Tag Archives: Server 2008 R2

Upgrading Network Policy Server from Server 2008 R2 to Server 2012 R2

Synopsis: This tutorial will cover a basic "upgrade" path to go from Server 2008 R2 to Server 2012 R2. This tutorial assumes you have a single Network Policy Server and you are wishing to reuse the same machine name, IP, and settings. In environments needing high availability, you will need to complete each of the steps below, adding/removing each server being upgraded from your network load balancer.

In a standalone instance, you will experience some downtime as you will have to retire the old machine and setup a new one.

Tutorial

Login to your Server 2008 R2 NPS server
Open up a command prompt with Administrative Privileges
Execute the following command
1. netsh nps export filename="c:\users\YOURUSERNAME\Desktop\NPS.xml" exportPSK=YES
Copy the NPS.xml file to your local machine
Disjoin the NPS server from the domain
Retire the machine
Recreate a new Server 2012 R2 machine with the same name and IP address
Join the Server 2012 R2 machine to the domain
Open up Server Manager and select Add Roles and Features
Click Next > on the Before You Begin screen
Click Next > on the Installation Type screen
Click Next > on the Server Selection screen
Check Network Policy and Access Services (click Add Features when the screen pops up)
Click Next > on the Features screen
Click Next > on the Network Policy and Access Services screen
Check Network Policy Server and click Next >
Click Install
Click Close once the installation has successfully completed
Copy over your XML file from the old NPS server to your new Server 2012 R2 NPS server.
Open up an administrative powershell prompt
Execute the following command
1. Import-NpsConfiguration -Path c:\users\YOURUSERNAME\Desktop\NPS.xml
Head over to Server Manager and select Tools -> Network Policy Server
Verify the rules imported (I selected RADIUS Clients and Servers -> RADIUS Clients to see if it imported my WLAN controller)
Connect your machine to your wireless network! 🙂

Enabling SSL on Windows Server Update Services (WSUS)

28 Replies

Here are the steps to configure SSL on your servers running the Windows Server Update Services. This guide was written using Server 2012 R2, however it should be the same steps for Windows Server 2008 R2 as well. This guide also assumes you have a working instance of WSUS installed and configured, using default ports.

Login to your WSUS server
Open up Server Manager
Select Tools -> Internet Information Services (IIS) Manager
Generate a SSL certificate
1. Click on your Server and select Server Certificates
2. If you have your own PKI environment, follow these steps, if not, jump to step three
  1. Click Create Domain Certificate on the right side
  2. Fill in the requested information on the Distinguished Name Properties page and click Next
  3. Select your certificate authority and enter a friendly name (this can be anything), and then click Finish
3. If you need to submit a certificate request to an external certificate authority like Goaddy, Verisgn, Comodo; follow these steps
  1. Click Create Certificate Request on the right side
  2. Fill out the Distinguished Name Properties and click Next
  3. Change the Bit length to 2048 and click Next
  4. Select a location on where to place the CSR file that will be generated by the wizard and click Finish
  5. At this point, send the request to your certificate authority (like GoDaddy, Verisign, or your own internal certificate authority). You should receive back a .cer file once the claim has been fulfilled.
  6. Click on Complete Certificate Request on the right side
  7. Select the .cer file that your public certificate authority provided you, type in a friendly name (this can be anything), select Web Hosting for the certificate store, and click OK
Next, we need to bind the SSL certificate to your network adapter.
1. Expand your server, expand Sites, and select WSUS Administration
2. Select Bindings... on the right side
3. Select the https site and hit the Edit... button
4. Select https for the type, select the SSL certificate you created above, and click OK
5. Click Close on the Site Bindings window
Next, we need to enforce SSL encryption on the following virtual roots
• ApiRemoting30
• ClientWebService
• DSSAuthWebService
• ServerSyncWebService
• SimpleAuthWebService
1. Expand WSUS Administration and foreach of the directories above, complete the following steps
  1. Select the virtual site
  2. Double click on SSL Settings
  3. Check Require SSL and leave client certificates to ignore
  4. Click Apply in the top right corner
Next, we need to execute a command to tell WSUS to use ssl
1. Open up an elevated command prompt
2. Navigate to your WSUS installation folder
  1. cd "c:\Program Files\Update Services\Tools"
3. Execute the following command (replace your server with the correct FQDN)
  1. WSUSUtil.exe configuressl myserver.mydomain.local
Restart the WSUS server to make sure all changes take effect. You should be able to bring up the WSUS management console if all went well.
Configure your clients to connect via SSL to the WSUS server via Group Policy
1. Login to your domain controller
2. Open up Server Manager
3. Open up Group Policy Management
4. Right click on the policy you want to edit and select Edit
5. Expand Computer Configuration -> Polices -> Administrative Templates -> Windows Components -> Windows Update
6. Double click on Specify intranet Microsoft update service location
7. Change the intranet update service url to https and specify port 8531 and then click Apply.

That should do it! Try doing a gpupdate /force on your local machine and the check for windows updates. If windows successfully completes checking for updates, you should be good to go! 🙂

Notes: Official documentation from Microsoft in regards to using SSL and WSUS can be found here: http://technet.microsoft.com/en-us/library/hh852346.aspx#consswsus

Migrating Domain Controllers From Server 2008 R2 to Server 2012 R2

94 Replies

In this article, I have documented the steps I took to update our two domain controllers to Server 2012 R2 from Server 2008 R2. While this can be considered a tutorial, it is more a reflection of what I did during my migration process. This guide assumes you have already made backups of your environment, all Windows Active Directory Domain Controllers in the forest are running Server 2003 or later, and we will be recycling (reusing) the same two servers you deployed. Last, Microsoft strongly recommends we do a clean install and not directly upgrade each server, so we will decommission a DC, reinstall windows, and then redeploy the DC until the entire environment has been upgraded.

Prepare the AD Schema for Server 2012 R2
1. Mount the Server 2012 R2 installation disk on one of your Domain Controllers
2. Open up a command prompt with Administrative Privileges and navigate to the /support/adprep folder on the installation media.
  1. Click Start, type cmd, right click select Run as administrator
  2. Execute the command: d:
  3. Execute the command: cd d:\support\adprep
3. Execute the following command (don't close out of this until after we verify the schema version in an upcoming step):
  1. adprep /forestprep
  2. Type the letter C and press the enter key to begin the process
4. Execute the following command:
  1. adprep /domainprep
5. Verify the schema version has been updated
  1. Click Start and search for regedit
6. Open up regedit and navigate to Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NTDS\Parameters
7. Verify the Schema Version value matches the last entry shown in your upgrade results. In my case, the Schema Version should be 69.
Demote and decommission secondary domain controller
1. Click Start, Run...
2. Type dcpromo and click OK
3. Click Next > on the Welcome page
4. If the domain controller has the global catalog service, make sure your primary DC also has the service enabled and click OK. This can be done by opening up Active Directory Sites and Services and viewing the services for each domain controller.
5. Make sure the Delete this domain because this server is the last domain controller in the domain is UNCHECKED, and click Next >
6. Type in a new password to be used for the Local Administrator account the machine will contain after it is demoted.
7. Click Next > on the Summary page
8. Check the Reboot on completion box to restart the server after the service has been removed
9. Log back into the DC upon reboot and open up Server Manager
10. In Roles Summary, click Remove Roles
11. Click Next > on the Before You Begin page
12. Uncheck Active Directory Domain Services and DNS Server (if the role is installed) and click Next >
13. Click Remove
14. Click Close
15. Select Yes on the Do you want to restart now? dialog box
16. Log back into the DC upon reboot and you should greeted by a Removal Results window. Let the process finish and select Close upon removal success.
17. Disjoin the machine from the domain
  1. Click Start, right click Computer, select Properties
  2. Click Change settings
  3. Click Change... on the System Properties page
  4. Check Workgroup, type in a workgroup name, and click OK
  5. Click OK on the warning dialog
  6. Click OK on the Welcome to the workgroup dialog
  7. Click OK on the restart dialog
  8. Click Close on the System Properties window
    (oops, forgot to make a screenshot!)
  9. Click Restart Later on the Microsoft Windows dialog box
  10. Shutdown the machine
18. Format the decommissioned machine, reinstall a clean copy of Server 2012 R2, and join the machine to the domain.
Add first Server 2012 R2 Domain Controller
1. At this point, you should have one Server 2008 R2 Domain Controller and a blank Server 2012 R2 machine joined to the domain ready for the Active Directory services. If you are at this point, continue on, if not, you might want to read back a couple steps and see where things ventured off course.
2. Start Server Manager on your new Server 2012 R2 machine.
3. Select Manage in the top right and select Add Roles and Features
4. Click Next > on the Before you begin screen
5. Click Next > on the Select installation type screen
6. Ensure your new server is selected and click Next >
7. Check the box next to Active Directory Domain Services
8. On the Add features that are required for Active Directory Domain Services? dialog, click the Add Features button
9. Click Next >
10. Click Next >
11. Check the box that says Restart the destination server automatically if required
  (Click Yes on the restart dialog if it pops up)
12. Click the Install button
13. Once the install is done, click the Close button
14. Next, head back to the Server Manager screen and select the warning icon with the flag; then select Promote this server to a domain controller.
15. On the Deployment Configuration page, make sure Add a domain controller to an existing domain is checked and hit Next >
16. Check Domain Name System (DNS) server, Check Global Catalog (GC), and uncheck Read only domain controller (RODC). Enter a strong password to be used to access Directory Services Restore Mode and click Next >
17. Click Next > on the DNS Options page
18. Click Next > on the Additional Options page, or if you would like, you can manually select a domain controller to replicate data from and then hit Next >.
19. Click Next > on the Paths page
20. Click Next > on the Review Options page
21. Click Install on the Prerequisites Check page
22. Once the domain controller reboots after installation, open up Server Manager and select Tools, Active Directory Users and Computers
23. Expand your Domain and select Domain Controllers; ensure your new machine shows up here.
24. Next, verify DNS works properly
  1. Go back to Server Manager, select Tools, DNS
  2. Expand your server, Forward Lookup Zones, and right click on your domain name and select Properties
  3. Select the Name Servers tab and ensure all DCs are listed
Next, we need to verify the FSMO (Flexible Single Master Operations) roles are stored on our other server 2008 DC
1. On the new Server 2012 R2 DC we joined, open up a command prompt with administrative privileges.
2. Execute the following command to verify FSMO roles are on our 2008 DC:
  netdom query fsmo
Next, we need to transfer the FSMO roles from our primary DC to our new one
1. Execute the following command using the same command prompt in the previous steps: ntdsutil
2. Type roles when prompted and hit enter
3. Type connections when prompted and hit enter
4. Type connect to server server2012DC.mydomain.com, where server2012DC is the new DC we just deployed, when prompted and hit enter
5. Type quit and hit enter
6. Type transfer schema master and hit enter
7. Click Yes on the Role Transfer Dialog for the Schema Master role
8. Type transfer naming master and hit enter
9. Click Yes on the Role Transfer Confirmation Dialog for the Naming Master role
10. Type transfer PDC and hit enter
11. Click Yes on the Role Transfer Configuration Dialog for the Primary Domain Controller role
12. Type transfer RID master and hit enter
13. Click Yes on the Role Transfer Configuration Dialog for the RID master role
14. Type transfer infrastructure master and hit enter
15. Click Yes on the Role Transfer Configuration Dialog for the Infrastructure Master role
16. Type quit and hit enter
17. Type quit and hit enter
18. Execute the following command to ensure the FSMO services are on the new Server 2012 R2 machine: netdom query fsmo
At this point, you should have a Server 2012 R2 DC with the FSMO roles and a secondary 2008 R2 Domain Controller. If not, please go back and complete the steps to get to this point.
Optional Step: After upgrading the first DC, you may want to reconfigure the machine to keep its time in sync with an external source. To do this, please follow my guide here: http://jackstromberg.com/2013/10/configuring-external-time-source-on-your-primary-domain-controller/
Next, decommission the last Server 2008 R2 domain controller that used to function as the primary DC.
1. Follow the same instructions in Step 2 above called Demote and decommission secondary domain controller
Next, add the machine back to the domain
1. Follow the same instructions in Step 3 above called Add first Server 2012 R2 Domain Controller
At this point, your environment should be up and running with Windows Server 2012 R2! You can optionally transfer the FSMO roles back to your "primary" DC that you had before, or continue on with the roles left on the current DC.

Notes

Official information on removing a domain controller from the domain can be found on Microsoft's website here: http://technet.microsoft.com/en-us/library/cc771844(v=ws.10).aspx

Deploying a Read-Only Domain Controller with Server 2008 R2

1 Reply

Recently, I just configured a MPLS link to a remote office and noticed user experience isn't quite what it is at the centralized office. In an effort to help speed up the user's experience (response time in domain authentication and DNS resolution), we will be going over setting up a Read-Only Domain Controller to allow users to authenticate to the domain in the event the connection between the remote site and the main site would go down, as well as create a cached copy of DNS at the remote site to help increase response times in DNS intensive applications (particularly, web browsing experience).

Requirements

Active Directory has been properly configured at a main facility
You have servers that are running Windows Server 2003 or greater
The domain functional level is set to Server 2003 or higher
If there is windows server 2003 environment, the Active Directory schema needs to be extended for RODC installation by running the command: adprep /rodcprep
PDC emulator operation master should be on Windows server 2008
- Execute the following command to find out which machine is the PDC emulator if you are unsure:
  - dsquery server -hasfsmo pdc

Instructions

Deploy a new server (I used Server 2008 R2 in this example).
Open up Server Manager, right click on Roles and select Add Roles
Click Next on the Before You Begin screen.
Check Active Directory Domain Services on the Add Roles Wizard and click Next >
Click Next > on the Active Directory Domain Services screen.
Click Install on the Confirm Installation Selections screen.
Click Close when the installation is done.
Click on Active Directory Domain Services once the installation is done, back in Server Manager.
Select Run the Active Directory Domain Services Installation Wizard (dcpromo.exe)
Once you see the Active Directory Domain Services Installation Wizard, check the Use advanced mode installation checkbox and click Next >
Click Next > on the Operating System Compatibility step.
Check Existing forest, and then check Add domain controller to an existing domain
On the Network Credentials page, type in the name of the domain you want to connect to and then specify the credentials to add the machine. These credentials must have at least domain admin privileges to join the DC to the network.
On the select a domain screen, select your domain and click Next >
Select a site and then click Next >
On the Additional Domain Controller Options page, check DNS Server, Global catalog, and Read-only domain controller (RODC) boxes for each of the rolls and select Next >
1. Here is some information on what each of the choices do. This is from the following KB article by Microsoft: http://technet.microsoft.com/en-us/library/cc754629(v=ws.10).aspx
  - DNS server: This option is selected by default so that your domain controller can function as a DNS server. If you do not want the domain controller to be a DNS server, clear this check box. However, if you do not install the DNS server role on the RODC and the RODC is the only domain controller in the branch office, users in the branch office will not be able to perform name resolution when the WAN to the hub site is offline.
  - Global catalog: This option is selected by default. It adds the read-only directory partitions of the global catalog to the domain controller, and it enables global catalog search functionality. If you do not want the domain controller to be a global catalog server, clear this option. However, if you do not install a global catalog server in the branch office or enable universal group membership caching for the site that includes the RODC, users in the branch office will not be able to log on to the domain when the WAN to the hub site is offline.
  - Read-only domain controller. When you create an RODC account, this option is selected by default and you cannot clear it.
On the Specify the Password Replication Policy step, adjust the settings for each group, specifying if you want to cache user credentials on the Read-Only domain controller. In this tutorial, I left all of the options Deny except the Allowed RODC Password Replication Group, which is default per Microsoft. Click Next > once you have determined the settings you want to use.
On the Delegation of RODC Installation and Administration step, click the Set... button and select either a user or security group of users that you wish to have Administrative access to the read-only domain controller. If this is a remote office where you have a designated IT member(s), you would want to create a security group on your read/write DC and then select the group. However, if you will always know only one individual will login to the RODC, you can specify their user as the one to have local Administrative privileges. Lastly, if you don't want anyone to be able to mess with the RODC, you can simply click Next > and that will only allow members of the Domain Admins or Enterprise Admins security groups to manage the RODC. Click Next > once you have decided what security group or user you wish to allow local administrative access to the machine.
Click Next > on the Install from Media screen to pull the most current information from one of your active domain controllers.
Click Next > on the Source Domain Controller screen to Let the wizard choose an appropriate domain controller to replicate from. If you prefer replication from a specific machine, you may check the Use this specific domain controller box, select the machine from the list, and then click Next >.
Click Next > on the Location to store the Database, Log Files, and SYSVOL; unless you wish to relocate those files to a separate partition.
On the Directory Services Restore Mode Administrator Password, enter a strong password to be used in the event you need to put the DC in restore mode.
At this point, you can export the settings to make an answer file or you can click Next > for the server to begin applying the configuration.
Click Finish once done and Restart when prompted.

Upon restart, you should be good to go! I would recommend running the Microsoft Best Practice analyzer and checking the Windows event logs to ensure everything is good to go.

Attempt to configure DHCP server failed with error code 0x8007005. Access is denied.

How do I setup msSQL to use SSL?

Preparing Server 2008 R2 for vCenter Server 5

Jack Stromberg

A site about stuff