Active Directory Cookbook for windows server 2003- P35 pptx

351
Table 11-4. Attributes of siteLink objects
Attribute Description
siteList
Multivalued list of distinguished names of each site that is associated with the
site link. See Recipe 11.8
for more information.
Table 11-5. Attributes of server objects
Attribute Description
bridgeheadTransportList
Multivalued attribute that contains the list of transports (e.g., IP or
SMTP) for which the server is a preferred bridgehead server.
cn
RDN of the object. This is set to the hostname of the associated
server.
dNSHostName
Fully qualified domain name of the server. This attribute is
automatically maintained for domain controllers.
serverReference
Distinguished name of the corresponding computer object
contained within one of the domain-naming contexts.
Table 11-6. Attributes of nTDSDSA (NTDS Settings) objects
Attribute Description
cn
RDN of the object, which is always equal to NTDS Settings.
invocationID
GUID that represents the DIT (ntds.dit) on the domain controller.
hasMasterNCs
Multivalued attribute containing the list of writeable naming
contexts (does not include application partitions) stored on the

domain controller.
hasPartialReplicaNCs
Multivalued attribute containing the list of read-only naming
contexts stored on the domain controller. This will be populated only
if the domain controller is a global catalog server.
msDS-Behavior-Version
Number that represents the functional level (i.e., operating system)
of the domain controller. This attribute is new to Windows Server
2003.
msDS-HasDomainNCs
Contains the distinguished name of the writeable Domain naming
context stored on the domain controller. This attribute is new to
Windows Server 2003.
msDs-
HasInstantiatedNCs

A combination of all available read-only and writeable naming
contexts stored on the domain controller. This attribute is new to
Windows Server 2003.

352
Table 11-6. Attributes of nTDSDSA (NTDS Settings) objects
Attribute Description
msDS-
hasPartialReplicaNCs

Multivalued attribute that contains distinguished names of each
read-only naming context stored on the domain controller. This will
be populated only if the domain controller is a global catalog server.
This attribute is new to Windows Server 2003.

msDS-hasMasterNCs
Multivalued attribute that contains distinguished names of each
writeable naming context and application partition stored on the
domain controller. This attribute is new to Windows Server 2003.
options
Bit flag that determines if domain controller is a global catalog
server.
queryPolicyObject
If set, the distinguished name of LDAP query policy object to be
used by the domain controller.
Table 11-7. Attributes of nTDSConnection objects
Attribute Description
cn
RDN of the object. For Knowledge Consistency Checker (KCC)
generated connections, this is a GUID.
enabledConnection
Boolean that indicates if the connection is available to be used.
fromServer
Distinguished name of the NTDS Settings object of the domain
controller this connection replicates with.
ms-DS-
ReplicatesNCReason

Multivalued attribute that stores reason codes for why the connection
exists. There will be one entry per naming context the connection is
used for.
options
Bit flag where a value of 1 indicates the connection was created by
the KCC and a value of 0 means the connection was manually
created. See Recipe 11.22

for more information.
schedule
Octet string that represents the replication schedule for the site link.
transportType
Distinguished name of the transport type (e.g., IP or SMTP) that is
used for the connection.
Recipe 11.1 Creating a Site
11.1.1 Problem
You want to create a site.

353
11.1.2 Solution
11.1.2.1 Using a graphical user interface
1. Open the Active Directory Sites and Services snap-in.
2. Right-click on the Sites container and select New Site.
3. Beside Name, enter the name of the new site.
4. Under Link Name, select a site link for the site.
5. Click OK twice.
11.1.2.2 Using a command-line interface
Create an LDIF file called create_site.ldf with the following contents:
dn: cn=<SiteName>,cn=sites,cn=configuration,<ForestRootDN>
changetype: add
objectclass: site

dn: cn=Licensing Site Settings,cn=<SiteName>,cn=sites,cn=configuration,
<ForestRootDN>
changetype: add
objectclass: licensingSiteSettings

dn: cn=NTDS Site

Settings,cn=<SiteName>,cn=sites,cn=configuration,<ForestRootDN>
changetype: add
objectclass: nTDSSiteSettings

dn: cn=Servers,cn=<SiteName>,cn=sites,cn=configuration,<ForestRootDN>
changetype: add
objectclass: serversContainer
then run the following command:
> ldifde -v -i -f create_site.ldf
11.1.2.3 Using VBScript
' This code creates the objects that make up a site.
' SCRIPT CONFIGURATION
strSiteName = "<SiteName>" ' e.g. Dallas
' END CONFIGURATION

set objRootDSE = GetObject("LDAP://RootDSE")
set objSitesCont = GetObject("LDAP://cn=sites," & _
objRootDSE.Get("configurationNamingContext") )
' Create the site
set objSite = objSitesCont.Create("site","cn=" & strSiteName)
objSite.SetInfo

' Create the Licensing Site Settings object
set objLicensing = objSite.Create("licensingSiteSettings", _
"cn=Licensing Site Settings")

354
objLicensing.SetInfo

' Create the NTDS Site Settings object

set objNTDS = objSite.Create("nTDSSiteSettings","cn=NTDS Site Settings")
objNTDS.SetInfo

' Create the Servers container
set objServersCont = objSite.Create("serversContainer","cn=Servers")
objServersCont.SetInfo

WScript.Echo "Successfully created site " & strSiteName
11.1.3 Discussion
To create a site in Active Directory, you have to create a number of objects. The first is a site
object, which is the root of all the other objects. The
site object contains the following:
licensingSiteSettings
This object isn't mandatory, but is created automatically when creating a site with AD
Sites and Services. It is intended to point clients to a license server for the site.
nTDSSiteSettings
This object stores replication-related properties about a site, such as the replication
schedule, current ISTG role holder, and whether universal group caching is enabled.
serversContainer
This container is the parent of the
server objects that are part of the site. All the domain
controllers that are members of the site will be represented in this container.
After these objects are created, you've essentially created an empty site. If you didn't do anything
else, the site would not be of much value. To make it usable, you need to assign
subnet objects
to it (see Recipe 11.4), and add the site to a siteLink object to link the site to other sites (see
Recipe 11.7). At that point, you can promote or move domain controllers into the site, and it
should be fully functional.
11.1.4 See Also
MS KB 318480 (HOW TO: Create and Configure an Active Directory Site in Windows 2000)

Recipe 11.2 Listing the Sites
11.2.1 Problem
You want to obtain the list of sites.

355
11.2.2 Solution
11.2.2.1 Using a graphical user interface
1. Open the Active Directory Sites and Services snap-in.
2. Click on the Sites container.
3. The list of sites will be displayed in the right pane.
4. Double-click on a site to view its properties.
11.2.2.2 Using a command-line interface
Run the following command to list the sites:
> dsquery site
Run the following command to view the properties for a particular site:
> dsget site "<SiteName>"
11.2.2.3 Using VBScript
' This code lists all of the site objects.

set objRootDSE = GetObject("LDAP://RootDSE")
set objSitesCont = GetObject("LDAP://cn=sites," & _
objRootDSE.Get("configurationNamingContext") )
objSitesCont.Filter = Array("site")
for each objSite in objSitesCont
Wscript.Echo " " & objSite.Get("cn")
next
11.2.3 Discussion
Site objects are stored in the Sites container (e.g.,
cn=sites,cn=configuration,dc=rallencorp,dc=com) in the Configuration Naming Context (CNC).
For more information on creating sites, see Recipe 11.1.

Recipe 11.3 Deleting a Site
11.3.1 Problem
You want to delete a site.
11.3.2 Solution
11.3.2.1 Using a graphical user interface
1. Open the Active Directory Sites and Services snap-in.
2. Click on the Sites container.

356
3. In the right pane, right-click the site you want to delete and select Delete.
4. Click Yes twice.
11.3.2.2 Using a command-line interface
> dsrm <SiteDN> -subtree -noprompt
11.3.2.3 Using VBScript
' This code deletes a site and all child containers.
' SCRIPT CONFIGURATION
strSiteName = "<SiteName>" ' e.g. Dallas
' END CONFIGURATION

set objRootDSE = GetObject("LDAP://RootDSE")
set objSite = GetObject("LDAP://cn=" & strSiteName & ",cn=sites," & _
objRootDSE.Get("configurationNamingContext") )
objSite.DeleteObject(0)
WScript.Echo "Successfully deleted site " & strSiteName
11.3.3 Discussion
When deleting a site, be very careful to ensure that no active server objects exist within it. If
you delete a site that contains domain controllers, it will disrupt replication for all domain
controllers in that site. A more robust VBScript solution would be to first perform an ADO query
for all server objects using the distinguished name of the site as the base DN. If no servers were
returned, then you could safely delete the site. If server objects were found, you should move

them before deleting the site.
It is also worth noting that deleting a site does not delete any of the subnets or site links that were
associated with the site. This would be another good thing to add to the VBScript solution. That
is, before you delete the site, delete any subnets and site links that are associated with site.
Recipe 11.4 Creating a Subnet
11.4.1 Problem
You want to create a subnet.
11.4.2 Solution
11.4.2.1 Using a graphical user interface
1. Open the Active Directory Sites and Services snap-in.
2. Right-click on the Subnets container and select New Subnet.
3. Enter the Address and Mask and then select which site the subnet is part of.
4. Click OK.
11.4.2.2 Using a command-line interface

357
Create an LDIF file called create_subnet.ldf with the following contents:
dn: cn=<Subnet>,cn=subnets,cn=sites,cn=configuration,<ForestRootDN>
changetype: add
objectclass: subnet
siteObject: cn=<SiteName>,cn=sites,cn=configuration,<ForestRootDN>
then run the following command:
> ldifde -v -i -f create_subnet.ldf
11.4.2.3 Using VBScript
' This code creates a subnet object and associates it with a site.
' SCRIPT CONFIGURATION
strSubnet = "<Subnet>" ' e.g. 10.5.3.0/24
strSite = "<SiteName>" ' e.g. Dallas
' END CONFIGURATION

set objRootDSE = GetObject("LDAP://RootDSE")
set objSubnetsCont = GetObject("LDAP://cn=subnets,cn=sites," & _
objRootDSE.Get("configurationNamingContext") )
set objSubnet = objSubnetsCont.Create("subnet", "cn=" & strSubnet)
objSubnet.Put "siteObject", "cn=" & strSite & ",cn=sites," & _
objRootDSE.Get("configurationNamingContext")
objSubnet.SetInfo

WScript.Echo "Successfully created subnet " & strSubnet
11.4.3 Discussion
Subnet objects reside in the Subnets container (e.g.,
cn=subnets,cn=sites,cn=configuration,dc=rallencorp,dc=com) in the CNC. The relative
distinguished name (RDN) of the subnet should be the subnet address and bit-mask combination
(e.g., 10.5.3.0/24). The other important attribute to set is siteObject, which should contain the
DN of the site that the subnet is associated with.
11.4.4 See Also
MS KB 323349 (HOW TO: Configure Subnets in Windows Server 2003 Active Directory)
Recipe 11.5 Listing the Subnets
11.5.1 Problem
You want to list the subnet objects in Active Directory.
11.5.2 Solution
11.5.2.1 Using a graphical user interface

358
1. Open the Active Directory Sites and Services snap-in.
2. Click on the Subnets container.
3. The list of subnets will be displayed in the right pane.
4. To view the properties of a specific subnet, double-click on the one you want to view.
11.5.2.2 Using a command-line interface
The following command will list all subnets:

> dsquery subnet
The following command will display the properties for a particular subnet. Replace <Subnet>
with the subnet address and mask (e.g., 10.5.3.0/24):
> dsget subnet "<Subnet>"
11.5.2.3 Using VBScript
' This code lists all the subnets stored in Active Directory.
set objRootDSE = GetObject("LDAP://RootDSE")
set objSubnetsCont = GetObject("LDAP://cn=subnets,cn=sites," & _
objRootDSE.Get("configurationNamingContext") )
objSubnetsCont.Filter = Array("subnet")
for each objSubnet in objSubnetsCont
Wscript.Echo " " & objSubnet.Get("cn")
next
11.5.3 Discussion
To display the site that subnets are associated with, include the siteObject attribute as one of
the attributes to return from the query. For example, the second to last line of the VBScript
solution could be modified to return the site by using this code:
Wscript.Echo " " & objSubnet.Get("cn") & " : " & objSubnet.Get("siteObject")
11.5.4 See Also
MS KB 323349 (HOW TO: Configure Subnets in Windows Server 2003 Active Directory)
Recipe 11.6 Finding Missing Subnets
11.6.1 Problem
You want to find the subnets that are missing from your site topology. Missing subnets can result
in clients not authenticating against the most optimal domain controller, which can degrade
performance.

359
11.6.2 Solution
Having all of your subnets in Active Directory is important because a client that attempts to
logon from a subnet that is not associated with any site may authenticate with any domain

controller in the domain. This can result in the logon process taking longer to complete.
Unfortunately, Microsoft has not provided an easy way to rectify this problem.
Under Windows 2000, the only source of missing subnet information was the System event 5778.
Here is an example:
Event Type: Information
Event Source: NETLOGON
Event Category: None
Event ID: 5778
Date: 1/27/2003
Time: 12:07:04 AM
User: N/A
Computer: DC2
Description:
'JSMITH-W2K' tried to determine its site by looking up its IP address
('10.21.85.34')
in the Configuration\Sites\Subnets container in the DS. No subnet matched
the IP
address. Consider adding a subnet object for this IP address.
The only way to dynamically determine missing subnets is to query each domain controller for
5778 events and map the IP addresses specified within the events to a subnet you add to the site
topology.
With Windows Server 2003 things are not that much better. One of the issues with the 5778
events under Windows 2000 is that they could easily fill up your System event log if you had
many missing subnets. In Windows 2003, Microsoft decided to instead display a summary event
5807 that states that some number of connection attempts have been made by clients that did not
map to a subnet in the site topology. Here is an example:
Event Type: Warning
Event Source: NETLOGON
Event Category: None
Event ID: 5807

Date: 1/10/2003
Time: 10:59:53 AM
User: N/A
Computer: DC1
Description:
During the past 4.18 hours there have been 21 connections to this Domain
Controller
from client machines whose IP addresses don't map to any of the existing
sites in the
enterprise. Those clients, therefore, have undefined sites and may connect to
any
Domain Controller including those that are in far distant locations from the
clients.

360
A client's site is determined by the mapping of its subnet to one of the
existing
sites. To move the above clients to one of the sites, please consider
creating subnet
object(s) covering the above IP addresses with mapping to one of the existing
sites.
The names and IP addresses of the clients in question have been logged on
this
computer in the following log file '%SystemRoot%\debug\netlogon.log' and,
potentially, in the log file '%SystemRoot%\debug\netlogon.bak' created if the
former
log becomes full. The log(s) may contain additional unrelated debugging
information.
To filter out the needed information, please search for lines which contain
text

'NO_CLIENT_SITE:'. The first word after this string is the client name and
the second
word is the client IP address. The maximum size of the log(s) is controlled
by the
following registry DWORD value
'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
Netlogon\Parameters\LogFileMaxSize'; the default is 20000000 bytes. The
current
maximum size is 20000000 bytes. To set a different maximum size, create the
above
registry value and set the desired maximum size in bytes.

For more information, see Help and Support Center at

events.asp.
Instead of scraping the event logs on every domain controller, you can look at the
%SystemRoot%\debug\netlogon.log file on each domain controller and parse out all the
NO_CLIENT_SITE entries. This is still far from an easy process, but at least the event logs are
no longer cluttered with 5778 events.
Here is an example of some of the NO_CLIENT_SITE entries from the netlogon.log file:
01/16 15:50:07 RALLENCORP: NO_CLIENT_SITE: RALLEN-TEST4 164.2.45.157
01/16 15:50:29 RALLENCORP: NO_CLIENT_SITE: SJC-BACKUP 44.25.26.142
01/16 16:19:58 RALLENCORP: NO_CLIENT_SITE: RALLEN-TEST4 164.2.45.157
01/16 16:20:07 RALLENCORP: NO_CLIENT_SITE: RALLEN-TEST4 164.2.45.157
01/16 16:50:07 RALLENCORP: NO_CLIENT_SITE: RALLEN-TEST4 164.2.45.157
01/16 16:57:00 RALLENCORP: NO_CLIENT_SITE: JSMITH-W2K1 10.61.80.19
01/16 17:20:08 RALLENCORP: NO_CLIENT_SITE: RALLEN-TEST4 164.2.45.157
01/16 17:50:08 RALLENCORP: NO_CLIENT_SITE: RALLEN-TEST4 164.2.45.157
If you wanted to get creative and automate a solution to do this, you could write a script that goes
out to each domain controller, opens the netlogon.log file and retrieves NO_CLIENT_SITE

entries. You can then examine all of the IP addresses and create subnets in Active Directory that
would contain them. You could associate all of those subnets with a default site or even use the
Default-First-Site-Name site. Then once a week (or whenever), you could look at the sites