Active Directory, Cluster and other fun stuff... : Quick Tips

Quick Tip: Back up your NTFS security permissions

justintu — Thu, 26 Feb 2009 15:09:00 GMT

Here is a simple command that you can run right now in order to save you from some down-time the next time your file system permissions get set back to the Windows defaults. Proactively running this from time to time (think: task scheduler) can save you a lot of time and money the next time disaster strikes. There are multiple backup solutions and utilities that you can use for this purpose, however this one is easy to use and the price is right. (free)

Subinacl.exe

http://www.microsoft.com/downloads/details.aspx?FamilyID=E8BA3E56-D8FE-4A91-93CF-ED6985E3927B&displaylang=en

Here is example syntax that you can use to proactively back up your NTFS permissions:

Subinacl /noverbose /output=c:\ntfs_perms.txt /subdirectories "Path to the Folder whose NTFS permissions we have to Backup"

To backup the permissions of the folder, subfolders and files on folder called Data on the G: drive:

subinacl /noverbose /output=c:\ntfs_perms.txt /subdirectories G:\data\

If you wanted to just backup the NTFS permissions for the entire drive, the command would look like this:

subinacl /noverbose /output=c:\ntfs_G_drive_perms.txt /subdirectories G:\*.*

Most of you will probably not be concerned with backing up down to the file level, and are satisfied with just backing up the permissions at the directory level. Backing up the permissions for just the directories can be achieved with the following syntax:

subinacl /noverbose /output=c:\G_driveNTFSperms.txt /subdirectories=directoriesonly G:\*.*

The contents of the file created by subinacl are viewable in your favorite text editor:

To restore the permissions on the drive using the file that you backed them up to:

Subinacl /playfile c:\G_driveNTFSperms.txt

Test it out thoroughly in your lab environment before rolling it out to production.

Thanks for reading,

Justin Turner

Technorati Tags: Permissions,Server 2008,Server 2003,Security

Quick TIP: The replication operation was preempted

justintu — Fri, 22 Aug 2008 01:20:00 GMT

This tip can help clear some confusion when you encounter the following error while forcing replication:

result 8461 The replication operation was preempted

Here is the output of running repadmin /showreps on a brand new domain controller:

DC=contoso,DC=com
5th_Ward\ContosoDC2 via RPC
objectGuid: 5ed02b33-a6ab-4576-b109-bb688221e6e3

Last attempt @ 2008-08-21 17:51.44 failed, result 8461: The replication operation was preempted.
Last success @ (never).

If you use the verbose switch you will see the following:

DC invocationID:
5ed02b33-a6ab-4576-b109-bb688221e6e3 DO_SCHEDULED_SYNCS WRITEABLE
COMPRESS_CHANGES NO_CHANGE_NOTIFICATIONS NEVER_SYNCED PREEMPTED USNs:
577738/OU, 0/PU Last attempt @ 2008-08-21 17:51:44 was delayed for a
normal reason, result 8461 (0x210d): The replication operation was preempted.
Last success @ (never).

The reason we log this message is because there is an ongoing higher priority replication operation that has not completed yet. In order to see what inbound replication items are queued (and have preempted us) run the following command on the dc:

repadmin /queue

If you have a lot of items queued run:

repadmin /queue >c:\repl_queue.txt

This will output a list of inbound replication tasks that are queued. They are listed by task id in order of priority. The replication operation that we are waiting on is at the top of the list.

If you want to find out what objects/attributes are currently being replicated in to this dc we can enable diagnostic logging for "5 Replication Events" (coming in a future post) However, Steve Patrick(Spat) shows us a cool repadmin cmd in his post here.

repadmin /showchanges ContosoDC2 5ed02b33-a6ab-4576-b109-bb688221e6e3 DC=corp,DC=com >changes.txt

Part 2 of this post will come at a later date. Stay tuned...

Quick TIP: Quickly verify AD replication status

justintu — Thu, 29 Nov 2007 10:36:00 GMT

It can be a little tedious to verify replication status in a large Active Directory environment via the Sites and Services snap-in. Here is a command I use quite frequently to check the replication status of all domain controllers:

REPADMIN /SHOWREPL * /CSV >showrepl.csv

View the file in Microsoft Excel and perform the following filtering options to get a good quick overview of replication health:

1. Hide columns A and B

2. Select the row just under Column headers and choose Window / Freeze Pane (In Excel 2007: View tab, Window, Freeze Panes, Freeze Top Row)

3. Highlight the entire spreadsheet and choose Data / Filter / Auto-Filter

4. Click on the down-arrow for the "Last Failure Status" column, and choose "does not
equal" then type in "0" (In Excel 2007: Uncheck the box next to "0")

You are left with a list of domain controllers having replication problems. From a cmd prompt, use:

"net helpmsg ErrorCodeNumber" to identify the replication error

(eg. net helpmsg 1396)

Quick TIP: Force FRS replication

justintu — Fri, 27 Apr 2007 15:16:00 GMT

For this tip you will need a somewhat newer version of ntfrsutl.exe

You can grab a version out of the Service Pack 2 Support Tools download here.

Beginning with the version of ntfrsutl.exe in KB 823230 we have the ability to force FRS replication to occur across site boundaries immediately instead of waiting for the schedule to open up.

Here is the command's syntax:

ntfrsutl forcerepl [computer] /r SetName /p PartnerDnsName
= Force FRS to start a replication cycle ignoring the schedule

The PartnerDNSName is the FQDN of the server that you want to source from.

Here is an example using a DC Name of ContosoDC1 and a PartnerDNSName of ContosoDC2:

ntfrsutl forcerepl contosodc1 /r "domain system volume (sysvol share)" /p ContosoDC2.Contoso.com

Running the command initiates replication, and returns the following information:

LocalComputerName = contosodc1
ReplicaSetGuid = (null)
CxtionGuid = (null)
ReplicaSetName = domain system volume (sysvol share)
PartnerDnsName = ContosoDC2.Contoso.com

As you can see there are two additional parameters that you can specify, ReplicaSetGuid and CxtionGuid, but neither are required.

Quick Tips

justintu — Fri, 27 Apr 2007 09:01:11 GMT

I've added a new tag called "Quick Tips." These are going to be smaller posts where I offer some time-saving tip, or some other similar type of goodie.

Look out for the first one soon!