Account Lockout (part 2 of 4)

In Microsoft Download Center, search and download “Account Lockout and Management Tools”
Double-click “ALTools.exe” to extract all on 64-bit Windows Server 2008 R2 platformThe related files will be here.

Scenario
One day, someone tell you that her or his account is locked and want to know what happen. In the moment, how to track this status?

By LockoutStatus utility
Right-click “LockoutStatus.exe” next to click Run as administrator in the menu
Click File –> Select Target…Key locked account name as “test_2” into Target User Name and its domain name as “dw.com” into Target Domain Name.
If need to use the enough AD right, please enable “Use Alternate Credentials” check box and key in the related data as User Name, Password and Domain Name.
Now you can know when this account is locked and which DC lock it.Right-click this next to click “Open Event Viewer" in menu
In Event Viewer, expand Windows Logs and right-click Security next to click “Filter Current Log…” in menu
Key in ID numbers as “4625,4740,4771,4772,4777” next to click “OK” button
Now you can see all filtered log
Open each log to realize which computer trigger the locked status.
Maybe we need to log on this computer to realize what reason trigger the locked happen.
According to common causes for account lockouts (reference 3), sometimes we cannot find the root cause event though follow its suggestion.

Reference
(1). Description of security events in Windows Vista and in Windows Server 2008
     or  Description of security events in Windows 7 and in Windows Server 2008 R2
(2). Standalone Utility --- Account Lockout Status (LockoutStatus.exe)
(3). Common Causes for Account Lockouts

<<<   Account Lockout (part 1 of 4)

 Account Lockout (part 3 of 4)   >>>

Set RPC Dynamic Range port on Any Servers

In the DFSR mechanism, it always use RPC Dynamic port to communicate with DC when want to generate the Health Report.
Due to the firewall locates between DFSR Server and DC, so I need to set RPC Dynamic port to fixed port on DC.
How to do it? Add the registry entity,key and value!

Add Registry Entity
By Registry Editor, explore “HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc" and right-click “Rpc" next to click “New", "Key" in menuWrite down “Internet"

Add Registry Key and Value
Right-click “Internet" next to click “New", "Multi-String Value" in menu
Write down “Ports”
Right-click “Ports” and click “Modify…”
Write down “5000-5100” in Value data field next to click “OK” button
Right-click “Internet" next to click “New", "String Value" in menu
Write down “PortsInternetAvailable”
Right-click “PortsInternetAvailable” and click “Modify…”
Write down “Y” in Value data field next to click “OK” button
Right-click “Internet" next to click “New", "String Value" in menu
Write down “UseInternetPorts”
Right-click “UseInternetPorts” and click “Modify…”
Write down “Y” in Value data field next to click “OK” button
Now we have already finished the registry setting.
Restart this Server so that all applications use RPC dynamic port will run on between 5000 and 5100.

In the moment, the firewall need to create a rule for TCP/5000-5100 from DFSR Server to DC. So does that the health report will be generated now.

For reference KB 154596

one-way DFSR on Windows Server 2008 R2 (part 3 of 3)

By default, the Replication Group Schedule is real time and 512 Kbps bandwidth usage.

If the source(VBHV-FS-01) and destination(VBHV-FS-11) just only have empty folder,its replication mechanism is very simple --- put data to VBHV-FS-01 and data will replicate to VBHV-FS-11.

If the source and destination folder has the different data on replicated folder, it will occur the DfsPrivate folder to handle the conflict or delete status.

If you want to delete data on the destination(VBHV-FS-11),
the file access denied message will show up because this folder attribute is read-only.

If you want to correct replication schedule, you can do the following process:
Click “Connections” tab and select one connection you want to correct it next to click “Properties” link
Click “Schedule” tab and select “Custom connection schedule” option next to click “Edit Schedule…” button
Click “Details >>” button
Select one Day as “Sunday” next to click “Edit…” button
Select Start time, End time and bandwidth next to click “OK” button
Click “OK” button to complete edit schedule
The schedule type also change to “Custom Connection Schedule”

If you want to force replication data from source to destination and doesn’t change the schedule setting, you can execute command as “dfsrdiag syncnow /partner:<Source Computer Name> /RGName:<Replication Group Name> /member:<Destination Computer Name> /Time:1” in VBHV-FS-01 console.

If you want to quickly get any change as new DFSR connection creation, you can execute command to poll AD in DFSR Server console after AD replication finish.

If you want to know replication health, please select one replication group name as “One Way Replication with the same Folder Name” next to click “Create Diagnostic Report…” link.
Select “Health report” option next to click “Next >” button
Choose Report path as “C:\DFSReports” next to click “Next >” button
Choose Included members as “VBHV-FS-01”,"VBHV-FS-11” next to click “Next >” button
Select “Yes, count backlogged files in this report” and Reference Member as “VBHV-FS-01”, enable “Count the replicated files and their sizes on each member” check box next to click “Next  >” button
Click “Create” button
Generate report in process
Now the Health Report has already been generated.



<<<   one-way DFSR on Windows Server 2008 R2 (part 2 of 3)

 one-way DFSR on Windows Server 2008 R2 (part 1 of 3)>>>

one-way DFSR on Windows Server 2008 R2 (part 2 of 3)

After prepare the related prerequisite, I will begin to setup the DFSR configuration by management utility.

Configure DFSR
In DFS Management, right-click “Replication” and select “New Replication Group…” in menu to launch New Replication Group Wizard
In New Replication Group Wizard, select the option of Replication Group Type as “Multipurpose replication group” next to click “Next >” button
Write down the name of replication group as “One Way Replication with…” and Optional description of replication group as “Data replicate from DMZ to Internal”, select Domain as “dw.com” next to click “Next >” button
Click “Add…” button for selecting Replication Group Members
From this location “dw.com” to enter the object name as “VBHV-FS-01;VBHV-FS-11” next to click “Check Names” button
After the object names are resolved, please click “OK” button
Check members progress now
When the members have already added, click “Next >" button
Due to I will create One-Way replication, select “No topology” option next to click “Next >” button
The warning message show up and tell us that the custom topology need to be created by ourselves after this wizard finishes.
Select Primary member as “VBHV-FS-01” next to click “Next >” button
Click “Add…” button to select a folder on the primary member
Click “Browse…” button for selecting local path of folder
Select a folder as “DMZ to Internal” next to click “OK” button
The Use name based on path option will be choose and name is “DMZ to Internal” as folder name. If doesn’t need to use custom name, please click “OK” button to go ahead.
Click “Next >” button
Click “Edit…” for selecting the local path of the replicated folder
Select “Enabled” option next to click “Browse…” button
Select a folder as “DMZ to Internal” next to click “OK” button
Click “OK” button
Click “Next >” button
If the settings are correct, click “Create” button to begin to create the new replication group.
When the status show “Success” word, we have already completed the New Replication Group Wizard now.
After click “Close” button, the warning message show up again and tell us that the replication never begin right now due to the configuration will depend on Active Directory Domain Services replication latency and polling interval.
Now the DFS Management about Replication setting is as follows:
Due to only create one replication path from VBHV-FS-01 to VBHV-FS-11, the reverse path from VBHV-FS-11 to VBHV-FS-01 also need to be created so that the topology will be fully connected.
Click “Connections” tab and “New Connection…” action
Change Sending member to “VBHV-FS-11” and Receiving member to “VBHV-FS-01”, disable “Create a second connection in the opposite direction” check box next to click “OK” button
Now the reverse replication has already been created.
Click “Memberships” tab, right-click “VBHV-FS-11” next to select “Make read-only” in menu
So do that will change Replicated Folder is read-only attribute.
Until now, we have already completed the one-way DFSR configuration.
In next article, I will confirm whether the replication function is normal.

<<<   one-way DFSR on Windows Server 2008 R2 (part 1 of 3)

one-way DFSR on Windows Server 2008 R2 (part 3 of 3)   >>>