Monday 16 December 2019

Sync all Domain Controllers

Using Command Prompt from DC:

repadmin /syncall /APeD

------------------------------------------------------------------------------------------
The flags in the following list are supported.
• /a Aborts, if any server is unavailable.
• /A Synchronizes all naming contexts that are held on the home server.
• /d Identifies servers by distinguished name in messages.
• /e Synchronizes domain controllers across all sites in the enterprise. By default, this command does not synchronize domain controllers in other sites.
• /h Displays Help.
• /i Iterates indefinitely.
• /I Runs the repadmin /showrepl command on each server pair in the path instead of synchronizing.
• /j Synchronizes adjacent servers only.
• /p Pauses after every message to allow the user to abort the command.
• /P Pushes changes outward from the specified domain controller.
• /q Runs in quiet mode, which suppresses call back messages.
• /Q Runs in very quiet mode, which reports fatal errors only.
• /s Does not synchronize.
• /S Skips the initial server response check.


--------------------------

Replication summary:

repadmin /replsum

To check to which Domain Controller the end nodes are connected

From command prompt type:
Set l

Output>> 
C:\Users\Rinith >set l
LOCALAPPDATA=C:\Users\Rinith\AppData\Local
LOGONSERVER=\\HQABCD

Check Operational Group Policy from DC:
From Event Viewer
>>Applications and Services Logs >> Microsoft >> Windows > GroupPolicy >> Operational >> Filter Event ID 5310

Result:
Account details:
            Account Name : CN=**01P,OU=Domain Controllers,DC=ABCD,DC=COM
            Account Domain Name : ABCD.COM
            DC Name : \\**01P.ABCD.COM
            DC Domain Name : ABCD.COM

Resolution: Windows 10 Hello - Group Policy PIN and fingerprint gray out

Requirement:

Allow user to logon with PIN or Fingerprint via Group Policies

Resolution:

Create GPO



 Some of the commands to troubleshoot in case policies won’t replicate to the end nodes:

Logon to DC and open Active Directory PowerShell Module as administrator and execute below commands and compress the output folder c:\Ms-log and send by mail:

Cd \

md MS-log

Get-ADDomain | fl Name, DomainMode > C:\ms-log\DFL.txt

Get-ADForest | fl Name, ForestMode > C:\ms-log\FFL.txt
 
Get-ADDomainController -Filter * | select Name, OperatingSystem, IPv4Address, Site > C:\ms-log\dclist.txt

Netdom query fsmo > C:\ms-log\fsmo.txt

Repadmin /showrepl * /csv > C:\ms-log\showrepl.csv

Gpresult /h C:\ms-log\GPR001.html

auditpol.exe /get /category:*  >  C:\ms-log\audit.txt

dfsrmig.exe /getglobalstate > c:\MS-Log\dfs.txt 

logon to client open CMD as admin and execute below

gpresult /h c:\gpr-client.html  


For more information:

https://www.tenforums.com/tutorials/107441-enable-disable-users-sign-windows-10-using-biometrics.html

Monday 26 August 2019

Start/Stop VMs during off-hours solution in Azure Automation, Log Analytics




To automate the start and stop of the VMs hosted on Azure we need to consider two things, i) Automation Account and ii) Log Analytics Workspace

Scenario:


Set up the first solution deployment to start few VMs at 6 AM and stop them at 6 PM from Monday to Friday.

Then you would make the second solution deployment to start the other few VMs at 10 AM and stop them at 10 PM from Sunday to Thursday.

Please read through the steps, as you would have to specify the resource group/s you want this action to be taken, and you would also have to exclude the VMs on which you don’t want the solution.


For example, if you have 20 VMs in one resource group, but you only want the first 8 VMs to be started and stopped by the solution, you would have to specify the Resource Group name during deployment process and a list of the excluded VMs (VM9, VM10, VM11 … VM20).  This way, the solution will only affect (start and stop) VM1, VM2, VM3… VM8.

I have used the naming convention ‘StartStopVMDaily-IRIS-AA’, where IRIS stands for the project vendor and AA stands for Automation Account, and for ‘StartStopVMDaily-IRIS-LA’ LA stands for Log Analytics. Make sure both automation account and log analytics have the  same resource group name.


To summarize following are the process:


All services>> Automation Accounts>> click Add 

Add automation account name and fill in other relevant details for - ‘StartStopVMDaily-IRIS-AA’  and click create.



Then let’s go to the service, ‘log analytics workspaces’ via All services>> Log Analytics workspaces:





Click Add. 







Fill in sensible details for ex: 

StartStopVMDaily-IRIS-LA >> Subscription: Enterprise >> Resource Group: provide resource group name of the hosted VMs >> Location: West Europe >> Pricing Tier: Free (select what suites you) and click OK.


After creation of Log Analytics workspaces, click on 'StartStopVMDaily-IRIS-LA' which has been just created (as highlighted below).



Click workspace summary





from Overview window click 'Add' option from the marketplace search window, type 'Start/Stop VMs during off-hours' 










and click Create  





as soon as create button is clicked >> from 'Add Solution' space select workspace as 'StartStopVMDaily-IRIS-LA' >> automation account as 'StartStopVMDaily-IRIS-AA' >> configuration: configure parameters >>



parameters:

vm runbook: target resourceGroup Names: wildcard '*', * is applicable to all resource groups, else specify correct resource group where the VMs reside >> VM Exclude List (list of VMs which needs to be excluded>>  enter the VM names in the space provided. For more than one VM enter with coma >> enter schedule daily start and stop time (specify correct time zone >> select email functionality if required and specify a valid email address.>> click ok and click create.

Click log analytics workspace 'StartStopVMDaily-IRIS-LA' which we just created. and click workspace summary



Selecting the graphical ‘startstopvmview’ provides a historical summary of the schedules.



If you may want to modify the schedules to recur automation weekly or monthly based on your requirement following Home>> Automation Account >> select the required automation account (for ex: ‘StartStopVMDaily-IRIS-AA’) >> click Schedules >> Scheduled-StartVM or Scheduled-StopVM


Settings:


 You may include or exclude VMs by modifying the variables:


Automation Accounts >> StartStopVMDaily-IRIS-AA >> Variables

Select External_ExcludeVMNames and modify the Value (VMNames described under it)


Reorganize automation account and log analytics @your Azure portal favourites:
Deploy the solution twice based on the above scenario.


I hope the above depicted pictures are self-explanatory.
Have a great time J.

also read@Microsoft documentation