followed by a tilde (~) character, and then type the appropriate modifier (that is, %~modifier).

%* in a batch script refers to all the arguments (e.g. %1 %2 %3

%4 %5 …)

Substitution of batch parameters (%n) has been enhanced. You can

now use the following optional syntax:

%~1 – expands %1 removing any surrounding quotes («)

%~f1 - expands %1 to a fully qualified path name

%~d1 - expands %1 to a drive letter only

%~p1 - expands %1 to a path only

%~n1 - expands %1 to a file name only

%~x1 - expands %1 to a file extension only

%~s1 - expanded path contains short names only

%~a1 - expands %1 to file attributes

%~t1 - expands %1 to date/time of file

%~z1 - expands %1 to size of file

%~$PATH:1 – searches the directories listed in the PATH

environment variable and expands %1 to the fully

qualified name of the first one found. If the

environment variable name is not defined or the

file is not found by the search, then this

modifier expands to the empty string

The modifiers can be combined to get compound results:

%~dp1 – expands %1 to a drive letter and path only

%~nx1 – expands %1 to a file name and extension only

%~dp$PATH:1 – searches the directories listed in the PATH

environment variable for %1 and expands to the

drive letter and path of the first one found.

%~ftza1 – expands %1 to a DIR like output line

In the above examples %1 and PATH can be replaced by other

valid values. The %~ syntax is terminated by a valid argument

number. The %~ modifiers may not be used with %*

Как подключить Samba 3 сервер к домену Active Directory

Sharm — Mon, 14 Sep 2009 15:59:22 +0000

Join Samba 3 to Your Active Directory Domain

Original: http://www.enterprisenetworkingplanet.com/netos/article.php/3487081

A popular thing to do with Samba these days is to join a Samba 3 host to a Windows Active Directory domain. You may freely set up any number of Samba servers in a Windows network without joining them to the domain. The advantages of domain membership are central management and authentication, and single sign-on. Using Winbind allows Linux clients to log on to the AD domain without requiring local Linux system accounts, which is a lovely time- and hassle-saver.

Presumably you already have a functioning Active Directory domain, and know how to run it. AD is very dependent on DNS (domain name system) so I’ll assume your DNS house is also in order. On your Linux box you’ll need Samba 3, version 3.0.8 or newer. Plus MIT Kerberos 5, version 1.3.1 or newer, and OpenLDAP. (The Samba documentation states that Heimdal Kerberos, version 0.6.3 or newer, also works. The examples in this article use MIT Kerberos.) Debian users need thekrb5-user, krb5-config, krb5-doc, and libkrb53 packages. Red Hat and Fedora users need the krb5and krb5-client RPMs.

First you should verify that your Samba installation has been compiled to support Kerberos, LDAP, Active Directory, and Winbind. Most likely it has, but you need to make sure. The smbd command has a switch for printing build information. You will see a lot more lines of output than are shown here:

root@windbag:/usr/sbin# cd /usr/sbin root@windbag:/usr/sbin# smbd -b | grep LDAP HAVE_LDAP_H HAVE_LDAP HAVE_LDAP_DOMAIN2HOSTLIST ... root@windbag:/usr/sbin# smbd -b | grep KRB HAVE_KRB5_H HAVE_ADDRTYPE_IN_KRB5_ADDRESS HAVE_KRB5 ... root@windbag:/usr/sbin# smbd -b | grep ADS WITH_ADS WITH_ADS root@windbag:/usr/sbin# smbd -b | grep WINBIND WITH_WINBIND WITH_WINBIND

If you are in the unfortunate position of missing any of these, which will be indicated by a blank line, you need to recompile Samba. See Chapter 37 of the The Official Samba-3 HOWTO and Reference Guide.

Configure and Test Kerberos

Let’s say our Active Directory domain server is bigserver.domain.net, and the Samba server is namedsamba1. This is the absolute minimum Kerberos configuration file, /etc/krb5.conf, for connecting to this domain:

'libdefaults' default_realm = DOMAIN.NET 'realms' DOMAIN.NET = { kdc = bigserver.domain.net } 'domain_realms' .kerberos.server = DOMAIN.NET Use uppercase where it shows. Now try to connect, and mind your cases: # kinit Administrator@DOMAIN.NET Password for Administrator@DOMAIN.NET Configure /etc/hosts Even if your DNS servers are perfect in every way, it is a good idea to add important servers to your local /etc/hosts file. It speeds up lookups and provides a fallback in case the DNS servers go down: 192.168.10.5 bigserver.domain.net bigserver Configure Samba This example smb.conf shows a basic setup for a printer server and home shares. Shares are configured in the usual manner, only the global section changes when you join to an AD domain. # Global parameters 'global' workgroup = DOMAIN realm = DOMAIN.NET preferred master = no server string = Samba file and print server security = ADS encrypt passwords = yes log level = 3 log file = /var/log/samba/%m max log size = 50 winbind separator = + printcap name = cups printing = cups idmap uid = 10000-20000 idmap gid = 10000-20000 'homes' comment = Home Directories valid users = %S read only = No browseable = No 'printers' comment = All Printers browseable = no printable = yes guest ok = yes The workgroup is the name of your AD domain. Server string is a comment describing the server, make this anything you want. Log level runs from 0, for no logging, to 10, extreme logging. See man smbd.conf for the rest. Save your changes and run $ testparm This checks smb.conf for syntax errors. Any errors must be corrected before going ahead. Then start up Samba: # /etc/init.d/samba start Finally, join your Samba machine to Active Directory: # net ads join -U Administrator Administrator's password: Joined 'SAMBA1' to realm 'DOMAIN.NET.' Hurrah! Success. The Samba box will now appear as a machine account under "Computers" in your AD console. Now stop Samba until the final steps are completed. Enabling Windbind Debian users may need to install the winbind package separately. RPM users will find it in the samba-common RPM. First, edit /etc/nsswitch.conf. The first three lines are the most important; the others vary according to your system:

passwd:	compat winbind
group:	compat winbind
shadow:	compat
hosts:	files dns wins
networks:	files dns
protocols:	db files
services:	db files
ethers:	db files
rpc:	db files

Save your changes, and fire up windbind and Samba: # winbind # /etc/init.d/samba start Now verify that windbind is working. These commands pull lists of users and groups from the AD domain controller: # wbinfo -u BIGSERVER+Administrator BIGSERVER+Guest BIGSERVER+cschroder BIGSERVER+mhall # wbinfo -g BIGSERVER+Domain Computers BIGSERVER+Domain Admins BIGSERVER+Domain Guests BIGSERVER+Domain Users This command verifies that logins and passwords are coming from the AD server, and not the local machine: # getent passwd BIGSERVER+cschroder:x:1000:1000:,,,:/home/BIGSERVER/cschroder:/bin/bash If winbind is not working and local authentication is still active, they will not have the BIGSERVER+ prefix. Finally, as root run net ads info to display the AD server information. Troubleshooting If you've gotten this far and everything works, your Samba server is now a fully-fledged member of your Active Directory domain, and can be managed like any other AD object. A nice bonus is you may have local Linux accounts on the Samba box that are not visible in Active Directory; which means your Samba admins can SSH directly into the Samba server for admin chores, and not have to fuss with AD roadblocks. A good troubleshooting guide is chapter 9 of "Samba-3 by Example" (Adding UNIX/LINUX Servers and Clients). Also refer to chapter 12 (Identity Mapping) of "The Official Samba-3 HOWTO and Reference Guide" to learn about winbind in greater depth. Resources Many good Samba books and howtos here. Network Installation of Windows Printers from Samba tells how to automatically install Windows printers from Samba. Chapter 23 of the Linux Cookbook covers Samba basics in depth, including printing and file sharing, and connecting from both Windows and Linux clients.

Как упавший контроллер домена поднять

Sharm — Thu, 10 Sep 2009 12:59:49 +0000

http://articles.techrepublic.com.com/5100-10878_11-6082663.html

хорошая статья – что делать, если упал один из контроллеров домена

This article is also available as a PDF download.

I recently had to sort out an issue with a failed mirror set (i.e., RAID 1) on a Windows Server 2003 domain controller. No problem, I thought. Well, not quite. The mirror had to be deleted, taking everything from both drives with it. Restoring Active Directory through backup failed. To make a bad situation worse, the DC was the holder of all the Flexible Single Master of Operations (FSMO) roles in this (single) domain. Transferring the roles failed; seizing them was problematic. Disaster recovery? Indeed! This article will show you how to get such a DC–and the whole domain–back from the brink. As you’ll see, a disaster recovery plan is about more than generalities.

Disaster scenario

You have your disaster recovery plan all neatly set out. Then disaster strikes: A Windows Server 2003 domain controller goes down. Okay, not a train smash; you’ve got up-to-date backups. But restoring Active Directory via backup fails. Now what? Well, you can still reinstall Server 2003 and restore user data from backup. (The latter works–you’ve checked.)

There’s only one problem: This server was the holder of all the FSMO roles. So you’re starting to sweat a little, but not too profusely. You know about transferring FSMO roles to another domain controller. But what if that fails? Yes, you can try seizing it. At this stage, you’re looking at the stuff disasters are made of, because now your whole domain teeters on the brink. (I’ll explain why in a moment.)

Admittedly, this is a very particular (and very unfortunate) scenario. But then, the nature of a disaster is its unpredictability. And there are a couple of general lessons to be learned from this specific incident. Here’s what I did and what I learned along the way.

In this situation, the failed mirror could not be rebuilt in a nondestructive way (I won’t go into the whys and wherefores here), making loss of all data on both drives inevitable. I tried restoring AD from backup. It failed, presumably because the backup software that was used (an old version for NT) didn’t back up the system state data. Trying to restore with Server 2003’s own backup utility (ntbackup.exe) didn’t work either. It didn’t recognize the backup format of the legacy software.

Lose the roles and you’re lost

Next, I tried transferring the FSMO roles that were held by this DC to another DC in the domain. It failed. Then I attempted seizing the roles, but the error messages I got (Figure A) did not look promising. I nevertheless attempted seizing every role, and strangely enough, after completing the whole procedure described below, I saw that the roles had been seized successfully. (Don’t ask me, ask Microsoft.)

Figure A

The attempt at seizing the roles resulted in these errors. (Note: the domain name, DC/server name, and CN name have been edited out for security reasons.)

But what happens if you do lose the FSMO roles? Let’s just say that losing some of them can have bone-chilling implications. For example, without the RID Master, if you have more than one domain, you won’t–with immediate effect–be able to move security principals from one domain to another. You also won’t be able to add new users, groups, and computers to the domain. You won’t experience the latter problem immediately, as each DC in the domain has a pool of 512 RIDs. But after that, you’re dead in the water. Now you’re faced with the prospect rebuilding the whole domain.

Replication to the rescue

So what are your options (apart from re-creating the domain)? Reinstalling and replicating. If you have a big AD (and maybe slow WAN links), replication is not an attractive option, but it might be your only choice. If you have another DC in the same site as the failed DC, you’re in luck, because replication will be much faster.

Tip: If it will speed up things, take the DC you’re reinstalling to the same location as the one you intend replicating from. In my case, the two DCs in the same site were separated by a wireless link that would have slowed replication down, so I took the one across.

Reinstall Windows Server 2003 on the failed machine, make it a DC (run DCPromo), and install and restore whatever other services there were on the machine, like DHCP, WINS, DNS, and IIS. When you’re finished, start replicating. Now you’re ready to restore your data.

First, clean up

Before you reinstall Windows Server 2003 on the failed machine and make it a DC, there’s an important job to do: a metadata cleanup. This entails removing the dead DC from AD (more technically speaking, removing the ntdsDSA object). You have to be an Enterprise Administrator to perform this task.

A word of caution: Be absolutely sure this is the route you want to take before you do the metadata cleanup. There’s no turning back (at least none that I’m aware of).

How you perform the cleanup will differ depending on whether you want to name your new DC the same as the old (failed) one. I suggest retaining the old name, as it simplifies matters a lot (for example, with shares). However, if you always wanted to rename that DC, now is the time.

Let’s start with the steps to follow if you want to give the new DC the same name. In this case, you’ll have to remove the old DC’s ntdsDSA object.

The commands differ slightly depending on whether the DC in question has Service Pack 1 (SP1) installed. If SP1 is installed, metadata cleanup also removes File Replication Service (FRS) connections and as part of the process, tries to transfer or seize any operations master roles that the retired DC holds.

Type ntdsutil at the command prompt.
At the ntdsutil: prompt, type metadata cleanup and press [Enter].
If SP1 is installed, type remove selected server ServerName. (See Figure B.) If SP1 is not installed and you’re using the version of Ntdsutil.exe that’s included with Windows Server 2003 with no service pack, connect to the existing domain controller (in our case, the one in the same site as the failed DC) on which you want to remove the failed DC’s ntdsDSA object. To do this, type connections at the metadata cleanup prompt and press [Enter].
Type connect to server , where is the DC that will be used to clean the metadata, and press [Enter]. It can be any working DC in the same domain, but we’ll use one in the same site. Figure C shows this step on a DC that does not have SP1 installed.
Type quit and press [Enter].
Type select operation target and press [Enter].
Type list domains and press [Enter]. All domains in the forest will be listed.
Type select domain and press [Enter].
Type list sites and press [Enter].
Type select site (the number of the site in which the DC was a member) and press [Enter].
Type list servers in site and press [Enter].
Type select server , where is that of the DC to be removed, and press [Enter].
Type quit and press [Enter].
Type remove selected server and press [Enter].
Type quit and press [Enter] until you’re back at the command prompt.

Figure B

Starting the metadata cleanup process using ntdsutil on a DC with SP1 installed

FigureC

Starting the metadata cleanup process using ntdsutil on a DC without SP1 installed

If you’re going to take the plunge and give the DC a new name, you’ll have to remove the failed server from the Sites & Services and Users & Computers snap-ins. NB: Don’t do this if the new DC will have the same name as the failed one.

Open the Sites & Services snap-in.
Select the relevant site.
Delete the server object representing the failed DC.

Open the Users & Computers snap-in.
Select the domain controllers container.
Delete the computer object associated with the failed DC.

Lessons

Here are some things you should know, check, and do before disaster strikes:

This might seem pretty obvious (but how many of us do it…): Plan for what-if (worst-case) scenarios. That’s what’s meant by «disaster», right? Don’t bargain on anything (backups working, etc.)

Outline procedures to recover from disasters like these. Put a fair amount of detail in your disaster recovery documentation. You need more than generalities. Have the procedures for tasks like seizing FSMO roles set out clearly as part of your disaster recovery plan. It will speed up recovery considerably in case of a crisis.

Even better, test your procedures in the calm environment of a test lab.

Regularly check that you have what it takes to recover from a disaster. For instance, how up-to-date is the backup of your system state data? When it comes to system state data, age matters. If your system state backup is older than the tombstone age, you’re in for trouble. The default tombstone lifetime is 60 days. (A tombstone keeps tabs on objects deleted but not yet completely removed from AD.) To prevent inconsistencies in AD, you’re prevented from restoring data older than the tombstone lifetime.

Prepare to speed up recovery (and take pressure off yourself) by making separate backups of DNS and DHCP and all server drivers.

Ensure that your disaster recovery procedure is set out clearly and systematically, listing the steps to follow and the order in which things should be done.

Potential pitfalls

Install the relevant service pack(s) and critical updates immediately after reinstallation. Remember to check shares and permissions. I also had to restore mapped drives. Also, remember to set up the time service again if you had to follow the recovery route described above. And just to add to the fun: If you apply Server 2003’s SP1, you might run into a problem with the time server service not starting. You’ll find the solution here.

KIS vs NTFS

Sharm — Thu, 10 Sep 2009 11:40:06 +0000

Недавно столкнулись с интересной ситуацией:

при выполнении SVN update под Windows 7 TortoiseSVN выдавала сообщение об ошибке – недоступности каталога. При этом в System логе Windows появлялось сообщение с EventID 55 – NTFS – что файловая система повреждена и требуется проверка.

В результате изучения проблемы был обнаружен виновник – им оказался Kaspersky Internet Security 2010, установленный на компьютере. После отключения проверки файлов на-лету, проблема исчезла.

Винчестер, память и операционная система, на которые мы поначалу грешили, оказались невиновны

Как отрегулировать Теневое копирование тома под Vista/Windows 7

Sharm — Tue, 16 Jun 2009 20:43:58 +0000

Служба «Теневое копирование тома» (Volume Shadowcopy Service, VSS) сохраняет точки восстановления и поддерживает резервирование и восстановление файлов. Для этого служба выполняет моментальный снимок файлов на определенный момент времени. VSS создаёт статические копии открытых файлов и приложений, которые при других обстоятельствах не могут быть скопированы.

Благодаря этому механизму, в Vista появилась возможность вернуться к предыдущей версии любых файлов. Теперь можно даже восстановить папку, которая была удалена без помещения в корзину! Для этого достаточно открыть свойства более верхней папки, выбрать «Предыдущие копии» («Previous versions») и открыть последнюю предыдущую версию. Затем вы сможете скопировать удаленную папку на прежнее место. Конечно, все это возможно при условии, что служба теневого копирования включена и отслеживает изменения на вашем диске.

Посмотреть, сколько места занимают текущие теневые копии тома можно с помощью команды:

vssadmin list shadowstorage

Эта команда выведет список всех имеющихся копий с указанием их размера.

С помощью vssadmin можно также изменить размер, который система сможет выделить для теневых копий.

Для Windows 7 после установки теневые копии создаются только для системного диска. Если у вас документы находятся на диске D:, стоит открыть Control Panel -> System and Security -> System, выбрать «System protection» и включить создание предыдущих копий для этого диска: