Aman Sahota - MSFT

1:Many Workshop's for Microsoft Partners | FY13

Aman Sahota — Wed, 10 Apr 2013 19:53:00 GMT

Hello Everyone!

This is in interest to 1:Many workshop Sessions planned for FY13. Please consider this a warm invite to come and join the sessions and get to know the latest technologies and features of Microsoft product line.

Workshop Title	Delivery Start Date	Delivery Start Time PST	Primary Presenter Full Name	Workshop Description	PLC Registration Link

How Domain Controller Cloning Works in Windows Server 2012	4/30/2013	9:00 AM PST	Aman Sahota	Understand the concepts of Domain Controller cloning in Windows Server 2012 through a lab demonstration and talk to the experts in order to clarify your concepts and doubts on this new feature on Windows Server 2012. The session would not only cover the concepts of the new technology but would also cover a demonstration of the same through a lab setup. Windows Server 2012 comes with a lot of new enhancements and features, which makes it more compatible with other technologies and the right solution of cloning and virtualization. This is a free event for Microsoft Partners.	Domain Controller Cloning in Server 2012

Operations Manager 2012 Best Practices for Service Providers	5/8/2013	1:00 PM PST	Nikunj Kansara	Operations Manager 2012 Best Practices for Service Providers - Using System Center 2012 - Operations Manager, we can monitor a multi-forest environment with or without trust boundary. This is a most desired solution for most service providers. In this session we will explore some of the scenarios and best practices that can be used by the service provider implementing OM 2012 as their Monitoring Tool. This is a free event for Microsoft Partners.	Operations Manager 2012 Best Practices for Service Providers

Enabling Hosted IaaS Clouds Using Windows Server, System Center 2012 SP1 and Service Provider Foundation	5/9/2013	1:00 PM PST	Puneet Vig	This session focus on Microsoft Hosting Cloud Solution, using the infrastructure as a service model, built on Windows Server and System Center. Deliver the benefits of public cloud computing, including self-service, scalability, and elasticity. Build your Service Provider cloud using guidance to help you establish appropriate service level agreements (SLAs) and create portals that your customers can use to directly provision, manage, and monitor their infrastructure. This is a free event for Microsoft Partners.	Enabling Hosted IaaS Clouds

Chalk Talk - Designing and Deploying an Active Directory Infrastructure in Windows Server 2012	5/10/2013	9:00 AM PST	Aman Sahota	Chalk Talk is a direct collaboration with Microsoft experts. The session will be presented via Microsoft Live Meeting. Be prepared with audio to ask your questions. This is a fully interactive session and your full participation is encouraged Chalk Talk on Designing an Active Directory Infrastructure - Bring your questions to this fully interactive session to gain understanding regarding the different approaches for Designing or Redesigning an Active Directory Infrastructure with Windows Server 2012. This session can help you identify the right solution and set of tools to meet special requirements. Present your customer scenarios and get expert advice from consultants with right set of expertise. Cost – 1.5 advisory hours will be deducted from your organization for this session.	Chalk Talk - Designing and Deploying AD Infrastructure in 2012

Chalk Talk on Virtual Desktop Infrastructure/Remote Desktop Services	5/24/2013	9:00 AM PST	Yash Tolia	Thinking of implementing a VDI solution but still have a lot of questions? Join our VDI/RDS Chalk Talk session for answers to questions like: what are the use case scenarios for VDI? Do I really need virtual machines or can an RD Session Host fulfill my needs? What are some of the new out of box features of VDI with Windows Server 2012? What about performance over the WAN? All these, and much more. . Cost – 1.5 advisory hours will be deducted from your organization for this session.	Chalk Talk on VDI and RDS

System Center Configuration Manager 2012 Momentum Workshop: Deep Dive into Patch Deployment	5/28/2013	9:00 AM PST	Sarish George	System Center Configuration Manager (SCCM) 2012 Software Update Management makes it easier to manage update deployment and assessment process of your servers and desktops. Organizations get better control and won’t need to turn to reports to track compliance status. There are many new alerts on the console which help to track any errors /failing components. In this session we will take a deep dive look at the new software update management capabilities of SCCM 2012.Agenda:Key ConceptsInvestmentsRBAC and User Targeting Monitor vs. RemediateCI Versioning Reports Target Audiences: IT Pros, Architects, TDMs. This is a free event for Microsoft Partners.	System Center Configuration Manager 2012 Momentum Workshop

Chalk Talk for Windows Rights Management Services in Server 2012	6/21/2013	9:00 AM PST	Anil Malekani	Chalk Talk is a direct collaboration with Microsoft experts. The session will be presented via Microsoft Live Meeting. Be prepared with audio to ask your questions. This is a fully interactive session and your full participation is encouraged Chalk Talk for Windows Rights Management Services in Server 2012 - Bring your questions to this fully interactive session to gain understanding regarding the windows RMS role which helps you protect and encrypt your file shares accross your enterprise. How RMS can benifit you in the file share deployment and also meet the company complience. This session can help you identify the right solution and deployment techniques to meet special requirements. Present your customer scenarios and get expert advice from consultants with right set of expertise. Cost – 1.5 advisory hours will be deducted from your organization for this session.	Chalk Talk for Windows RMS 2012

Watch this space for more info .. or follow on Twitter @amansingh_19

Hope you see you all !

Happy Learning!

Cloning Virtual Domain Controller In Server 2012 – ACTIVE DIRECTORY 2012

Aman Sahota — Thu, 17 Jan 2013 17:53:39 GMT

Welcome everyone for today’s session on Virtual Domain Controller Cloning in Server 2012.

As we know cloning, copying, snapshots or anything but reinstalling a virtual domain controller wasn’t the best for your Active Directory, instead it would most likely make your existing directory from bad to worse. USN rollbacks, lingering objects, time mismatch and ultimately risking AD corruption.

Starting with Server 2012 DC cloning and Snapshot restoration is supported.

In Server 2012, a new VM-Generation-ID unique Identifier is incorporated as an additional attribute of a Domain Controller’s Computer object in AD as well as of VM host (VM container) which is running Virtual DC instance.

When a Virtual DC running Server 2012 boots up, Server 2012 looks for mismatch between VM-Generation-ID recorded on VM instance and VM-Generation-ID on DC’s computer object in AD. If there is a mismatch windows Server knows of the possible snapshot or cloning event which has occurred, and it pushes the latest RID pool and USN for updated information. This safeguards AD health.

Note:

· VM-Generation-ID attribute must be supported on your host hypervisor. VM-Generation-ID support is included in Hyper-V v3 (Server 2012). Other Hypervisor vendors may have the ability but please confirm the version with your vendor support group.

· Source DC must be Server 2012

· PDC role holder must be available to cloned DC and ensure its running Server 2012.

How to Clone your Virtual Domain Controller in Server 2012

Ø Authorize the Source Domain Controller

You will add the source DC, which you will use to close other DC’s to a special Active Directory group called “Cloneable Domain Controllers”. You can find it under Users container.

Best practice is to remove the cloneable DC from this group after completing your task. As cloned DC will also be added to this group. So best you clean it at the end.

Ø Compatible Services to Clone

You need to ensure the services running on your server, if they are compatible with DC cloning. Since certain Software components will be affected after a change in computer name and Security Identifier. You must remove all incompatible software’s prior to cloning; else the process can fail.

Command to list services running on your DC: Get-ADDCCloningExcludedApplicationList

For all incompatible software, you will update them in the Exclude list.

Command to update the list on your DC: Get-ADDCCloningExcludedApplicationList –GenerateXml

And this is how the XML file will look like, found at c:\windows\NTDS:

Ø Configure Source DC to setup new clone DC – DCCloneConfig.xml

You can configure the source DC with set of instructions to clone new DC with specific settings as Network Settings, DNS, WINS, AD Site name, Computer Name etc.

New Clone DC will read the DCCloneConfig.xml file and use these settings while booting up the new Clone DC.

Here is how you will create the DCCloneConfig.xml in powershell

New-ADDCCloneConfigFile -IPv4Address 192.168.1.15 -IPv4DefaultGateway 192.168.1.10 -IPv4SubnetMask 255.255.255.0 -IPv4DNSResolver 192.168.1.20 -Static -SiteName London -CloneComputerName DC2

You can view your DCCloneConfig.xml file from c:\windows\NTDS:

Since I have configured the source DC for cloning and there is not unsupported service and I’m ready to start the cloning process.

Ø Shut down the VM

Shut down the Virtual machine of Source Domain Controller to prepare it for cloning.

You can simply shut down your virtual machine (DC1) or shoot the power shell command let

Stop-VM –Name server2012 –ComputerName AMAN-LAB1

Ø Export the Virtual Machine

Export the Virtual Machine of Source Domain Controller to a Folder Path

Export-VM –Name server2012 –ComputerName AMAN-LAB1 –Path E:\CloneDATA

This usually takes around 5 Minutes to complete but may differ on every environment.

Ø Import the VM

$NewCloneDC = Import-VM -Path "E:\CloneDATE\server2012\Virtual Machines\xyz.xml" -Copy –GenerateNewId –VhdDestinationPath E:\Hyper-V\VirtualHardDisks\DC2

We use a variable ($NewCloneDC) to store the information in it. With the Import-VM switch we point it to path of the xml file and use –copy for copying the vhd data and –GenerateNewID to specify a new generation ID different to source exported VM and this completes the task.

If we are importing it to the same Hyper-V host, it’s important you create a new folder in the hierarchy and import it there. Since the name is same of exported VM you will need to rename it

This takes about 5 minutes again to complete

Ø Rename the New cloned VM

Rename-VM -VM $NewCloneDC -New-Name "DC2"

Ø Power ON new DC

After the renaming step lets power on the source and new VM. New VM will read information from DCCloneConfig.xml and assign itself a new computer name and IP settings.

This should bring up the new DC2 with specified settings.

Hope this was informative and a good experience.

What’s New in Active Directory Domain Services in Server 2012? AD – Server 2012

Aman Sahota — Thu, 10 Jan 2013 19:47:55 GMT

Don’t we all love to know what’s new in AD DS? Here’s a quick peek

The New Stuff in AD DS Server 2012 can merely be categorized into two types “new” and “improved”. Either way both are Eye Catching.

1. Virtualization Improvements

Server 2012 is powered with great Virtualization improvements which are much needed in Day today’s domain management not only in high scale environments but also for the ease of management.

CLONING

You can now clone your Domain Controller. Yes you heard me right “Cloning” is the new feature which allows you to deploy replicas of your single domain controller across your environment.

Process of Cloning involves creating a copy of your exiting virtual DC after authorizing the source DC to be cloned in AD DS. Then Creating a configuration file that contains detailed information (hostname, IP address, DNS servers, etc.) or you have an option to leave it blank by allowing the system to fill that for you. This process not only reduces the steps and time involved but allows you to fully deploy Additional DC’s which are authorized for cloning by Domain administrator.

SAFE GUARDING

AD DS is not new to virtualization, however the features present in most hypervisors can sometimes just not work right with AD replication algorithms (For example logical clocks). In server 2012, a virtualized DC uses a unique identifier which is exposed by Hypervisor called the Virtual machine GenerationID. Virtual machine GenerationID changes whenever there is a change in virtual machine state (for example during boot or before completing any transaction). Virtual machine running DC will compare its Virtual machine GenerationID against the value store in Directory. Mismatch in the ID can event for a rollback and AD DS would allow DC to talk on other DC’s in the environment to give it its current state of information and prevent it from creating duplicate SID’s. This will only work if your hypervisor is Virtual machine GenerationID aware.

Visit the link for detailed information: AD DS Virtualization

Also Read: How to Cloning Virtual Domain Controller In Server 2012

2. Easy Deployments and Upgrades

AD DS in Server 2012 brings together all the steps required to deploy a new DC into One single Graphical Interface. It can do all the good things together saving the additional task which Domain Administrators have it written in the check list. It is built on windows PowerShell in line with Server Manager to target multiple server and remotely deploy DC’s , bringing in smile on end user experience.

Few task that can be automated through the GUI - We can preparing the Domain for DC promotion as adprep.exe in included in the GUI, we can install AD DS server roles remotely, when deploying multiple DC’s across wide geographical locations. This would also correct any prerequisites which are necessary. Below is a sample of how the GUI looks like.

You can also view Scripts to look at the power shell commands.

3. Simplified Management

Dynamic Access Control

DAC brings the next level of Access Control which allows Administrators more express more based on modern day challenges in regulatory and business requirements. It enhances the existing model by introducing user – claims, device -claims or User + device claims (AKA Compound identity). Authorization decisions can be made based on new central access policies (CAP) model and File-Classification.

You try accessing a file share and get an ACCESS DENIED. As a user, you’d be glad if someone explains to you why you do not have necessary permissions on the share and also gives you an opportunity to report it to the authorized controller with a dialog box.

Auditing has been made more granular and same time more flexible and simpler.

Visit the link for Scenario Overview: Dynamic Access Control

Direct Access Offline Domain Join

DirectAccess offline domain join is a process that computers running Windows Server 2012 and Windows 8 can use to join a domain without being physically joined to the corporate network, or connected through VPN. Offline domain join for DirectAccess provides DirectAccess policies to clients to allow remote provisioning.

In short, just join the computer over the internet. (You will need DirectAccess for this)

Visit the link for detailed information: DirectAccess Offline Domain Join

Active Directory Recycle Bin User Interface

AD Recycle bin was introduced in 2008 R2, but was limited to PowerShell only, now you a GUI

Visit the link for Details: Active Directory Recycle Bin

Active Directory Federation Services (AD FS)

AD FS now does not need to be installed separately and has multiple improvement. Watch out the space for an upcoming blog on AD FS

Visit the link for Details: AD FS

Windows PowerShell History Viewer

Since PowerShell is the way forward we look to increase the learning experience. Every UI action can be viewed into PowerShell cmdlets.

Active Directory Replication and Topology windows PowerShell cmdlets

When an Administrator hears about an AD Replication issue, First thing he would look for are the AD tools to view the result of the replication state such as repadmin, ntdsutil & AD sites and services.

Using PowerShell all of the tools can be incorporated in easy and powerful scripting experience. It’s consistent and compatible with other windows PowerShell cmdlets.

Visit the link for Details: AD Replication and Topology PowerShell cmdlets

Fine Grained Password Policy User Interface

In order to leverage on the 2008 FGPP with more precise management, UI has been introduced which allows administrators to create, edit and assign which much minimum trial and error administration.

Visit the link for Details: FGPP

Active Directory Based Activation (AD BA)

We all know how windows activation worked in the past or even in 2008. Using the AD BA, You can activate your clients using Active Directory Infrastructure. However please be noted only windows 8 clients can leverage the feature.

Visit the link for Details: AD BA

Group Managed Service Accounts (gMSA)

Managed Service Accounts were introduced in 2008 R2 and Win 7, these are managed domain accounts which provided password management to run a service or any related administrative task. GMSA extends the same functionality to multiple servers in the domain. This can be helpful while connecting to a service hosted on a server farm or NLB.

Visit the link for Details: gMSA

4. AD DS Platform Changes

Some of the enhancements may not be common to an administrative point but surely it’s a way forward.

AD DS claims in AD FS
Relative ID (RID) Improvements
Deferred Index Creation
Kerberos Enhancements.

There is tremendous effort put in Server 2012 AD DS platform architecture, which is enhanced to improve the Design and scalability. This altogether benefits the performance which an Administrator would love to see.

Hope you find this Informative.

Happy Reading!

Step by Step guide to lower Active Directory Functional Level

Aman Sahota — Fri, 28 Dec 2012 21:57:00 GMT

In Windows Server 2008 R2 and Windows Server 2012, you can lower the Forest and Domain functional level from 2012 to 2008 R2, or from 2008 R2 to 2008. But you cannot lower it beyond 2008. Also, this is not possible by GUI, you have to use PowerShell for doing this. Let’s see how you can do it in the following steps:

1. Import the AD module

Import-Module -Name ActiveDirectory

2. Check the Forest Functional level of your Active Directory

Get-ADForest | Format-Table Name , ForestMode

You can also check it by going to AD Domain and services.

3. Lower the Forest Functional Level and then the Domain Functional Level

Set-ADForestMode –Identity “woodgrovebank.com” –ForestMode Windows2008Forest

Set-ADDomainMode –Identity “woodgrovebank.com” –DomainMode Windows2008Domain

4. To Confirm your Forest Functional level of your Active Directory

Get-ADForest | Format-Table Name , ForestMode

The only thing that you want to keep in mind is your recycle bin functionality which should not be enabled. (Its disabled by default).

Hope this helps. Happy reading!

RoadRunner!

Aman Sahota — Wed, 19 Dec 2012 19:20:00 GMT

Hello Everyone!! It gives me immense pleasure to welcome you all to my blog site. I will be looking forward to BLOG all of my most interesting case work and research. Having started my journey in Small business server team with MS, the first steps have been fab ! and if you ask me I can reiterate each day I spent with SBS, it’s an absolute joyride! My current role with MS is consulting Microsoft Partners with planning designing and deploying windows platform solutions also advising on product sales.

Personally I love travelling , exploring new places and I am a huge soccer fan. My team is Chelseafc in English Premier League, favorite player Fernando Torres and D Drogba.

All said; I am really excited to get on the show and be part of the NEXT BIG Thing!

Once again Welcome everyone and enjoy the ride.