superuser.com/questions/118272/how-can-i-configure-the-max-connection-limit-for-remote-desktop-connections
Windows 2003 by default allows the RDP connections to administer
the server remotely. But if you want more users to login and work on
the same, you need to make it as a Terminal Server and you also need to
buy licenses for your clients that connect to it.
It is called CALs and it can be either per device or per user. So if
you have 5 licenses, you'll be able to connect to that server the way
you want.
-----------
Run Command-Type gpedit.msc-Click on Computer Configuration
-Administrative Templates-Windows Components-Terminal
Service and Increase the "Limit Number of Connections"
--------
You will need to install Terminal server on your system. Go to
Administrative tools, then Configure your server, and follow the wizard
to make your system a Terminal server. At that time, the concurrent
connections are virtually unlimited
------------
allow users to connect remotely using Terminal Services
Specifies whether to allow users to connect remotely using Terminal Services.
You can use this setting to configure Terminal Services remote access for the target computers.
If the status is set to Enabled, users can connect to the target computers remotely using Terminal Services. You can limit the number of users who can connect simultaneously by configuring the "Limit number of connections" setting or the "Maximum Connections" option on the Network Adapter tab in the Terminal Services Configuration tool.
If the status is set to Disabled, the target computers maintain current connections, but will not accept any new incoming connections.
If the status is set to Not Configured, Terminal Services uses the "Allow users to connect remotely to your computer" option on the target computer to determine whether remote connection is allowed. This option is found on the Remote tab in System Properties.
Start a program on connection
Configures Terminal Services to run a specified program automatically upon connection.
You can use this setting to specify a program to run automatically when a user logs on to a remote computer.
By default, Terminal Services sessions provide access to the full Windows desktop, unless otherwise specified with this setting, by the server administrator, or by the user in configuring the client connection. Enabling this setting overrides the "Start Program" settings set by the server administrator or user. The Start menu and Windows Desktop are not displayed, and when the user exits the program the session is automatically logged off.
To use this setting, in Program path and file name, type the fully qualified path and file name of the executable file to be run when the user logs on. If necessary, in Working Directory, type the fully qualified path to the starting directory for the program. If you leave Working Directory blank, the program runs with its default working directory. If the specified program path, file name, or working directory is not the name of a valid directory, the terminal server connection fails with an error message.
If the status is set to Enabled, Terminal Services sessions automatically run the specified program and use the specified Working Directory (or the program default directory, if Working Directory is not specified) as the working directory for the program.
If the status is set to Disabled or Not Configured, Terminal Services sessions start with the full desktop, unless the server administrator or user specify otherwise. (See Computer Config\Administrative templates\Windows Components\System\Logon\"Run these programs at user logon" setting.)
Note: This setting appears in both Computer Configuration and User Configuration. If both settings are configured, the Computer Configuration setting overrides.
Showing posts with label Windows 2003. Show all posts
Showing posts with label Windows 2003. Show all posts
Wednesday, May 8, 2013
Thursday, March 7, 2013
Comodo Firewall & Windows 2003
Comodo firewall on Windows Server 2003 Standard R2
Configurattion of Comodo firewall on Win 2003 Server who runs SQL Express and Terminal Server in app mode!
Server has 2 NIC's.
On 1st NIC is LAN for SQL and admin RDP (NO GATEWAY AND NO DNS)
On 2nd NIC is open Internet 1Mb/1Mb optic for WAN RDP connections
What I want is next:
1. Config Comodo to allow all LAN requests for SQL Express 2005 so everyone on LAN can work without problems trougth NIC 1
2. Config Comodo to allow all RDP requests from WAN and LAN
3. If it's possible, enter WAN IP ranges who can connect on RDP
4. BLOCK ALL OTHER FROM WAN !
-------------------------------------------
For the 1st NIC (for the SQL & RDP), where you want all traffic allowed, do the following:
Go to Security/Tasks/Add a Zone. You will give the Zone a name, and define it in accordance with the IP address range of the related NIC.
Then go to Security/Tasks/Define a New Trusted Network, and select the Zone you just created. This will add two rule to the Network Monitor (at the top of the list) ~ One rule to Allow IP Out, one rule to Allow IP In; this way all traffic can go from computer to the Zone, and back, without limitations. Reboot.
For the WAN, you'll need/want to create Zones for the IP Range (or each IP, depending on your needs and the IP configuration) for what you want to allow to connect w/RDP. Then use those Zones to manually create Network Monitor Rules to allow the traffic; you can set the Port, IP, etc, to control the connection and create tighter security. You might see this thread about Network Rules. http://forums.comodo.com/index.php/topic,1125.0.html; it's a great source of information.
Configurattion of Comodo firewall on Win 2003 Server who runs SQL Express and Terminal Server in app mode!
Server has 2 NIC's.
On 1st NIC is LAN for SQL and admin RDP (NO GATEWAY AND NO DNS)
On 2nd NIC is open Internet 1Mb/1Mb optic for WAN RDP connections
What I want is next:
1. Config Comodo to allow all LAN requests for SQL Express 2005 so everyone on LAN can work without problems trougth NIC 1
2. Config Comodo to allow all RDP requests from WAN and LAN
3. If it's possible, enter WAN IP ranges who can connect on RDP
4. BLOCK ALL OTHER FROM WAN !
-------------------------------------------
For the 1st NIC (for the SQL & RDP), where you want all traffic allowed, do the following:
Go to Security/Tasks/Add a Zone. You will give the Zone a name, and define it in accordance with the IP address range of the related NIC.
Then go to Security/Tasks/Define a New Trusted Network, and select the Zone you just created. This will add two rule to the Network Monitor (at the top of the list) ~ One rule to Allow IP Out, one rule to Allow IP In; this way all traffic can go from computer to the Zone, and back, without limitations. Reboot.
For the WAN, you'll need/want to create Zones for the IP Range (or each IP, depending on your needs and the IP configuration) for what you want to allow to connect w/RDP. Then use those Zones to manually create Network Monitor Rules to allow the traffic; you can set the Port, IP, etc, to control the connection and create tighter security. You might see this thread about Network Rules. http://forums.comodo.com/index.php/topic,1125.0.html; it's a great source of information.
Wednesday, December 5, 2012
Windows 2003 Server 2 NIC (multihomed)
http://www.tomshardware.com/forum/24551-42-windows-2003-server-network-cards-multi-homed-connection-help
I have two network cards in my Windows 2003 RS2 (Small Business) and two routers, I plan to have it set up so that we have a fall-back if the internet on the primary router were to drop out or loose connectivity to the internet, so that we will not loose connectivity or outside requests for applications running on our server.
At the moment my configuration is this:-
Network card 1:
IP: 192.168.0.5
Sub: 255.255.255.0
Gateway: 192.168.0.1
Network Card 2:
IP: 192.168.0.4
Sub: 255.255.255.0
Gateway: 192.168.0.2
What is the best way to achieve this? At the moment the workstations default gateway all go directly to the router, is it better to direct them via the server so they can benefit from a multi-homed connection?
--------------------------------------------
You would need to purchase a high-end router and configure it to use an alternate path if the first path failed - First path ISP #1, second past ISP #2. With that, you wouldn't need the 2nd NIC in the server.
If you plug them both in, the server will take a path to use as a connection to everything. If the server has to switch NICs to get inbound traffic, it'll have to drop a connection to everything attached to it.
Thus, you'll want to pick up a network device to do the routing for you. You could go with something like Network Load Balancing, which you might be able to use with Windows Server.. it'll install on the server itself. Though, in my position, we have our ISP load balance for us so we don't have to configure it.
But you're looking at a high end router.. Cisco comes to mind.. I can't think of the other brand that might be easier to use.
You may be able to find a dual WAN Linksys Router which may resolve your problem as well.
http://www.speedguide.net/broadband-view.php?hw=34
----------------------
!!!!!
I was working on the same thing just recently, and figured out how to do it in windows server 2003. And it's working just fine.
Make sure you either have or can install Routing & Remote Access (should be in Administrative Tools)
If you need to install it, just do so with basic NAT/Firewall checked (one of the options required to install RRAS - Routing and Remote Access Service), but we're not going to use NAT.
Remove your gateways from your adapters (by going to your NIC->TCP/IP Properties->Advanced->Gateways->Remove (hopefully you can get my drift))
In the RRAS snap-in, right click on Static Routes and add a new route.
(I'm going to assume that your LAN connections are named "Network Card 1" and "Network Card 2" respectively for ease of typing)
Set this up:
Interface: Network Card 1
Destination: 0.0.0.0
Network mask: 255.255.255.255
Gateway: 192.168.0.1
Metric: 1
Click ok, and right-click "Static routes" and add another new route:
Set this up:
Interface: Network Card 2
Destination: 0.0.0.0
Network mask: 255.255.255.255
Gateway: 192.168.0.2
Metric: 1
Click "OK" and then right-click on "static routes" and click "show ip table"
make a note/screenshot of it as it is now
Go back to your network adapter properties, go to the "Network Card 1" properties
Go to TCP/IP Properties->Advanced->Gateways->"Add"
Gateway: 192.168.0.1
Automatic Metric: UNCHECKED
Metric: 20
Close out of that
go to the "Network Card 2" properties
Go to TCP/IP Properties->Advanced->Gateways->"Add"
Gateway: 192.168.0.2
Automatic Metric: UNCHECKED
Metric: 20
Now get a new list of the routes in your IP routing table by going into the RRAS snap-in, right click on "static routes" and click "show ip routing table"
You should have at the top, something like this (the first 4 lines are the critical ones, if these aren't right, re-try the order in which you setup the static routes & add the gateways)
Destination Network Mask Gateway Interface Metric Protocol
0.0.0.0 255.255.255.255 192.168.0.1 Network Card 1 1 Static (non...)
0.0.0.0 255.255.255.255 192.168.0.2 Network Card 2 1 Static (non...)
0.0.0.0 0.0.0.0 192.168.0.1 Network Card 1 20 Network Mgmt
0.0.0.0 0.0.0.0 192.168.0.2 Network Card 2 20 Network Mgmt
Be sure to make your destination NAT on your routers MATCH from router to IP resepectively, or the whole thing won't work, ie:
router: 192.168.0.1 needs to forward traffic to 192.168.0.5
router: 192.168.0.2 needs to forward traffic to 192.168.0.4
Essentially what you're doing is bonding a gateway to a NIC. This may work for you, it has definately worked for me when I needed to setup a web server that would respond on 2 different public IP's.
!!!!
---------------------
Hi, look up for ClearOS. it is easy to learn and install. use it as your "ROUTER" in multi wan mode, so if one drop, it will still use the other one. and you wont have 2 gateways. only one, the ClearOs server's IP.
it works like this:
2 routers go into the server, and then one cable goes out from the sever, to the network. so you will need 3 lan ports.
I have two network cards in my Windows 2003 RS2 (Small Business) and two routers, I plan to have it set up so that we have a fall-back if the internet on the primary router were to drop out or loose connectivity to the internet, so that we will not loose connectivity or outside requests for applications running on our server.
At the moment my configuration is this:-
Network card 1:
IP: 192.168.0.5
Sub: 255.255.255.0
Gateway: 192.168.0.1
Network Card 2:
IP: 192.168.0.4
Sub: 255.255.255.0
Gateway: 192.168.0.2
What is the best way to achieve this? At the moment the workstations default gateway all go directly to the router, is it better to direct them via the server so they can benefit from a multi-homed connection?
--------------------------------------------
You would need to purchase a high-end router and configure it to use an alternate path if the first path failed - First path ISP #1, second past ISP #2. With that, you wouldn't need the 2nd NIC in the server.
If you plug them both in, the server will take a path to use as a connection to everything. If the server has to switch NICs to get inbound traffic, it'll have to drop a connection to everything attached to it.
Thus, you'll want to pick up a network device to do the routing for you. You could go with something like Network Load Balancing, which you might be able to use with Windows Server.. it'll install on the server itself. Though, in my position, we have our ISP load balance for us so we don't have to configure it.
But you're looking at a high end router.. Cisco comes to mind.. I can't think of the other brand that might be easier to use.
You may be able to find a dual WAN Linksys Router which may resolve your problem as well.
http://www.speedguide.net/broadband-view.php?hw=34
----------------------
!!!!!
I was working on the same thing just recently, and figured out how to do it in windows server 2003. And it's working just fine.
Make sure you either have or can install Routing & Remote Access (should be in Administrative Tools)
If you need to install it, just do so with basic NAT/Firewall checked (one of the options required to install RRAS - Routing and Remote Access Service), but we're not going to use NAT.
Remove your gateways from your adapters (by going to your NIC->TCP/IP Properties->Advanced->Gateways->Remove (hopefully you can get my drift))
In the RRAS snap-in, right click on Static Routes and add a new route.
(I'm going to assume that your LAN connections are named "Network Card 1" and "Network Card 2" respectively for ease of typing)
Set this up:
Interface: Network Card 1
Destination: 0.0.0.0
Network mask: 255.255.255.255
Gateway: 192.168.0.1
Metric: 1
Click ok, and right-click "Static routes" and add another new route:
Set this up:
Interface: Network Card 2
Destination: 0.0.0.0
Network mask: 255.255.255.255
Gateway: 192.168.0.2
Metric: 1
Click "OK" and then right-click on "static routes" and click "show ip table"
make a note/screenshot of it as it is now
Go back to your network adapter properties, go to the "Network Card 1" properties
Go to TCP/IP Properties->Advanced->Gateways->"Add"
Gateway: 192.168.0.1
Automatic Metric: UNCHECKED
Metric: 20
Close out of that
go to the "Network Card 2" properties
Go to TCP/IP Properties->Advanced->Gateways->"Add"
Gateway: 192.168.0.2
Automatic Metric: UNCHECKED
Metric: 20
Now get a new list of the routes in your IP routing table by going into the RRAS snap-in, right click on "static routes" and click "show ip routing table"
You should have at the top, something like this (the first 4 lines are the critical ones, if these aren't right, re-try the order in which you setup the static routes & add the gateways)
Destination Network Mask Gateway Interface Metric Protocol
0.0.0.0 255.255.255.255 192.168.0.1 Network Card 1 1 Static (non...)
0.0.0.0 255.255.255.255 192.168.0.2 Network Card 2 1 Static (non...)
0.0.0.0 0.0.0.0 192.168.0.1 Network Card 1 20 Network Mgmt
0.0.0.0 0.0.0.0 192.168.0.2 Network Card 2 20 Network Mgmt
Be sure to make your destination NAT on your routers MATCH from router to IP resepectively, or the whole thing won't work, ie:
router: 192.168.0.1 needs to forward traffic to 192.168.0.5
router: 192.168.0.2 needs to forward traffic to 192.168.0.4
Essentially what you're doing is bonding a gateway to a NIC. This may work for you, it has definately worked for me when I needed to setup a web server that would respond on 2 different public IP's.
!!!!
---------------------
Hi, look up for ClearOS. it is easy to learn and install. use it as your "ROUTER" in multi wan mode, so if one drop, it will still use the other one. and you wont have 2 gateways. only one, the ClearOs server's IP.
it works like this:
2 routers go into the server, and then one cable goes out from the sever, to the network. so you will need 3 lan ports.
Multiple network adapters
Windows 2003 two nics two gateways
Windows 2003 and 2 nic's trying to route between different subnets.
I do not think that you can achieve your requirement by any software application, as meniolf suggested; you need to think about manageable switches to configure subnet/VLAN.
=============================
DC with 2 NICs and DNS resolving in the different subnets
DNS configuration best practice on DC and clients/member servers:
== MULTIHOMING Domain controllers is not recommended, it always results in multiple problems.
1. Domain Controllers should not be multi-homed
2. Being a VPN Server and even simply running RRAS makes it multi-homed.
3. DNS even just all by itself, is better on a single homed machine.
4. Domain Controllers with the PDC Role are automatically Domain Master Browser. Master Browsers should not be multi-homed
272294 - Active Directory Communication Fails on Multihomed Domain Controllers http://support.microsoft.com/default.aspx?scid=kb;en-us;272294
191611 - Symptoms of Multihomed Browsers
http://support.microsoft.com/default.aspx?scid=kb;EN-US;191611
== DNS configuration on domain controller:
1. Each DC / DNS server points to its private IP address as primary DNS server and other internal/remote DNS servers as secondary DNS in TCP/IP property.
2. Each DC has just one IP address and one network adapter is enabled (disable unused NICs).
3. If multiple NICs (enabled and disabled) are present on server, make sure the active NIC should be on top in NIC binding.
4. Contact your ISP and get valid DNS IPs from them and add it in to the forwarders, Do not set public DNS server in TCP/IP setting of DC.
== IP configuration on clients and member servers:
1. Each workstation/member server should point to local DNS server as primary DNS and other remote DNS servers as secondary.
2. Do not set public DNS server in TCP/IP setting of client/member server.
Once you are done with above, run "ipconfig /flushdns & ipconfig /registerdns", restart DNS server and NETLOGON service on each DC.
--------------------------------------------
running DCs multihomed is bad configuration and should NEVER be used
Why is this crappy setup chosen from you? Anyway, please remove on each DC one NIC, cleanup DNS zones and run ipconfig /flushdns and ipconfig /registerdns and restart the netlogon service. See Ace's article why NOT using this:
http://msmvps.com/blogs/acefekay/archive/2009/08/17/multihomed-dcs-with-dns-rras-and-or-pppoe-adapters.aspx
Use switches that provide VLANs and then divide the subnets that way.
==================================
Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2
This following characteristics apply:
If you disable multicast support (causing the host to revert to unicast mode), Network Load Balancing automatically instructs the driver belonging to the cluster adapter to override the adapter's unique, built-in network address and to change its media access control address to the cluster's media access control address. This is the address used on all cluster hosts. You do not need to manually configure the network adapter to recognize this address. (Note that some network adapters do not support changing their media access control addresses. If you experience this problem, you must install a network adapter that does.)
Notes
Optimizing network performance
Windows 2003 and 2 nic's trying to route between different subnets.
I do not think that you can achieve your requirement by any software application, as meniolf suggested; you need to think about manageable switches to configure subnet/VLAN.
=============================
DC with 2 NICs and DNS resolving in the different subnets
DNS configuration best practice on DC and clients/member servers:
== MULTIHOMING Domain controllers is not recommended, it always results in multiple problems.
1. Domain Controllers should not be multi-homed
2. Being a VPN Server and even simply running RRAS makes it multi-homed.
3. DNS even just all by itself, is better on a single homed machine.
4. Domain Controllers with the PDC Role are automatically Domain Master Browser. Master Browsers should not be multi-homed
272294 - Active Directory Communication Fails on Multihomed Domain Controllers http://support.microsoft.com/default.aspx?scid=kb;en-us;272294
191611 - Symptoms of Multihomed Browsers
http://support.microsoft.com/default.aspx?scid=kb;EN-US;191611
== DNS configuration on domain controller:
1. Each DC / DNS server points to its private IP address as primary DNS server and other internal/remote DNS servers as secondary DNS in TCP/IP property.
2. Each DC has just one IP address and one network adapter is enabled (disable unused NICs).
3. If multiple NICs (enabled and disabled) are present on server, make sure the active NIC should be on top in NIC binding.
4. Contact your ISP and get valid DNS IPs from them and add it in to the forwarders, Do not set public DNS server in TCP/IP setting of DC.
== IP configuration on clients and member servers:
1. Each workstation/member server should point to local DNS server as primary DNS and other remote DNS servers as secondary.
2. Do not set public DNS server in TCP/IP setting of client/member server.
Once you are done with above, run "ipconfig /flushdns & ipconfig /registerdns", restart DNS server and NETLOGON service on each DC.
--------------------------------------------
running DCs multihomed is bad configuration and should NEVER be used
Why is this crappy setup chosen from you? Anyway, please remove on each DC one NIC, cleanup DNS zones and run ipconfig /flushdns and ipconfig /registerdns and restart the netlogon service. See Ace's article why NOT using this:
http://msmvps.com/blogs/acefekay/archive/2009/08/17/multihomed-dcs-with-dns-rras-and-or-pppoe-adapters.aspx
Use switches that provide VLANs and then divide the subnets that way.
==================================
Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2
Multiple network adapters
Network Load balancing can use multiple network adapters in
two different and distinct ways. The first use is to create multiple
Network Load Balancing clusters; achieved by binding Network Load
Balancing to each of the multiple adapters.
The second use for multiple network adapters is to use one or more adapters for handling cluster traffic, but also configure at least one adapter to be used for server management. The management adapter does not handle cluster traffic. Further information on this this second use of multiple network adapters is described below.
The second use for multiple network adapters is to use one or more adapters for handling cluster traffic, but also configure at least one adapter to be used for server management. The management adapter does not handle cluster traffic. Further information on this this second use of multiple network adapters is described below.
Multiple network adapters in unicast mode
In unicast mode, the cluster's media access control (MAC)
address is assigned to the network adapter that is functioning as the
cluster adapter, and the cluster adapter's built-in MAC address is not
used. Because of this, host to host communication (other than Network
Load Balancing heartbeat-related traffic) is not possible on the
cluster adapter.
The following characteristics apply:
The following characteristics apply:
-
Adapters used as cluster adapters
- The cluster IP address resolves to the adapter's cluster MAC address (which Network Load Balancing automatically generates).
- If the cluster adapter's dedicated IP address is used, this IP address also resolves to the cluster MAC address.
- The cluster adapter handles client-to-cluster traffic using the virtual IP address. However host-to-host traffic within the same cluster is not possible on this adapter because the MAC address for each host in a particular cluster is the same. For more information, see Address Resolution Protocol (ARP).
-
Adapter used as the management adapter
- Network Load Balancing in not bound to this adapter.
- This adapter's IP address resolves to the adapter's built-in MAC address.
- This adapter handles network traffic specific to the computer, including traffic from both inside and outside the subnet in which the computer is located.
Multiple network adapters in multicast mode
In multicast mode, the cluster's MAC address is assigned to network adapters that are functioning as cluster adapters, but the cluster adapters' built-in address is retained so that both addresses are used, the first for client-to-cluster traffic and the second for network traffic specific to the computer.This following characteristics apply:
-
Adapters used as cluster adapters
- The cluster IP address resolves to the adapter's cluster MAC address (which Network Load Balancing automatically generates).
- If the cluster adapter's dedicated IP address is used, this IP address resolves to the adapter's original, built-in MAC address.
- In multicast mode, the cluster adapters can handle both client-to-cluster traffic and traffic specific to the computer, including all traffic from both inside and outside the subnet in which the computer is located.
-
Adapter used as the management adapter
- Network Load Balancing in not bound to this adapter.
- This adapter's IP address resolves to the adapter's built-in MAC address.
- This adapter can be used to handle the network traffic specific to the computer, including traffic from both inside and outside the subnet in which the computer is located.
-
Network Load Balancing does not support a mixed unicast/multicast
environment within a single cluster. Within each cluster, all network
adapters in that cluster must be either multicast or unicast;
otherwise, the cluster will not function properly.
However, there is no restriction on the number of network adapters: Different hosts can have a different number of adapters.
If you disable multicast support (causing the host to revert to unicast mode), Network Load Balancing automatically instructs the driver belonging to the cluster adapter to override the adapter's unique, built-in network address and to change its media access control address to the cluster's media access control address. This is the address used on all cluster hosts. You do not need to manually configure the network adapter to recognize this address. (Note that some network adapters do not support changing their media access control addresses. If you experience this problem, you must install a network adapter that does.)
Notes
-
Multicast support is not enabled by default. To enable it, see Enable multicast support.
However, even if you do not enable multicast support, you are advised
to consider using at least two network adapters (with one network
adapter dedicated to handling client-to-cluster traffic) in order to
achieve optimum performance and the full range of networking
functionality. For more information, see Optimizing network performance.
- If you are using single network adapter, see Single network adapter and Single network adapter limitations.
Optimizing network performance
If the cluster hosts are directly connected to a hub in order
to receive client requests, incoming client traffic is automatically
sent to all ports.
To limit switch port flooding (for example, when computers outside the cluster also share the hub), see Limit switch port flooding. The steps outlined make all incoming client traffic flow through one switch port and thereby conserve switch bandwidth. In this configuration, you are advised to consider adding a second, dedicated network adapter for each host connected to an individual switch port. The use of two network adapters per host on the cluster subnet helps to direct network traffic through the cluster hosts. Incoming client traffic flows through the hub for simultaneous delivery to all hosts, while outgoing traffic flows directly to the switch ports. Be sure to enter a gateway IP address in the Internet Protocol (TCP/IP) Properties dialog box in Network Connections for the dedicated network adapter, to cause outgoing network traffic to flow through that network adapter. At the same time, be sure to remove the default gateway for the cluster adapter, if one has been configured. It is essential that the default gateway be configured for either the cluster adapter or the dedicated adapter but not both.
To limit switch port flooding (for example, when computers outside the cluster also share the hub), see Limit switch port flooding. The steps outlined make all incoming client traffic flow through one switch port and thereby conserve switch bandwidth. In this configuration, you are advised to consider adding a second, dedicated network adapter for each host connected to an individual switch port. The use of two network adapters per host on the cluster subnet helps to direct network traffic through the cluster hosts. Incoming client traffic flows through the hub for simultaneous delivery to all hosts, while outgoing traffic flows directly to the switch ports. Be sure to enter a gateway IP address in the Internet Protocol (TCP/IP) Properties dialog box in Network Connections for the dedicated network adapter, to cause outgoing network traffic to flow through that network adapter. At the same time, be sure to remove the default gateway for the cluster adapter, if one has been configured. It is essential that the default gateway be configured for either the cluster adapter or the dedicated adapter but not both.
Tuesday, January 17, 2012
Reset Roaming Profile and Folder Redirection Permissions
Source
[...]
Resetting Permissions
If you run into permission issues, first make sure your parent folder permissions are correct as defined above.
If you need to reset permissions on a user folder, you will first need to take ownership of the entire folder, then reset permissions, then assign ownership back to the user. While it is possible to do this in the GUI, if you need to do it for lots of users, you’ll want to develop a script. Starting from Richard Teachout’s article, I came up with the following approach. Notes:
D:\RoamingProfiles
D:\RoamingProfiles\UserDocs
D:\RoamingProfiles\UserDocs\User01
D:\RoamingProfiles\UserDocs\User01
D:\RoamingProfiles\UserProfiles
D:\RoamingProfiles\UserProfiles\User01
D:\RoamingProfiles\UserProfiles\User01.V2 – used by new Windows 7 profile folder redirection
D:\RoamingProfiles\UserProfiles\User02
D:\RoamingProfiles\UserProfiles\User02.V2
The ScriptBased on that structure, I created my script in the D:\RoamingProfiles folder, and assumed it would be run with a single parameter, the %UserName%. Here are the basic commands. As always, use at your own risk!
[...]
[...]
Resetting Permissions
If you run into permission issues, first make sure your parent folder permissions are correct as defined above.
If you need to reset permissions on a user folder, you will first need to take ownership of the entire folder, then reset permissions, then assign ownership back to the user. While it is possible to do this in the GUI, if you need to do it for lots of users, you’ll want to develop a script. Starting from Richard Teachout’s article, I came up with the following approach. Notes:
- You can use the built-in utility takeown to assign ownership to Administrators. However in order to assign ownership back to end users, you’ll need to download and install subinacl.
- For permission assignment, you can use the built-in cacls utility. Although Mr. Teachout recommended the /G parameter to grant permissions, I had better luck with the /P parameter to replace permissions. This hopefully takes care of the odd permission on some profiles where the user has full access to the top folder only.Using /G on that kind of folder generates errorlevel 13 and the message "The data is invalid".
D:\RoamingProfiles
D:\RoamingProfiles\UserDocs
D:\RoamingProfiles\UserDocs\User01
D:\RoamingProfiles\UserDocs\User01
D:\RoamingProfiles\UserProfiles
D:\RoamingProfiles\UserProfiles\User01
D:\RoamingProfiles\UserProfiles\User01.V2 – used by new Windows 7 profile folder redirection
D:\RoamingProfiles\UserProfiles\User02
D:\RoamingProfiles\UserProfiles\User02.V2
The ScriptBased on that structure, I created my script in the D:\RoamingProfiles folder, and assumed it would be run with a single parameter, the %UserName%. Here are the basic commands. As always, use at your own risk!
[...]
Tuesday, October 4, 2011
Can not access a shared directory on another machine
ipconfig -all
Source
========================
At least on Windows XP it does.
Look at
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser\Parameters
======================
Source
Action
------------------------------
Right-click My Computer, select Properties. Select Computer Name tab, click Change button. Then, click the "More" button. Verify that the "Primary DNS suffix of this computer" field is blank. If there is .tech.schoolname.edu or similar in the box, the server will register that suffix after its name as the FQDN.
------------------------------
Well then, taking one step at a time, and I'm thinking that getting your clients at least back to the way they were before, is more pressing than jumping to AD at this point.
There clearly is something wrong with name resolution if you can't even ping the server by name. If your clients can't resolve the name of the server to an IP, then we can't even think about accessing a share in the form of \\servername\sharename.
However, you CAN test \\serverIP\sharename and see if that connects. Meaning, if your server has an IP of 192.168.50.11, then from a client, try to connect to \\192.168.50.11\sharename. If that connects, then your file sharing is OK, and you just need to fix name resolution of the server.
You are correct in that you do NOT have to put the d$ share in the UNC path; should just be \\servername\sharename or \\serverIP\sharename
Seems to me, that your server still thinks is has an FQDN of SCHOOL.tech.schoolname.org. So are you telling us that you've removed the DC role from the server, and have placed the server back into a WORKGROUP, using the same workgroup name as the clients. Confirm ALL of the TCP/IP properties on the server -- did you set the DNS server(s) back to what they were pre-AD (pre-AD sounds weird)? Are you using WINS in your org and did you check the WINS settings? Did you check if NETBIOS is enabled on the server?
I'll just briefly respond to a couple of points in your last post relative to moving forward with the AD implementation.
It is a good practice to name your AD domain name something like schoolname.LOCAL rather than using your public FQDN (SCHOOL.tech.schoolname.org). There's nothing stopping one from using their public domain name as their AD name, but as you can imagine there are considerations that need to be made for accessing public servers of the domain from internal clients. So make it easy on yourself and don't do it.
You were correct in defining DNS Forwarders in your first attempt, but missed a couple of other steps which we can talk about later.
You won't host your public DNS on the AD-controller (DC), so don't worry about that. DNS is used on the DC's to store AD-related information and to do name resolution for the organization, and is not necessarily intended to be used as your public DNS host.
There clearly is something wrong with name resolution if you can't even ping the server by name. If your clients can't resolve the name of the server to an IP, then we can't even think about accessing a share in the form of \\servername\sharename.
However, you CAN test \\serverIP\sharename and see if that connects. Meaning, if your server has an IP of 192.168.50.11, then from a client, try to connect to \\192.168.50.11\sharename. If that connects, then your file sharing is OK, and you just need to fix name resolution of the server.
You are correct in that you do NOT have to put the d$ share in the UNC path; should just be \\servername\sharename or \\serverIP\sharename
Seems to me, that your server still thinks is has an FQDN of SCHOOL.tech.schoolname.org. So are you telling us that you've removed the DC role from the server, and have placed the server back into a WORKGROUP, using the same workgroup name as the clients. Confirm ALL of the TCP/IP properties on the server -- did you set the DNS server(s) back to what they were pre-AD (pre-AD sounds weird)? Are you using WINS in your org and did you check the WINS settings? Did you check if NETBIOS is enabled on the server?
I'll just briefly respond to a couple of points in your last post relative to moving forward with the AD implementation.
It is a good practice to name your AD domain name something like schoolname.LOCAL rather than using your public FQDN (SCHOOL.tech.schoolname.org). There's nothing stopping one from using their public domain name as their AD name, but as you can imagine there are considerations that need to be made for accessing public servers of the domain from internal clients. So make it easy on yourself and don't do it.
You were correct in defining DNS Forwarders in your first attempt, but missed a couple of other steps which we can talk about later.
You won't host your public DNS on the AD-controller (DC), so don't worry about that. DNS is used on the DC's to store AD-related information and to do name resolution for the organization, and is not necessarily intended to be used as your public DNS host.
At least on Windows XP it does.
Look at
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser\Parameters
======================
Wednesday, November 17, 2010
Network Address Translation in Windows Server 2003
Source
To configure the Routing and Remote Access and the Network Address Translation components, your computer must have at least two network interfaces: one connected to the Internet and the other one connected to the internal network. You must also configure the network translation computer to use Transport Control Protocol/Internet Protocol (TCP/IP).
If you use dial-up devices such as a modem or an Integrated Services Digital Network (ISDN) adapter to connect to the Internet, install your dial-up device before you configure Routing and Remote Access.
Configure Routing and Remote Access
Configure Routing and Remote Access
To activate Routing and Remote Access, follow these steps:
1. Click Start, point to All Programs, point to Administrative Tools, and then click Routing and Remote Access.
2. Right-click your server, and then click Configure and Enable Routing and Remote Access.
3. In the Routing and Remote Access Setup Wizard, click Next, click Network address translation (NAT), and then click Next.
4. Click Use this public interface to connect to the Internet, and then click the network adapter that is connected to the Internet. At this stage you have the option to reduce the risk of unauthorized access to your network. To do so, click to select the Enable security on the selected interface by setting up Basic Firewall check box.
5. Examine the selected options in the Summary box, and then click Finish.
Configure dynamic IP address assignment for private network clients
Configure dynamic IP address assignment for private network clients
You can configure your Network Address Translation computer to act as a Dynamic Host Configuration Protocol (DHCP) server for computers on your internal network. To do so, follow these steps:
1. Click Start, point to All Programs, point to Administrative Tools, and then click Routing and Remote Access.
2. Expand your server node, and then expand IP Routing.
3. Right-click NAT/Basic Firewall, and then click Properties.
4. In the NAT/Basic Firewall Properties dialog box, click the Address Assignment tab.
5. Click to select the Automatically assign IP addresses by using the DHCP allocator check box. Notice that default private network 192.168.0.0 with the subnet mask of 255.255.0.0 is automatically added in the IP address and the Mask boxes. You can keep the default values, or you can modify these values to suit your network.
6. If your internal network requires static IP assignment for some computers — such as for domain controllers or for DNS servers — exclude those IP addresses from the DHCP pool. To do this, follow these steps:
a. Click Exclude.
b. In the Exclude Reserved Addresses dialog box, click Add, type the IP address, and then click OK.
c. Repeat step b for all addresses that you want to exclude.
d. Click OK.
Configure name resolution
To configure name resolution, follow these steps:
1. Click Start, point to All Programs, point to Administrative Tools, and then click Routing and Remote Access.
2. Right-click NAT/Basic Firewall, and then click Properties.
3. In the NAT/Basic Firewall Properties dialog box, click the Name Resolution tab.
4. Click to select the Clients using Domain Name System (DNS) check box. If you use a demand-dial interface to connect to an external DNS server, click to select the Connect to the public network when a name needs to be resolved check box, and then click the appropriate dial-up interface in the list.
- Related posts
- How to Configure Routing and Remote Access Service in Windows Server 2003
- How To Configure a VPN Server to Act as a Router in Windows Server 2003
- How To Install and Configure a DHCP Server in a Workgroup in Windows Server 2003
- How to configure Internet E-mail accounts in Outlook 2007
- How To Create an Active Directory Server in Windows Server 2003
Networking Windows Server 2003
thedailyreviewer.com/.../workgroup-share-access
\\server1\Folder
\\IP-of-server\Folder
"User has not been granted the requested logon type at this computer"
when trying to map a drive
--------------------
MS error Event ID: 4311
http://www.eventid.net/display.asp?...
This error can occur because of an incorrect registry setting.
The value for HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\TransportBindName can be blank. Set it to "\Device\", reboot.
--------------------
Troubleshooting Try running nbtstat -n on the server. It should display something like this where the serverName parameter can be seen (in this case the localhost was named ALF33ENT and the serverName parameter was set as above with a trailing A on the end).
If you are running Windows 2003 and get an error like Failed to access NetBT Driver - NetBT may not be loaded, you may not be logged in as an administrator. You must be an administrator to run nbtstat. If you are still getting this error, you might want to reset your network settings. You can do this by running the command netsh int ip reset c:\reset.log and rebooting. Before doing that - Please note that this will reset your TCP/IP settings and your IP address will be set to DHCP if it was static before. Therefore, make sure you copy down your static IP addresses and nameserver settings and have a way to connect back to the server. After the reboot, you can reset your static IP and name servers.
------------------
Folder Share In Workgroup
I did. "Everyone" has read permission in sharing, and only Ted (& admin) have full rights in security. But Ted can only open files "read-only"
It is because Computername/Ted (which he is using) is not the same thing as Servername/Ted which only exists on the server and is the account that has the rights.
My "workgroup" techniques may be a bit rusty but if the Workgroup Names on all machines match and if the accounts on all machines are spelled the same and if the matching accounts also use matching passwords then it should work transparently.
But if that all still doesn't work just make the server a DC, join the workstations to it, and be done with it. As long as you keep the Domain design simple and don't try to do more than you know how to do,..it is *easier* to work with a Domain than it is to work with a workgroup.
------------
===============
Source
TCP/IP
\\server1\Folder
\\IP-of-server\Folder
"User has not been granted the requested logon type at this computer"
when trying to map a drive
--------------------
MS error Event ID: 4311
http://www.eventid.net/display.asp?...
This error can occur because of an incorrect registry setting.
The value for HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\TransportBindName can be blank. Set it to "\Device\", reboot.
--------------------
Troubleshooting Try running nbtstat -n on the server. It should display something like this where the serverName parameter can be seen (in this case the localhost was named ALF33ENT and the serverName parameter was set as above with a trailing A on the end).
If you are running Windows 2003 and get an error like Failed to access NetBT Driver - NetBT may not be loaded, you may not be logged in as an administrator. You must be an administrator to run nbtstat. If you are still getting this error, you might want to reset your network settings. You can do this by running the command netsh int ip reset c:\reset.log and rebooting. Before doing that - Please note that this will reset your TCP/IP settings and your IP address will be set to DHCP if it was static before. Therefore, make sure you copy down your static IP addresses and nameserver settings and have a way to connect back to the server. After the reboot, you can reset your static IP and name servers.
------------------
Folder Share In Workgroup
I did. "Everyone" has read permission in sharing, and only Ted (& admin) have full rights in security. But Ted can only open files "read-only"
It is because Computername/Ted (which he is using) is not the same thing as Servername/Ted which only exists on the server and is the account that has the rights.
My "workgroup" techniques may be a bit rusty but if the Workgroup Names on all machines match and if the accounts on all machines are spelled the same and if the matching accounts also use matching passwords then it should work transparently.
But if that all still doesn't work just make the server a DC, join the workstations to it, and be done with it. As long as you keep the Domain design simple and don't try to do more than you know how to do,..it is *easier* to work with a Domain than it is to work with a workgroup.
------------
The names & passwords DO match, just the local domains are different for the PC & server.
You mean the Workgroup Names? There is no such thing as a "local domain".
The name need to match,....Ok,..well they don't *need* to match,...but see where I'm going here?,...I am trying to create a simple, straight-forward, non-vague, "by-the-book" situation here so that it is easier to troubleshoot.
This is such a small setup - just 3 PCs - I didn't bother with a DC as it seemed hardly worth the effort & of no use.
A DC is almost *always* worth the effort no matter how small the situation is.
You mean the Workgroup Names? There is no such thing as a "local domain".
The name need to match,....Ok,..well they don't *need* to match,...but see where I'm going here?,...I am trying to create a simple, straight-forward, non-vague, "by-the-book" situation here so that it is easier to troubleshoot.
This is such a small setup - just 3 PCs - I didn't bother with a DC as it seemed hardly worth the effort & of no use.
A DC is almost *always* worth the effort no matter how small the situation is.
The real determing fact is the cost of another machine and the Server OS and if the people using it have enough skills to at least use it at a basic level. If you keep it simple it doesn't take much knowledge.
Workgroups are *always* more trouble to deal with. I thought maybe it would ask for an additional login, but it just opens the folder & makes the files read-only.
The only other thing I can think of is errors in the Permissions. Double check them.
Workgroups are *always* more trouble to deal with. I thought maybe it would ask for an additional login, but it just opens the folder & makes the files read-only.
The only other thing I can think of is errors in the Permissions. Double check them.
*Remember* that Share Permissions do not effect the NTFS Permissions.
You can grant every Share Permission in the world to the user,...but yet the NTFS permissions can still not allow anything other than Read-only.
The Share Permissions and the NTFS Security are two different things and you must set them both properly.
------------There are two places you need to assign rights:
Sharing and security. Make sure you assign permissions in both.
HowToNetworking.com ===============
Source
TCP/IP
HOW TO: Configure TCP/IP Networking While NetBIOS Is Turned Off on a Server Running Windows Server 2003
This step-by-step article describes how to configure a computer running Windows Server 2003 with TCP/IP networking while NetBIOS is turned off
This step-by-step article describes how to configure a computer running Windows Server 2003 with TCP/IP networking while NetBIOS is turned off
HOW TO: Determine Which Program Uses or Blocks Specific Transmission Control Protocol Ports in Windows Server 2003
This step-by-step article discusses how to determine which program uses or blocks specific Transmission Control Protocol (TCP) ports. The Netstat.exe utility has a new switch, the -o switch, that can display the process identifier (ID) that is...
This step-by-step article discusses how to determine which program uses or blocks specific Transmission Control Protocol (TCP) ports. The Netstat.exe utility has a new switch, the -o switch, that can display the process identifier (ID) that is...
HOW TO: Diagnose and Test TCP/IP or NetBIOS Network Connections in Windows Server 2003
This article tells how to diagnose and test Transmission Control Protocol/Internet Protocol (TCP/IP) or NetBIOS network configurations. It also tells how to use of the most common diagnostic tools and provides basic network analysis techniques
This article tells how to diagnose and test Transmission Control Protocol/Internet Protocol (TCP/IP) or NetBIOS network configurations. It also tells how to use of the most common diagnostic tools and provides basic network analysis techniques
HOW TO: Enable TCP/IP Forwarding in Windows Server 2003
By default, TCP/IP forwarding is turned off (disabled) in Windows Server 2003. This article describes how to enable TCP/IP forwarding on a Windows Server 2003-based computer.
By default, TCP/IP forwarding is turned off (disabled) in Windows Server 2003. This article describes how to enable TCP/IP forwarding on a Windows Server 2003-based computer.
HOW TO: Harden the TCP/IP Stack Against Denial of Service Attacks in Windows Server 2003
Denial of service (DoS) attacks are network attacks that are aimed at making a computer or a particular service on a computer unavailable to network users. Denial of service attacks can be difficult to defend against. To help prevent denial of service attacks, you can harden the TCP/IP protocol stack on your Windows Server 2003 computers. The default TCP/IP stack configuration is tuned to handle standard intranet traffic. If you connect a computer directly to the Internet, Microsoft recommends that you harden the TCP/IP stack against denial of service attacks.
Denial of service (DoS) attacks are network attacks that are aimed at making a computer or a particular service on a computer unavailable to network users. Denial of service attacks can be difficult to defend against. To help prevent denial of service attacks, you can harden the TCP/IP protocol stack on your Windows Server 2003 computers. The default TCP/IP stack configuration is tuned to handle standard intranet traffic. If you connect a computer directly to the Internet, Microsoft recommends that you harden the TCP/IP stack against denial of service attacks.
HOW TO: Remove and Reinstall TCP/IP on a Windows Server 2003 Domain Controller
This article describes how to remove and then reinstall TCP/IP on a Windows Server 2003 domain controller. When you troubleshoot an issue, you may suspect that a TCP/IP-related component is either corrupted or damaged
DHCP
This article describes how to remove and then reinstall TCP/IP on a Windows Server 2003 domain controller. When you troubleshoot an issue, you may suspect that a TCP/IP-related component is either corrupted or damaged
DHCP
How To Install and Configure a DHCP Server in a Workgroup in Windows Server 2003
This step-by-step article describes how to configure a new Windows Server 2003-based Dynamic Host Configuration Protocol (DHCP) server on a stand-alone server to provide centralized management of IP addresses and other TCP/IP configuration settings.
This step-by-step article describes how to configure a new Windows Server 2003-based Dynamic Host Configuration Protocol (DHCP) server on a stand-alone server to provide centralized management of IP addresses and other TCP/IP configuration settings.
How To Install and Configure a DHCP Server in an Active Directory Domain in Windows Server 2003
This step-by-step article describes how to build and configure a new Windows Server 2003-based Dynamic Host Configuration Protocol (DHCP) server in a Windows Server 2003 Active Directory domain.
This step-by-step article describes how to build and configure a new Windows Server 2003-based Dynamic Host Configuration Protocol (DHCP) server in a Windows Server 2003 Active Directory domain.
VPN
HOW TO: Configure Packet Filter Support for PPTP VPN Clients in Windows Server 2003
This article describes how to configure packet filter support for PPTP VPN clients. The Windows Server 2003 Routing and Remote Access service supports virtual private networking (VPN).
This article describes how to configure packet filter support for PPTP VPN clients. The Windows Server 2003 Routing and Remote Access service supports virtual private networking (VPN).
HOW TO: Provide Secure Point-to-Point Communications Across a Private Network or the Internet in Windows Server 2003
This step-by-step article describes how to install and configure a virtual private network (VPN) to provide secure point-to-point communications across a private network or the Internet.
This step-by-step article describes how to install and configure a virtual private network (VPN) to provide secure point-to-point communications across a private network or the Internet.
SMTP
HOW TO: Prevent Mail Relay in the IIS SMTP Virtual Server in Windows Server 2003
This step-by-step article describes how to prevent mail relays for an Internet Information Services (IIS) Simple Mail Transport Protocol (SMTP) virtual server.
IIS
How to Configure IIS to Host my Web Page
This step-by-step article describes how to prevent mail relays for an Internet Information Services (IIS) Simple Mail Transport Protocol (SMTP) virtual server.
IIS
How to Configure IIS to Host my Web Page
Monday, January 4, 2010
Seguridad Mejorada en Windows 2003 Server
Quitar / Desabilitar Seguridad Mejorada en Windows 2003 Server
Una nueva característica de la seguridad Windows 2003 Server ha fijado a Internet Explorer en alta seguridad por defecto, así que no podrás examinar ningun sitio como lo hacias con Windows XP, para desabilitar esta opcion en Windows 2003 Server debes seguir los siguientes pasos:
Ir a Inicio –> Ejecutar y Escribes “control” y le das “Enter o Aceptar”, busca “Agregar o quitar Programas“, doble click o Enter sobre el mismo, busca y haz click en “Agregar o quitar componentes de Windows” buscar la opcion “Configuracion de Seguridad mejorada de Internet Explorer“, por defecto esta tildada, asi que destildamos para que sea desintalada, presionamos Aceptar y Reiniciamos la PC para que tome los cambios y actualice el registro
La proxima vez que abramos Internet Explorer nos aparecera una pagina indicando que la seguridad mejorada no esta habilitada, entramos en “Herramientas” –> “Opciones de Internet” y en “Direccion” colocamos “Pagina en Blanco” o “www.google.com” etc, lo que nos guste.
Disabling Shutdown Event Tracker
If you are using Windows Server 2003 or 2008, you might have noticed that whenever you click on Shutdown button, it shows a dialog box asking you the reason behind shutting down the system. You have to select an option from drop-down box or write into Comment box to be able to shutdown the system. 
Many people find it very annoying and want to disable it but they don't know how to disable it.
Today in this tutorial, we'll tell you a simple way to completely remove this annoying dialog box:
2. It'll open Group Policy Editor. Now go to:
4. Now double-click on "Display Shutdown Event Tracker" and select "Disabled". Apply it and the annoying dialog box will never appear again.
NOTE: You can also use this method to enable Shutdown Event Tracker in Windows client OS like Windows XP, Vista, 7, etc. Just set the option value to "Enabled".
1. Type regedit in RUN dialog box and press Enter.
2. It'll open Registry Editor. Now go to:
4. Now select "Reliability" key and in right-side pane, look for following 2 DWORD values:
5. Now set values of both DWORD to 0
6. That's it. Now you'll not see the reason dialog box while shutting down the system.
Thanks to our readers "Config" and "Dragonsbane777" for sharing registry method.
NOTE: You can also use this method to enable Shutdown Event Tracker in Windows client OS like Windows XP, Vista, 7, etc. Just set the values of both DWORD to 1 using Step 5.
====================
Many people find it very annoying and want to disable it but they don't know how to disable it.
Today in this tutorial, we'll tell you a simple way to completely remove this annoying dialog box:
1. Type gpedit.msc in RUN dialog box and press Enter.METHOD 1: Using Group Policy Editor
2. It'll open Group Policy Editor. Now go to:
Computer Configuration -> Administrative Templates -> System3. In right-side pane, look for "Display Shutdown Event Tracker" option.
4. Now double-click on "Display Shutdown Event Tracker" and select "Disabled". Apply it and the annoying dialog box will never appear again.
NOTE: You can also use this method to enable Shutdown Event Tracker in Windows client OS like Windows XP, Vista, 7, etc. Just set the option value to "Enabled".
If you face problems while using Group Policy Editor, you can also use Registry Editor to do the same task.METHOD 2: Using Registry Editor
1. Type regedit in RUN dialog box and press Enter.
2. It'll open Registry Editor. Now go to:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT3. Under "Windows NT" key, look for a key "Reliability". If its not present, create it.
4. Now select "Reliability" key and in right-side pane, look for following 2 DWORD values:
ShutdownReasonOnIf the DWORD values are not present, create them.
ShutdownReasonUI
5. Now set values of both DWORD to 0
6. That's it. Now you'll not see the reason dialog box while shutting down the system.
Thanks to our readers "Config" and "Dragonsbane777" for sharing registry method.
NOTE: You can also use this method to enable Shutdown Event Tracker in Windows client OS like Windows XP, Vista, 7, etc. Just set the values of both DWORD to 1 using Step 5.
====================
Tuesday, September 8, 2009
Disabling 'simple file sharing'
Right click the Start menu
->Explore->Toolbar->Tools->Folder options->View>
scroll down until yoou see 'use simple file sharing' and deselect it.
Click 'okay'
Now, you should see the Security tab on the folder.
-----------------------------
Use access control to restrict who can use your files
HDD Share names will not stick
Cannot change default administrative shares
->Explore->Toolbar->Tools->Folder options->View>
scroll down until yoou see 'use simple file sharing' and deselect it.
Click 'okay'
Now, you should see the Security tab on the folder.
-----------------------------
Use access control to restrict who can use your files
HDD Share names will not stick
Cannot change default administrative shares
Thursday, June 18, 2009
Internet Explorer Enhanced Security
Windows Server 2003 shipped with security locked down by default. Part of this locking down is Internet Explorer Enhanced Security which is an extra layer of protection when surfing the internet using Internet Explorer (more information can be found by going here on a Windows Server 2003 [test] machine). Some people want to uninstall it.
Disabling Internet Explorer Enhanced Security Configuration
Before we start, understand the way the uninstaller works. You can uninstall the entire Configuration, or just for users, or just for Administrators. The un-installer is set up like this:
Enhanced Security
->For Administrators
->For Users
If you have just random users connecting via Remote Desktop or Terminal Services, you may want to leave the Users configuration installed. This tutorial will be removing all of it.
Disabling IEES Configuration (source of this post)Enhanced Security
->For Administrators
->For Users
If you have just random users connecting via Remote Desktop or Terminal Services, you may want to leave the Users configuration installed. This tutorial will be removing all of it.
Disabling Internet Explorer Enhanced Security Configuration
Click Start-- Control Panel -- Add/Remove Programs
Now click Add/Remove Windows Components
Click the check mark next to Internet Explorer Enhanced Security Configuration (to make it unchecked).
If you'd like to only disable it for Administrators or only for Users you can click Details and do so.
NEXT and voilá
Now click Add/Remove Windows Components
Click the check mark next to Internet Explorer Enhanced Security Configuration (to make it unchecked).
If you'd like to only disable it for Administrators or only for Users you can click Details and do so.
NEXT and voilá
Monday, June 15, 2009
Active Directory Federation Services (ADFS) in Windows
How To ADFS
ADFS es un funcionalidad agregada en la versión de Windows Server 2003 R2, si bien hay muchos que conocen un concepto básico, vamos a ver cómo poner en práctica y cuáles son los escenarios a aplicar para un uso de ADFS.
ADFS es una implementación de Web Servicies (WS) en especial de WS-Federation que permite interactuar con cualquier otra federación que cumpla con los mismos tipos de WS.
Lo que nos permite ADFS es la posibilidad hacer relaciones de confianza entre federaciones (dominios) donde la autenticación se hace en cada federación usando estos WS.En los escenarios de Internet el escenario aplicable es el de SSO. Como ejemplo simple nos permite tener una federación con recursos (resource partner) y otra federación de cuentas (Account partner).En la federación de recursos de debe declarar aplicaciones (basadas en Token - legacy o Aplicaciones ADFS Aware basadas .Net 2.0) y que son accedidas desde internet por una federación asociada. En este caso la federación asociada cumple el rol de Federación de cuentas, donde cuenta con un repositorio de validación (Active Directory o ADAM)
Lo más importante de todo esto es que un usuario para acceder a la aplicación de la federación de recursos, usara una cuenta de su dominio y a través de nuestra relación de federaciones podrá acceder y validarse a nuestra aplicación sin la necesidad de hacer VPN o relación de confianza entre dominios ni forest.
El beneficio principal de este esquema es que la federación encargada de la aplicación no se tiene que preocupar de la administración de cuentas, claves de los usuarios externos que la consumen, ya que se validan en su propio dominio.
How To ADFS
ADFS es un funcionalidad agregada en la versión de Windows Server 2003 R2, si bien hay muchos que conocen un concepto básico, vamos a ver cómo poner en práctica y cuáles son los escenarios a aplicar para un uso de ADFS.
ADFS es una implementación de Web Servicies (WS) en especial de WS-Federation que permite interactuar con cualquier otra federación que cumpla con los mismos tipos de WS.
Lo que nos permite ADFS es la posibilidad hacer relaciones de confianza entre federaciones (dominios) donde la autenticación se hace en cada federación usando estos WS.En los escenarios de Internet el escenario aplicable es el de SSO. Como ejemplo simple nos permite tener una federación con recursos (resource partner) y otra federación de cuentas (Account partner).En la federación de recursos de debe declarar aplicaciones (basadas en Token - legacy o Aplicaciones ADFS Aware basadas .Net 2.0) y que son accedidas desde internet por una federación asociada. En este caso la federación asociada cumple el rol de Federación de cuentas, donde cuenta con un repositorio de validación (Active Directory o ADAM)
Lo más importante de todo esto es que un usuario para acceder a la aplicación de la federación de recursos, usara una cuenta de su dominio y a través de nuestra relación de federaciones podrá acceder y validarse a nuestra aplicación sin la necesidad de hacer VPN o relación de confianza entre dominios ni forest.
El beneficio principal de este esquema es que la federación encargada de la aplicación no se tiene que preocupar de la administración de cuentas, claves de los usuarios externos que la consumen, ya que se validan en su propio dominio.
Friday, June 5, 2009
Networking with Windows Server 2003
Setup Network Users in Windows 2003 Server
How to configure DNS for Internet access: How to Start with a Stand-Alone Server Running Windows Server 2003
The stand-alone server running Windows Server 2003 becomes a DNS server for your network. In the first step, you assign this server a static Internet Protocol (IP) address. DNS servers must not use dynamically assigned IP addresses because a dynamic change of address could cause clients to lose contact with the DNS server.
How to configure DNS for Internet access: How to Start with a Stand-Alone Server Running Windows Server 2003
The stand-alone server running Windows Server 2003 becomes a DNS server for your network. In the first step, you assign this server a static Internet Protocol (IP) address. DNS servers must not use dynamically assigned IP addresses because a dynamic change of address could cause clients to lose contact with the DNS server.
Step 1: Configure TCP/IP
- Click Start, point to Control Panel, point to Network Connections, and then click Local Area Connection.
- Click Properties.
- Click Internet Protocol (TCP/IP), and then click Properties.
- Click the General tab.
- Click Use the following IP address, and then type the IP address, subnet mask, and default gateway address in the appropriate boxes.
- Click Advanced, and then click the DNS tab.
- Click Append primary and connection specific DNS suffixes.
- Click to select the Append parent suffixes of the primary DNS suffix check box.
- Click to select the Register this connection's addresses in DNS check box.
Note that DNS servers running Windows Server 2003 must point to themselves for DNS. If this server needs to resolve names from its Internet service provider (ISP), you must configure a forwarder. Forwarders are discussed in the How to Configure Forwarders section later in this article. - Click OK three times.
NOTE: If you receive a warning from the DNS Caching Resolver service, click OK to dismiss the warning. The caching resolver is trying to contact the DNS server, but you have not finished configuring the server.
Step 2: Install Microsoft DNS Server
- Click Start, point to Control Panel, and then click Add or Remove Programs.
- Click Add or Remove Windows Components.
- In the Components list, click Networking Services (but do not select or clear the check box), and then click Details.
- Click to select the Domain Name System (DNS) check box, and then click OK.
- Click Next.
- When you are prompted, insert the Windows Server 2003 CD-ROM into the computer's CD-ROM or DVD-ROM drive.
- On the Completing the Windows Components Wizard page, click Finish when Setup is complete.
- Click Close to close the Add or Remove Programs window.
Best practices for DNS client settings in Windows 2000/2003 Server:
http://support.microsoft.com/?id=825036
Wednesday, June 3, 2009
Virtualizing SBS 2003 Standard Edition on Linux host
Virtualizing SBS 2003 Standard Edition R2 on Debian Linux Lenny host
Debian Linux Host with VMWare 2.0.1 (http://www.petri.co.il/forums/showthread.php?t=36217)
Just installed SBS 2003 Standard Edition R2 (OEM) as guest on VMWare 2.0.1 - Host OS is Linux Debian 5 "Lenny" 64-bit
Works like a charm
The Hardware is a AMD Phenom II 940 processor with 8 gb ram, MOBO is ASUS M4N78 PRO, nVidia Geforce 8300, Integrated VGA, PCI-Express, Dual DR2-667/800/1066, Socket AM2+, Phenom II Supported
communities.vmware.com
Debian Linux Host with VMWare 2.0.1 (http://www.petri.co.il/forums/showthread.php?t=36217)
Just installed SBS 2003 Standard Edition R2 (OEM) as guest on VMWare 2.0.1 - Host OS is Linux Debian 5 "Lenny" 64-bit
Works like a charm
The Hardware is a AMD Phenom II 940 processor with 8 gb ram, MOBO is ASUS M4N78 PRO, nVidia Geforce 8300, Integrated VGA, PCI-Express, Dual DR2-667/800/1066, Socket AM2+, Phenom II Supported
communities.vmware.com
Windows 2003 R2 from standard to enterprise
Source
www.computing.net (more related to windows 2003)
Upgrading
www.computing.net (more related to windows 2003)
Upgrading
windows 2003 standard edition R2 SP2 32bit
and i need to upgrade it to the enterprise edition
because i have 8GB RAM physically installed and the standard edition only recognizes 4GB.
When I launch the installer of the enterprise CD i get the following error:
“Setup cannot run in program compatibility mode. To run Setup normally, go to My Computer, double-click the CD icon, and then double-click the Setup.exe file”.
Please note that I tried to run setup by double clicking the executable but I directly received the same error.
and i need to upgrade it to the enterprise edition
because i have 8GB RAM physically installed and the standard edition only recognizes 4GB.
When I launch the installer of the enterprise CD i get the following error:
“Setup cannot run in program compatibility mode. To run Setup normally, go to My Computer, double-click the CD icon, and then double-click the Setup.exe file”.
Please note that I tried to run setup by double clicking the executable but I directly received the same error.
Solution
First please refer to the following supported upgrade path:
http://www.microsoft.com/windowsserver2003/evaluation/whyupgrade/supportedpaths.mspx
Please also note you can only upgrade to Enterprise 32bit from your system.
http://support.microsoft.com/kb/810613
If you can meet the upgrade requirements, please try steps below:
1. Insert the Windows Server 2003 Enterprise CD.
2. Click Start, point to Accessories, and then click Program Compatibility Wizard.
3. In the wizard, click Next.
4. Choose “I want to use the program in the CD-ROM drive” and click Next.
5. Choose “Do not apply a compatibility mode” and click Next.
6. Click Next.
7. Check the box before “Allow non-administrators to run this program” and click Next.
8. Click Next.
Now you can double-click the executable file to install Windows Server 2003 Enterprise again.
If the issue persists, please let me know if your Windows Server 2003 Standard and Enterprise are retail or OEM versions. Does your Windows Server 2003 Enterprise include R2 and SP2?
Hope it helps.
Tuesday, June 2, 2009
Server 2k3 SP2 Administration Toolkit
The Administration Tools Pack allows administrators to install the Windows Server 2003 SP2 management tools onto a computer running Windows XP Professional or a Windows Server 2003 family operating system to perform remote server management functions.
Windows Server 2003 Service Pack 2 Administration Tools Pack for x64 editions
http://www.microsoft.com/downloads/d...DisplayLang=en
Windows Server 2003 Service Pack 2 Administration Tools Pack for x86 editions:
http://www.microsoft.com/downloads/d...9-3f101e533d95
Windows Server 2003 Service Pack 2 Administration Tools Pack for x64 editions
http://www.microsoft.com/downloads/d...DisplayLang=en
Windows Server 2003 Service Pack 2 Administration Tools Pack for x86 editions:
http://www.microsoft.com/downloads/d...9-3f101e533d95
Thursday, May 14, 2009
Monday, March 16, 2009
Tiny 2003 & micro XP
Download
The following hotfixes are integrated:On first boot:
Service Pack 1 (build 1830)
All 50 Critical and Recommended Hotfixes
(Windows Updates) up to 16.10.2006
Get the latest here:
thepiratebay.org/..../Micro-X_(MicroXP_and_Micro2003)
MicroXP_v0.82_For.External.USB.DRIVE
RAM Memory Useage = 45mb
Files = 2,857
Folders = 37
Running processes = 13
Running Services = 13
Ever feel that Windows XP is not fast enough, especially for ultimate gaming experience? Windows Tiny2003 eXperience Edition is a minimalist operating system based on Windows Server 2003 Enterprise edition but looks and feels as it�s Windows XP which has been fully tweaked and transformed for home use and games play, with ability to run almost all software, applications and programs, including games that runs on Windows XP. Why Windows 2003 Server? According to the hacker of Tiny2003, Windows Server 2003 kernel outperforms Windows XP where it installs faster, boots faster, runs applications faster, manages programs better, never slows down even after days of using, and gives even better frame rates in games over Windows XP.
The main feature of Windows Tiny2003 or Windows Server 2003 eXperience edition is that Internet Explorer, Outlook Express and Windows Media Player 11 have been removed and replaced with Mozilla Firefox v2.0.0.1, Thunderbird v1.5.0.9 and as an option install for WMP11. Other open source and free components been installed include DirectX D3DX Updated DLL Libraries (24 to 31), Flash Player v9.0.28.0, FoxIt PDF Reader Pro v2.0.0930, Sygate Personal Firewall Pro v5.6.3408, Windows Movie Maker From Windows XP and WinRAR v3.62.
Beside, Windows Tiny2003 includes more than 200 registry tweaks to make the Windows Server 2003 to behave like Windows XP. Some of the tweaks and hacks are:
* Monitor resolution set to 1024 x 768 (even in VMware)
* Turned "Hardware Acceleration" up to full.
* Removed "Manage Your Server" shortcut from Start Menu.
* Removed "Windows Server Post Setup Security Updates" screen.
* Does not show "Manage Your Server" wizard on Startup.
* DirectDraw and Direct3D is enabled in DirectX Diagnostic Tool.
* Programs are set to have priority over background program.
* All "Ctrl+Alt+Del" prompts are disabled.
* Server 2003 "Shutdown Event Tracker" is disabled.
* Windows Audio service is enabled.
* Notepad Tweak - Turned on "WordWrap" in Notepad.
* Enabled Status Bar in Windows Explorer and Notepad.
* Removed "Shortcut to" Prefix on Shortcuts.
* Disabled Transition Effect when you right click.
* Disabled Window Animation.
* Shows complete filename with extension.
* Displays DOS filenames in proper text-case.
* Shows Hidden Files and Folders.
* Uses Windows Classic Folders.
* Disabled Balloon Tips.
* Any open folders restore again when Windows restarts.
* Disabled automatic restart in the event of a BSOD.
* Disabled Error Reporting (still notify on critical errors).
* Disabled Windows Time service.
* Removed Language Bar.
* Removed Shared Documents from My Computer.
* Renaming of Recycle Bin is allowed.
* Hung services are killed after 5 secs.
* Got rid of Places Bar in Common Dialog Boxes.
* Start Menu is speeded up to almost zero delay.
* Added Notepad as a Right Click Item.
* Can open NFO files with notepad from the outset.
Tuesday, February 24, 2009
Forgotten Administrator Password
Source
I have often ran across computers that I needed to gain access to for data recovery, but I didnt have the administrator password to access the hard drive. Since in many situations, there is just one administrator account I can't log into another administrator account and change the password so I have to rely on other methods. I could put the hard drive into another computer as a slave and gain access (sometimes) or I could try installing a second copy of the operating system in parallel and gain access but there must be a better way.
That way is to try to reset the administrator password to something you do know and allow you to access to the user profile and the data. In most cases, this is the best solution. However, you have to make sure the data is not encrypted using the Windows XP Encrypting File System (EFS) or other encryption. If the data is encrypted, you probably will not be able to gain access to those encrypted files by changing the administrator password.
Petter Nordahl-Hagen's Offline NT Password & Registry Editor
This is absolutely one of the best free tools to reset the administrator password and gain access that I have ever used. It modifies the encrypted password in the registry's SAM file allowing you access to the account in Windows NT/2000/XP/2003/Vista systems.
There is an image file to create a bootable floppy disk or bootable CD to modify the admin password and access NTFS partitions. You do not need to know the old password to set a new one. It will also offer to unlock disabled or locked user accounts (a very helpful feature). The program was just updated on April 9, 2007 to include Vista support.
Please visit the site by clicking on the link below to download a CD image or floppy image of this great program.
http://home.eunet.no/pnordahl/ntpasswd/
LoginRecovery.com
Another option is to decrypt the password and show you the actual administrator password. A great site for doing this is loginrecovery.com. Basically, you download a small program to extract the password from the computer, then you submit the encrypted password file to their site and they will recover the lost password. Of course, you need a computer with Internet access to upload the file and find the password.
With this option, the administrator password is not changed so you wont lose access to EFS encrypted files. Visit their site by clicking below
http://www.loginrecovery.com
Although there are probably other options to recover an administrator password, I find the two option shown above to be the quickest and easiest ways to either change or discover the password and allow you access to the user profile and data stored on the hard drive.
I have often ran across computers that I needed to gain access to for data recovery, but I didnt have the administrator password to access the hard drive. Since in many situations, there is just one administrator account I can't log into another administrator account and change the password so I have to rely on other methods. I could put the hard drive into another computer as a slave and gain access (sometimes) or I could try installing a second copy of the operating system in parallel and gain access but there must be a better way.
That way is to try to reset the administrator password to something you do know and allow you to access to the user profile and the data. In most cases, this is the best solution. However, you have to make sure the data is not encrypted using the Windows XP Encrypting File System (EFS) or other encryption. If the data is encrypted, you probably will not be able to gain access to those encrypted files by changing the administrator password.
Petter Nordahl-Hagen's Offline NT Password & Registry Editor
This is absolutely one of the best free tools to reset the administrator password and gain access that I have ever used. It modifies the encrypted password in the registry's SAM file allowing you access to the account in Windows NT/2000/XP/2003/Vista systems.
There is an image file to create a bootable floppy disk or bootable CD to modify the admin password and access NTFS partitions. You do not need to know the old password to set a new one. It will also offer to unlock disabled or locked user accounts (a very helpful feature). The program was just updated on April 9, 2007 to include Vista support.
Please visit the site by clicking on the link below to download a CD image or floppy image of this great program.
http://home.eunet.no/pnordahl/ntpasswd/
LoginRecovery.com
Another option is to decrypt the password and show you the actual administrator password. A great site for doing this is loginrecovery.com. Basically, you download a small program to extract the password from the computer, then you submit the encrypted password file to their site and they will recover the lost password. Of course, you need a computer with Internet access to upload the file and find the password.
With this option, the administrator password is not changed so you wont lose access to EFS encrypted files. Visit their site by clicking below
http://www.loginrecovery.com
Although there are probably other options to recover an administrator password, I find the two option shown above to be the quickest and easiest ways to either change or discover the password and allow you access to the user profile and data stored on the hard drive.
Subscribe to:
Posts (Atom)
LibreOffice
Firefox
