Windows Tips & Tricks UPDATE, December 27, 2004, —brought to you by the Windows IT Pro Network and the Windows 2000 FAQ site
Make sure your copy of Windows Tips & Tricks UPDATE isn't mistakenly blocked by antispam software! Be sure to add Windows_TipsandTricks_UPDATE@list.windowsitpro.com to your list of allowed senders and contacts.
This email newsletter comes to you free and is supported by the following advertisers, which offer products and services in which you might be interested. Please take a moment to visit these advertisers' Web sites and show your support for Windows Tips & Tricks UPDATE.
Free White Paper: High Availability for Windows Services
Windows IT Pro VIP
Sponsor: Free White Paper: High Availability for Windows Services
It is no stretch to say that Windows high availability must be a fundamental element in your short- and long-term strategic IT planning. This free white paper discusses the core issues surrounding Windows high availability, with a focus on business drivers and benefits. You'll learn about the current market solutions, technologies and real-world challenges including cost-benefit analyses. Plus, find out how to assess technical elements required in choosing a high-availability solution, including the robustness of the technology, time-to-failover, and implementation difficulties. Download this white paper now!
- Q. Why do some organizational units (OUs) have a blue exclamation point next to them in Group Policy Management Console (GPMC)?
- Q. How can I run a report that displays the last password change for all accounts in a container?
- Q. How can I determine whether my server is running Exchange Server 2003, Standard Edition, or Exchange 2003, Enterprise Edition?
- Q. After I upgraded from Windows 2000 Server to Windows Server 2003, I received an error about the Enterprise Domain Controllers group's access to certain Group Policy Objects (GPOs) in Group Policy Management Console (GPMC). What's causing this error?
- Q. Where is fault-tolerant (i.e., domain-based) Dfs information stored?
by John Savill, FAQ Editor, firstname.lastname@example.org
This week, I tell you why some organizational units (OUs) have a blue exclamation point next to them in Group Policy Management Console (GPMC), how to run a report that displays the last password change for all accounts in a container, and how to determine whether a server is running Exchange Server 2003, Standard Edition, or Exchange 2003, Enterprise Edition. I also explain the cause of an error about the Enterprise Domain Controllers group's access to certain Group Policy Objects (GPOs) in GPMC and tell you where fault-tolerant Dfs information is stored.
Sponsor: Windows IT Pro VIP
Get Exclusive Access to Windows IT Pro Print Products Online!
Our VIP subscribers get online access to all of our print publications, plus a print subscription to Windows IT Pro and exclusive access to our banner-free VIP Web site. Now we've added even more content from the archives of SQL Server Magazine! You won't find a more complete and comprehensive resource anywhere--check it out!
Q. Why do some organizational units (OUs) have a blue exclamation point next to them in Group Policy Management Console (GPMC)?
A. A blue exclamation point that's displayed next to an OU container in GPMC indicates that the container has Block Inheritance enabled, which means that settings made to parent containers aren't applied to the OU (unless the policy for the parent container has the "No Override" option configured). You can confirm that Block Inheritance is configured for an OU that has a blue exclamation point by right-clicking the OU; "Block Inheritance" should be selected on the displayed context menu.
Q. How can I run a report that displays the last password change for all accounts in a container?
A. The last-password-change date is stored in the user class's Active Directory (AD) pwdLastSet attribute as a large (64-bit) integer, which means the date must be converted so that it can be read and displayed in a usable "date" format. To perform the conversion, I modified a script by Richard Mueller so that it searches for all users in the passed root distinguished name and outputs their last-password-change date to a screen. You can download the script, listuserpasslastchange.vbs, at http://www.windowsitpro.com/content/content/44925/listuserpasslastchange.zip, or copy and paste the following script into a text file.
' John Savill ' This is based on Richard Mueller's script on Interger8Date ' conversion, which is copyrighted as below. ' Copyright (c) 2003 Richard L. Mueller ' Hilltop Lab Web site - http://www.rlmueller.net ' ' I simply changed it to output all objects in a passed DN. Option Explicit Dim strLdapPath, objConnection, objChild Dim lngTZBias, objUser, objPwdLastSet Dim objShell, lngBiasKey, k ' Check that all required arguments have been passed If Wscript.Arguments.Count 0 Then On Error GoTo 0 Integer8Date = #1/1/1601# End If On Error GoTo 0 End Function To run the script, use the syntax cscript listuserpasslastchange.vbs ou=test,dc=demo,dc=test You'll see output that's similar to this: CN=Bruce Wayne 11/17/2003 1:30:14 PM CN=Clark Kent 11/17/2003 1:31:30 PM CN=Hal Jordan 12/6/2004 2:52:56 PM CN=Wally West 3/17/2003 9:04:45 AM
Q. How can I determine whether my server is running Exchange Server 2003, Standard Edition, or Exchange 2003, Enterprise Edition?
A. If you have more than one storage group (SG), more than one message database, or if your database is greater than 16GB, you have Exchange 2003 Enterprise. Another way to verify your Exchange Server edition is to open the Exchange Server Setup Progress.log file, which is located on the root of your system drive. Search for one of the following entries:
\[16:53:50\] Setup configuration information: -- ID:xxxxx -- \[16:53:50\] This is a(n) Standard version of Microsoft Exchange Server -- ID:xxxxx--
\[16:53:50\] Setup configuration information: -- ID:62227 -- \[16:53:50\] This is a(n) Enterprise version of Microsoft Exchange Server -- ID:62232 --
One of these entries indicates your Exchange Server version. I find it easiest to locate the appropriate entry by searching for the "Setup configuration information" string in the file.
Q. After I upgraded from Windows 2000 Server to Windows Server 2003, I received an error about the Enterprise Domain Controllers group's access to certain Group Policy Objects (GPOs) in Group Policy Management Console (GPMC). What's causing this error?
A. Windows 2003 introduced the Group Policy Modeling feature, which allows simulations of Resultant Set of Policies (RsoP) scenarios and is performed by a service that runs on Windows 2003 domain controllers (DCs). Because this service is on the DCs, the Enterprise Domain Controllers group needs access to all Group Policy Objects (GPOs). This access is granted automatically to any newly created GPO. However, GPOs that existed before the upgrade aren't updated with the new permissions. When you use GPMC to access such GPOs, you'll receive a warning, which the figure at http://www.windowsitpro.com/content/content/44925/gpmcnoedcaccess.gif shows. To solve the problem, perform these steps:
- Log on as a domain administrator.
- Start a command prompt and navigate to the \%programfiles%\gpmc\scripts folder (e.g., c:\program files\gpmc\scripts) by typing
cd /d %programfiles%\gpmc\scripts
- Execute the GrantPermissionOnAllGPOs.wsf script that's provided with GPMC and specify the domain's DNS name--for example:
Cscript GrantPermissionOnAllGPOs.wsf "Enterprise Domain Controllers" /Permission:Read /Domain:savilltech.com(The command wraps to two lines here because of space limitations.) Be sure to replace savilltech.com with your domain name.
Q. Where is fault-tolerant (i.e., domain-based) Dfs information stored?
A. Unlike standalone Dfs roots and namespaces, which store their information in the registry, domain-based Dfs namespaces store their information in Active Directory (AD). The exact location in AD is the DFS-Configuration object--yes, it's one object--which is why any change to the Dfs structure causes the entire Dfs namespace to be replicated to all domain controllers (DCs) in the domain AD partition's System container. You can view this object by using a tool such as ADSI Edit.
(from Windows IT Pro and its partners)
Migrating from Novell NDS to Windows Server 2003 means moving from an established directory service to the latest version of Active Directory. Missing a step in the migration process could mean real problems. Use our quick reference guide as a cheat-sheet to help you manage each step of the migration process. Download the guide now.
If you're discouraged about not having piles of money for improving the availability of your Exchange server, join Exchange MVP Paul Robichaux for this free Web seminar and learn how to maximize your existing configuration. Survive unexpected outages, plan for the unplannable, and evaluate what your real business requirements are without great expense. Register now!
You are if you have an Internet connection faster than 384Kbps. In this free on-demand Web seminar, Alan Sugano will examine two attacks (an SMTP Auth Attack and a SQL Attack) that let spammers get into the network and relay spam. Find out how to keep the hackers out of your network and what to do if your mail server is blacklisted as an open relay. Register now!
More and more companies are taking the first steps toward leaving passwords behind and implementing tokens for at least a portion of their users and systems. In this free on-demand Web seminar, join Randy Franklin Smith to find out the advantages of implementing token-based Reduced Sign-On (RSO) and learn how you can you make a solid business case to management that justifies the costs. Get valuable checklists of key evaluation and testing points and critical success factors for rollout time. Register now!
(A complete Web and live events directory brought to you by Windows IT Pro: http://www.windowsitpro.com/events )
Our expert panel delivers tips, techniques, and insight to get you closer to a service management plan in this free on-demand Web seminar. Get real-world perspectives on industry trends and examples of how to leverage service management for maximum results and how to implement a plan for your business. Register now!
Instant recovery and data protection solutions for Exchange and SQL servers
Here's how to reach us with your comments and questions:
- About the newsletter — email@example.com
- About technical questions — http://www.windowsitpro.com/forums
- About product news — firstname.lastname@example.org
- About your subscription — email@example.com
- About sponsoring UPDATE — firstname.lastname@example.org
This weekly email newsletter is brought to you by Windows IT Pro, the leading publication for Windows professionals who want to learn more and perform better. Subscribe today.