Course Objectives
As Active Directory enters its "tweens," most AD admins and managers
have moved from "how do I design and set this up?" to "now that I'm
running a 10-year-old AD that someone else created and is now gone, how can I most easily and cheaply manage it,
fix it, and streamline it?" Active Directory consultant and expert
Mark Minasi, author of the best-selling Mastering Windows Server
book series, answers those questions every day for his clients... and
now he can answer them for you.
In a special one-day, reduced-price "hey, don'tcha know there's a
depression on?" course, Mark begins by explaining the down-and-dirty
details of troubleshooting DNS, which AD old-timers will know is the
root of most AD problems, and dispels a pernicious myth about R2's DNS
server and Extensions to DNS (EDNS). Following that, you'll see
how to kick nslookup to the curb, replacing it with the far more
powerful (and free!) Domain Internet Groper tool, better known as "dig."
From there, you'll learn about using event logs, Netlogon logs and
Kerberos logs to take logon troubleshooting to the next level, including
step-by-step instructions on using Network Monitor to show what's
exactly happening in a failed logon. This "AD troubleshooting" first part ends with a quick examination of
the ongoing security threat posed by NTLM logons, and how to find and
eradicate them before someone uses them to penetrate your network.
Next, we'll move to Part Two, a multi-pronged discussion of
virtualizing domain controllers. We've been virtualizing various
kinds of servers for years, but virtualizing DCs has always carried the
faint whiff of "hey, go ahead and do that, but it's your funeral!" and
so you'll learn how virtualizing affects clock synchronization, server
imaging/duplicate SID issues, and replication. Most important,
though, you'll learn how to address each of those situations to ensure worry-free
DC virtualization.
In Part Three, Mark leads you through an all-new, practical,
example-filled guide to getting started using PowerShell to simplify a
wide variety of admin tasks... even if you've never used PowerShell.
One recent attendee told Mark that he was able to clean up years of
accumulated AD junk in an AD that he'd just inherited... and he got it
done before the class was even over! (We do recommend,
however, that in general you'll want to be careful about actually
modifying your production network while in class... but apparently it
did work out well for at least one attendee.) We're
pretty sure that every attendee will walk away with at least one "hey, I
could use that!" moment in the PowerShell section.
We'll be offering a longer two-day version of this course starting
some time in 2012 with our standard hasn't-changed-since-1998
per-student price of $1000, but as times are still tough and because
Mark's still working out the exact course flow and content, we're offering this
one-day class for $399 per student for a limited number of sessions
instead of the standard $500/student rate for a one-day class.
(And trust us, just avoiding one DC virtualization error or
saving two days' work by creating a PowerShell one-liner will make the
class more than pay for itself.)
Join Mark for a fun, fast-paced, lucid discourse on getting your AD
work done better and faster!
Key Seminar Benefits
- Learn how "QAAA" -- Question, Answer, Authority and Additional
-- is the key to cracking even the most frustrating DNS name resolution
puzzles
- Discover where to get and how to use "dig," a great free DNS troubleshooting
tool
- Understand why the all-too-common advice to "disable EDNS," a bit of
non-wisdom found on many Internet blogs, is a horribly bad idea, and how
to identify and solve the problems supposedly created by EDNS
- See the easy way to use Network Monitor or WireShark's power
to troubleshoot DNS and Kerberos problems... anyone can do it!
- Find out how to enable and read Netlogon's debug log to help you
smoke out logon problems
- Know how Kerberos logon tickets work and, sometimes, how they can
not work (and what to do about it)
- Understand Kerberos "token bloat" and "ticket bloat," how it's going
to be more and more common as time goes on, and how to monitor and
remediate such problems
- Grasp the nature of network security threats posed in modern-day ADs
by LM and NTLM logons and the tools that will enable you to eradicate
them
- Understand the basic problems that virtualization poses for domain
controllers
- Choose the right approach to time synchronization in virtualized
environments
- Learn how to avoid the most common problems arising from imaging
virtual servers in an AD
- Master the AD replication concepts that can lead to a serious -- and
hard to eradicate -- AD failure called "USN bubbles," as these bubbles
are, well, fairly hard to pop
- Configure R2's nifty new AD-related PowerShell cmdlets so that you
can use them even if your "newest" DC only runs Server 2003 R2
- Save time by getting the scoop on what does and doesn't make sense
AD-wise with PowerShell
- Learn PowerShell basics "in passing" as you see how to solve thorny
AD admin tasks with simple PowerShell "one-liners"
- Uncover the "filter" commands and the "hammer" commands that, when
glued together, let you accomplish in an hour or so what would have
taken days of VBScript/ADSI coding... and start building your own
library of PowerShell power tools
Course Outline
- DNS Queries Explained
When DNS doesn't work, neither does AD, and the "atomic" part of DNS is the
query. We'll start off by examining queries in greater-than-usual
detail, so we can understand how to fix them when they break.
- DNS servers and recursion across the Internet and inside the
firewall
- Transient ports and transaction IDs
- UDP, TCP, and the answer to "why there are only 13 root
servers?"
- Cracking Open Queries
Now we're ready to take DNS queries down to
the "bare metal" with an old friend, Network Monitor. (What's that
you say, Netmon and you aren't old friends? Fear not...
Mark's defanged Netmon for thousands, and you too will be a Netmon lover
by the time we're done.)
- Netmon acquisition and setup for minimum annoyance
- Tips on getting traces
- Filtering in Netmon
- Picking apart a DNS packet
- Understanding QAAA
- Knowing your baseline: a successful query, step by step in
Netmon
- Next step: a method of tracking dynamic DNS updates
- A better DNS tool: DIG
- Extensions to DNS (EDNS)
By now, you'll know plenty about DNS queries,
and you'll also know that while DNS is an amazingly robust system,
it's based on a bunch of quarter-century-old assumptions that don't really
reflect the reality of today's TCP/IP networks, and that those
assumptions are cramping DNS performance. Fortunately there's a
workaround for all of that called Extensions to DNS (EDNS). Even
more fortunately, Microsoft DNS has supported EDNS since 2003, if
you enable it. R2 finally did enable it, and many people think
that's a bad idea. Mark disagrees, but it's your call -- and this
section will equip you to make that call.
- EDNS goals: more flags, bigger packets
- Solving the all-important backward compatibility issue
- Firewalls and EDNS: busting the "EDNS breaks DNS" myth
- Configuring EDNS on Windows DNS servers
- Logon Troubleshooting I: Event Logs and Netlogon
If it isn't
DNS, it's time to put on that caving helmet with the light on it and start
exploring Windows' labyrinthine logon processes. Our first two guides:
event logs and the Netlogon log. Here's how to do it.
- What to audit on event logs
- "Logon" events versus "Account logon" events
- Reminder: event logs can be consolidated
- Activating Netlogon logs
- A plan for deciphering Netlogon logs
- Logon Troubleshooting II: Cracking Open Kerberos
Once we've
established the specifics of a logon failure (what didn't log on when, and
some of the "why"), we may still need to look deeper, and Kerberos is about
as deep as you can go. In this section, you'll quickly review how
Kerberos works, see how to use Network Monitor to track it, and understand
common sources of Kerberos failures.
- Kerberos basics: users, services, tickets, and the Key
Distribution Service
- Kerberos clues with KLIST
- Strengthening Kerberos with Server 2008/R2 and Windows 7/Vista
- Kerberos tracking with Network Monitor
- Kerberos uses UDP or TCP... when do you care?
- Activating Kerberos logging and finding sources to decipher the logs
- Understanding token bloat and ticket bloat
- Tools to track bloat
- Strategies to avoid bloat
- Future glimpse in brief: how Windows 8 battles bloat
- Securing your AD from NTLM/LM
As if you didn't already have
enough to do, we're afraid Mark's got to make you worry about
something else: NTLM logons. Yup, NTLM's been around for
a long time, and yup, it's always been one of those "one of these
days we'll have to worry about this..." things, and unfortunately,
it's one of those days. In this section, you'll learn why you
give a hoot about NTLM logons and, best of all, how R2's making your
life a bit easier in tracking down and eradicating those logons.
- The NTLM and LM threat: why now?
- How NTLM creeps into Kerberos-centric ADs
- NTLM restriction policies
- A sample test that'll produce NTLM every time... via a bug in the
NET command
- Virtualized DCs and Time
In this section, we start the second part
of the class, where we'll explain how to safely run your DCs as virtual
machines. The first trouble spot is time synchronization.
- Time sync drift review in Windows
- How VMs cause troubles for time
- An alternative time sync strategy
- Implementing the strategy most easily
- Virtualized DCs and Imaging
The ease of system rollout with an imaging tool like Ghost or ImageX
revolutionized desktop OS deployment back in 1995. Since then, the
simplicity of imaging virtual server images has led to many
organizations rolling out legions of member servers, and some of those
servers bear security IDs (SIDs) that are identical to their cybernetic brethren's
and sistren's. Is running a bunch of servers with the same SIDs a
bad thing? Well, asking that question in a room full of server
admins can actually generate more heat than the "which is better, PC or
Mac" question, but there is a right answer to the question. As you'll find out
in this section, duplicate SIDs can lead to a bunch of serious
problems... and you'll find out how to handle those problems in this
section. (By the way, Mark asked us to assure our readers
that "sistren" is indeed an English word, albeit one not used in quite a
while, and here a while means a Canterbury Tales' timeframe.)
- Review: SIDs, systems and security
- Some things you may not know about SIDs
- Where duplicate SIDs get domains in trouble
- The case for Sysprep
- Looking After Replication in a Virtual Environment
AD replication is really quite robust -- Mark's only seen a few serious
replication failures in the past decade or so -- but the rise of virtualized
DCs, in combination with snapshots has changed that story. AD's
replication structure is well thought-out, with a lot of internal
consistency checking and an impressive ability to detect and heal
replication problems. It has one flaw, however: the AD folks at
Microsoft designed AD with the assumption that time always goes forward.
With virtual machines, though, that's not a good assumption, as restoring a
snapshot does what only H.G. Wells and Doctor Who had done previously --
running time backward. In this section, you'll learn exactly what
happens when the clock runs backwards for AD, and how you can step into
Jean-Claude Van Damme's role as Time Cop and avoid polluting your AD's time
stream.
- AD replication review: USNs, high-watermarks, up-to-dateness
vector tables, and all that other stuff that you used to know but have
forgotten because AD replication works so well that you never had to
worry about it
- How restoring snapshots creates "USN bubbles" and why they are so
very bad
- Database identifiers: how the Invocation ID makes life easier for us
time cops
- Safe time travel with a couple of Registry entries
- A very brief trip into the future for a glimpse of how Windows 8
Server makes AD time travel safer
- AD's New PowerShell Tools: A Brief Intro
For many of us,
PowerShell's been a great-sounding idea that we've skipped so far
because, well, it surely sounds nice but it's not clear how it'll make
our AD administrative tasks all that much easier, right? Well, not
really right any more, as Microsoft has released 76 PowerShell
tools ("cmdlets," in PowerShell-speak) that not only make tasks that
once took days into ones that you can accomplish in an hour or two,
they didn't make us upgrade to R2 to use them. In this
section, we'll quickly cover the barest of PowerShell basics so we're ready to
meet some real power tools.
- Getting PowerShell for your AD
- The sort of stuff that PowerShell's good at, versus what it's not so
good at
- PowerShell power tools: a taste of why PowerShell will win you
over
- The PowerShell AD automation approach: the "filter" and the
"hammer"
- Collecting the Users: Understanding PowerShell's AD Filters
Some AD tasks are one-off, single user jobs that take a moment and so
really may not justify automation in all admin's minds. In other
cases, though and in particular tasks involving ADs that have had a few
generations of administrators, can be jobs that look like "find all of
the users with such-and-such problem or characteristic and do
such-and-such to those users." Solving such tasks manually can be
time-consuming and mind-numbing, which is why we'll want to know how to
attack them with PowerShell. (Another reason why we'll want to
know that is because if we don't attack them with PowerShell and enjoy
the speed and efficiency that automation offers, then, well, we soon might
not have a job that involves AD administration, if you know what we
mean.) In this section, you'll learn about four PowerShell cmdlets
that make finding users under a given set of criteria a snap. In
the process, you'll also learn the basic "tricks of the trade" that all
PowerShell users need to know.
- Using get-aduser to collect users by attributes and location in the
forest
- Zeroing in on account problems: search-adaccount lets you find
inactive, disabled, locked etc users
- Get-adobject: a more complex, but wider-spectrum search tool
- Get-adgroupmember: grabbing users by their group memberships
- Dropping the Hammer: Now That You've Got 'Em...
Once you've
winnowed out just the users that you want, what do you want to do to
them? Change their manager? Delete them? Unlock their
accounts? Force them to set a new password when next they log on?
There's an app -- or, rather, a cmdlet -- for all of those, and many
more, as you'll learn in our last section.
- Changing attributes with set-aduser
- Changing passwords
- Account
changes: unlocking, enabling, disabling and more
- Moving and
deleting accounts
- Changing group memberships
- Next steps: where to go from
here to explore PowerShell more thoroughly
Course Materials and Course Format
The class works from PowerPoint presentations. Every attendee
gets a printed copy of the PowerPoints. To make it possible to run
this course in just two days, this runs in mainly lecture/demo format.
You'll see an R2-based AD run through its paces in a series of interesting
and explanatory demonstrations.
Arranging a Course At Your
Location
We offer this class as a public seminar occasionally; you can view the current schedule www.minasi.com/pubsems.htm.
But you needn't wait — Mark can come to your organization to teach it
on-site. On-site classes offer you the flexibility to lengthen or shorten
the class, add hands-on labs, modify the course's focus and zero in on
your group's specific needs. For more info, please contact out
office at (757) 426-1431 between noon and five PM Eastern time or email
assistant@minasi.com to
discuss scheduling and fees.
|